Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:23-12-2015
durchgeführt von i_ro_000 (2015-12-26 12:26:15)
Gestartet von C:\Users\i_ro_000\Downloads
Windows 10 Home (X64) (2015-12-17 11:03:44)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-2785950416-199303644-2934268561-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-2785950416-199303644-2934268561-503 - Limited - Disabled)
Gast (S-1-5-21-2785950416-199303644-2934268561-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2785950416-199303644-2934268561-1003 - Limited - Enabled)
i_ro_000 (S-1-5-21-2785950416-199303644-2934268561-1001 - Administrator - Enabled) => C:\Users\i_ro_000
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Ad-Aware Antivirus (Disabled - Out of date) {B0CC18C6-E527-6EE6-874C-9D19920E5619}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Ad-Aware Antivirus (Disabled - Out of date) {0BADF922-C31D-6168-BDFC-A66BE9891CA4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
FW: Ad-Aware Firewall (Disabled) {88F799E3-AF48-6FBE-AC13-342C6CDD1162}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
Ad-Aware Antivirus (HKLM\...\{9A711B34-77B5-4DDA-A97E-2FD6663729E1}_AdAwareUpdater) (Version: 11.9.696.8769 - Lavasoft)
AdAwareInstaller (Version: 11.9.696.8769 - Lavasoft) Hidden
AdAwareUpdater (Version: 11.9.696.8769 - Lavasoft) Hidden
Adobe Flash Player 20 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 20.0.0.235 - Adobe Systems Incorporated)
AntimalwareEngine (Version: 3.0.99.0 - Lavasoft) Hidden
Apple Application Support (32-Bit) (HKLM-x32\...\{649A1FD9-5892-46AD-8DF0-C4A43FF61CB7}) (Version: 4.1 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{0DE0A178-AC7B-4650-806C-CF226DE03766}) (Version: 4.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{3540181E-340A-4E7A-B409-31663472B2F7}) (Version: 9.1.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
Ashampoo AppLauncher (Medion) v.1.0.0 (HKLM-x32\...\Ashampoo AppLauncher (Medion)_is1) (Version: 1.0.0 - Ashampoo GmbH & Co. KG)
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.15.129 - Avira Operations GmbH & Co. KG)
Avira Launcher (HKLM-x32\...\{5dfbeba9-9f22-463d-8c95-c861911810a2}) (Version: 1.1.47.11018 - Avira Operations GmbH & Co. KG)
Avira Launcher (x32 Version: 1.1.47.11018 - Avira Operations GmbH & Co. KG) Hidden
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
CyberLink Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
CyberLink PowerDirector 11 (Version: 11.0.0.3910 - CyberLink Corp.) Hidden
CyberLink PowerRecover (HKLM-x32\...\InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.7.0.3019 - CyberLink Corp.)
CyberLink PowerRecover (Version: 5.7.0.3019 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Digital Plus Home Theater (HKLM\...\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.6.3.1 - Dolby Laboratories Inc)
ELAN Touchpad 12.8.3.13_X64 (HKLM\...\Elantech) (Version: 12.8.3.13 - ELAN Microelectronic Corp.)
Galerie de photos (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
iCloud (HKLM\...\{B33C558F-772F-4308-A059-390FBF9BAAAE}) (Version: 5.0.2.61 - Apple Inc.)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4276 - Intel Corporation)
Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1064 - Intel Corporation)
Intel(R) Virtual Buttons (HKLM-x32\...\1992736F-C90A-481C-B21B-EE34CAD07387) (Version: 1.0.0.14 - Intel Corporation)
Intel(R) Wireless Bluetooth(R) (HKLM-x32\...\{EA877F2C-A0FB-4379-83D0-734540686C80}) (Version: 17.1.1531.1764 - Intel Corporation)
Intel(R) Wireless Bluetooth(R)(patch version 17.0.1427.2) (HKLM\...\{302600C1-6BDF-4FD1-1406-148929CC1385}) (Version: 17.1.1406.0472 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{85b9d34f-7397-4e39-8600-07942ef6ca04}) (Version: 17.0.5 - Intel Corporation)
Intel® Security Assist (HKLM-x32\...\{84DB01CB-7EB7-4261-9249-99A32768D991}) (Version: 1.0.0.523 - Intel Corporation)
iTunes (HKLM\...\{E690A491-702F-4DEC-9977-C015D1DBB57C}) (Version: 12.3.1.23 - Apple Inc.)
Java 8 Update 66 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218066F0}) (Version: 8.0.660.18 - Oracle Corporation)
Malwarebytes Anti-Malware Version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4641.1005 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41105.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 43.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 43.0.2 (x86 de)) (Version: 43.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 43.0.2.5833 - Mozilla)
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0105 - Pegatron Corporation)
QuickTime 7 (HKLM-x32\...\{80CEEB1E-0A6C-45B9-A312-37A1D25FDEBC}) (Version: 7.78.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7535 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Skype™ 7.13 (HKLM-x32\...\{6A0549A9-1B96-498C-ACBC-3943001FEB19}) (Version: 7.13.101 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
SteuerSparErklärung 2015 (HKLM-x32\...\{312C0E08-8F94-4536-AAF6-3413F784AC5F}) (Version: 20.37.167 - Akademische Arbeitsgemeinschaft)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-2785950416-199303644-2934268561-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\i_ro_000\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1\FileCoAuth.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2785950416-199303644-2934268561-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
==================== Wiederherstellungspunkte =========================
ACHTUNG: Systemwiederherstellung ist deaktiviert
==================== Hosts Inhalt: ==========================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2013-08-23 00:25 - 2015-03-09 21:16 - 00450771 ____N C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
127.0.0.1 www.123moviedownload.com
Da befinden sich 15463 zusätzliche Einträge.
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {15D4B971-E952-4C9E-9278-51CD9261B5A0} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {2AF4570D-F238-448C-B149-1CE7905701B9} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.)
Task: {3AA8AFDB-A289-465A-BA44-2E68E34602DC} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {46D41332-3C94-4BA5-A9B8-3033F6EE183B} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG
Task: {5790FF80-136C-4C20-BB72-61276DE4817E} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {6EEFC5B3-B673-4186-A0E8-CE2761FC065D} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {890AC204-0A41-42EF-A355-ABF47F37B6BF} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {9961CC4E-8D9F-4860-BC00-9B64C63ECD83} - System32\Tasks\PDVDServ12 Task => C:\Program Files (x86)\CyberLink\PowerDVD12\PDVD12Serv.exe [2014-05-27] (CyberLink Corp.)
Task: {BD03EE28-56DC-4C2D-B4F4-5429118C966B} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {CE7A3174-67E1-42ED-A299-CEFE329EE5C1} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-12-21] (Adobe Systems Incorporated)
Task: {CEC1E4C0-F538-4948-986C-42595D2DA0A1} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {D400497B-8378-46B8-A58C-5C33357EFB7F} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {D50C4282-263F-481D-AE36-C41484EEB982} - System32\Tasks\DolbySelectorTask => C:\Program Files\Dolby Digital Plus\ddp.exe [2014-04-08] (Dolby Laboratories Inc.)
Task: {DFFFC5F5-AC70-48BC-8C6B-201C927D6E2F} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {F10056B8-204F-4D24-98AD-B51500143731} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {F186D98A-AAC7-4826-BF41-D929EAC4F47C} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {F5A444AC-7553-4730-8134-EF47C9A4D4B7} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {F8CAA8B8-31AD-447F-A9F0-D2198674F89D} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MEDIONhome.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.medion.com
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Welcome.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.aldi.com
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2015-10-30 18:18 - 2015-10-30 18:18 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2014-10-10 20:33 - 2014-03-05 02:58 - 00136192 _____ () C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe
2008-10-25 02:35 - 2008-10-25 02:35 - 00128296 _____ () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
2015-02-13 14:20 - 2015-02-13 14:20 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-10-13 20:45 - 2015-10-13 20:45 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-12-09 17:55 - 2015-12-09 17:55 - 00712432 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareService.exe
2015-12-09 17:58 - 2015-12-09 17:58 - 00025856 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\boost_system-vc120-mt-1_57.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 00057096 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\boost_date_time-vc120-mt-1_57.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 00123656 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\boost_filesystem-vc120-mt-1_57.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 11671800 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareServiceKernel.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 03549904 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\RCF.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 00911616 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\boost_regex-vc120-mt-1_57.dll
2015-12-09 17:59 - 2015-12-09 17:59 - 00107776 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\boost_thread-vc120-mt-1_57.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 00035072 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\boost_chrono-vc120-mt-1_57.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 00709360 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareActivation.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 00476928 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareApplicationUpdater.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 00847600 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareGamingMode.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 00101096 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareReset.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 00123104 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareTime.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 01030912 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareDefinitionsUpdater.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 00905488 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareDefinitionsUpdaterScheduler.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 01146608 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareIgnoreList.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 00243440 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareQuarantine.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 01571584 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareAntiMalwareEngine.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 00206080 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareAntiRootkitEngine.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 01210616 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareScannerHistory.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 01373928 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareScanner.dll
2015-12-09 17:59 - 2015-12-09 17:59 - 00036096 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\boost_timer-vc120-mt-1_57.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 01019640 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareScannerScheduler.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 01190656 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareRealTimeProtection.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 02489592 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareIncompatibles.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 01468136 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareAntiSpam.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 01416944 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareAntiPhishing.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 03263736 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareParentalControl.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 02995960 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareWebProtection.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 01325816 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareEmailProtection.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 00059656 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\boost_iostreams-vc120-mt-1_57.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 01856768 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareNetworkProtection.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 01013992 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwarePromo.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 00365288 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareFeedback.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 02958592 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareThreatWorkAlliance.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 01261800 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwarePinCode.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 01014504 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareNotice.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 01542896 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareAvcEngine.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 01222416 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareRealTimeProtectionHistory.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 00475888 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareStatistics.dll
2014-10-10 19:20 - 2013-03-07 00:42 - 00389896 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2014-10-10 20:33 - 2014-07-12 03:15 - 02222592 _____ () C:\Program Files (x86)\PHotkey\PHotkey.exe
2014-10-10 20:33 - 2010-01-13 03:36 - 00117256 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
2015-12-17 21:22 - 2015-12-17 21:22 - 02653816 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2014-10-10 20:33 - 2010-01-13 03:36 - 00121864 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
2015-12-17 21:22 - 2015-12-17 21:22 - 02653816 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2015-12-19 08:52 - 2015-12-07 14:33 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2015-12-20 09:57 - 2015-12-20 09:57 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.12.15004.0_x86__8wekyb3d8bbwe\SkypeHost.exe
2014-10-10 20:33 - 2010-12-18 00:04 - 00449032 _____ () C:\Program Files (x86)\PHotkey\ATouch64.exe
2014-10-10 20:33 - 2014-04-04 04:41 - 03471872 _____ () C:\Program Files (x86)\PHotkey\POSD.exe
2014-10-10 20:33 - 2014-02-22 03:19 - 08857088 _____ () C:\Program Files (x86)\PHotkey\GPMTray.exe
2014-10-10 20:33 - 2014-07-09 00:39 - 03006464 _____ () C:\Program Files (x86)\PHotkey\KeyboardMonitorTool.exe
2015-12-19 08:51 - 2015-12-07 15:14 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2015-12-19 08:51 - 2015-12-07 15:00 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2015-12-19 08:52 - 2015-12-07 14:37 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2015-12-19 08:52 - 2015-12-07 14:34 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2015-12-19 08:52 - 2015-12-07 14:36 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 09574112 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareTray.exe
2015-12-09 17:58 - 2015-12-09 17:58 - 00492288 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\boost_locale-vc120-mt-1_57.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 02266344 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\HtmlFramework.dll
2015-12-09 17:58 - 2015-12-09 17:58 - 00868600 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769\AdAwareTrayDefaultSkin.dll
2015-09-01 01:29 - 2014-10-17 01:26 - 00622880 _____ () C:\Program Files (x86)\IObit\LiveUpdate\ProductStatistics.dll
2014-10-10 20:33 - 2009-12-19 01:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll
2014-10-10 20:33 - 2013-09-18 09:23 - 00108032 _____ () C:\Program Files (x86)\PHotkey\PGFNEX.dll
2015-12-20 09:57 - 2015-12-20 09:57 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.12.15004.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll
2015-12-20 09:57 - 2015-12-20 09:58 - 21845504 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.12.15004.0_x86__8wekyb3d8bbwe\SkyWrap.dll
2014-10-10 19:15 - 2013-08-05 18:49 - 00627672 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2013-08-06 01:48 - 2013-08-06 01:48 - 00016856 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2015-12-26 10:57 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-12-26 10:57 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-12-26 10:57 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-12-26 10:57 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-12-26 10:57 - 2014-04-25 14:11 - 02972112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\NotificationSpreader.dll
2015-12-26 10:57 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\iaioi2ce.sys => ""="Driver"
==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com
Da befinden sich 7866 mehr Seiten.
IE restricted site: HKU\S-1-5-21-2785950416-199303644-2934268561-1001\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-2785950416-199303644-2934268561-1001\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-2785950416-199303644-2934268561-1001\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-2785950416-199303644-2934268561-1001\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-2785950416-199303644-2934268561-1001\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-2785950416-199303644-2934268561-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-2785950416-199303644-2934268561-1001\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-2785950416-199303644-2934268561-1001\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-2785950416-199303644-2934268561-1001\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-2785950416-199303644-2934268561-1001\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-2785950416-199303644-2934268561-1001\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-2785950416-199303644-2934268561-1001\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-2785950416-199303644-2934268561-1001\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-2785950416-199303644-2934268561-1001\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-2785950416-199303644-2934268561-1001\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-2785950416-199303644-2934268561-1001\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-2785950416-199303644-2934268561-1001\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-2785950416-199303644-2934268561-1001\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-2785950416-199303644-2934268561-1001\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-2785950416-199303644-2934268561-1001\...\123simsen.com -> www.123simsen.com
Da befinden sich 7866 mehr Seiten.
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-2785950416-199303644-2934268561-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\i_ro_000\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-2785950416-199303644-2934268561-1001\...\StartupApproved\Run: => "Skype"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{E381ACB7-C89A-4D41-831C-ACA754A10522}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{1EE9051B-C600-4EC2-84DC-5993BBC0B77F}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{06F43771-2F97-4A07-8888-31A55D84C0BE}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{F7E06E8C-5231-4F47-96FF-D7C11A38AF59}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{9ED0CFDA-E71C-4A7A-B1B5-4696E7E13FC6}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{293350A5-0DFA-405A-8C0B-5DF466EFA247}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{3153B440-1248-49D1-92C5-B47D986ECBAA}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{DDF045F6-E38D-49C9-B94B-E4FFF292ED4E}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{FA0F1CCD-58B1-4DA2-9D75-CA44A565CD7C}] => (Allow) LPort=2869
FirewallRules: [{6078E9FA-772A-4FA1-8763-85EA5327E1F6}] => (Allow) LPort=1900
FirewallRules: [{BC38BF45-040A-47DC-B1AE-C77DB3C33C4F}] => (Allow) C:\Program Files\CyberLink\PowerDirector11\PDR10.EXE
FirewallRules: [{9CE3F7D7-298A-435E-B14B-375304BEA388}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{53D7E873-19D6-4958-89F5-04E64F703711}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{ABFF4691-E234-4C8E-B9F6-EBFF8AE1A3A4}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{32AB8839-9FF5-49C3-A2C6-8C2F05C8301E}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{766BEEE7-DB2E-4CC0-942C-E468A4AF1446}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{A2AAA924-6428-4315-A143-ADAC64218732}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{7F8C72C7-8F46-4D13-9E4E-A2979C98B898}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [TCP Query User{AD9076D7-DFE7-4DC3-B9E1-EAE16977A067}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{C4C42B3B-CBBA-4E38-9561-DBEF81A4EC23}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{411930C1-CB89-4BA1-AAF8-370C90BB87DD}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{9D0A5830-47F8-40E2-AC65-03364AAE38B5}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (12/26/2015 10:19:17 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: {51696D9F-D5FC-4456-81C5-9C5D0BEE0ACC}.exe, Version: 3.1.0.9, Zeitstempel: 0x566b28d2
Name des fehlerhaften Moduls: {51696D9F-D5FC-4456-81C5-9C5D0BEE0ACC}.exe, Version: 3.1.0.9, Zeitstempel: 0x566b28d2
Ausnahmecode: 0x40000015
Fehleroffset: 0x0014321c
ID des fehlerhaften Prozesses: 0x161c
Startzeit der fehlerhaften Anwendung: 0x{51696D9F-D5FC-4456-81C5-9C5D0BEE0ACC}.exe0
Pfad der fehlerhaften Anwendung: {51696D9F-D5FC-4456-81C5-9C5D0BEE0ACC}.exe1
Pfad des fehlerhaften Moduls: {51696D9F-D5FC-4456-81C5-9C5D0BEE0ACC}.exe2
Berichtskennung: {51696D9F-D5FC-4456-81C5-9C5D0BEE0ACC}.exe3
Vollständiger Name des fehlerhaften Pakets: {51696D9F-D5FC-4456-81C5-9C5D0BEE0ACC}.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: {51696D9F-D5FC-4456-81C5-9C5D0BEE0ACC}.exe5
Error: (12/26/2015 10:08:19 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Avira.ServiceHost.exe, Version: 1.1.47.11018, Zeitstempel: 0x55f12efe
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 10.0.10586.0, Zeitstempel: 0x5632da1c
Ausnahmecode: 0xe0434352
Fehleroffset: 0x000bd8a8
ID des fehlerhaften Prozesses: 0x72c
Startzeit der fehlerhaften Anwendung: 0xAvira.ServiceHost.exe0
Pfad der fehlerhaften Anwendung: Avira.ServiceHost.exe1
Pfad des fehlerhaften Moduls: Avira.ServiceHost.exe2
Berichtskennung: Avira.ServiceHost.exe3
Vollständiger Name des fehlerhaften Pakets: Avira.ServiceHost.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Avira.ServiceHost.exe5
Error: (12/26/2015 10:08:19 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Avira.ServiceHost.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.MissingMethodException
bei Avira.OE.CertificateTools.AuthenticodeVerifier.HasTrustworthyAviraSignature(System.String)
bei Avira.OE.CertificateTools.AuthenticodeVerifier.VerifyAviraSignature(System.String)
bei Avira.OE.ServiceHost.AssemblyLoadVerifier.IsSignatureValid(Avira.OE.CertificateTools.IAuthenticodeVerifier, System.String)
bei Avira.OE.ServiceHost.AssemblyLoadVerifier+<>c__DisplayClass2.<AreSignaturesValid>b__1(System.String)
bei System.Linq.Enumerable.All[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.Collections.Generic.IEnumerable`1<System.__Canon>, System.Func`2<System.__Canon,Boolean>)
bei Avira.OE.ServiceHost.AssemblyLoadVerifier.AreSignaturesValid(System.Collections.Generic.IEnumerable`1<System.String>)
bei Avira.OE.ServiceHost.Program+<>c__DisplayClass1.<OnServiceStart>b__0(System.Object)
bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
bei System.Threading.ThreadPoolWorkQueue.Dispatch()
bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
Error: (12/26/2015 10:08:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Avira.ServiceHost.exe, Version: 1.1.47.11018, Zeitstempel: 0x55f12efe
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 10.0.10586.0, Zeitstempel: 0x5632da1c
Ausnahmecode: 0xe0434352
Fehleroffset: 0x000bd8a8
ID des fehlerhaften Prozesses: 0x1bec
Startzeit der fehlerhaften Anwendung: 0xAvira.ServiceHost.exe0
Pfad der fehlerhaften Anwendung: Avira.ServiceHost.exe1
Pfad des fehlerhaften Moduls: Avira.ServiceHost.exe2
Berichtskennung: Avira.ServiceHost.exe3
Vollständiger Name des fehlerhaften Pakets: Avira.ServiceHost.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Avira.ServiceHost.exe5
Error: (12/26/2015 10:08:03 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Avira.ServiceHost.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.MissingMethodException
bei Avira.OE.CertificateTools.AuthenticodeVerifier.HasTrustworthyAviraSignature(System.String)
bei Avira.OE.CertificateTools.AuthenticodeVerifier.VerifyAviraSignature(System.String)
bei Avira.OE.ServiceHost.AssemblyLoadVerifier.IsSignatureValid(Avira.OE.CertificateTools.IAuthenticodeVerifier, System.String)
bei Avira.OE.ServiceHost.AssemblyLoadVerifier+<>c__DisplayClass2.<AreSignaturesValid>b__1(System.String)
bei System.Linq.Enumerable.All[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.Collections.Generic.IEnumerable`1<System.__Canon>, System.Func`2<System.__Canon,Boolean>)
bei Avira.OE.ServiceHost.AssemblyLoadVerifier.AreSignaturesValid(System.Collections.Generic.IEnumerable`1<System.String>)
bei Avira.OE.ServiceHost.Program+<>c__DisplayClass1.<OnServiceStart>b__0(System.Object)
bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
bei System.Threading.ThreadPoolWorkQueue.Dispatch()
bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
Error: (12/26/2015 10:07:16 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Avira.ServiceHost.exe, Version: 1.1.47.11018, Zeitstempel: 0x55f12efe
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 10.0.10586.0, Zeitstempel: 0x5632da1c
Ausnahmecode: 0xe0434352
Fehleroffset: 0x000bd8a8
ID des fehlerhaften Prozesses: 0xaac
Startzeit der fehlerhaften Anwendung: 0xAvira.ServiceHost.exe0
Pfad der fehlerhaften Anwendung: Avira.ServiceHost.exe1
Pfad des fehlerhaften Moduls: Avira.ServiceHost.exe2
Berichtskennung: Avira.ServiceHost.exe3
Vollständiger Name des fehlerhaften Pakets: Avira.ServiceHost.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Avira.ServiceHost.exe5
Error: (12/26/2015 10:07:16 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Avira.ServiceHost.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.MissingMethodException
bei Avira.OE.CertificateTools.AuthenticodeVerifier.HasTrustworthyAviraSignature(System.String)
bei Avira.OE.CertificateTools.AuthenticodeVerifier.VerifyAviraSignature(System.String)
bei Avira.OE.ServiceHost.AssemblyLoadVerifier.IsSignatureValid(Avira.OE.CertificateTools.IAuthenticodeVerifier, System.String)
bei Avira.OE.ServiceHost.AssemblyLoadVerifier+<>c__DisplayClass2.<AreSignaturesValid>b__1(System.String)
bei System.Linq.Enumerable.All[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.Collections.Generic.IEnumerable`1<System.__Canon>, System.Func`2<System.__Canon,Boolean>)
bei Avira.OE.ServiceHost.AssemblyLoadVerifier.AreSignaturesValid(System.Collections.Generic.IEnumerable`1<System.String>)
bei Avira.OE.ServiceHost.Program+<>c__DisplayClass1.<OnServiceStart>b__0(System.Object)
bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
bei System.Threading.ThreadPoolWorkQueue.Dispatch()
bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
Error: (12/26/2015 04:57:57 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SCHLEPPI)
Description: Bei der Aktivierung der App „Microsoft.LockApp_cw5n1h2txyewy!WindowsDefaultLockScreen“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (12/26/2015 04:57:57 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SCHLEPPI)
Description: Bei der Aktivierung der App „Microsoft.LockApp_cw5n1h2txyewy!WindowsDefaultLockScreen“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (12/26/2015 04:57:56 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SCHLEPPI)
Description: Bei der Aktivierung der App „Microsoft.LockApp_cw5n1h2txyewy!WindowsDefaultLockScreen“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Systemfehler:
=============
Error: (12/26/2015 11:52:00 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (12/26/2015 11:40:17 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (12/26/2015 11:34:54 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (12/26/2015 11:15:40 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (12/26/2015 11:07:11 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (12/26/2015 10:51:57 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalAktivierung{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (12/26/2015 10:10:48 AM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: {784E29F4-5EBE-4279-9948-1E8FE941646D}
Error: (12/26/2015 10:09:48 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Intel(R) Dynamic Application Loader Host Interface" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (12/26/2015 10:08:20 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 3 Mal passiert.
Error: (12/26/2015 10:08:07 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
CodeIntegrity:
===================================
Date: 2015-12-25 07:09:08.380
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-12-20 16:16:10.213
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-12-20 08:38:31.868
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-12-17 21:26:04.323
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-12-17 11:50:59.141
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-12-17 11:36:07.443
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Celeron(R) CPU N2940 @ 1.83GHz
Prozentuale Nutzung des RAM: 79%
Installierter physikalischer RAM: 3985.47 MB
Verfügbarer physikalischer RAM: 803.17 MB
Summe virtueller Speicher: 4689.47 MB
Verfügbarer virtueller Speicher: 1731.32 MB
==================== Laufwerke ================================
Drive c: (Boot) (Fixed) (Total:55.28 GB) (Free:15.85 GB) NTFS
Drive d: (Data) (Fixed) (Total:405 GB) (Free:84.38 GB) NTFS
Drive e: (Recover) (Fixed) (Total:60.76 GB) (Free:44.08 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (Size: 58.3 GB) (Disk ID: EFD180AA)
Partition: GPT.
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 73DF262E)
Partition 1: (Not Active) - (Size=405 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=60.8 GB) - (Type=07 NTFS)
==================== Ende von Addition.txt ============================
So, dies waren die Logs, die ich heute gefahren habe. Die Logs von farbar von gestern scheinen überschrieben worden zu sein.
und hier noch der adware report vom 24. alle weiteren (tiefen)scans blieben ohne befund Code:
<?xml version="1.0"?>
-<Summary>
<ScanInfo EndTime="20151223T233749.577954" StartTime="20151223T233125.577954" ScanType="Quick" ScanMode="Manual"/>
-<InfectedObjects>
<InfectedObject ThreatName="Cookie.WebTrends" ThreatType="Virus" ObjectStatus="Deleted" InnerObject="" ParentContainers="" ObjectPath="C:\Users\i_ro_000\AppData\Local\Microsoft\Windows\INetCookies\Low\10L9L484.txt" ObjectType="Cookie"/>
<InfectedObject ThreatName="Cookie.2o7" ThreatType="Virus" ObjectStatus="Deleted" InnerObject="" ParentContainers="" ObjectPath="C:\Users\i_ro_000\AppData\Local\Microsoft\Windows\INetCookies\Low\Z4OQCOK4.txt" ObjectType="Cookie"/>
<InfectedObject ThreatName="Cookie.BS.Serving-Sys" ThreatType="Virus" ObjectStatus="Deleted" InnerObject="" ParentContainers="" ObjectPath="C:\Users\i_ro_000\AppData\Local\Microsoft\Windows\INetCookies\6TA99798.txt" ObjectType="Cookie"/>
<InfectedObject ThreatName="Cookie.PointRoll" ThreatType="Virus" ObjectStatus="Deleted" InnerObject="" ParentContainers="" ObjectPath="C:\Users\i_ro_000\AppData\Local\Microsoft\Windows\INetCookies\6WKEYD1Z.txt" ObjectType="Cookie"/>
<InfectedObject ThreatName="Cookie.PointRoll" ThreatType="Virus" ObjectStatus="Deleted" InnerObject="" ParentContainers="" ObjectPath="C:\Users\i_ro_000\AppData\Local\Microsoft\Windows\INetCookies\B3TJK2XL.txt" ObjectType="Cookie"/>
<InfectedObject ThreatName="Cookie.BS.Serving-Sys" ThreatType="Virus" ObjectStatus="Deleted" InnerObject="" ParentContainers="" ObjectPath="C:\Users\i_ro_000\AppData\Local\Microsoft\Windows\INetCookies\BE921ENE.txt" ObjectType="Cookie"/>
<InfectedObject ThreatName="Cookie.Ru4" ThreatType="Virus" ObjectStatus="Deleted" InnerObject="" ParentContainers="" ObjectPath="C:\Users\i_ro_000\AppData\Local\Microsoft\Windows\INetCookies\CS7AO3SA.txt" ObjectType="Cookie"/>
<InfectedObject ThreatName="Cookie.Ru4" ThreatType="Virus" ObjectStatus="Deleted" InnerObject="" ParentContainers="" ObjectPath="C:\Users\i_ro_000\AppData\Local\Microsoft\Windows\INetCookies\IL8Q3CQF.txt" ObjectType="Cookie"/>
<InfectedObject ThreatName="Cookie.Ru4" ThreatType="Virus" ObjectStatus="Deleted" InnerObject="" ParentContainers="" ObjectPath="C:\Users\i_ro_000\AppData\Local\Microsoft\Windows\INetCookies\N8MDRY1Q.txt" ObjectType="Cookie"/>
</InfectedObjects>
</Summary>
und hier noch ein root kit scan mit Sbybot Code:
// info: Rootkit removal help file
// copyright: (c) 2008-2015 Safer-Networking Ltd. All rights reserved.
:: RootAlyzer Results
File:"Unknown ADS","D:\Pictures\Eigene Bilder\2009\May Nascar\movie.AVI:TOC.WMV:$DATA"
File:"Unknown ADS","D:\Pictures\Camera Roll\WIN_20150402_094054.JPG:ms-properties:$DATA"
File:"Unknown ADS","D:\Pictures\Camera Roll\WIN_20150402_094100.JPG:ms-properties:$DATA"
File:"Unknown ADS","D:\Pictures\Camera Roll\WIN_20150402_094102.JPG:ms-properties:$DATA"
File:"Unknown ADS","D:\Pictures\Camera Roll\WIN_20150609_093651.JPG:ms-properties:$DATA"
File:"Unknown ADS","D:\Pictures\Camera Roll\WIN_20150609_093704.JPG:ms-properties:$DATA"
File:"Unknown ADS","D:\Pictures\Camera Roll\WIN_20150609_093707.JPG:ms-properties:$DATA"
File:"Unknown ADS","D:\Pictures\2010-09-12\MVI_0930.AVI:TOC.WMV:$DATA"
File:"Unknown ADS","D:\Pictures\2010-09-12\MVI_0931.AVI:TOC.WMV:$DATA"
File:"Unknown ADS","D:\Pictures\2010-09-12\MVI_0997.AVI:TOC.WMV:$DATA"
File:"Unknown ADS","D:\Pictures\2010-09-12\MVI_1082.AVI:TOC.WMV:$DATA"
File:"Unknown ADS","C:\Windows\Installer\$PatchCache$\Managed\000021599B0090400100000000F01FEC:Win32App_1:$DATA"
File:"Unknown ADS","C:\Windows\Installer\$PatchCache$\Managed\1C006203FDB61DF44160419892CC3158:Win32App_1:$DATA"
File:"Unknown ADS","C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A:Win32App_1:$DATA"
File:"Unknown ADS","C:\Windows\Installer\$PatchCache$\Managed\2DDDC93A3BF389C4DB9E3E30423414C7:Win32App_1:$DATA"
File:"Unknown ADS","C:\Windows\Installer\$PatchCache$\Managed\80E0C21349F86354AA6F43317F48CAF5:Win32App_1:$DATA"
File:"Unknown ADS","C:\Windows\Installer\$PatchCache$\Managed\A294F1550B104CD468F678E54CDE0C8A:Win32App_1:$DATA"
File:"Unknown ADS","C:\Windows\Installer\$PatchCache$\Managed\CFD2C1F142D260E3CB8B271543DA9F98:Win32App_1:$DATA"
File:"Unknown ADS","C:\Windows\Installer\$PatchCache$\Managed\D20352A90C039D93DBF6126ECE614057:Win32App_1:$DATA"
File:"Unknown ADS","C:\Windows\Installer\$PatchCache$\Managed\D7314F9862C648A4DB8BE2A5B47BE100:Win32App_1:$DATA"
File:"Unknown ADS","C:\Windows\Installer\$PatchCache$\Managed\E1810453A043A7E44B90136643272B7F:Win32App_1:$DATA"
File:"Unknown ADS","C:\Windows\Installer\$PatchCache$\Managed\EFEE0228DC83E77358593193D847A0EC:Win32App_1:$DATA"
File:"Unknown ADS","C:\Windows\Installer\$PatchCache$\Managed\F855C33BF27780340A9593F0FBB9AAEA:Win32App_1:$DATA"
File:"Unknown ADS","C:\Users\i_ro_000\OneDrive:ms-properties:$DATA"
File:"Unknown ADS","C:\Users\i_ro_000\OneDrive\Bilder:ms-properties:$DATA"
File:"Unknown ADS","C:\Users\i_ro_000\OneDrive\Documents:ms-properties:$DATA"
File:"Unknown ADS","C:\Users\i_ro_000\OneDrive\Pictures:ms-properties:$DATA"
File:"Unknown ADS","C:\Users\i_ro_000\OneDrive\Documents\Combination Declaration and Assignment US Application.doc:ms-properties:$DATA"
File:"Unknown ADS","C:\Users\i_ro_000\OneDrive\Documents\Finanzamt Umzug.odt:ms-properties:$DATA"
File:"Unknown ADS","C:\Users\i_ro_000\OneDrive\Documents\Fjäll Räven.odt:ms-properties:$DATA"
File:"Unknown ADS","C:\Users\i_ro_000\OneDrive\Bilder\Eigene Aufnahmen:ms-properties:$DATA"
File:"Unknown ADS","C:\Users\i_ro_000\OneDrive\Bilder\Eigene Aufnahmen\SCHLEPPI - WIN_20150609_093651.JPG:ms-properties:$DATA"
File:"Unknown ADS","C:\Users\i_ro_000\OneDrive\Bilder\Eigene Aufnahmen\SCHLEPPI - WIN_20150609_093704.JPG:ms-properties:$DATA"
File:"Unknown ADS","C:\Users\i_ro_000\OneDrive\Bilder\Eigene Aufnahmen\SCHLEPPI - WIN_20150609_093707.JPG:ms-properties:$DATA"
File:"Unknown ADS","C:\ProgramData\regid.1991-06.com.microsoft:Win32App_1:$DATA"
File:"Unknown ADS","C:\ProgramData\Microsoft\Windows Live\SOXE:Win32App_1:$DATA"
File:"Unknown ADS","C:\ProgramData\Intel\Wireless\Settings:Win32App_1:$DATA"
File:"Unknown ADS","C:\ProgramData\Avira\Launcher\apps\icons:Win32App_1:$DATA"
File:"Unknown ADS","C:\ProgramData\Apple\Apple Application Support\kdrl:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Apple Software Update:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Bonjour:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\CyberLink:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Malwarebytes Anti-Malware:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Microsoft SQL Server Compact Edition:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Mozilla Firefox:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\OpenOffice 4:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\PHotkey:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\QuickTime:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Windows Live:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Windows Live\Contacts:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Windows Live\Photo Gallery:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Windows Live\Shared:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Windows Live\SOXE:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Windows Live\Shared\en-gb:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Windows Live\Shared\fr:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Windows Live\Photo Gallery\en-gb:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Windows Live\Photo Gallery\fr:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Windows Live\Photo Gallery\Shared:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Windows Live\Installer\en-gb:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Windows Live\Installer\fr:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\VS Revo Group\Revo Uninstaller:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.1:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Microsoft Silverlight\5.1.41105.0:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Microsoft Office\Office15:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Medion MediaPack 3\Ashampoo AppLauncher (Medion):Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Java\jre1.8.0_66:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\iTunes\Mozilla Plugins:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Intel\TXE Components:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\CyberLink\LabelPrint:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\CyberLink\Media Suite:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\CyberLink\PhotoDirector4:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\CyberLink\Power2Go8:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\CyberLink\PowerDVD Copy:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\CyberLink\PowerDVD12:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\CyberLink\YouCam:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\CyberLink\YouCam\EffectScript:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\CyberLink\PowerDVD12\Common\MUI:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\CyberLink\PhotoDirector4\Kernel\UACObject:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Common Files\Skype:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Common Files\Microsoft Shared\VC:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Common Files\Java\Java Update:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Common Files\Apple\Apple Application Support:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Common Files\Apple\Internet Services:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Common Files\Apple\Mobile Device Support:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Bonjour\Bonjour.Resources:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Avira\AntiVir Desktop:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Avira\Launcher:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\SteuerSparErklaerung 2015:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files\Bonjour:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files\Dolby Digital Plus:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files\iTunes:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files\Microsoft Silverlight:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files\Realtek\Audio\HDA:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files\Microsoft Silverlight\5.1.41105.0:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files\Lavasoft\Ad-Aware Antivirus\Antimalware Engine\3.0.99.0:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.9.696.8769:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files\iPod\bin\iPodService.Resources:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files\Intel\TXE Components:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files\Intel\WiFi:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files\Intel\WiFiDrivers\Drivers:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files\Intel\TXE Components\Lang:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files\CyberLink\PowerDirector11:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files\CyberLink\PowerRecover:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files\Common Files\microsoft shared\DW:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files\Common Files\microsoft shared\VC:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files\Common Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus Updater\11.9.696.8769:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files\Common Files\Apple\Apple Application Support:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files\Common Files\Apple\CoreFP:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files\Common Files\Apple\Internet Services:Win32App_1:$DATA"
File:"Unknown ADS","C:\Program Files\Common Files\Apple\Mobile Device Support:Win32App_1:$DATA"
File:"Unknown ADS","C:\$RECYCLE.BIN\S-1-5-21-2785950416-199303644-2934268561-1001\$RHUBYHY:Win32App_1:$DATA"
File:"Unknown ADS","C:\$RECYCLE.BIN\S-1-5-21-2785950416-199303644-2934268561-1001\$RN99YHM:Win32App_1:$DATA"
File:"Unknown ADS","C:\$RECYCLE.BIN\S-1-5-21-2785950416-199303644-2934268561-1001\$RTAK5UB:Win32App_1:$DATA"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SOFTWARE\Wow6432Node\Microsoft\Security Center\","Svc"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\","Upgrade"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SOFTWARE\Wow6432Node\Microsoft\InputMethod\Jpn\","DuState"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SOFTWARE\Wow6432Node\Microsoft\InputMethod\Chs\","DuState"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SOFTWARE\Microsoft\Security Center\Svc\","Upgrade"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SOFTWARE\Microsoft\InputMethod\Jpn\","DuState"
RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SOFTWARE\Microsoft\InputMethod\Chs\","DuState"
sbybot hängt sich übrigens bei 100% auf bei der Suche nach:
Status: Suche läuft...
Produkt: Zlob.ZipCodec heruntergeladene Dateien...
(falls das noch wichtig sein sollte) |
AdwCleaner auf deinen Desktop.
Hast du noch irgendwelche Probleme mit deinem Rechner? 