| mamaimapril | 28.05.2016 00:20 |
Hallo, Matthias,
schön, dass Du Dir Zeit nimmst.:taenzer:
Hier die Dateien: Code:
# AdwCleaner v5.118 - Bericht erstellt am 28/05/2016 um 00:54:27
# Aktualisiert am 23/05/2016 von Xplode
# Datenbank : 2016-05-26.2 [Server]
# Betriebssystem : Windows 8.1 (X64)
# Benutzername : Rhea - MNEMOSYNE
# Gestartet von : C:\Users\Rhea\Desktop\adwcleaner_5.118.exe
# Option : Suchlauf
# Unterstützung : hxxp://toolslib.net/forum
***** [ Dienste ] *****
***** [ Ordner ] *****
Ordner gefunden : C:\StormAlert
Ordner gefunden : C:\Users\Rhea\AppData\Local\StartPoint
Ordner gefunden : C:\Users\Rhea\AppData\Local\StormAlert
***** [ Dateien ] *****
***** [ DLL ] *****
***** [ WMI ] *****
***** [ Verknüpfungen ] *****
***** [ Aufgabenplanung ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel gefunden : HKCU\Software\Classes\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}
Schlüssel gefunden : HKLM\SOFTWARE\Classes\CLSID\{C424171E-592A-415A-9EB1-DFD6D95D3530}
Schlüssel gefunden : HKLM\SOFTWARE\Classes\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}
Schlüssel gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C424171E-592A-415A-9EB1-DFD6D95D3530}
Schlüssel gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{C424171E-592A-415A-9EB1-DFD6D95D3530}
Wert gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{C424171E-592A-415A-9EB1-DFD6D95D3530}]
Wert gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{C424171E-592A-415A-9EB1-DFD6D95D3530}]
Wert gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{C424171E-592A-415A-9EB1-DFD6D95D3530}]
***** [ Internetbrowser ] *****
[C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\prefs.js] gefunden : user_pref("browser.search.searchengine.alias", "do-search");
[C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\prefs.js] gefunden : user_pref("browser.search.searchengine.desc", "this is my first firefox searchEngine");
[C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\prefs.js] gefunden : user_pref("browser.search.searchengine.iconURL", "hxxp://do-search.com/favicon.ico");
[C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\prefs.js] gefunden : user_pref("browser.search.searchengine.ptid", "corna");
[C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\prefs.js] gefunden : user_pref("browser.search.searchengine.uid", "WDCXWD5000MPCK-24AWHT0_WD-WX41AA36277462774");
[C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\prefs.js] gefunden : user_pref("extensions.quick_start.enable_search1", false);
[C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\prefs.js] gefunden : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);
*************************
C:\AdwCleaner\AdwCleaner[R0].txt - [2161 Bytes] - [17/12/2014 17:39:20]
C:\AdwCleaner\AdwCleaner[R1].txt - [2221 Bytes] - [17/12/2014 23:25:02]
C:\AdwCleaner\AdwCleaner[R2].txt - [1535 Bytes] - [18/12/2014 15:12:15]
C:\AdwCleaner\AdwCleaner[R3].txt - [1029 Bytes] - [19/12/2014 00:56:59]
C:\AdwCleaner\AdwCleaner[R4].txt - [1117 Bytes] - [19/12/2014 01:09:48]
C:\AdwCleaner\AdwCleaner[S0].txt - [2249 Bytes] - [17/12/2014 23:35:11]
C:\AdwCleaner\AdwCleaner[S1].txt - [4533 Bytes] - [19/12/2014 01:02:07]
C:\AdwCleaner\AdwCleaner[S2].txt - [3366 Bytes] - [28/05/2016 00:54:27]
########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [3439 Bytes] ##########
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.6 (04.25.2016)
Operating System: Windows 8.1 x64
Ran by Rhea (Administrator) on 28.05.2016 at 1:04:57,51
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 3
Successfully deleted: C:\ProgramData\fb133a470b78426fb88c5382644f7185 (Folder)
Successfully deleted: C:\Users\Rhea\AppData\Local\startpoint (Folder)
Successfully deleted: C:\WINDOWS\wininit.ini (File)
Deleted the following from C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\prefs.js
user_pref(browser.search.searchengine.alias, do-search);
user_pref(browser.search.searchengine.desc, this is my first firefox searchEngine);
user_pref(browser.search.searchengine.iconURL, hxxp://do-search.com/favicon.ico);
user_pref(browser.search.searchengine.ptid, corna);
user_pref(browser.search.searchengine.uid, WDCXWD5000MPCK-24AWHT0_WD-WX41AA36277462774);
user_pref(extensions.quick_start.enable_search1, false);
user_pref(extensions.quick_start.sd.closeWindowWithLastTab_prev_state, false);
Registry: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 28.05.2016 at 1:06:55,11
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:23-05-2016
durchgeführt von Rhea (2016-05-28 01:27:38)
Gestartet von C:\Users\Rhea\Desktop
Windows 8.1 (Update) (X64) (2014-05-23 00:02:59)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-3879709871-1962586687-2025067079-500 - Administrator - Disabled)
Gast (S-1-5-21-3879709871-1962586687-2025067079-501 - Limited - Disabled)
Rhea (S-1-5-21-3879709871-1962586687-2025067079-1001 - Administrator - Enabled) => C:\Users\Rhea
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
7-Zip 9.35 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0935-000001000000}) (Version: 9.35.00.0 - Igor Pavlov)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.016.20041 - Adobe Systems Incorporated)
Adobe Flash Player 21 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 21.0.0.242 - Adobe Systems Incorporated)
Audacity 1.2.6 (HKLM-x32\...\Audacity_is1) (Version: - )
Benutzerhandbuch (x32 Version: 1.0.0.15 - Lenovo) Hidden
Common Desktop Agent (Version: 1.62.0 - OEM) Hidden
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.65.7.0 - Conexant)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)
CyberLink PowerDirector 10 (Version: 10.0.0.2810 - CyberLink Corp.) Hidden
Dolby Digital Plus Home Theater (HKLM\...\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.5.1.1 - Dolby Laboratories Inc)
Dropbox (HKLM-x32\...\Dropbox) (Version: 3.20.1 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.35.3 - Dropbox, Inc.) Hidden
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.2.20140326 - Landesfinanzdirektion Thüringen)
Energy Manager (HKLM-x32\...\InstallShield_{AC768037-7079-4658-AC24-2897650E0ABE}) (Version: 1.0.0.33 - Lenovo)
Energy Manager (x32 Version: 1.0.0.33 - Lenovo) Hidden
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
FileZilla Server (HKLM-x32\...\FileZilla Server) (Version: beta 0.9.50 - FileZilla Project)
Garmin BaseCamp (HKLM-x32\...\{B0BED0BB-E1C4-49AA-840F-7CA052ADF5EB}) (Version: 4.3.4 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM-x32\...\{3D5D6CFC-3097-425A-8D8F-7EAF5D57641D}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
GMX MailCheck (HKLM-x32\...\1&1 Mail & Media GmbH Toolbar IE8) (Version: 2.6.6.1 - 1&1 Mail & Media GmbH)
GMX Softwareaktualisierung (HKLM-x32\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 4.0.1.0 - 1&1 Mail & Media GmbH)
Intel(R) Dynamic Platform and Thermal Framework (HKLM-x32\...\FFD10ECE-F715-4a86-9BD8-F6F47DA5DA1C) (Version: 7.10.0.2208 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3366 - Intel Corporation)
Intel(R) Sideband Fabric Device Driver (HKLM-x32\...\C5A8BC6E-723A-4C0F-96E1-C426D1A4BCA9) (Version: 1.70.305.16316 - Intel Corporation)
Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1050 - Intel Corporation)
Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)
Lenovo Motion Control (HKLM-x32\...\InstallShield_{E7E2BEA6-ECCE-4306-9486-A08781BE0AD0}) (Version: 2.0.0.1104 - PointGrab)
Lenovo Motion Control (x32 Version: 2.0.0.1104 - PointGrab) Hidden
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.0.0.2105 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 8.0.0.2105 - CyberLink Corp.) Hidden
Lenovo Smart Voice (HKLM\...\Lenovo SmartVoice) (Version: 1.0.2.2 - Lenovo)
Lenovo Transition (HKLM\...\Lenovo Transition) (Version: 2.0.13.12271 - Lenovo)
Lenovo Yoga PhoneCompanion (HKLM-x32\...\InstallShield_{0F82EA83-B0C5-4AB9-9695-DFE92C5FD57B}) (Version: 1.1.9.5 - Lenovo)
Lenovo Yoga PhoneCompanion (x32 Version: 1.1.9.5 - Lenovo) Hidden
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM-x32\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 ENU (HKLM\...\{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 46.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 46.0.1 (x86 de)) (Version: 46.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 46.0.1.5966 - Mozilla)
Mozilla Thunderbird 38.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 38.6.0 (x86 de)) (Version: 38.6.0 - Mozilla)
Nokia Connectivity Cable Driver (HKLM\...\{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}) (Version: 7.1.32.69 - )
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.6.9 - Notepad++ Team)
OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
paint.net (HKLM\...\{F509C1F4-0029-49F9-B145-A4C4E8DF481A}) (Version: 4.0.3 - dotPDN LLC)
PDF Architect 2 (HKLM-x32\...\PDF Architect 2) (Version: 2.0.24.16092 - pdfforge GmbH)
PDF Architect 2 View Module (HKLM-x32\...\{46889070-D447-4936-A5D3-246DB972FA2E}) (Version: 2.0.6.16537 - pdfforge GmbH)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
PHOTOfunSTUDIO 9.6 PE (HKLM-x32\...\{7113ACE0-A2FA-463B-969A-E3FD7BF42573}) (Version: 9.06.710.1031 - Panasonic Corporation)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.310 - Qualcomm Atheros Communications)
Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.30164 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Samsung Drucker-Diagnose (HKLM-x32\...\Samsung Printer Diagnostics) (Version: 1.0.4.7 - Samsung Electronics Co., Ltd.)
Samsung Easy Document Creator (HKLM-x32\...\Samsung Easy Document Creator) (Version: 1.06.60 (17.03.2015) - Samsung Electronics Co., Ltd.)
Samsung Easy Printer Manager (HKLM-x32\...\Samsung Easy Printer Manager) (Version: 1.05.81.00(25.05.2015) - Samsung Electronics Co., Ltd.)
Samsung M2070 Series (HKLM-x32\...\Samsung M2070 Series) (Version: 1.22 (07.09.2015) - Samsung Electronics Co., Ltd.)
Samsung M2070 Series XPS (Windows 8) (HKLM-x32\...\Samsung M2070 Series XPS (Windows 8)) (Version: 3.03.08.00:05 - Samsung Electronics Co., Ltd.)
Samsung Network PC Fax (HKLM-x32\...\Samsung Network PC Fax) (Version: 1.11.28 (10.03.2015) - Samsung Electronics Co., Ltd.)
Samsung OCR Software (HKLM-x32\...\Samsung OCR Software) (Version: 1.01.12 (15.10.2014) - Samsung Electronics Co., Ltd.)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
Samsung Scan Assistant (HKLM-x32\...\Samsung Scan Assistant) (Version: 1.05.07 (20.07.2012) - Samsung Electronics Co., Ltd.)
Samsung Scan Process Machine (x32 Version: 1.03.05.25 - Samsung Electronics Co., Ltd.) Hidden
Samsung Universal Print Driver 2 (HKLM-x32\...\Samsung Universal Print Driver 2) (Version: 2.50.06.00 - Samsung Electronics Co., Ltd.)
Samsung Universal Scan Driver (HKLM-x32\...\Samsung Universal Scan Driver) (Version: 1.2.19.0 - Samsung Electronics Co., Ltd.)
SILKYPIX Developer Studio 4.2 SE (HKLM-x32\...\InstallShield_{8B9D37A0-F77B-41DD-932A-CE01DEC1ADAA}) (Version: 4 - Ichikawa Soft Laboratory)
SILKYPIX Developer Studio 4.2 SE (x32 Version: 4 - Ichikawa Soft Laboratory) Hidden
SNS Upload for Easy Document Creator (HKLM-x32\...\{B6B5F07C-88D5-49D3-A1A7-A6D4BC37DCCC}) (Version: 1.0.0 - Samsung Electronics Co.,Ltd)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
StreamTransport version: 1.1.6.2 (HKLM-x32\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version: - )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.14.6 - Synaptics Incorporated)
UserGuide (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 1.0.0.15 - Lenovo)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
Windows-Treiberpaket - Lenovo (ACPIVPC) System (02/17/2013 9.52.0.776) (HKLM\...\35DD26BE48DAF4A9F35F969F3CB1E3E1435E661E) (Version: 02/17/2013 9.52.0.776 - Lenovo)
Windows-Treiberpaket - Lenovo (WUDFRd) LenovoVhid (07/25/2013 10.30.0.288) (HKLM\...\6BCA401E9CBEED970D75F55FA5320F60D11984E9) (Version: 07/25/2013 10.30.0.288 - Lenovo)
XAMPP (HKLM-x32\...\xampp) (Version: 5.6.3-0 - Bitnami)
Yoga Picks (HKLM-x32\...\{267C8BA0-876B-4589-9F14-EFB84ABCEA7F}) (Version: 1.5.013.1202 - Lenovo)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{087B3AE3-E237-4467-B8DB-5A38AB959AC9}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{3B092F0C-7696-40E3-A80F-68D74DA84210}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{63542C48-9552-494A-84F7-73AA6A7C99C1}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{7BC0E710-5703-45BE-A29D-5D46D8B39262}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\ooofilt_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{AE424E85-F6DF-4910-A6A9-438797986431}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\propertyhdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001_Classes\CLSID\{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {48F86BC9-1A37-4268-8DC9-4B902CAEC945} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {4D1C6EFB-FADF-4188-9DAE-072F214E05B7} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-05-22] (Adobe Systems Incorporated)
Task: {721CA287-0ACF-41C2-A15A-35A9A2785A33} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-02-17] (Dropbox, Inc.)
Task: {7520915A-6376-4F3A-9F78-6895858C2E24} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {80EFEDA3-E3E4-451A-81B7-A19891B23FDA} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-02-17] (Dropbox, Inc.)
Task: {CFE11131-73E0-419A-BE2D-C3A87FC84D8F} - System32\Tasks\Registration 1und1 Task => C:\Program Files (x86)\1und1Softwareaktualisierung\cdsupdclient.exe [2015-10-08] (1&1 Mail & Media GmbH)
Task: {D8C74952-C759-495C-BAED-612B80646889} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {F69EE45E-80DB-40F7-B912-B46E9C2F1791} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-04-22] (Adobe Systems Incorporated)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-11517530520.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xd10c1016 -pinnedTimeHigh 0x01d0d295 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000064 hxxp://dict.leo.org/ende/index_de.html#/search=&searchLoc=0&resultOrder=basic&multiwordShowS
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-11689991990.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xd3990412 -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000056 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/82/bebalanced-k%C3%B6rper
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-12072113890.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x0327686a -pinnedTimeHigh 0x01d0f4b0 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000017 hxxp://www.clipfish.de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-12425247930.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xf60c1a3b -pinnedTimeHigh 0x01cfbe56 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000064 hxxp://dict.leo.org/frde/index_de.html#/search=&searchLoc=0&resultOrder=basic&multiwordShowS
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-13304856320.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x0de30816 -pinnedTimeHigh 0x01d06bbd -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000032 hxxp://www.unwetterzentrale.de/uwz/temperatur.html
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-13506273490.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x245d8140 -pinnedTimeHigh 0x01d0fb60 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000001e hxxp://woerterbuchnetz.de/DWB/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-14704389310.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x709605fc -pinnedTimeHigh 0x01d07bb4 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000029 hxxp://localhost/joomla341/administrator/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-15829586810.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x8dac8991 -pinnedTimeHigh 0x01d0f876 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000015 hxxp://www.amazon.de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-16228374220.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xdd5a7938 -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000050 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/83/bebalanced-geist
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-17714738290.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xa06bf05f -pinnedTimeHigh 0x01cfbdf1 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x0000001e hxxp://www.gpsies.com/login.do
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-18349738120.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x012fa14d -pinnedTimeHigh 0x01d06bbc -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000042 hxxp://www.niederschlagsradar.de/niederschlagsprognose.aspx?type=1
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-1856752590.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x9e55eab1 -pinnedTimeHigh 0x01d06bcf -securityFlags 0x00000000 -tileType 0x00000002 -url 0x0000001a hxxp://www.codecheck.info/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-1930419650.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x16618286 -pinnedTimeHigh 0x01d06bbd -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000011 hxxp://fritz.box/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-20172485120.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x1a75fa60 -pinnedTimeHigh 0x01cfbc92 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000025 hxxp://www.bahn.de/p/view/index.shtml
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-20504568990.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xebcbbc70 -pinnedTimeHigh 0x01cfbc91 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x0000003b hxxp://www.boeser-wolf.schule.de/concours/2014/accueil.html
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-5511536870.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xa5d41f09 -pinnedTimeHigh 0x01d138b2 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000064 hxxp://dict.leo.org/esde/index_de.html#/search=&searchLoc=0&resultOrder=basic&multiwordShowS
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\-6764561640.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xc0dd7b7c -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000051 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/80/bebalanced-basics
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\13362524720.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xfdbd1b9c -pinnedTimeHigh 0x01cfc2d2 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000025 hxxp://wetterstationen.meteomedia.de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\14722268070.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x0374d018 -pinnedTimeHigh 0x01d138f7 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000026 hxxp://www.duden.de/schwierige-woerter
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\16003941200.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x029e0744 -pinnedTimeHigh 0x01d06bbd -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000017 hxxp://www.sat24.com/eu
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\16371692260.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x6ede0d80 -pinnedTimeHigh 0x01d12204 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000013 hxxp://www.faz.net/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\19320121740.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x4f006974 -pinnedTimeHigh 0x01d0d42f -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000028 hxxps://www.aerzte-finanz.de/praxispilot
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\19571323130.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x08753f27 -pinnedTimeHigh 0x01d0b0b6 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000002d hxxp://online.rote-liste.de/suche/ferro-sanol
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\19858872700.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xe480d8c3 -pinnedTimeHigh 0x01d06bc9 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000003c hxxp://www.hautschutzengel.de/bedenkliche-inhaltsstoffe.html
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\21415739090.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xe924f5b3 -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000059 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/84/bebalanced-sch%C3%B6nheit
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\330252100.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x40fe2528 -pinnedTimeHigh 0x01d07ba4 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000032 hxxp://localhost/joomla341/administrator/index.php
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\4300483340.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xcc6d0835 -pinnedTimeHigh 0x01d07936 -securityFlags 0x00000000 -tileType 0x00000001 -url 0x00000053 hxxps://www.my-airex.com/training/uebungsvideos/video-detail/81/bebalanced-workouts
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\4699799270.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x2a286297 -pinnedTimeHigh 0x01cfe086 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000041 hxxp://fahrplanauskunft.vrn.de/vrn/XSLT_TRIP_REQUEST2?language=de
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\4736959030.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -pinnedSite -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x693ce4b5 -pinnedTimeHigh 0x01d06bc1 -securityFlags 0x00000000 -tileType 0x00000003 -url 0x000000a5 hxxp://scholar.google.com/scholar?hl=en&q=%22101-86-0%22+OR+%22hexyl+cinnamaldehyde%22+OR+%2
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\6473758050.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xff1fdcd2 -pinnedTimeHigh 0x01cfe091 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x00000044 hxxp://wetterstationen.meteomedia.de/?station=107300&wahl=vorhersage
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\8167997760.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xfb848207 -pinnedTimeHigh 0x01d0fea8 -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000001c hxxp://www.dirksbiokiste.de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\8302254560.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xfce9884c -pinnedTimeHigh 0x01d0fb5f -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000001b hxxp://dwb.uni-trier.de/de/
ShortcutWithArgument: C:\Users\Rhea\AppData\Local\Microsoft\Windows\Application Shortcuts\Microsoft.InternetExplorer.Default\8511463020.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -contentTile -formatVersion 0x00000003 -pinnedTimeLow 0xe44b0b80 -pinnedTimeHigh 0x01d12ea3 -securityFlags 0x00000000 -tileType 0x00000002 -url 0x00000041 hxxps://www.efiliale.de/efiliale/internetmarke/productDetails.jsp
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2016-05-25 19:22 - 2015-06-11 15:58 - 00022528 _____ () C:\WINDOWS\System32\ssm4mlm.dll
2015-05-22 19:34 - 2014-04-16 10:22 - 00029184 _____ () C:\WINDOWS\System32\usp02l.dll
2014-03-07 00:05 - 2012-04-24 12:43 - 00390632 ____N () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2016-05-25 19:26 - 2016-05-01 09:38 - 00498488 ____N () C:\WINDOWS\SysWOW64\spdsvc.exe
2015-05-22 19:34 - 2014-11-26 13:07 - 00118576 _____ () C:\WINDOWS\SysWOW64\SecUPDUtilSvc.exe
2014-03-07 00:06 - 2014-03-07 00:06 - 00062224 _____ () C:\ProgramData\LenovoTransition\Server\x64\dptf.dll
2014-03-07 00:00 - 2013-11-18 17:40 - 00019440 _____ () C:\Program Files (x86)\Lenovo\Yoga Picks\Service\x64\YogaPicks.AppService.exe
2014-05-12 11:49 - 2014-05-12 11:49 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2015-05-22 19:34 - 2013-10-04 06:53 - 00734720 _____ () C:\WINDOWS\system32\SnMinDrv.dll
2015-05-22 18:05 - 2015-06-10 08:18 - 00087552 ____N () C:\WINDOWS\system32\SSDEVM64.DLL
2014-03-07 00:06 - 2014-03-07 00:06 - 00815104 _____ () C:\Program Files\Lenovo Yoga PhoneCompanion\adb.exe
2014-12-02 13:52 - 2015-06-11 15:58 - 01604096 _____ () C:\WINDOWS\system32\spool\DRIVERS\x64\3\ssm4mdu.dll
2015-10-28 10:32 - 2014-05-13 13:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-10-28 10:32 - 2014-05-13 13:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-10-28 10:32 - 2014-05-13 13:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-10-28 10:32 - 2012-08-23 11:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-10-28 10:32 - 2012-04-03 18:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-04-22 13:00 - 2014-04-22 13:00 - 00988160 _____ () C:\Program Files (x86)\OpenOffice 4\program\libxml2.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\Windows:nlsPreferences [386]
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Gambali => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com
Da befinden sich 7866 mehr Seiten.
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\123simsen.com -> www.123simsen.com
Da befinden sich 7866 mehr Seiten.
==================== Hosts Inhalt: ==========================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2013-08-22 15:25 - 2016-03-22 19:06 - 00450771 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
127.0.0.1 www.123moviedownload.com
Da befinden sich 15463 zusätzliche Einträge.
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Rhea\Pictures\dendrobium.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{A1565219-9C4A-477E-B087-633B3F01E71E}] => (Allow) C:\Program Files\CyberLink\PowerDirector10\PDR10.EXE
FirewallRules: [{27C039CA-A127-4E1D-B1D3-CFEB670B44C4}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{52CA7F06-4BB9-4795-8066-9B58632D957C}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [TCP Query User{A68DF61A-3CEB-457C-A455-E979D0DFD9D9}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{3BA7C7BB-201C-4578-8032-226B84A5187E}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [{D77998D3-8628-4C19-B4A4-AF6FD6322E17}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{53831517-DB8D-477E-A9BA-0C3A6D4F67AC}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{1061C061-F384-43B0-A0D9-6DDF4EE6503F}C:\xampp\filezillaftp\filezillaserver.exe] => (Allow) C:\xampp\filezillaftp\filezillaserver.exe
FirewallRules: [UDP Query User{7D299E78-91AB-4FFE-A9D0-96D0355417B2}C:\xampp\filezillaftp\filezillaserver.exe] => (Allow) C:\xampp\filezillaftp\filezillaserver.exe
FirewallRules: [TCP Query User{1AF7B847-EFE8-41FB-8695-62F373AFC563}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
FirewallRules: [UDP Query User{68C4E61F-D08F-4ECF-BDF9-34E20341F5B6}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
FirewallRules: [TCP Query User{B954C488-1AA4-4941-8C2B-67D5286A963E}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [UDP Query User{E1072E6A-6360-495F-926E-F632C4A9689B}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [{2F8C4FC1-9C82-4726-8649-49E2C93B9D8E}] => (Allow) C:\Windows\twain_32\Samsung\SLM2070\ScanCDLM\ScanCDLM.exe
FirewallRules: [{AF6153E9-14EE-4199-BED9-3D14AB492CF1}] => (Allow) C:\Windows\twain_32\Samsung\SLM2070\ScanCDLM\ScanCDLM.exe
FirewallRules: [{D4FA5DEE-C506-4A04-935D-390F5C6079FB}] => (Allow) C:\Program Files (x86)\Samsung\Easy Document Creator\EDC.exe
FirewallRules: [{F1A3B9EF-D5FB-4574-9BEB-96ECBB0D684B}] => (Allow) C:\Program Files (x86)\Samsung\Easy Document Creator\EDC.exe
FirewallRules: [{D921552C-CE68-403D-9DBE-CAC966A95EE2}] => (Allow) C:\Program Files (x86)\Samsung\Network PC Fax\drv\NetFaxMon64.exe
FirewallRules: [{4EA57459-AD30-41FA-9486-39ECF62DD501}] => (Allow) C:\Program Files (x86)\Samsung\Network PC Fax\drv\NetFaxMon.exe
FirewallRules: [{CA400C7C-FCAD-4924-A278-73C732755889}] => (Allow) C:\WINDOWS\system32\spool\drivers\x64\3\NetFaxMon64.exe
FirewallRules: [{0DB4AB93-0BF1-452D-B832-A710ACAE9614}] => (Allow) C:\Program Files (x86)\Scan Assistant\USDAgent.exe
FirewallRules: [{0A36E50D-B3B9-4F9E-89E2-F7D348BB11A2}] => (Allow) C:\Program Files (x86)\Scan Assistant\USDAgent.exe
FirewallRules: [{B01021EE-1A36-4775-B364-BBFD21F779CC}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Print Driver 2\PrinterSelector\SUPDApp.exe
FirewallRules: [{6AE25776-262D-4156-A3AD-06CEFDE05C0E}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\ICCUpdater.exe
FirewallRules: [{E1687298-987D-4B20-9A26-B60751527F08}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\ICCUpdater.exe
FirewallRules: [{ED9943F9-DE46-46E9-925F-100E5091517E}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\ScanCDLM.exe
FirewallRules: [{8A2BA25A-496F-4DCC-A5C7-C19393A3D961}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\ScanCDLM.exe
FirewallRules: [{62296BC3-29A2-4E43-A5B9-FC5F4AFF9F77}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
FirewallRules: [{AA356EF1-DC9A-4E7C-9867-11E0FD6ADEA3}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\IDS.Application.exe
FirewallRules: [{92F8AF9C-8320-4DA0-9BD8-8385FCE371E0}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\OrderSupplies.exe
FirewallRules: [{ACDC45D2-E539-4A5C-88F5-D552A85E4715}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\IDSAlert.exe
FirewallRules: [{5101E3CE-13FC-48A1-B5C4-7AEFDA6EE3B9}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\uninstall.exe
FirewallRules: [{C4AADB98-8170-4343-BE13-431B9916C69F}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\CDAS2PC.exe
FirewallRules: [{FADE533B-82AD-4F77-BE3C-8EFC1FCF83BE}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\ScanProcess.exe
FirewallRules: [{90066ABE-2A39-4368-906B-678D875AC021}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\Scan2PCNotify.exe
FirewallRules: [{B325C3E0-A133-4252-8525-E421CB05311C}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
FirewallRules: [{4D6BB0B0-11D9-45EB-BFF1-83D9D0931CEE}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
==================== Wiederherstellungspunkte =========================
25-03-2016 22:43:12 Windows Update
22-05-2016 23:47:21 Windows Update
26-05-2016 21:34:56 Windows Update
28-05-2016 01:05:01 JRT Pre-Junkware Removal
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (05/28/2016 01:36:56 AM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/28/2016 01:31:30 AM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/27/2016 10:25:13 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/27/2016 10:24:26 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/27/2016 10:22:25 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/27/2016 10:14:45 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/27/2016 10:05:39 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/27/2016 08:43:34 PM) (Source: DptfEvent) (EventID: 1) (User: )
Description: DptfPolicyConfigTDPDll
DptfSetConfigTdpLevel: DeviceIoControl() failed.
Error: (05/27/2016 08:31:56 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm backgroundTaskHost.exe, Version 6.3.9600.17415 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1d94
Startzeit: 01d1b845ef463274
Endzeit: 4294967295
Anwendungspfad: C:\WINDOWS\system32\backgroundTaskHost.exe
Berichts-ID: 33054ee8-2439-11e6-82fa-afc2c2513d9f
Vollständiger Name des fehlerhaften Pakets: Microsoft.BingSports_3.0.1.174_x64__8wekyb3d8bbwe
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: AppexSports
Error: (05/27/2016 08:31:36 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Mnemosyne)
Description: Bei der Aktivierung der App „Microsoft.BingHealthAndFitness_8wekyb3d8bbwe!AppexHealthAndFitness“ ist folgender Fehler aufgetreten: -2147023170. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Systemfehler:
=============
Error: (05/27/2016 10:05:38 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst SensrSvc erreicht.
Error: (05/27/2016 07:21:48 PM) (Source: DCOM) (EventID: 10010) (User: Mnemosyne)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (05/27/2016 07:21:18 PM) (Source: DCOM) (EventID: 10010) (User: Mnemosyne)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (05/27/2016 09:48:18 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 10. Der Windows-SChannel-Fehlerstatus lautet: 10.
Error: (05/27/2016 09:42:17 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 10. Der Windows-SChannel-Fehlerstatus lautet: 10.
Error: (05/25/2016 07:26:22 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "Samsung Printer Dianostics Service" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (05/25/2016 06:29:48 PM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: Mnemosyne)
Description: 0x8000002a117\??\C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\S-1-5-21-3879709871-1962586687-2025067079-1001-0-ntuser.dat
Error: (05/25/2016 06:29:32 PM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: Mnemosyne)
Description: 0x8000002a117\??\C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\S-1-5-21-3879709871-1962586687-2025067079-1001-0-ntuser.dat
Error: (05/24/2016 04:24:54 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80246013 fehlgeschlagen: Update für Windows 8.1 für x64-Systeme (KB2976978)
Error: (05/24/2016 04:24:23 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80246013 fehlgeschlagen: Update für Windows 8.1 für x64-Systeme (KB3035583)
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Pentium(R) CPU N3520 @ 2.16GHz
Prozentuale Nutzung des RAM: 51%
Installierter physikalischer RAM: 3979.22 MB
Verfügbarer physikalischer RAM: 1936.52 MB
Summe virtueller Speicher: 4683.22 MB
Verfügbarer virtueller Speicher: 2592.03 MB
==================== Laufwerke ================================
Drive c: (Windows8_OS) (Fixed) (Total:426.74 GB) (Free:343.25 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:22.99 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 9E01DD02)
Partition: GPT.
==================== Ende von Addition.txt ============================
Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:23-05-2016
durchgeführt von Rhea (Administrator) auf MNEMOSYNE (28-05-2016 01:23:57)
Gestartet von C:\Users\Rhea\Desktop
Geladene Profile: Rhea (Verfügbare Profile: Rhea)
Platform: Windows 8.1 (Update) (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Intel Corporation) C:\Windows\System32\DptfParticipantProcessorService.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyCriticalService.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyLpmService.exe
(FileZilla Project) C:\Program Files (x86)\FileZilla Server\FileZilla Server.exe
(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Lenovo Smart Voice\LsvUIService.exe
(PointGrab LTD) C:\Program Files (x86)\Lenovo\Motion Control\PGService.exe
(Lenovo) C:\Program Files\Lenovo Yoga PhoneCompanion\PhoneCompanionPusher.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\x64\3\NetFaxServer64.exe
() C:\Windows\SysWOW64\spdsvc.exe
() C:\Windows\SysWOW64\SecUPDUtilSvc.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Lenovo) C:\ProgramData\LenovoTransition\Server\x64\ymc.exe
() C:\Program Files (x86)\Lenovo\Yoga Picks\Service\x64\YogaPicks.AppService.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
() C:\Program Files\Lenovo Yoga PhoneCompanion\adb.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(1und1 Mail und Media GmbH) C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck_Broker.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_21_0_0_242.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_21_0_0_242.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\swriter.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.bin
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [DptfPolicyLpmServiceHelper] => C:\WINDOWS\system32\DptfPolicyLpmServiceHelper.exe [111488 2013-09-17] (Intel Corporation)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [907480 2013-09-04] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2780400 2013-10-28] (Synaptics Incorporated)
HKLM\...\Run: [Yoga PhoneCompanion] => C:\Program Files\Lenovo Yoga PhoneCompanion\Yoga Phone Companion.exe [844304 2014-03-07] (Lenovo)
HKLM\...\Run: [AutoStartTransition] => C:\Program Files (x86)\Lenovo\Lenovo Transition\Transition.exe [294672 2014-03-07] ()
HKLM\...\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [15813616 2014-03-07] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [80880 2014-03-07] (Lenovo(beijing) Limited)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [464608 2014-09-08] ()
HKLM-x32\...\Run: [Yoga Picks] => C:\Program Files (x86)\Lenovo\Yoga Picks\Yoga Picks.exe [119824 2013-12-02] (Lenovo)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2024800 2014-06-04] (Wondershare)
HKLM-x32\...\Run: [FileZilla Server Interface] => C:\Program Files (x86)\FileZilla Server\FileZilla Server Interface.exe [2457560 2015-03-19] (FileZilla Project)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [MailCheck IE Broker] => C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck_Broker.exe [2171456 2015-12-17] (1und1 Mail und Media GmbH)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [23745808 2016-05-07] (Dropbox, Inc.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [132736 2013-11-15] (Atheros Communications)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\Run: [BingSvc] => C:\Users\Rhea\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2016-01-02] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\Run: [EEDSpeedLauncher] => rundll32.exe C:\WINDOWS\system32\eed_ec.dll,SpeedLauncher
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\...\Run: [RESTART_STICKY_NOTES] => C:\WINDOWS\system32\StikyNot.exe [479744 2014-10-29] (Microsoft Corporation)
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\PhotoScreensaver.scr [589312 2014-10-29] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [Application Restart #0] => C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe [372408 2014-11-08] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-07] (Dropbox, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PHOTOfunSTUDIO 9.6 PE.lnk [2016-05-23]
ShortcutTarget: PHOTOfunSTUDIO 9.6 PE.lnk -> C:\Program Files (x86)\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe (Panasonic Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Network PC Fax.lnk [2016-05-23]
ShortcutTarget: Samsung Network PC Fax.lnk -> C:\Windows\System32\spool\drivers\x64\3\NetFaxTray64.exe (Samsung Electronics Co., Ltd.)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
ProxyEnable: [.DEFAULT] => Proxy ist aktiviert.
ProxyServer: [.DEFAULT] => http=127.0.0.1:51185;https=127.0.0.1:51185
Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{47953B4F-4698-4BE4-8629-D04F23915DC9}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{927CA755-A3D5-411C-BDE0-BDE30D80941F}: [DhcpNameServer] 150.201.1.2
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://wetterstationen.meteomedia.de/?station=107300&wahl=vorhersage
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Internet Explorer\Main,DisableRequiresActiveXPrompt = www.shopssl.de;www1.wdr.de
HKU\S-1-5-21-3879709871-1962586687-2025067079-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.msn.com/de-de/?pc=SL5M&ocid=SL5MDHP&osmkt=de-de
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> DefaultScope {28D5C0CF-B06B-4074-A52A-388C3B862DF3} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SL5MDF&PC=SL5M&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {28D5C0CF-B06B-4074-A52A-388C3B862DF3} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {4E2A6A0E-B18C-469F-BC62-EAFB366818A5} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {79EE8967-C73E-45F3-9A1A-E79B6BA5E802} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> {C6966AB3-7BDE-4182-86B6-DD1910E1B58A} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8
BHO: GMX MailCheck BHO -> {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} -> C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-10-25] (Oracle Corporation)
BHO-x32: GMX MailCheck BHO -> {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} -> C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-10-25] (Oracle Corporation)
Toolbar: HKLM - GMX MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
Toolbar: HKLM-x32 - GMX MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
Toolbar: HKU\S-1-5-21-3879709871-1962586687-2025067079-1001 -> GMX MailCheck - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
Handler: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
Handler-x32: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll [2015-12-17] (1und1 Mail und Media GmbH)
FireFox:
========
FF ProfilePath: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: Bing
FF Homepage: hxxps://www.malwarebytes.org/restorebrowser//?type=hp&ts=1429294429&from=corna&uid=WDCXWD5000MPCK-24AWHT0_WD-WX41AA36277462774
about:preferences
FF Keyword.URL: hxxp://www.bing.com/search?FORM=SL5MDF&PC=SL5M&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_21_0_0_242.dll [2016-05-22] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_242.dll [2016-05-22] ()
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-10-25] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-10-25] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-05-16] (Adobe Systems Inc.)
FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll [2014-04-30] (pdfforge GmbH)
FF SearchPlugin: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\searchplugins\bing-.xml [2016-01-01]
FF SearchPlugin: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\searchplugins\google-images.xml [2014-12-18]
FF SearchPlugin: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\searchplugins\google-maps.xml [2014-12-18]
FF SearchPlugin: C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\searchplugins\heise-netze-spam-listen-abfrage.xml [2016-02-19]
FF Extension: Bing Search - C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\Extensions\bingsearch.full@microsoft.com.xpi [2016-01-01]
FF Extension: Adblock Plus - C:\Users\Rhea\AppData\Roaming\Mozilla\Firefox\Profiles\s003w570.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-05-24]
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [318592 2013-11-15] (Windows (R) Win 7 DDK provider) [Datei ist nicht signiert]
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-02-17] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-02-17] (Dropbox, Inc.)
R2 DptfParticipantAcpiProcessorService; C:\Windows\system32\DptfParticipantProcessorService.exe [117704 2013-09-17] (Intel Corporation)
R2 DptfPolicyCriticalService; C:\Windows\system32\DptfPolicyCriticalService.exe [150760 2013-09-17] (Intel Corporation)
R2 DptfPolicyLpmService; C:\Windows\system32\DptfPolicyLpmService.exe [124904 2013-09-17] (Intel Corporation)
R2 FileZilla Server; C:\Program Files (x86)\FileZilla Server\FileZilla Server.exe [779736 2015-03-19] (FileZilla Project)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [Datei ist nicht signiert]
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [Datei ist nicht signiert]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)
R2 LsvUIService; C:\Program Files (x86)\Lenovo\Lenovo Smart Voice\LsvUIService.exe [70416 2014-03-07] (Lenovo)
S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1716264 2014-04-30] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-04-30] (pdfforge GmbH)
R2 PGService; C:\Program Files (x86)\Lenovo\Motion Control\PGService.exe [163624 2013-11-04] (PointGrab LTD)
R2 PhoneCompanionPusher; C:\Program Files\Lenovo Yoga PhoneCompanion\PhoneCompanionPusher.exe [285712 2014-03-07] (Lenovo)
S3 PhoneCompanionVap; C:\Program Files\Lenovo Yoga PhoneCompanion\PhoneCompanionVap.exe [304144 2014-03-07] (Lenovo)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()
R2 Samsung Network Fax Server; C:\WINDOWS\system32\spool\drivers\x64\3\NetFaxServer64.exe [801472 2015-03-10] (Samsung Electronics Co., Ltd.)
R2 Samsung Printer Dianostics Service; C:\WINDOWS\SysWOW64\\spdsvc.exe [498488 2016-05-01] ()
R2 SamsungUPDUtilSvc; C:\WINDOWS\SysWOW64\SecUPDUtilSvc.exe [118576 2014-11-26] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
R2 ymc; C:\ProgramData\LenovoTransition\Server\x64\ymc.exe [34576 2014-03-07] (Lenovo)
R2 YogaPicks.AppService; C:\Program Files (x86)\Lenovo\Yoga Picks\Service\x64\YogaPicks.AppService.exe [19440 2013-11-18] ()
R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2013-11-15] (Atheros) [Datei ist nicht signiert]
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3858944 2013-10-17] (Qualcomm Atheros Communications, Inc.)
S3 AX88772; C:\Windows\system32\DRIVERS\ax88772.sys [113864 2013-07-18] (ASIX Electronics Corp.)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-11-15] (Qualcomm Atheros)
R3 DptfDevAcpiProc; C:\Windows\system32\DRIVERS\DptfDevAcpiProc.sys [198808 2013-09-17] (Intel Corporation)
R3 DptfDevGen; C:\Windows\system32\DRIVERS\DptfDevGen.sys [78504 2013-09-17] (Intel Corporation)
R3 DptfManager; C:\Windows\system32\DRIVERS\DptfManager.sys [493240 2013-09-17] (Intel Corporation)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R0 MBI; C:\Windows\System32\drivers\MBI.sys [29464 2013-10-10] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3344352 2013-07-08] (Intel Corporation)
R3 SensorsServiceDriver; C:\Windows\System32\drivers\WUDFRd.sys [226304 2014-10-29] (Microsoft Corporation)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-10-28] (Synaptics Incorporated)
R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [87568 2013-07-01] (Intel Corporation)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
S3 rtsuvc; \SystemRoot\system32\DRIVERS\rtsuvc.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-05-28 01:23 - 2016-05-28 01:25 - 00023743 _____ C:\Users\Rhea\Desktop\FRST.txt
2016-05-28 01:06 - 2016-05-28 01:06 - 00001367 _____ C:\Users\Rhea\Desktop\JRT.txt
2016-05-28 00:38 - 2016-05-28 00:38 - 03678272 _____ C:\Users\Rhea\Desktop\adwcleaner_5.118.exe
2016-05-28 00:35 - 2016-05-28 00:35 - 01610816 _____ (Malwarebytes) C:\Users\Rhea\Desktop\JRT.exe
2016-05-27 18:08 - 2016-05-27 18:08 - 00000000 ____D C:\Users\Rhea\Documents\ProcAlyzer Dumps
2016-05-25 19:26 - 2016-05-25 19:25 - 02078208 ____N C:\WINDOWS\SysWOW64\DlgSearchEngine.dll
2016-05-25 19:26 - 2016-05-01 09:38 - 00498488 ____N C:\WINDOWS\SysWOW64\spdsvc.exe
2016-05-25 19:26 - 2015-12-04 10:03 - 00017831 ____N C:\WINDOWS\SysWOW64\spddata.xml
2016-05-25 19:24 - 2016-05-25 19:24 - 00000000 ____D C:\Program Files\Common Files\Common Desktop Agent
2016-05-25 19:22 - 2015-06-11 15:58 - 00022528 _____ () C:\WINDOWS\system32\ssm4mlm.dll
2016-05-25 19:09 - 2016-05-25 19:09 - 04357416 _____ C:\Users\Rhea\Downloads\SamsungPrinterInstaller.exe
2016-05-24 20:32 - 2016-05-25 20:02 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-05-24 15:07 - 2016-05-24 15:07 - 00130612 _____ C:\Users\Rhea\Desktop\Abholcoupon_fuer_Koffer_zur_Geburt.pdf
2016-05-24 00:11 - 2016-05-24 00:17 - 00059771 _____ C:\Users\Rhea\Downloads\Addition.txt
2016-05-24 00:09 - 2016-05-24 00:17 - 00048791 _____ C:\Users\Rhea\Downloads\FRST.txt
2016-05-23 23:42 - 2016-05-23 23:42 - 00001210 _____ C:\Users\Rhea\Desktop\malwarebytes230516.txt
2016-05-23 23:17 - 2016-05-25 18:29 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-05-23 23:16 - 2016-05-23 23:45 - 00001123 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-05-23 23:16 - 2016-05-23 23:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-05-23 23:16 - 2016-05-23 23:16 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-05-23 23:16 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2016-05-23 23:16 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2016-05-23 23:16 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2016-05-23 23:15 - 2016-05-23 23:15 - 02383360 _____ (Farbar) C:\Users\Rhea\Downloads\FRST64 (1).exe
2016-05-23 23:14 - 2016-05-23 23:14 - 02383360 _____ (Farbar) C:\Users\Rhea\Desktop\FRST64.exe
2016-05-23 23:11 - 2016-05-23 23:15 - 22851472 _____ (Malwarebytes ) C:\Users\Rhea\Downloads\mbam-setup-2.2.1.1043.exe
2016-05-23 00:48 - 2016-04-04 08:35 - 00046768 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2016-05-23 00:48 - 2016-04-02 15:26 - 01386496 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2016-05-23 00:48 - 2016-04-02 15:26 - 01169408 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2016-05-23 00:48 - 2016-03-28 15:21 - 00698368 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2016-05-23 00:48 - 2016-03-28 15:21 - 00499200 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2016-05-23 00:48 - 2016-03-28 15:21 - 00279040 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2016-05-23 00:48 - 2016-03-28 15:21 - 00215040 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2016-05-23 00:48 - 2016-03-28 15:21 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2016-05-23 00:48 - 2016-02-09 03:31 - 22365472 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-05-23 00:48 - 2016-02-09 03:31 - 19794896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2016-05-23 00:48 - 2016-02-08 21:48 - 12879360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2016-05-23 00:48 - 2016-02-08 19:12 - 14466560 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2016-05-23 00:48 - 2016-02-08 18:53 - 02171904 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlowUI.dll
2016-05-23 00:48 - 2016-02-05 16:46 - 01455104 _____ (Microsoft Corporation) C:\WINDOWS\system32\VSSVC.exe
2016-05-23 00:48 - 2016-02-03 17:14 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\IPMIDrv.sys
2016-05-23 00:48 - 2016-02-03 17:11 - 01673728 _____ (Microsoft Corporation) C:\WINDOWS\system32\workfolderssvc.dll
2016-05-23 00:48 - 2016-02-02 19:51 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmAuto.dll
2016-05-23 00:48 - 2016-02-02 19:19 - 00144384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmAuto.dll
2016-05-23 00:48 - 2016-02-02 19:15 - 00787456 _____ (Microsoft Corporation) C:\WINDOWS\system32\WorkfoldersControl.dll
2016-05-23 00:48 - 2016-02-02 19:01 - 00031744 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmAgent.dll
2016-05-23 00:48 - 2016-02-02 18:51 - 02609152 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmSvc.dll
2016-05-23 00:48 - 2016-02-02 18:48 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmWmiPl.dll
2016-05-23 00:48 - 2016-02-02 18:46 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmAgent.dll
2016-05-23 00:48 - 2016-02-02 18:41 - 02170880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmSvc.dll
2016-05-23 00:48 - 2016-02-02 18:39 - 00236032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmWmiPl.dll
2016-05-23 00:48 - 2016-01-27 17:18 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2016-05-23 00:48 - 2016-01-21 21:35 - 00952928 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2016-05-23 00:48 - 2016-01-21 20:42 - 00786152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2016-05-23 00:47 - 2016-03-16 03:58 - 00442712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2016-05-23 00:47 - 2016-03-16 03:58 - 00332632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2016-05-23 00:47 - 2016-03-14 18:50 - 00316760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys
2016-05-23 00:47 - 2016-03-12 02:49 - 02466136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2016-05-23 00:47 - 2016-03-12 02:47 - 00160160 _____ (Microsoft Corporation) C:\WINDOWS\system32\IPHLPAPI.DLL
2016-05-23 00:47 - 2016-03-12 02:47 - 00121912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IPHLPAPI.DLL
2016-05-23 00:47 - 2016-03-10 21:17 - 01133752 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2016-05-23 00:47 - 2016-03-10 19:48 - 00862720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2016-05-23 00:47 - 2016-03-10 19:43 - 00161280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msorcl32.dll
2016-05-23 00:47 - 2016-03-10 19:03 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\dsparse.dll
2016-05-23 00:47 - 2016-03-10 18:55 - 00510976 _____ (Microsoft Corporation) C:\WINDOWS\system32\webio.dll
2016-05-23 00:47 - 2016-03-10 18:55 - 00166400 _____ (Microsoft Corporation) C:\WINDOWS\system32\mtxoci.dll
2016-05-23 00:47 - 2016-03-10 18:52 - 00186880 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll
2016-05-23 00:47 - 2016-03-10 18:48 - 00024064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dsparse.dll
2016-05-23 00:47 - 2016-03-10 18:42 - 00413696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webio.dll
2016-05-23 00:47 - 2016-03-10 18:42 - 00116736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mtxoci.dll
2016-05-23 00:47 - 2016-03-05 19:44 - 00148480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shacct.dll
2016-05-23 00:47 - 2016-03-05 19:04 - 00192512 _____ (Microsoft Corporation) C:\WINDOWS\system32\shacct.dll
2016-05-23 00:47 - 2016-02-27 20:28 - 00131584 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2016-05-23 00:47 - 2016-02-27 19:57 - 03273728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2016-05-23 00:47 - 2016-02-27 19:19 - 03820544 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2016-05-23 00:47 - 2016-02-27 18:32 - 03547648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2016-05-23 00:47 - 2016-02-09 03:31 - 02757616 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2016-05-23 00:47 - 2016-02-09 03:31 - 02412576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2016-05-23 00:47 - 2016-02-09 03:31 - 00273264 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2016-05-23 00:47 - 2016-02-08 22:55 - 02712576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
2016-05-23 00:47 - 2016-02-08 22:15 - 02551808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\themecpl.dll
2016-05-23 00:47 - 2016-02-08 22:02 - 01197056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usercpl.dll
2016-05-23 00:47 - 2016-02-08 21:43 - 00524288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2016-05-23 00:47 - 2016-02-08 21:40 - 00539648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hgcpl.dll
2016-05-23 00:47 - 2016-02-08 21:39 - 00305152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\stobject.dll
2016-05-23 00:47 - 2016-02-08 21:37 - 00141312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingMonitor.dll
2016-05-23 00:47 - 2016-02-08 21:35 - 00954880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll
2016-05-23 00:47 - 2016-02-08 21:34 - 00667648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2016-05-23 00:47 - 2016-02-08 21:33 - 00520192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSync.dll
2016-05-23 00:47 - 2016-02-08 20:50 - 03120640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
2016-05-23 00:47 - 2016-02-08 19:55 - 02592256 _____ (Microsoft Corporation) C:\WINDOWS\system32\themecpl.dll
2016-05-23 00:47 - 2016-02-08 19:33 - 01278464 _____ (Microsoft Corporation) C:\WINDOWS\system32\usercpl.dll
2016-05-23 00:47 - 2016-02-08 19:02 - 00653824 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2016-05-23 00:47 - 2016-02-08 19:00 - 00599552 _____ (Microsoft Corporation) C:\WINDOWS\system32\hgcpl.dll
2016-05-23 00:47 - 2016-02-08 18:58 - 00336384 _____ (Microsoft Corporation) C:\WINDOWS\system32\stobject.dll
2016-05-23 00:47 - 2016-02-08 18:55 - 00173056 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingMonitor.dll
2016-05-23 00:47 - 2016-02-08 18:53 - 01348096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2016-05-23 00:47 - 2016-02-08 18:50 - 01220096 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll
2016-05-23 00:47 - 2016-02-08 18:50 - 00841728 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2016-05-23 00:47 - 2016-02-08 18:48 - 00655872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSync.dll
2016-05-23 00:47 - 2016-02-08 18:47 - 02819584 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2016-05-23 00:47 - 2016-02-08 18:44 - 00955392 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2016-05-23 00:47 - 2016-02-07 01:05 - 00551256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2016-05-23 00:47 - 2016-02-05 21:07 - 00378712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2016-05-23 00:47 - 2016-02-05 17:11 - 00845312 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL
2016-05-23 00:47 - 2016-02-05 17:11 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL
2016-05-23 00:47 - 2016-02-05 17:07 - 00272384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL
2016-05-23 00:47 - 2016-02-05 17:02 - 01083904 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2016-05-23 00:47 - 2016-02-04 20:07 - 00222720 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpsapi.dll
2016-05-23 00:47 - 2016-02-04 19:35 - 00142848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpsapi.dll
2016-05-23 00:47 - 2016-02-04 18:23 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2016-05-23 00:47 - 2016-02-04 18:22 - 00561664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2016-05-23 00:47 - 2016-02-02 19:18 - 01574912 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbengine.exe
2016-05-23 00:47 - 2016-01-31 19:17 - 00779264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsAnytimeUpgradeui.exe
2016-05-23 00:47 - 2016-01-26 21:15 - 00072024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vpci.sys
2016-05-23 00:47 - 2016-01-22 07:22 - 02487296 _____ (Microsoft Corporation) C:\WINDOWS\system32\storagewmi.dll
2016-05-23 00:47 - 2016-01-22 07:11 - 01482240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\storagewmi.dll
2016-05-23 00:47 - 2016-01-21 00:40 - 00099672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\disk.sys
2016-05-23 00:47 - 2014-11-08 04:38 - 00166912 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2016-05-23 00:47 - 2014-11-08 04:17 - 00143360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2016-05-23 00:46 - 2016-02-02 20:16 - 00112640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rasl2tp.sys
2016-05-22 23:17 - 2016-04-22 22:54 - 25816576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-05-22 23:17 - 2016-04-22 22:14 - 02893312 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-05-22 23:17 - 2016-04-22 22:08 - 06052864 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-05-22 23:17 - 2016-04-22 22:06 - 20349952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-05-22 23:17 - 2016-04-22 21:29 - 02285568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-05-22 23:17 - 2016-04-22 21:19 - 15414784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-05-22 23:17 - 2016-04-22 21:14 - 00725504 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2016-05-22 23:17 - 2016-04-22 21:14 - 00379392 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2016-05-22 23:17 - 2016-04-22 20:54 - 13811200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-05-22 23:17 - 2016-04-22 20:52 - 02596864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-05-22 23:17 - 2016-04-22 20:52 - 00330752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2016-05-22 23:17 - 2016-04-22 20:40 - 01547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-05-22 23:17 - 2016-04-22 20:27 - 02121216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-05-22 23:16 - 2016-04-22 22:15 - 00571904 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2016-05-22 23:16 - 2016-04-22 22:00 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2016-05-22 23:16 - 2016-04-22 21:35 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2016-05-22 23:16 - 2016-04-22 21:24 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2016-05-22 23:16 - 2016-04-22 21:23 - 00663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2016-05-22 23:16 - 2016-04-22 21:17 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2016-05-22 23:16 - 2016-04-22 21:14 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2016-05-22 23:16 - 2016-04-22 21:12 - 02131968 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2016-05-22 23:16 - 2016-04-22 20:58 - 04611072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-05-22 23:16 - 2016-04-22 20:58 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2016-05-22 23:16 - 2016-04-22 20:53 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2016-05-22 23:16 - 2016-04-22 20:52 - 00693248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2016-05-22 23:16 - 2016-04-22 20:51 - 02056192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2016-05-22 23:16 - 2016-04-22 20:29 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2016-05-22 23:16 - 2016-04-22 20:24 - 01311744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-05-22 23:16 - 2016-04-22 20:23 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2016-05-22 23:16 - 2016-03-31 01:56 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2016-05-22 23:16 - 2016-03-31 01:56 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2016-05-22 23:16 - 2016-03-31 01:55 - 00315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2016-05-22 23:16 - 2016-03-31 01:30 - 00279040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2016-05-22 23:16 - 2016-03-31 01:30 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2016-05-22 23:15 - 2016-04-06 23:13 - 00561960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2016-05-22 23:15 - 2016-04-06 23:13 - 00137976 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncrypt.dll
2016-05-22 23:15 - 2016-04-06 20:20 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2016-05-22 23:15 - 2016-04-06 20:19 - 00401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
2016-05-22 23:15 - 2016-04-06 20:19 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2016-05-22 23:15 - 2016-04-06 19:49 - 00120384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncrypt.dll
2016-05-22 23:15 - 2016-04-06 19:40 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2016-05-22 23:15 - 2016-04-06 18:57 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-05-22 23:15 - 2016-04-06 18:52 - 00432128 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2016-05-22 23:15 - 2016-04-06 18:20 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2016-05-22 23:15 - 2016-04-06 17:48 - 00357888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2016-05-22 23:15 - 2016-03-31 08:50 - 01307328 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2016-05-22 23:15 - 2016-03-31 05:40 - 00747520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2016-05-22 23:15 - 2016-03-03 18:47 - 02345472 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2016-05-22 23:15 - 2016-03-03 18:33 - 01556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2016-05-22 23:14 - 2016-04-11 08:21 - 00074584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volmgr.sys
2016-05-22 23:14 - 2016-04-10 09:48 - 00738096 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10level9.dll
2016-05-22 23:14 - 2016-04-10 09:48 - 00613624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10level9.dll
2016-05-22 23:14 - 2016-04-10 07:37 - 01549144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2016-05-22 23:14 - 2016-04-10 06:21 - 01763376 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2016-05-22 23:14 - 2016-04-10 06:21 - 01489088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2016-05-22 23:14 - 2016-04-10 06:14 - 01380600 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2016-05-22 23:14 - 2016-04-10 01:29 - 04169216 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2016-05-22 23:14 - 2016-04-10 00:07 - 01097728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2016-05-22 23:14 - 2016-04-09 23:58 - 00534016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2016-05-22 23:14 - 2016-04-09 23:50 - 00375296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2016-05-22 23:14 - 2016-03-29 03:42 - 07446368 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-05-22 23:14 - 2016-03-11 16:48 - 00833024 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll
2016-05-22 23:14 - 2016-03-10 19:03 - 00111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\samlib.dll
2016-05-22 23:14 - 2016-03-10 18:48 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\samlib.dll
2016-05-22 23:14 - 2016-03-03 18:13 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\basesrv.dll
2016-05-22 23:14 - 2016-03-03 03:39 - 01661576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2016-05-22 23:14 - 2016-03-03 03:39 - 01212248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2016-05-22 23:14 - 2016-02-11 22:17 - 01737088 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2016-05-22 23:14 - 2016-02-11 22:17 - 01663184 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2016-05-22 23:14 - 2016-02-11 22:17 - 01523208 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2016-05-22 23:14 - 2016-02-11 22:17 - 01490120 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2016-05-22 23:14 - 2016-02-11 22:17 - 01358952 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2016-05-22 23:14 - 2016-02-11 22:16 - 01501488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2016-05-22 23:14 - 2016-02-09 20:07 - 00246784 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-system-events.dll
2016-05-22 16:37 - 2016-05-22 16:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-05-28 01:23 - 2014-12-17 19:53 - 00000000 ____D C:\FRST
2016-05-28 01:18 - 2014-12-17 17:39 - 00000000 ____D C:\AdwCleaner
2016-05-28 01:13 - 2016-02-17 12:08 - 00001230 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job
2016-05-28 00:48 - 2016-03-22 17:50 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-05-27 20:33 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache
2016-05-27 18:14 - 2013-08-22 17:20 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-05-27 11:13 - 2016-02-17 12:08 - 00001226 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job
2016-05-27 11:05 - 2016-02-17 12:12 - 00000000 ___RD C:\Users\Rhea\Dropbox
2016-05-27 11:02 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-05-27 11:01 - 2013-08-22 15:36 - 00000000 ____D C:\WINDOWS\Inf
2016-05-27 11:01 - 2013-08-22 15:25 - 01835008 ___SH C:\WINDOWS\system32\config\BBI
2016-05-27 10:58 - 2015-04-15 13:33 - 00000000 ____D C:\WINDOWS\system32\appraiser
2016-05-27 10:58 - 2015-04-05 20:25 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX
2016-05-27 10:58 - 2015-04-05 20:25 - 00000000 ___SD C:\WINDOWS\system32\GWX
2016-05-25 22:42 - 2015-08-30 00:10 - 00000000 ____D C:\Users\Rhea\AppData\Local\WEB2Print
2016-05-25 21:39 - 2014-05-23 00:25 - 00000000 ____D C:\Users\Rhea\AppData\Local\CrashDumps
2016-05-25 20:02 - 2014-06-26 11:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-05-25 19:44 - 2014-05-23 02:08 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3879709871-1962586687-2025067079-1001
2016-05-25 19:26 - 2015-05-22 18:06 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung Printers
2016-05-25 19:24 - 2015-05-22 17:02 - 00000000 ____D C:\ProgramData\Samsung
2016-05-25 19:23 - 2015-05-22 17:02 - 00000000 ____D C:\Program Files (x86)\SamsungPrinterLiveUpdateInstaller
2016-05-25 18:20 - 2014-03-07 07:41 - 00767130 _____ C:\WINDOWS\system32\perfh007.dat
2016-05-25 18:20 - 2014-03-07 07:41 - 00160216 _____ C:\WINDOWS\system32\perfc007.dat
2016-05-25 18:20 - 2013-10-07 20:27 - 01776918 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-05-25 17:30 - 2013-08-22 17:36 - 00000000 ___RD C:\WINDOWS\ToastData
2016-05-23 23:45 - 2016-03-08 21:27 - 00001159 _____ C:\Users\Rhea\Desktop\GM5 Bedienungsanleitung.lnk
2016-05-23 23:45 - 2016-02-24 15:44 - 00001376 _____ C:\Users\Rhea\Desktop\todo - Verknüpfung.lnk
2016-05-23 23:45 - 2016-02-16 12:03 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-05-23 23:45 - 2016-02-14 20:21 - 00001695 _____ C:\Users\Rhea\Desktop\Lärmprotokoll 2 2016 - Verknüpfung.lnk
2016-05-23 23:45 - 2015-10-28 10:32 - 00001418 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2016-05-23 23:45 - 2015-09-05 13:14 - 00000982 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
2016-05-23 23:45 - 2014-11-04 22:37 - 00001186 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-05-23 23:45 - 2014-10-07 14:25 - 00001744 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Eigene Musik.lnk
2016-05-23 23:45 - 2014-10-05 15:46 - 00000965 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2016-05-23 23:45 - 2014-10-05 11:53 - 00001181 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\paint.net.lnk
2016-05-23 23:45 - 2014-10-03 14:46 - 00000752 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bilder.lnk
2016-05-23 23:45 - 2014-08-22 22:43 - 00000763 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Downloads.lnk
2016-05-23 23:45 - 2014-07-30 23:35 - 00001364 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RouteConverterWindows.lnk
2016-05-23 23:45 - 2014-06-26 11:49 - 00002125 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2016-05-23 23:45 - 2014-05-23 02:03 - 00001465 _____ C:\Users\Rhea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-05-23 23:45 - 2014-03-07 00:06 - 00001318 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmartVoiceToast.lnk
2016-05-23 23:45 - 2014-03-06 23:55 - 00002007 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office.lnk
2016-05-23 23:44 - 2013-08-22 17:43 - 00000000 ____D C:\WINDOWS\DigitalLocker
2016-05-23 14:01 - 2013-08-22 16:44 - 00371640 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-05-23 13:53 - 2013-08-22 21:12 - 00000000 ____D C:\Program Files\Windows Journal
2016-05-23 09:42 - 2014-06-13 00:55 - 139319312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-05-23 09:42 - 2014-06-13 00:55 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-05-23 09:28 - 2014-05-23 02:03 - 00000000 ____D C:\Users\Rhea
2016-05-23 00:18 - 2016-02-16 12:04 - 00003886 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2016-05-23 00:03 - 2014-12-16 18:42 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2016-05-22 22:53 - 2016-01-13 00:57 - 00177488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2016-05-22 16:48 - 2016-03-23 19:48 - 19942080 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerInstaller.exe
2016-05-22 16:48 - 2016-03-22 17:50 - 00003772 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2016-05-22 16:37 - 2016-02-17 12:08 - 00000000 ____D C:\Program Files (x86)\Dropbox
2016-05-22 16:32 - 2016-02-17 12:08 - 00000000 ____D C:\Users\Rhea\AppData\Local\Dropbox
2016-05-11 22:08 - 2015-03-11 23:30 - 00829944 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2016-05-11 22:08 - 2015-03-11 23:30 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2005-11-27 00:53 - 2005-11-27 00:53 - 0049152 _____ ( ) C:\Program Files\Interop.WIA.dll
2013-08-25 18:57 - 2013-08-25 18:57 - 0001968 _____ () C:\Program Files\License.txt
2014-07-22 15:14 - 2014-07-22 15:14 - 0828992 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Base.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 3087872 _____ () C:\Program Files\PaintDotNet.Base.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0562752 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Core.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 1826304 _____ () C:\Program Files\PaintDotNet.Core.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0090688 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Data.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0265728 _____ () C:\Program Files\PaintDotNet.Data.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0195648 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Effects.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0495104 _____ () C:\Program Files\PaintDotNet.Effects.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 1766976 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.exe
2014-06-27 14:41 - 2014-06-27 14:41 - 0000429 _____ () C:\Program Files\PaintDotNet.exe.config
2014-07-22 15:14 - 2014-07-22 15:14 - 0337472 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Framework.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 1019392 _____ () C:\Program Files\PaintDotNet.Framework.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 4711936 _____ () C:\Program Files\PaintDotNet.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0416832 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.Resources.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0050688 _____ () C:\Program Files\PaintDotNet.Resources.pdb
2014-06-23 11:10 - 2014-06-23 11:10 - 0145066 ____R () C:\Program Files\PaintDotNet.Strings.3.cs.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0141037 ____R () C:\Program Files\PaintDotNet.Strings.3.da.resources
2014-06-22 13:49 - 2014-06-22 13:49 - 0147174 ____R () C:\Program Files\PaintDotNet.Strings.3.DE.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0146230 ____R () C:\Program Files\PaintDotNet.Strings.3.ES.resources
2014-06-14 13:39 - 2014-06-14 13:39 - 0158177 ____R () C:\Program Files\PaintDotNet.Strings.3.fa.resources
2014-06-14 13:39 - 2014-06-14 13:39 - 0140166 ____R () C:\Program Files\PaintDotNet.Strings.3.fi.resources
2014-06-03 17:20 - 2014-06-03 17:20 - 0148878 ____R () C:\Program Files\PaintDotNet.Strings.3.FR.resources
2014-07-15 10:50 - 2014-07-15 10:50 - 0188674 ____R () C:\Program Files\PaintDotNet.Strings.3.hi.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0145645 ____R () C:\Program Files\PaintDotNet.Strings.3.hu.resources
2014-07-15 10:50 - 2014-07-15 10:50 - 0144519 ____R () C:\Program Files\PaintDotNet.Strings.3.it.resources
2014-06-20 16:13 - 2014-06-20 16:13 - 0155356 ____R () C:\Program Files\PaintDotNet.Strings.3.JA.resources
2014-06-03 17:20 - 2014-06-03 17:20 - 0148596 ____R () C:\Program Files\PaintDotNet.Strings.3.KO.resources
2014-06-14 13:39 - 2014-06-14 13:39 - 0147437 ____R () C:\Program Files\PaintDotNet.Strings.3.lt.resources
2014-06-24 13:17 - 2014-06-24 13:17 - 0142834 ____R () C:\Program Files\PaintDotNet.Strings.3.nl.resources
2014-06-03 17:20 - 2014-06-03 17:20 - 0143720 ____R () C:\Program Files\PaintDotNet.Strings.3.pl.resources
2014-06-14 13:39 - 2014-06-14 13:39 - 0145666 ____R () C:\Program Files\PaintDotNet.Strings.3.PT-BR.resources
2014-06-22 13:49 - 2014-06-22 13:49 - 0145325 ____R () C:\Program Files\PaintDotNet.Strings.3.pt-PT.resources
2014-06-03 13:56 - 2014-06-03 13:56 - 0138840 ____R () C:\Program Files\PaintDotNet.Strings.3.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0171796 ____R () C:\Program Files\PaintDotNet.Strings.3.RU.resources
2014-06-24 13:17 - 2014-06-24 13:17 - 0135198 ____R () C:\Program Files\PaintDotNet.Strings.3.ZH-CN.resources
2014-07-09 12:48 - 2014-07-09 12:48 - 0137582 ____R () C:\Program Files\PaintDotNet.Strings.3.zh-TW.resources
2014-07-22 15:14 - 2014-07-22 15:14 - 0563264 _____ (dotPDN LLC) C:\Program Files\PaintDotNet.SystemLayer.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 1058368 _____ () C:\Program Files\PaintDotNet.SystemLayer.Native.x64.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0968256 _____ () C:\Program Files\PaintDotNet.SystemLayer.Native.x86.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0767488 _____ () C:\Program Files\PaintDotNet.SystemLayer.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0014400 _____ (dotPDN LLC) C:\Program Files\PdnRepair.exe
2014-06-27 15:37 - 2014-06-27 15:37 - 0000235 _____ () C:\Program Files\PdnRepair.exe.config
2014-07-22 15:14 - 2014-07-22 15:14 - 0013824 _____ () C:\Program Files\PdnRepair.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0030784 _____ (dotPDN LLC) C:\Program Files\SetupNgen.exe
2010-04-21 00:57 - 2010-04-21 00:57 - 0000254 _____ () C:\Program Files\SetupNgen.exe.config
2014-07-22 15:14 - 2014-07-22 15:14 - 0030208 _____ () C:\Program Files\SetupNgen.pdb
2014-07-22 15:14 - 2014-07-22 15:14 - 0026688 _____ () C:\Program Files\ShellExtension_x64.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0023616 _____ () C:\Program Files\ShellExtension_x86.dll
2014-07-22 15:14 - 2014-07-22 15:14 - 0015936 _____ (dotPDN LLC) C:\Program Files\UpdateMonitor.exe
2014-06-28 10:29 - 2014-06-28 10:29 - 0000235 _____ () C:\Program Files\UpdateMonitor.exe.config
2014-07-22 15:14 - 2014-07-22 15:14 - 0013824 _____ () C:\Program Files\UpdateMonitor.pdb
2015-01-28 15:00 - 2015-01-28 15:00 - 0003893 _____ () C:\Users\Rhea\AppData\Local\recently-used.xbel
2014-03-06 23:26 - 2014-03-06 23:26 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Einige Dateien in TEMP:
====================
C:\Users\Rhea\AppData\Local\Temp\libeay32.dll
C:\Users\Rhea\AppData\Local\Temp\msvcr120.dll
C:\Users\Rhea\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2016-05-23 01:31
==================== Ende von FRST.txt ============================
Zwei Probleme bei der Durchführung Deiner Anweisungen sind aufgetreten:
- beim Adwarecleaner hat der Rechner nicht neu gestartet
- beim JRT habe ich den Virenscanner nicht deaktiviert, soll ich den Prozess ab Schritt 2 also wiederholen?
Danke vorab.
Noch zum Schluss eine Bitte: Könntest Du bei papaimapril schauen (Faden: http://www.trojaner-board.de/179086-...infektion.html ), ob wir hier genauso wie bei mir vorgehen sollten? Besten Dank! |
So funktioniert es:
AdwCleaner auf deinen Desktop.
und 
und speichere die Logdatei auf Deinem Desktop.