| zoraalive | 27.02.2017 16:13 |
danke für die Antwort
FRST.txt : Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 26-02-2017
durchgeführt von Dominik (Administrator) auf DESKTOP-PBJTD4R (27-02-2017 15:55:52)
Gestartet von C:\Users\Dominik\Desktop
Geladene Profile: Dominik (Verfügbare Profile: defaultuser0 & Dominik)
Platform: Windows 10 Pro Version 1607 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Scarlet.Crush Productions) E:\PS3Controller\ScpServer\bin\ScpService.exe
() C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe
(Spotify Ltd) C:\Users\Dominik\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Skillbrains) C:\Program Files (x86)\Skillbrains\lightshot\5.4.0.1\Lightshot.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_11610.1001.25.0_x64__8wekyb3d8bbwe\WinStore.App.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
==================== Registry (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7636696 2014-09-02] (Realtek Semiconductor)
HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation)
HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe [8029576 2016-11-23] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2780112 2017-01-20] (Malwarebytes)
HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [61896 2016-12-29] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [909744 2017-02-25] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Lightshot] => C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe [225944 2016-07-11] ()
HKU\S-1-5-21-2232720161-2271080761-1308937938-1001\...\Run: [Spotify Web Helper] => C:\Users\Dominik\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1446000 2017-02-19] (Spotify Ltd)
HKU\S-1-5-21-2232720161-2271080761-1308937938-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9108184 2016-11-07] (Piriform Ltd)
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{a81372f2-3be6-41d7-975d-87b3f9a4eafa}: [DhcpNameServer] 192.168.2.1
Internet Explorer:
==================
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2016-12-28] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2016-12-28] (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2016-12-28] (Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2016-12-28] (Microsoft Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)
FireFox:
========
FF ProfilePath: C:\Users\Dominik\AppData\Roaming\Mozilla\Firefox\Profiles\wl5jKVRv.default [2016-08-21]
FF Extension: (Avira Browser Safety) - C:\Users\Dominik\AppData\Roaming\Mozilla\Firefox\Profiles\wl5jKVRv.default\Extensions\abs@avira.com [2016-08-21]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-12-28] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-12-28] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
Chrome:
=======
CHR Profile: C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default [2017-02-27]
CHR Extension: (Google Präsentationen) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-08-21]
CHR Extension: (BetterTTV) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajopnjidmegmdimjlfnijceegpefgped [2016-08-21]
CHR Extension: (Google Docs) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-08-21]
CHR Extension: (Google Drive) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-08-21]
CHR Extension: (YouTube) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-08-21]
CHR Extension: (Adblock Plus) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-10-26]
CHR Extension: (Google Tabellen) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-08-21]
CHR Extension: (Avira Browserschutz) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2016-09-20]
CHR Extension: (Google Docs Offline) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-08-21]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-18]
CHR Extension: (Google Mail) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-08-21]
CHR Extension: (Chrome Media Router) - C:\Users\Dominik\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-02-07]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
==================== Dienste (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [1115552 2017-02-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\Antivirus\sched.exe [487424 2017-02-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [487424 2017-02-25] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [1519144 2017-02-25] (Avira Operations GmbH & Co. KG)
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe [936728 2014-01-28] ()
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [372272 2016-12-29] (Avira Operations GmbH & Co. KG)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [3699904 2016-12-28] (Microsoft Corporation)
R2 Ds3Service; E:\PS3Controller\ScpServer\bin\ScpService.exe [381952 2014-03-13] (Scarlet.Crush Productions) [Datei ist nicht signiert]
S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4355024 2017-01-20] (Malwarebytes)
S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [1325112 2017-02-20] (Overwolf LTD)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-09-15] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ======================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S0 amdkmafd; C:\WINDOWS\System32\drivers\amdkmafd.sys [49448 2016-08-18] (Advanced Micro Devices, Inc.)
R3 amdkmdag; C:\WINDOWS\System32\DriverStore\FileRepository\c0309114.inf_amd64_9133a0f6cb9c56bb\atikmdag.sys [26569872 2016-11-28] (Advanced Micro Devices, Inc.)
R3 amdkmdap; C:\WINDOWS\System32\DriverStore\FileRepository\c0309114.inf_amd64_9133a0f6cb9c56bb\atikmpag.sys [529440 2016-11-28] (Advanced Micro Devices, Inc.)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2014-01-28] ()
S3 AtiHDAudioService; C:\WINDOWS\system32\drivers\AtihdWT6.sys [110104 2016-09-28] (Advanced Micro Devices)
R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [161824 2017-02-25] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [163976 2017-02-25] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\WINDOWS\system32\DRIVERS\avkmgr.sys [44488 2017-02-25] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\WINDOWS\system32\DRIVERS\avnetflt.sys [88488 2017-02-25] (Avira Operations GmbH & Co. KG)
S3 Hamachi; C:\WINDOWS\system32\DRIVERS\Hamdrv.sys [45680 2016-08-31] (LogMeIn Inc.)
R3 MEIx64; C:\WINDOWS\System32\drivers\TeeDriverx64.sys [129312 2014-09-30] (Intel Corporation)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 ScpVBus; C:\WINDOWS\System32\drivers\ScpVBus.sys [39168 2013-05-19] (Scarlet.Crush Productions)
S3 VBoxUSB; C:\WINDOWS\System32\Drivers\VBoxUSB.sys [125520 2015-09-08] (Oracle Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2017-02-27 15:55 - 2017-02-27 15:56 - 00013889 _____ C:\Users\Dominik\Desktop\FRST.txt
2017-02-27 15:53 - 2017-02-27 15:53 - 04747704 _____ (AO Kaspersky Lab) C:\Users\Dominik\Downloads\tdsskiller (1).exe
2017-02-27 15:41 - 2017-02-27 15:55 - 00000000 ____D C:\FRST
2017-02-27 15:40 - 2017-02-27 15:41 - 02423296 _____ (Farbar) C:\Users\Dominik\Desktop\FRST64.exe
2017-02-27 00:33 - 2017-02-27 00:33 - 00000894 _____ C:\Users\Dominik\Desktop\JRT.txt
2017-02-27 00:30 - 2017-02-27 00:31 - 01663040 _____ (Malwarebytes) C:\Users\Dominik\Downloads\JRT (1).exe
2017-02-27 00:18 - 2017-02-27 13:23 - 00110536 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2017-02-27 00:18 - 2017-02-27 00:18 - 00176584 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMChameleon.sys
2017-02-27 00:18 - 2017-02-27 00:18 - 00001912 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-02-27 00:18 - 2017-02-27 00:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-02-27 00:18 - 2017-01-20 07:47 - 00077416 _____ C:\WINDOWS\system32\Drivers\mbae64.sys
2017-02-27 00:17 - 2017-02-27 00:17 - 55566792 _____ (Malwarebytes ) C:\Users\Dominik\Downloads\mb3-setup-consumer-3.0.6.1469.exe
2017-02-27 00:17 - 2017-02-27 00:17 - 00000000 ____D C:\Program Files\Malwarebytes
2017-02-27 00:12 - 2017-02-27 00:12 - 04015056 _____ C:\Users\Dominik\Downloads\AdwCleaner_6.043.exe
2017-02-27 00:11 - 2017-02-27 00:12 - 01169324 _____ C:\TDSSKiller.3.1.0.12_27.02.2017_00.11.14_log.txt
2017-02-27 00:09 - 2017-02-27 00:10 - 00141682 _____ C:\TDSSKiller.3.1.0.12_27.02.2017_00.09.03_log.txt
2017-02-27 00:08 - 2017-02-27 00:08 - 04747704 _____ (AO Kaspersky Lab) C:\Users\Dominik\Desktop\tdsskiller.exe
2017-02-26 13:13 - 2017-02-26 13:15 - 209704831 _____ C:\Users\Dominik\Downloads\PRO64Weedle.zip
2017-02-24 17:27 - 2017-02-26 07:57 - 00000000 ____D C:\Users\Dominik\BrawlhallaReplays
2017-02-24 17:17 - 2017-02-24 17:17 - 00000000 ____D C:\Users\Dominik\AppData\Roaming\BrawlhallaAir
2017-02-24 01:00 - 2017-02-24 01:00 - 00000000 ____D C:\Users\Dominik\Desktop\Bewerbung
2017-02-23 01:29 - 2017-02-23 01:29 - 00081129 _____ C:\Users\Dominik\Downloads\Laborsprechstunde_01_17.pdf
2017-02-12 22:16 - 2017-02-12 22:16 - 00056009 _____ C:\Users\Dominik\Downloads\Studienverlaufsbescheinigung (2).pdf
2017-02-12 22:16 - 2017-02-12 22:16 - 00055203 _____ C:\Users\Dominik\Downloads\Zahlungen_an_FHDO.pdf
2017-02-10 02:16 - 2017-02-10 02:16 - 96397262 _____ C:\Users\Dominik\Downloads\ESX-0.9.8_r1002_x64.zip
2017-02-10 02:14 - 2017-02-10 02:14 - 13286592 _____ (MEGA Limited) C:\Users\Dominik\Downloads\MEGAsyncSetup.exe
2017-02-06 22:27 - 2017-02-06 22:27 - 02551888 _____ (Skillbrains ) C:\Users\Dominik\Downloads\setup-lightshot.exe
2017-02-06 22:27 - 2017-02-06 22:27 - 00000424 _____ C:\Users\Dominik\AppData\Local\UserProducts.xml
2017-02-06 22:27 - 2017-02-06 22:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lightshot
2017-02-06 22:27 - 2017-02-06 22:27 - 00000000 ____D C:\Program Files (x86)\Skillbrains
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2017-02-27 15:52 - 2016-08-21 16:45 - 00000000 ____D C:\Program Files (x86)\Overwatch
2017-02-27 15:50 - 2016-08-21 16:33 - 00000000 ____D C:\Users\Dominik\AppData\Local\Battle.net
2017-02-27 15:37 - 2016-08-21 12:53 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-02-27 15:27 - 2016-08-26 00:24 - 00091584 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2017-02-27 14:53 - 2016-12-07 18:30 - 00000000 ____D C:\Program Files (x86)\Overwatch Test
2017-02-27 13:50 - 2016-08-21 16:04 - 00000000 ____D C:\Program Files (x86)\Battle.net
2017-02-27 13:50 - 2016-08-21 03:57 - 00000000 ____D C:\Users\Dominik
2017-02-27 13:29 - 2016-08-21 04:38 - 02677024 _____ C:\WINDOWS\system32\perfh007.dat
2017-02-27 13:29 - 2016-08-21 04:38 - 00716356 _____ C:\WINDOWS\system32\perfc007.dat
2017-02-27 13:29 - 2016-08-21 04:02 - 00005662 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-02-27 13:23 - 2016-08-26 00:25 - 00251848 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-02-27 13:23 - 2016-08-26 00:24 - 00043968 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2017-02-27 13:23 - 2016-08-21 12:54 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-02-27 02:21 - 2016-08-21 12:54 - 00065536 _____ C:\WINDOWS\system32\spu_storage.bin
2017-02-27 02:21 - 2016-08-21 04:33 - 00524288 _____ C:\WINDOWS\system32\config\BBI
2017-02-27 00:28 - 2016-08-26 00:29 - 00000000 ____D C:\AdwCleaner
2017-02-27 00:17 - 2016-08-26 00:24 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-02-26 20:14 - 2016-08-21 04:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-02-26 18:59 - 2016-11-15 16:19 - 00000000 ____D C:\Users\Dominik\Desktop\Spiele
2017-02-26 10:12 - 2016-09-19 13:59 - 00000000 ____D C:\Users\Dominik\AppData\Local\Spotify
2017-02-26 08:57 - 2016-09-19 13:59 - 00000000 ____D C:\Users\Dominik\AppData\Roaming\Spotify
2017-02-25 13:33 - 2016-08-21 04:36 - 00000000 ___HD C:\Program Files\WindowsApps
2017-02-25 09:01 - 2016-08-21 04:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2017-02-25 09:00 - 2016-10-06 19:27 - 00048584 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avusbflt.sys
2017-02-25 09:00 - 2016-08-21 04:05 - 00163976 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2017-02-25 09:00 - 2016-08-21 04:05 - 00161824 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2017-02-25 09:00 - 2016-08-21 04:05 - 00088488 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avnetflt.sys
2017-02-25 09:00 - 2016-08-21 04:05 - 00044488 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avkmgr.sys
2017-02-24 00:22 - 2016-08-22 14:12 - 00000000 ____D C:\WINDOWS\system32\MRT
2017-02-24 00:21 - 2016-08-22 14:12 - 138020592 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-02-22 21:58 - 2016-12-17 21:58 - 00000000 ____D C:\Program Files (x86)\Overwolf
2017-02-22 15:03 - 2016-08-21 04:33 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-02-21 23:39 - 2016-12-09 19:07 - 00003294 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2
2017-02-21 23:39 - 2016-08-21 03:58 - 00002393 _____ C:\Users\Dominik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-02-21 23:39 - 2016-08-21 03:58 - 00000000 ___RD C:\Users\Dominik\OneDrive
2017-02-21 21:46 - 2016-08-21 03:57 - 00000000 ____D C:\Users\Dominik\AppData\Local\Packages
2017-02-18 21:39 - 2016-08-21 04:03 - 00000000 ____D C:\ProgramData\Package Cache
2017-02-10 23:33 - 2016-08-21 04:35 - 00000000 ____D C:\WINDOWS\INF
2017-02-06 23:04 - 2016-08-21 03:59 - 00002264 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-02-06 20:48 - 2016-08-21 04:37 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-02-06 20:48 - 2016-08-21 04:37 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2017-01-13 02:19 - 2017-01-13 02:19 - 0000838 _____ () C:\Users\Dominik\AppData\Local\recently-used.xbel
2017-02-06 22:27 - 2017-02-06 22:27 - 0000003 _____ () C:\Users\Dominik\AppData\Local\updater.log
2017-02-06 22:27 - 2017-02-06 22:27 - 0000424 _____ () C:\Users\Dominik\AppData\Local\UserProducts.xml
2016-08-21 12:54 - 2016-08-21 12:54 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
==================== Bamital & volsnap ======================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2017-02-26 13:25
==================== Ende von FRST.txt ============================
Addition.txt : Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 26-02-2017
durchgeführt von Dominik (27-02-2017 15:56:12)
Gestartet von C:\Users\Dominik\Desktop
Windows 10 Pro Version 1607 (X64) (2016-08-21 02:56:42)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-2232720161-2271080761-1308937938-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-2232720161-2271080761-1308937938-503 - Limited - Disabled)
defaultuser0 (S-1-5-21-2232720161-2271080761-1308937938-1000 - Limited - Disabled) => C:\Users\defaultuser0
Dominik (S-1-5-21-2232720161-2271080761-1308937938-1001 - Administrator - Enabled) => C:\Users\Dominik
Gast (S-1-5-21-2232720161-2271080761-1308937938-501 - Limited - Disabled)
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Avira Antivirus (Enabled - Up to date) {B3F630BD-538D-1B4A-14FA-14B63235278F}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes (Disabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Avira Antivirus (Enabled - Up to date) {0897D159-75B7-14C4-2E4A-2FC449B26D32}
AS: Malwarebytes (Disabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
AMD Install Manager (HKLM\...\AMD Catalyst Install Manager) (Version: 9.0.000.4 - Advanced Micro Devices, Inc.)
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.25.154 - Avira Operations GmbH & Co. KG)
Avira Connect (HKLM-x32\...\{845380e2-f0b5-4584-bc40-cc54345b3c06}) (Version: 1.2.77.41287 - Avira Operations GmbH & Co. KG)
Avira Connect (x32 Version: 1.2.77.41287 - Avira Operations GmbH & Co. KG) Hidden
Brawlhalla (HKLM\...\Steam App 291550) (Version: - Blue Mammoth Games)
Catalyst Control Center Next Localization BR (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization BR (Version: 2016.1123.1856.34070 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (Version: 2016.1123.1856.34070 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (Version: 2016.1123.1856.34070 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (Version: 2016.1123.1856.34070 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (Version: 2016.1123.1856.34070 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (Version: 2016.1123.1856.34070 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (Version: 2016.1123.1856.34070 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (Version: 2016.1123.1856.34070 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (Version: 2016.1123.1856.34070 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (Version: 2016.1123.1856.34070 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (Version: 2016.1123.1856.34070 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (Version: 2016.1123.1856.34070 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (Version: 2016.1123.1856.34070 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (Version: 2016.1123.1856.34070 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (Version: 2016.1123.1856.34070 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (Version: 2016.1123.1856.34070 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (Version: 2016.1123.1856.34070 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (Version: 2016.1123.1856.34070 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (Version: 2016.1123.1856.34070 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (Version: 2016.1123.1856.34070 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (Version: 2016.1123.1856.34070 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.24 - Piriform)
Chaos on Deponia (HKLM\...\Steam App 220740) (Version: - Daedalic Entertainment)
Counter-Strike: Global Offensive (HKLM\...\Steam App 730) (Version: - Valve)
Dark Souls: Prepare to Die Edition (HKLM\...\Steam App 211420) (Version: - FromSoftware)
DARK SOULS™ II: Scholar of the First Sin (HKLM\...\Steam App 335300) (Version: - FromSoftware, Inc)
Deponia (HKLM\...\Steam App 214340) (Version: - Daedalic Entertainment)
Discord (HKU\S-1-5-21-2232720161-2271080761-1308937938-1001\...\Discord) (Version: 0.0.297 - Hammer & Chisel, Inc.)
FINAL FANTASY X/X-2 HD Remaster (HKLM\...\Steam App 359870) (Version: - SQUARE ENIX)
GIMP 2.8.18 (HKLM\...\GIMP-2_is1) (Version: 2.8.18 - The GIMP Team)
Goodbye Deponia (HKLM\...\Steam App 241910) (Version: - Daedalic Entertainment)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 56.0.2924.87 - Google Inc.)
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
League of Legends (HKLM-x32\...\League of Legends 4.1.2) (Version: 4.1.2 - Riot Games)
League of Legends (x32 Version: 4.1.2 - Riot Games) Hidden
Left 4 Dead 2 (HKLM\...\Steam App 550) (Version: - Valve)
Life Is Strange™ (HKLM\...\Steam App 319630) (Version: - DONTNOD Entertainment)
Lightshot-5.4.0.1 (HKLM-x32\...\{30A5B3C9-2084-4063-A32A-628A98DE512B}_is1) (Version: 5.4.0.1 - Skillbrains)
Malwarebytes Version 3.0.6.1469 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.0.6.1469 - Malwarebytes)
Microsoft Office 365 ProPlus - de-de (HKLM\...\O365ProPlusRetail - de-de) (Version: 16.0.7571.2109 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2232720161-2271080761-1308937938-1001\...\OneDriveSetup.exe) (Version: 17.3.6798.0207 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24212 (HKLM-x32\...\{323dad84-0974-4d90-a1c1-e006c7fdbb7d}) (Version: 14.0.24212.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24212 (HKLM-x32\...\{462f63a8-6347-4894-a1b3-dbfe3a4c981d}) (Version: 14.0.24212.0 - Microsoft Corporation)
Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}) (Version: 1.20.146.0 - Microsoft)
Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
NVIDIA PhysX (HKLM-x32\...\{B455E95A-B804-439F-B533-336B1635AE97}) (Version: 9.14.0702 - NVIDIA Corporation)
OBS Studio (HKLM-x32\...\OBS Studio) (Version: 17.0.0 - OBS Project)
Office 16 Click-to-Run Extensibility Component (x32 Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (x32 Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Overwatch (HKLM-x32\...\Overwatch) (Version: - Blizzard Entertainment)
Overwatch Test (HKLM-x32\...\Overwatch Test) (Version: - Blizzard Entertainment)
Overwolf (HKLM-x32\...\Overwolf) (Version: 0.102.217.0 - Overwolf Ltd.)
Pokemon Showdown (HKLM-x32\...\Pokemon Showdown) (Version: - "Pokemon Showdown")
Portal 2 (HKLM\...\Steam App 620) (Version: - Valve)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7335 - Realtek Semiconductor Corp.)
Rocket League (HKLM\...\Steam App 252950) (Version: - Psyonix, Inc.)
Skype™ 7.30 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.30.105 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-2232720161-2271080761-1308937938-1001\...\Spotify) (Version: 1.0.49.125.g72ee7853 - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Super Meat Boy (HKLM\...\Steam App 40800) (Version: - Team Meat)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.19 - TeamSpeak Systems GmbH)
The Binding of Isaac: Rebirth (HKLM\...\Steam App 250900) (Version: - Nicalis, Inc.)
Trine 2 (HKLM\...\Steam App 35720) (Version: - Frozenbyte)
Vulkan Run Time Libraries 1.0.26.0 (HKLM\...\VulkanRT1.0.26.0) (Version: 1.0.26.0 - LunarG, Inc.)
WinRAR 5.40 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
Worms Ultimate Mayhem (HKLM\...\Steam App 70600) (Version: - Team17 Digital Ltd)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {019FCD0F-8CC3-42BF-BF72-B89D7BD2A16A} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2016-12-29] (Microsoft Corporation)
Task: {03D8DC5E-DA31-4701-B326-8063E5346C22} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2016-12-29] (Microsoft Corporation)
Task: {23816B94-B2C2-4107-9A7B-3F8BCA4B50B9} - System32\Tasks\Overwolf Updater Task => C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [2017-02-20] (Overwolf LTD)
Task: {3B0BF889-B74F-45E8-B721-1D6268B9B76D} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-12-28] (Microsoft Corporation)
Task: {3F14E971-65B2-453E-BC81-61A12B7FDF41} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-11-07] (Piriform Ltd)
Task: {43FE854D-6665-40D2-AD22-667BC1A488E9} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-12-28] (Microsoft Corporation)
Task: {7A7D7AA2-DE7C-483C-AA7C-264A44FB66ED} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-08-21] (Google Inc.)
Task: {9CCC4F66-925B-49CF-972B-0FE9C38493F0} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2016-12-29] (Microsoft Corporation)
Task: {C19A89E9-637B-4432-87B4-9D77E1DAD413} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-08-21] (Google Inc.)
Task: {E736DE31-DE78-4FF8-92DC-1C66F9132FEE} - System32\Tasks\AMD Updater => C:\Program Files\AMD\CIM\\Bin64\InstallManagerApp.exe [2016-11-23] (Advanced Micro Devices, Inc.)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2016-07-16 12:42 - 2016-07-16 12:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-12-14 14:11 - 2016-12-09 11:29 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-08-21 12:54 - 2014-01-28 04:16 - 00936728 _____ () C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe
2016-12-14 14:11 - 2016-12-09 11:29 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2016-09-14 20:36 - 2016-09-07 05:56 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-11 15:53 - 2016-12-21 08:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 00014336 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick.2\qtquick2plugin.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 00739840 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Controls\qtquickcontrolsplugin.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 00014336 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Window.2\windowplugin.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 00071168 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Layouts\qquicklayoutsplugin.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 00011776 _____ () C:\Program Files\AMD\CNext\CNext\libEGL.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 02013696 _____ () C:\Program Files\AMD\CNext\CNext\libGLESv2.dll
2016-11-07 21:27 - 2016-11-07 21:27 - 00061440 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2017-02-22 17:40 - 2017-02-22 17:40 - 00073728 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-02-22 17:40 - 2017-02-22 17:40 - 00179712 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-02-22 17:40 - 2017-02-22 17:41 - 42895360 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-02-06 16:24 - 2017-02-06 16:24 - 02215424 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\roottools.dll
2017-02-06 23:04 - 2017-02-01 10:47 - 02459992 _____ () C:\Program Files (x86)\Google\Chrome\Application\56.0.2924.87\libglesv2.dll
2017-02-06 23:04 - 2017-02-01 10:47 - 00099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\56.0.2924.87\libegl.dll
2017-01-11 15:52 - 2016-12-21 07:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-11 15:52 - 2016-12-21 07:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-11 15:52 - 2016-12-21 07:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-11 15:52 - 2016-12-21 07:48 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2017-01-11 15:52 - 2016-12-21 07:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-11 15:52 - 2016-12-21 07:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-08-21 12:54 - 2017-02-27 13:23 - 00035472 _____ () C:\Program Files (x86)\ASUS\AXSP\1.02.00\PEbiosinterface32.dll
2016-08-21 12:54 - 2014-01-28 04:16 - 00104448 _____ () C:\Program Files (x86)\ASUS\AXSP\1.02.00\ATKEX.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\91524088.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\91524088.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2016-08-21 04:36 - 2016-08-21 04:35 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-2232720161-2271080761-1308937938-1001\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\web\wallpaper\Windows\img0.jpg
DNS Servers: 192.168.2.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [TCP Query User{A4C2C0C5-B89B-4731-9C86-FCB40A43A7B7}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [UDP Query User{544231A1-35DD-416F-AF5A-4CC11421FBE8}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [TCP Query User{5C1441E0-D9F3-40D1-9CDA-DBC49A6D2E5B}C:\users\dominik\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\dominik\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{8C4AD3CF-2847-48C8-8F3A-F1A33BE02559}C:\users\dominik\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\dominik\appdata\roaming\spotify\spotify.exe
FirewallRules: [{FB26BED0-D6E2-4372-B14F-6DE7C141FECA}] => (Allow) E:\Steam\Steam.exe
FirewallRules: [{E1531A2B-759B-4D8F-A2E0-DBFEA1A243A1}] => (Allow) E:\Steam\Steam.exe
FirewallRules: [{2E476B42-9B88-4929-8FEF-E1FFDB26834B}] => (Allow) E:\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{479B7F40-F5B7-4481-BCDA-1F8CB2DD3FC0}] => (Allow) E:\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{A46B6FFB-ACB2-4E3A-BCEE-423C6156E880}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{0A79EAE6-5FCD-4EB5-B508-24CFDAC1293A}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{2937A093-A1E6-44AA-8C69-CE6E73E4DB19}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [TCP Query User{89485249-225D-46A9-8A01-EAB944F6D867}E:\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) E:\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{5A7B028E-3189-4CEF-B61B-8CC0876E0751}E:\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) E:\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{0E49157D-0299-40B9-BAF5-F60E96A9005F}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{89581B83-155F-4B89-B8C2-1CE10C26C8A4}C:\program files (x86)\overwatch\overwatch.exe] => (Allow) C:\program files (x86)\overwatch\overwatch.exe
FirewallRules: [UDP Query User{2DB0D51B-2EFA-48FD-93E1-81AFB266A19A}C:\program files (x86)\overwatch\overwatch.exe] => (Allow) C:\program files (x86)\overwatch\overwatch.exe
FirewallRules: [{C2599AE3-63C8-46E7-AA27-EE3887F15710}] => (Allow) E:\Steam\steamapps\common\Dark Souls II Scholar of the First Sin\Game\DarkSoulsII.exe
FirewallRules: [{11A224CE-10E6-45EE-87EA-4FF35ED87734}] => (Allow) E:\Steam\steamapps\common\Dark Souls II Scholar of the First Sin\Game\DarkSoulsII.exe
FirewallRules: [{2D322769-21A7-4099-AEFE-46610E3ABB22}] => (Allow) E:\Steam\steamapps\common\Super Meat Boy\SuperMeatBoy.exe
FirewallRules: [{35EDB70B-3F97-47AA-835E-A81DD994F803}] => (Allow) E:\Steam\steamapps\common\Super Meat Boy\SuperMeatBoy.exe
FirewallRules: [{0E8185BF-4AD6-49F9-BC85-DDB15E8A30FF}] => (Allow) E:\Steam\steamapps\common\Portal 2\portal2.exe
FirewallRules: [{70C6B4E5-E9C6-4204-8309-5AB126D204FD}] => (Allow) E:\Steam\steamapps\common\Portal 2\portal2.exe
FirewallRules: [TCP Query User{3435C09F-DA17-40ED-B1D8-06395CCC8C3F}C:\program files (x86)\overwatch test\overwatch.exe] => (Allow) C:\program files (x86)\overwatch test\overwatch.exe
FirewallRules: [UDP Query User{A0838C46-41A2-4F72-B7BD-DE449232B09F}C:\program files (x86)\overwatch test\overwatch.exe] => (Allow) C:\program files (x86)\overwatch test\overwatch.exe
FirewallRules: [{689F8CB7-560A-4943-A8BC-875317690D0D}] => (Allow) E:\Steam\steamapps\common\Deponia\deponia.exe
FirewallRules: [{8D0A2B88-F628-44E3-B61B-6E42C0DAA1F1}] => (Allow) E:\Steam\steamapps\common\Deponia\deponia.exe
FirewallRules: [{18B323EC-3080-48DB-A4EA-692CEEDC69D4}] => (Allow) E:\Steam\steamapps\common\Deponia\VisionaireConfigurationTool.exe
FirewallRules: [{25560F78-041D-4DB0-9A96-4AE3023FE800}] => (Allow) E:\Steam\steamapps\common\Deponia\VisionaireConfigurationTool.exe
FirewallRules: [{7B4AF88A-8C6A-4641-A37E-391D4F34604A}] => (Allow) E:\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{4E183DAF-F4B3-472D-9BCA-A096E21677B4}] => (Allow) E:\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{AC43E22C-2007-4D66-9F7E-4F2CFB9382B5}] => (Allow) E:\Steam\steamapps\common\Chaos on Deponia\deponia2.exe
FirewallRules: [{27AED0DB-66FD-4F4F-9422-E4B38077F621}] => (Allow) E:\Steam\steamapps\common\Chaos on Deponia\deponia2.exe
FirewallRules: [{3EDA78E4-EB41-43EF-A5B8-D37E6535343A}] => (Allow) E:\Steam\steamapps\common\Chaos on Deponia\VisionaireConfigurationTool.exe
FirewallRules: [{6D52595E-1688-4F3D-A799-7E17348A659A}] => (Allow) E:\Steam\steamapps\common\Chaos on Deponia\VisionaireConfigurationTool.exe
FirewallRules: [{EAA1C14C-31D8-46A9-86A3-D7DBF27C5DF8}] => (Allow) E:\Steam\steamapps\common\Goodbye Deponia\deponia3.exe
FirewallRules: [{22E61544-F73A-47AC-9144-098C4037035E}] => (Allow) E:\Steam\steamapps\common\Goodbye Deponia\deponia3.exe
FirewallRules: [{6FEE6000-CD58-4108-B4BE-8CCCB5391E8F}] => (Allow) E:\Steam\steamapps\common\Goodbye Deponia\VisionaireConfigurationTool.exe
FirewallRules: [{6616EEBB-9EF2-422E-88AB-B80407A5AAEB}] => (Allow) E:\Steam\steamapps\common\Goodbye Deponia\VisionaireConfigurationTool.exe
FirewallRules: [{9A4C0752-E28B-4E7C-9AC4-4B28905AFAAA}] => (Allow) E:\Steam\steamapps\common\Dark Souls Prepare to Die Edition\DATA\DARKSOULS.exe
FirewallRules: [{8DEF61B0-DAB1-401E-AD11-2847FB478321}] => (Allow) E:\Steam\steamapps\common\Dark Souls Prepare to Die Edition\DATA\DARKSOULS.exe
FirewallRules: [{F1BF84C4-79F1-463E-AB33-7DE06EDD1861}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{7D97CB9D-085D-4937-A5FE-93F2340213B0}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{6D7CF63B-F03D-4ED8-B207-9DE4DF5F3199}] => (Allow) E:\Steam\steamapps\common\Trine 2\trine2_launcher.exe
FirewallRules: [{E5C68D54-A5A7-4CF0-870E-84CFCBAB3300}] => (Allow) E:\Steam\steamapps\common\Trine 2\trine2_launcher.exe
FirewallRules: [TCP Query User{26A9B01A-2025-454F-827A-7919964910AC}E:\steam\steamapps\common\trine 2\trine2_32bit.exe] => (Allow) E:\steam\steamapps\common\trine 2\trine2_32bit.exe
FirewallRules: [UDP Query User{B85C5D0D-9FEB-445F-AC4D-9F2A37F79B9B}E:\steam\steamapps\common\trine 2\trine2_32bit.exe] => (Allow) E:\steam\steamapps\common\trine 2\trine2_32bit.exe
FirewallRules: [{E9BFCFA5-FE29-43FF-8E14-93BB37711884}] => (Allow) E:\Steam\steamapps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [{3892A1BF-07B4-4FE6-8E9D-F13CECD7F2F4}] => (Allow) E:\Steam\steamapps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [{184C120F-7AA8-4B10-93E0-F07D9EB1D08F}] => (Allow) E:\Steam\steamapps\common\WormsXHD\Launcher.exe
FirewallRules: [{83F7B8A3-C048-4BB3-82A5-FAFE78DA26FC}] => (Allow) E:\Steam\steamapps\common\WormsXHD\Launcher.exe
FirewallRules: [{AB74D884-C207-4791-985A-2CB486E85E95}] => (Allow) E:\Steam\steamapps\common\Life Is Strange\Binaries\Win32\LifeIsStrange.exe
FirewallRules: [{7C47301D-48C3-4D11-9732-691B4E4EFE1E}] => (Allow) E:\Steam\steamapps\common\Life Is Strange\Binaries\Win32\LifeIsStrange.exe
FirewallRules: [{A8584053-F5ED-4385-A235-DC14A54D8748}] => (Allow) E:\Steam\steamapps\common\FINAL FANTASY FFX&FFX-2 HD Remaster\FFX&X-2_LAUNCHER.exe
FirewallRules: [{BF0E1F54-737A-4497-9DDD-6C720CB536DB}] => (Allow) E:\Steam\steamapps\common\FINAL FANTASY FFX&FFX-2 HD Remaster\FFX&X-2_LAUNCHER.exe
FirewallRules: [{8C774F04-A688-413D-B555-36D8593376A3}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{76CB4ABB-5D4D-4A88-ACEF-369522B305EA}] => (Allow) E:\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{CEB849EA-03EC-4536-81CC-93D17A90AA5F}] => (Allow) E:\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{AE680A41-61A9-4EB7-A96B-D653823A0BF6}] => (Allow) E:\Steam\steamapps\common\Brawlhalla\Brawlhalla.exe
FirewallRules: [{D534F81A-5A3E-4DE7-9E9E-6F70E60D8BC6}] => (Allow) E:\Steam\steamapps\common\Brawlhalla\Brawlhalla.exe
==================== Wiederherstellungspunkte =========================
10-02-2017 19:13:16 Geplanter Prüfpunkt
18-02-2017 21:39:05 Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24212
22-02-2017 15:03:00 Windows Update
27-02-2017 00:31:54 JRT Pre-Junkware Removal
==================== Fehlerhafte Geräte im Gerätemanager =============
Name: AMD High Definition Audio Device
Description: AMD High Definition Audio Device
Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}
Manufacturer: Advanced Micro Devices
Service: AtiHDAudioService
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (02/27/2017 12:34:11 AM) (Source: ATIeRecord) (EventID: 16387) (User: )
Description: ATI EEU Service event error
Error: (02/27/2017 12:32:12 AM) (Source: ATIeRecord) (EventID: 16387) (User: )
Description: ATI EEU Service event error
Error: (02/27/2017 12:31:55 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
System Error:
Zugriff verweigert
.
Error: (02/27/2017 12:18:14 AM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe.Manifest". Fehler in Manifest- oder Richtliniendatei "C:\Program Files (x86)\Microsoft Office\root\Office16\UccApi.DLL" in Zeile 1.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0".
Definition: UccApi,processorArchitecture="x86",type="win32",version="16.0.0.0".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (02/24/2017 12:22:41 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: Die Open-Prozedur für den Dienst "BITS" in der DLL "C:\Windows\System32\bitsperf.dll" war nicht erfolgreich. Die Leistungsdaten für diesen Dienst sind nicht verfügbar. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Fehlercode.
Error: (02/22/2017 03:03:01 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
System Error:
Zugriff verweigert
.
Error: (02/18/2017 09:39:52 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe.Manifest". Fehler in Manifest- oder Richtliniendatei "C:\Program Files (x86)\Microsoft Office\root\Office16\UccApi.DLL" in Zeile 1.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0".
Definition: UccApi,processorArchitecture="x86",type="win32",version="16.0.0.0".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (02/18/2017 09:39:06 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
System Error:
Zugriff verweigert
.
Error: (02/16/2017 02:35:34 PM) (Source: ATIeRecord) (EventID: 16387) (User: )
Description: ATI EEU Service event error
Error: (02/15/2017 03:19:30 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-PBJTD4R)
Description: Bei der Aktivierung der App „Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy!App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Systemfehler:
=============
Error: (02/27/2017 01:38:22 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
und der APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (02/27/2017 02:20:54 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
und der APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (02/27/2017 12:37:47 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
und der APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (02/27/2017 12:37:10 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
und der APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (02/27/2017 12:28:35 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Dienst konnte wegen einer fehlerhaften Anmeldung nicht gestartet werden.
Error: (02/27/2017 12:28:35 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "WSearch" konnte sich nicht als "NT AUTHORITY\SYSTEM" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
Die Anforderung wird nicht unterstützt.
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (02/27/2017 12:28:30 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
und der APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (02/27/2017 12:28:08 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Volumeschattenkopie" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (02/27/2017 12:28:07 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (02/27/2017 12:28:07 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "SCP DS3 Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
CodeIntegrity:
===================================
Date: 2016-12-25 17:51:39.335
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Program Files (x86)\Overwolf\0.100.227.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i5-4460 CPU @ 3.20GHz
Prozentuale Nutzung des RAM: 33%
Installierter physikalischer RAM: 8135.23 MB
Verfügbarer physikalischer RAM: 5447.87 MB
Summe virtueller Speicher: 9415.23 MB
Verfügbarer virtueller Speicher: 6285.11 MB
==================== Laufwerke ================================
Drive c: () (Fixed) (Total:238.37 GB) (Free:159.52 GB) NTFS
Drive e: (Volume) (Fixed) (Total:931.51 GB) (Free:795.39 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 24792777)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=42)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: 0EE9FFDF)
Partition 1: (Not Active) - (Size=993 KB) - (Type=42)
Partition 2: (Active) - (Size=100 MB) - (Type=42)
Partition 3: (Not Active) - (Size=238.4 GB) - (Type=42)
Partition 4: (Not Active) - (Size=344 KB) - (Type=42)
==================== Ende von Addition.txt ============================
tdskiller Report : Code:
16:02:27.0992 0x20a0 TDSS rootkit removing tool 3.1.0.12 Nov 7 2016 07:10:01
16:02:34.0289 0x20a0 ============================================================
16:02:34.0289 0x20a0 Current date / time: 2017/02/27 16:02:34.0289
16:02:34.0289 0x20a0 SystemInfo:
16:02:34.0289 0x20a0
16:02:34.0289 0x20a0 OS Version: 10.0.14393 ServicePack: 0.0
16:02:34.0289 0x20a0 Product type: Workstation
16:02:34.0289 0x20a0 ComputerName: DESKTOP-PBJTD4R
16:02:34.0289 0x20a0 UserName: Dominik
16:02:34.0289 0x20a0 Windows directory: C:\WINDOWS
16:02:34.0289 0x20a0 System windows directory: C:\WINDOWS
16:02:34.0289 0x20a0 Running under WOW64
16:02:34.0289 0x20a0 Processor architecture: Intel x64
16:02:34.0289 0x20a0 Number of processors: 4
16:02:34.0289 0x20a0 Page size: 0x1000
16:02:34.0289 0x20a0 Boot type: Normal boot
16:02:34.0289 0x20a0 CodeIntegrityOptions = 0x00000001
16:02:34.0289 0x20a0 ============================================================
16:02:34.0399 0x20a0 KLMD registered as C:\WINDOWS\system32\drivers\26298959.sys
16:02:34.0399 0x20a0 KLMD ARK init status: drvProperties = 0xFFF00, osBuild = 14393.693, osProperties = 0x19
16:02:34.0446 0x20a0 System UUID: {76820634-FD89-EC2E-A830-2DFF9716F0BD}
16:02:34.0696 0x20a0 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
16:02:34.0696 0x20a0 Drive \Device\Harddisk1\DR1 - Size: 0x3B9E656000 ( 238.47 Gb ), SectorSize: 0x200, Cylinders: 0x799A, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
16:02:34.0696 0x20a0 ============================================================
16:02:34.0696 0x20a0 \Device\Harddisk0\DR0:
16:02:34.0883 0x20a0 MBR partitions:
16:02:34.0883 0x20a0 \Device\Harddisk1\DR1:
16:02:34.0883 0x20a0 MBR partitions:
16:02:34.0883 0x20a0 Initialize success
16:02:34.0883 0x20a0 ============================================================
16:03:14.0356 0x0d40 ============================================================
16:03:14.0356 0x0d40 Scan started
16:03:14.0356 0x0d40 Mode: Manual; SigCheck; TDLFS;
16:03:14.0356 0x0d40 ============================================================
16:03:14.0356 0x0d40 KSN ping started
16:03:14.0559 0x0d40 KSN ping finished: true
16:03:14.0778 0x0d40 ================ Scan system memory ========================
16:03:14.0778 0x0d40 System memory - ok
16:03:14.0778 0x0d40 ================ Scan services =============================
16:03:14.0793 0x0d40 1394ohci - ok
16:03:14.0809 0x0d40 3ware - ok
16:03:14.0809 0x0d40 ACPI - ok
16:03:14.0809 0x0d40 AcpiDev - ok
16:03:14.0809 0x0d40 acpiex - ok
16:03:14.0825 0x0d40 acpipagr - ok
16:03:14.0825 0x0d40 AcpiPmi - ok
16:03:14.0825 0x0d40 acpitime - ok
16:03:14.0825 0x0d40 ADP80XX - ok
16:03:14.0825 0x0d40 AFD - ok
16:03:14.0840 0x0d40 ahcache - ok
16:03:14.0840 0x0d40 AJRouter - ok
16:03:14.0840 0x0d40 ALG - ok
16:03:14.0840 0x0d40 AMD External Events Utility - ok
16:03:14.0840 0x0d40 AmdK8 - ok
16:03:14.0840 0x0d40 amdkmafd - ok
16:03:14.0856 0x0d40 amdkmdag - ok
16:03:14.0856 0x0d40 amdkmdap - ok
16:03:14.0856 0x0d40 AmdPPM - ok
16:03:14.0856 0x0d40 amdsata - ok
16:03:14.0856 0x0d40 amdsbs - ok
16:03:14.0856 0x0d40 amdxata - ok
16:03:14.0856 0x0d40 AntiVirMailService - ok
16:03:14.0856 0x0d40 AntiVirSchedulerService - ok
16:03:14.0872 0x0d40 AntiVirService - ok
16:03:14.0872 0x0d40 AntiVirWebService - ok
16:03:14.0872 0x0d40 AppID - ok
16:03:14.0872 0x0d40 AppIDSvc - ok
16:03:14.0872 0x0d40 Appinfo - ok
16:03:14.0872 0x0d40 applockerfltr - ok
16:03:14.0872 0x0d40 AppMgmt - ok
16:03:14.0872 0x0d40 AppReadiness - ok
16:03:14.0872 0x0d40 AppVClient - ok
16:03:14.0887 0x0d40 AppvStrm - ok
16:03:14.0887 0x0d40 AppvVemgr - ok
16:03:14.0887 0x0d40 AppvVfs - ok
16:03:14.0887 0x0d40 AppXSvc - ok
16:03:14.0887 0x0d40 arcsas - ok
16:03:14.0887 0x0d40 asComSvc - ok
16:03:14.0887 0x0d40 AsIO - ok
16:03:14.0887 0x0d40 AsyncMac - ok
16:03:14.0903 0x0d40 atapi - ok
16:03:14.0903 0x0d40 AtiHDAudioService - ok
16:03:14.0903 0x0d40 AudioEndpointBuilder - ok
16:03:14.0903 0x0d40 Audiosrv - ok
16:03:14.0903 0x0d40 avgntflt - ok
16:03:14.0903 0x0d40 avipbb - ok
16:03:14.0903 0x0d40 Avira.ServiceHost - ok
16:03:14.0918 0x0d40 avkmgr - ok
16:03:14.0918 0x0d40 avnetflt - ok
16:03:14.0918 0x0d40 AxInstSV - ok
16:03:14.0918 0x0d40 b06bdrv - ok
16:03:14.0918 0x0d40 BasicDisplay - ok
16:03:14.0918 0x0d40 BasicRender - ok
16:03:14.0918 0x0d40 bcmfn - ok
16:03:14.0918 0x0d40 bcmfn2 - ok
16:03:14.0934 0x0d40 BDESVC - ok
16:03:14.0934 0x0d40 Beep - ok
16:03:14.0934 0x0d40 BFE - ok
16:03:14.0934 0x0d40 BITS - ok
16:03:14.0934 0x0d40 bowser - ok
16:03:14.0934 0x0d40 BrokerInfrastructure - ok
16:03:14.0934 0x0d40 Browser - ok
16:03:14.0934 0x0d40 BthAvrcpTg - ok
16:03:14.0950 0x0d40 BthHFEnum - ok
16:03:14.0950 0x0d40 bthhfhid - ok
16:03:14.0950 0x0d40 BthHFSrv - ok
16:03:14.0950 0x0d40 BTHMODEM - ok
16:03:14.0950 0x0d40 bthserv - ok
16:03:14.0950 0x0d40 buttonconverter - ok
16:03:14.0950 0x0d40 CapImg - ok
16:03:14.0950 0x0d40 cdfs - ok
16:03:14.0965 0x0d40 CDPSvc - ok
16:03:14.0965 0x0d40 CDPUserSvc - ok
16:03:14.0965 0x0d40 cdrom - ok
16:03:14.0965 0x0d40 CertPropSvc - ok
16:03:14.0965 0x0d40 cht4iscsi - ok
16:03:14.0965 0x0d40 cht4vbd - ok
16:03:14.0965 0x0d40 circlass - ok
16:03:14.0981 0x0d40 CLFS - ok
16:03:14.0981 0x0d40 ClickToRunSvc - ok
16:03:14.0981 0x0d40 ClipSVC - ok
16:03:14.0981 0x0d40 clreg - ok
16:03:14.0981 0x0d40 CmBatt - ok
16:03:14.0981 0x0d40 CNG - ok
16:03:14.0981 0x0d40 cnghwassist - ok
16:03:14.0997 0x0d40 CompositeBus - ok
16:03:14.0997 0x0d40 COMSysApp - ok
16:03:14.0997 0x0d40 condrv - ok
16:03:14.0997 0x0d40 CoreMessagingRegistrar - ok
16:03:14.0997 0x0d40 CryptSvc - ok
16:03:14.0997 0x0d40 CSC - ok
16:03:14.0997 0x0d40 CscService - ok
16:03:15.0012 0x0d40 dam - ok
16:03:15.0012 0x0d40 DcomLaunch - ok
16:03:15.0012 0x0d40 DcpSvc - ok
16:03:15.0012 0x0d40 defragsvc - ok
16:03:15.0012 0x0d40 DeviceAssociationService - ok
16:03:15.0012 0x0d40 DeviceInstall - ok
16:03:15.0012 0x0d40 DevQueryBroker - ok
16:03:15.0028 0x0d40 Dfsc - ok
16:03:15.0030 0x0d40 Dhcp - ok
16:03:15.0032 0x0d40 diagnosticshub.standardcollector.service - ok
16:03:15.0034 0x0d40 DiagTrack - ok
16:03:15.0036 0x0d40 disk - ok
16:03:15.0037 0x0d40 DmEnrollmentSvc - ok
16:03:15.0039 0x0d40 dmvsc - ok
16:03:15.0041 0x0d40 dmwappushservice - ok
16:03:15.0043 0x0d40 Dnscache - ok
16:03:15.0046 0x0d40 dot3svc - ok
16:03:15.0048 0x0d40 DPS - ok
16:03:15.0050 0x0d40 drmkaud - ok
16:03:15.0051 0x0d40 Ds3Service - ok
16:03:15.0051 0x0d40 DsmSvc - ok
16:03:15.0051 0x0d40 DsSvc - ok
16:03:15.0051 0x0d40 DXGKrnl - ok
16:03:15.0051 0x0d40 EapHost - ok
16:03:15.0051 0x0d40 ebdrv - ok
16:03:15.0051 0x0d40 EFS - ok
16:03:15.0051 0x0d40 EhStorClass - ok
16:03:15.0067 0x0d40 EhStorTcgDrv - ok
16:03:15.0067 0x0d40 embeddedmode - ok
16:03:15.0067 0x0d40 EntAppSvc - ok
16:03:15.0067 0x0d40 ErrDev - ok
16:03:15.0067 0x0d40 EventSystem - ok
16:03:15.0067 0x0d40 exfat - ok
16:03:15.0067 0x0d40 fastfat - ok
16:03:15.0067 0x0d40 Fax - ok
16:03:15.0082 0x0d40 fdc - ok
16:03:15.0082 0x0d40 fdPHost - ok
16:03:15.0082 0x0d40 FDResPub - ok
16:03:15.0082 0x0d40 fhsvc - ok
16:03:15.0082 0x0d40 FileCrypt - ok
16:03:15.0082 0x0d40 FileInfo - ok
16:03:15.0082 0x0d40 Filetrace - ok
16:03:15.0082 0x0d40 flpydisk - ok
16:03:15.0098 0x0d40 FltMgr - ok
16:03:15.0098 0x0d40 FontCache - ok
16:03:15.0098 0x0d40 FontCache3.0.0.0 - ok
16:03:15.0098 0x0d40 FrameServer - ok
16:03:15.0098 0x0d40 FsDepends - ok
16:03:15.0098 0x0d40 Fs_Rec - ok
16:03:15.0098 0x0d40 fvevol - ok
16:03:15.0098 0x0d40 gencounter - ok
16:03:15.0098 0x0d40 genericusbfn - ok
16:03:15.0114 0x0d40 GPIOClx0101 - ok
16:03:15.0114 0x0d40 gpsvc - ok
16:03:15.0114 0x0d40 GpuEnergyDrv - ok
16:03:15.0114 0x0d40 gupdate - ok
16:03:15.0114 0x0d40 gupdatem - ok
16:03:15.0114 0x0d40 Hamachi - ok
16:03:15.0114 0x0d40 HDAudBus - ok
16:03:15.0129 0x0d40 HidBatt - ok
16:03:15.0129 0x0d40 HidBth - ok
16:03:15.0129 0x0d40 hidi2c - ok
16:03:15.0129 0x0d40 hidinterrupt - ok
16:03:15.0129 0x0d40 HidIr - ok
16:03:15.0129 0x0d40 hidserv - ok
16:03:15.0129 0x0d40 HidUsb - ok
16:03:15.0129 0x0d40 HomeGroupListener - ok
16:03:15.0129 0x0d40 HomeGroupProvider - ok
16:03:15.0145 0x0d40 HpSAMD - ok
16:03:15.0145 0x0d40 HTTP - ok
16:03:15.0145 0x0d40 HvHost - ok
16:03:15.0145 0x0d40 hvservice - ok
16:03:15.0145 0x0d40 hwpolicy - ok
16:03:15.0145 0x0d40 hyperkbd - ok
16:03:15.0145 0x0d40 i8042prt - ok
16:03:15.0145 0x0d40 iagpio - ok
16:03:15.0160 0x0d40 iai2c - ok
16:03:15.0160 0x0d40 iaLPSS2i_GPIO2 - ok
16:03:15.0160 0x0d40 iaLPSS2i_I2C - ok
16:03:15.0160 0x0d40 iaLPSSi_GPIO - ok
16:03:15.0160 0x0d40 iaLPSSi_I2C - ok
16:03:15.0160 0x0d40 iaStorA - ok
16:03:15.0160 0x0d40 iaStorAV - ok
16:03:15.0160 0x0d40 iaStorV - ok
16:03:15.0176 0x0d40 ibbus - ok
16:03:15.0176 0x0d40 icssvc - ok
16:03:15.0176 0x0d40 IKEEXT - ok
16:03:15.0176 0x0d40 IndirectKmd - ok
16:03:15.0176 0x0d40 IntcAzAudAddService - ok
16:03:15.0176 0x0d40 intelide - ok
16:03:15.0176 0x0d40 intelpep - ok
16:03:15.0176 0x0d40 intelppm - ok
16:03:15.0192 0x0d40 iorate - ok
16:03:15.0192 0x0d40 IpFilterDriver - ok
16:03:15.0192 0x0d40 iphlpsvc - ok
16:03:15.0192 0x0d40 IPMIDRV - ok
16:03:15.0192 0x0d40 IPNAT - ok
16:03:15.0192 0x0d40 irda - ok
16:03:15.0192 0x0d40 IRENUM - ok
16:03:15.0192 0x0d40 irmon - ok
16:03:15.0207 0x0d40 isapnp - ok
16:03:15.0207 0x0d40 iScsiPrt - ok
16:03:15.0207 0x0d40 kbdclass - ok
16:03:15.0207 0x0d40 kbdhid - ok
16:03:15.0207 0x0d40 kdnic - ok
16:03:15.0207 0x0d40 KeyIso - ok
16:03:15.0207 0x0d40 KSecDD - ok
16:03:15.0207 0x0d40 KSecPkg - ok
16:03:15.0207 0x0d40 ksthunk - ok
16:03:15.0223 0x0d40 KtmRm - ok
16:03:15.0223 0x0d40 LanmanServer - ok
16:03:15.0223 0x0d40 LanmanWorkstation - ok
16:03:15.0223 0x0d40 lfsvc - ok
16:03:15.0223 0x0d40 LicenseManager - ok
16:03:15.0223 0x0d40 lltdio - ok
16:03:15.0223 0x0d40 lltdsvc - ok
16:03:15.0239 0x0d40 lmhosts - ok
16:03:15.0239 0x0d40 LSI_SAS - ok
16:03:15.0239 0x0d40 LSI_SAS2i - ok
16:03:15.0239 0x0d40 LSI_SAS3i - ok
16:03:15.0239 0x0d40 LSI_SSS - ok
16:03:15.0239 0x0d40 LSM - ok
16:03:15.0239 0x0d40 luafv - ok
16:03:15.0239 0x0d40 MapsBroker - ok
16:03:15.0254 0x0d40 MBAMService - ok
16:03:15.0254 0x0d40 megasas - ok
16:03:15.0254 0x0d40 megasas2i - ok
16:03:15.0254 0x0d40 megasr - ok
16:03:15.0254 0x0d40 MEIx64 - ok
16:03:15.0254 0x0d40 MessagingService - ok
16:03:15.0254 0x0d40 mlx4_bus - ok
16:03:15.0270 0x0d40 MMCSS - ok
16:03:15.0270 0x0d40 Modem - ok
16:03:15.0270 0x0d40 monitor - ok
16:03:15.0270 0x0d40 mouclass - ok
16:03:15.0270 0x0d40 mouhid - ok
16:03:15.0270 0x0d40 mountmgr - ok
16:03:15.0270 0x0d40 mpsdrv - ok
16:03:15.0270 0x0d40 MpsSvc - ok
16:03:15.0270 0x0d40 MRxDAV - ok
16:03:15.0285 0x0d40 mrxsmb - ok
16:03:15.0285 0x0d40 mrxsmb10 - ok
16:03:15.0285 0x0d40 mrxsmb20 - ok
16:03:15.0285 0x0d40 MsBridge - ok
16:03:15.0285 0x0d40 MSDTC - ok
16:03:15.0285 0x0d40 Msfs - ok
16:03:15.0285 0x0d40 msgpiowin32 - ok
16:03:15.0301 0x0d40 mshidkmdf - ok
16:03:15.0301 0x0d40 mshidumdf - ok
16:03:15.0301 0x0d40 msisadrv - ok
16:03:15.0301 0x0d40 MSiSCSI - ok
16:03:15.0301 0x0d40 msiserver - ok
16:03:15.0301 0x0d40 MSKSSRV - ok
16:03:15.0301 0x0d40 MsLldp - ok
16:03:15.0301 0x0d40 MSPCLOCK - ok
16:03:15.0317 0x0d40 MSPQM - ok
16:03:15.0317 0x0d40 MsRPC - ok
16:03:15.0317 0x0d40 MsSecFlt - ok
16:03:15.0317 0x0d40 mssmbios - ok
16:03:15.0317 0x0d40 MSTEE - ok
16:03:15.0317 0x0d40 MTConfig - ok
16:03:15.0317 0x0d40 Mup - ok
16:03:15.0332 0x0d40 mvumis - ok
16:03:15.0332 0x0d40 NativeWifiP - ok
16:03:15.0332 0x0d40 NcaSvc - ok
16:03:15.0332 0x0d40 NcbService - ok
16:03:15.0332 0x0d40 NcdAutoSetup - ok
16:03:15.0332 0x0d40 ndfltr - ok
16:03:15.0332 0x0d40 NDIS - ok
16:03:15.0332 0x0d40 NdisCap - ok
16:03:15.0348 0x0d40 NdisImPlatform - ok
16:03:15.0348 0x0d40 NdisTapi - ok
16:03:15.0348 0x0d40 Ndisuio - ok
16:03:15.0348 0x0d40 NdisVirtualBus - ok
16:03:15.0348 0x0d40 NdisWan - ok
16:03:15.0348 0x0d40 ndiswanlegacy - ok
16:03:15.0348 0x0d40 ndproxy - ok
16:03:15.0348 0x0d40 Ndu - ok
16:03:15.0364 0x0d40 NetAdapterCx - ok
16:03:15.0364 0x0d40 NetBIOS - ok
16:03:15.0364 0x0d40 NetBT - ok
16:03:15.0364 0x0d40 Netlogon - ok
16:03:15.0364 0x0d40 Netman - ok
16:03:15.0364 0x0d40 netprofm - ok
16:03:15.0364 0x0d40 NetSetupSvc - ok
16:03:15.0364 0x0d40 NetTcpPortSharing - ok
16:03:15.0379 0x0d40 NgcCtnrSvc - ok
16:03:15.0379 0x0d40 NgcSvc - ok
16:03:15.0379 0x0d40 NlaSvc - ok
16:03:15.0379 0x0d40 Npfs - ok
16:03:15.0379 0x0d40 npsvctrig - ok
16:03:15.0379 0x0d40 nsi - ok
16:03:15.0379 0x0d40 nsiproxy - ok
16:03:15.0395 0x0d40 NTFS - ok
16:03:15.0395 0x0d40 Null - ok
16:03:15.0395 0x0d40 nvraid - ok
16:03:15.0395 0x0d40 nvstor - ok
16:03:15.0395 0x0d40 OneSyncSvc - ok
16:03:15.0395 0x0d40 ose - ok
16:03:15.0395 0x0d40 OverwolfUpdater - ok
16:03:15.0395 0x0d40 p2pimsvc - ok
16:03:15.0410 0x0d40 p2psvc - ok
16:03:15.0410 0x0d40 Parport - ok
16:03:15.0410 0x0d40 partmgr - ok
16:03:15.0410 0x0d40 PcaSvc - ok
16:03:15.0410 0x0d40 pci - ok
16:03:15.0410 0x0d40 pciide - ok
16:03:15.0410 0x0d40 pcmcia - ok
16:03:15.0410 0x0d40 pcw - ok
16:03:15.0426 0x0d40 pdc - ok
16:03:15.0426 0x0d40 PEAUTH - ok
16:03:15.0426 0x0d40 PeerDistSvc - ok
16:03:15.0426 0x0d40 percsas2i - ok
16:03:15.0426 0x0d40 percsas3i - ok
16:03:15.0426 0x0d40 PerfHost - ok
16:03:15.0442 0x0d40 PhoneSvc - ok
16:03:15.0442 0x0d40 PimIndexMaintenanceSvc - ok
16:03:15.0442 0x0d40 pla - ok
16:03:15.0442 0x0d40 PlugPlay - ok
16:03:15.0442 0x0d40 PNRPAutoReg - ok
16:03:15.0442 0x0d40 PNRPsvc - ok
16:03:15.0442 0x0d40 PolicyAgent - ok
16:03:15.0457 0x0d40 Power - ok
16:03:15.0457 0x0d40 PptpMiniport - ok
16:03:15.0457 0x0d40 PrintNotify - ok
16:03:15.0457 0x0d40 Processor - ok
16:03:15.0457 0x0d40 ProfSvc - ok
16:03:15.0457 0x0d40 Psched - ok
16:03:15.0457 0x0d40 QWAVE - ok
16:03:15.0457 0x0d40 QWAVEdrv - ok
16:03:15.0473 0x0d40 RasAcd - ok
16:03:15.0473 0x0d40 RasAgileVpn - ok
16:03:15.0473 0x0d40 RasAuto - ok
16:03:15.0473 0x0d40 Rasl2tp - ok
16:03:15.0473 0x0d40 RasMan - ok
16:03:15.0473 0x0d40 RasPppoe - ok
16:03:15.0473 0x0d40 RasSstp - ok
16:03:15.0473 0x0d40 rdbss - ok
16:03:15.0489 0x0d40 rdpbus - ok
16:03:15.0489 0x0d40 RDPDR - ok
16:03:15.0489 0x0d40 RdpVideoMiniport - ok
16:03:15.0489 0x0d40 rdyboost - ok
16:03:15.0489 0x0d40 ReFSv1 - ok
16:03:15.0489 0x0d40 RemoteAccess - ok
16:03:15.0504 0x0d40 RemoteRegistry - ok
16:03:15.0504 0x0d40 RetailDemo - ok
16:03:15.0504 0x0d40 RmSvc - ok
16:03:15.0504 0x0d40 RpcEptMapper - ok
16:03:15.0504 0x0d40 RpcLocator - ok
16:03:15.0504 0x0d40 RpcSs - ok
16:03:15.0504 0x0d40 rspndr - ok
16:03:15.0504 0x0d40 RTL8167 - ok
16:03:15.0520 0x0d40 s3cap - ok
16:03:15.0520 0x0d40 SamSs - ok
16:03:15.0520 0x0d40 sbp2port - ok
16:03:15.0520 0x0d40 SCardSvr - ok
16:03:15.0520 0x0d40 ScDeviceEnum - ok
16:03:15.0520 0x0d40 scfilter - ok
16:03:15.0520 0x0d40 Schedule - ok
16:03:15.0520 0x0d40 scmbus - ok
16:03:15.0535 0x0d40 scmdisk0101 - ok
16:03:15.0535 0x0d40 SCPolicySvc - ok
16:03:15.0535 0x0d40 ScpVBus - ok
16:03:15.0535 0x0d40 sdbus - ok
16:03:15.0535 0x0d40 SDRSVC - ok
16:03:15.0535 0x0d40 sdstor - ok
16:03:15.0535 0x0d40 seclogon - ok
16:03:15.0551 0x0d40 SENS - ok
16:03:15.0551 0x0d40 Sense - ok
16:03:15.0551 0x0d40 SensorDataService - ok
16:03:15.0551 0x0d40 SensorService - ok
16:03:15.0551 0x0d40 SensrSvc - ok
16:03:15.0551 0x0d40 SerCx - ok
16:03:15.0551 0x0d40 SerCx2 - ok
16:03:15.0551 0x0d40 Serenum - ok
16:03:15.0567 0x0d40 Serial - ok
16:03:15.0567 0x0d40 sermouse - ok
16:03:15.0567 0x0d40 SessionEnv - ok
16:03:15.0567 0x0d40 sfloppy - ok
16:03:15.0567 0x0d40 SharedAccess - ok
16:03:15.0567 0x0d40 ShellHWDetection - ok
16:03:15.0567 0x0d40 shpamsvc - ok
16:03:15.0582 0x0d40 SiSRaid2 - ok
16:03:15.0582 0x0d40 SiSRaid4 - ok
16:03:15.0582 0x0d40 SkypeUpdate - ok
16:03:15.0582 0x0d40 smphost - ok
16:03:15.0582 0x0d40 SmsRouter - ok
16:03:15.0582 0x0d40 SNMPTRAP - ok
16:03:15.0582 0x0d40 spaceport - ok
16:03:15.0598 0x0d40 SpbCx - ok
16:03:15.0598 0x0d40 Spooler - ok
16:03:15.0598 0x0d40 sppsvc - ok
16:03:15.0598 0x0d40 srv - ok
16:03:15.0598 0x0d40 srv2 - ok
16:03:15.0598 0x0d40 srvnet - ok
16:03:15.0598 0x0d40 SSDPSRV - ok
16:03:15.0598 0x0d40 SstpSvc - ok
16:03:15.0614 0x0d40 StateRepository - ok
16:03:15.0614 0x0d40 Steam Client Service - ok
16:03:15.0614 0x0d40 stexstor - ok
16:03:15.0614 0x0d40 stisvc - ok
16:03:15.0614 0x0d40 storahci - ok
16:03:15.0614 0x0d40 storflt - ok
16:03:15.0614 0x0d40 stornvme - ok
16:03:15.0629 0x0d40 storqosflt - ok
16:03:15.0629 0x0d40 StorSvc - ok
16:03:15.0629 0x0d40 storufs - ok
16:03:15.0629 0x0d40 storvsc - ok
16:03:15.0629 0x0d40 svsvc - ok
16:03:15.0629 0x0d40 swenum - ok
16:03:15.0629 0x0d40 swprv - ok
16:03:15.0629 0x0d40 Synth3dVsc - ok
16:03:15.0645 0x0d40 SysMain - ok
16:03:15.0645 0x0d40 SystemEventsBroker - ok
16:03:15.0645 0x0d40 TabletInputService - ok
16:03:15.0645 0x0d40 TapiSrv - ok
16:03:15.0645 0x0d40 Tcpip - ok
16:03:15.0645 0x0d40 Tcpip6 - ok
16:03:15.0645 0x0d40 tcpipreg - ok
16:03:15.0660 0x0d40 tdx - ok
16:03:15.0660 0x0d40 terminpt - ok
16:03:15.0660 0x0d40 TermService - ok
16:03:15.0660 0x0d40 Themes - ok
16:03:15.0660 0x0d40 TieringEngineService - ok
16:03:15.0660 0x0d40 tiledatamodelsvc - ok
16:03:15.0660 0x0d40 TimeBrokerSvc - ok
16:03:15.0676 0x0d40 TPM - ok
16:03:15.0676 0x0d40 TrkWks - ok
16:03:15.0676 0x0d40 TrustedInstaller - ok
16:03:15.0676 0x0d40 tsusbflt - ok
16:03:15.0676 0x0d40 TsUsbGD - ok
16:03:15.0676 0x0d40 tsusbhub - ok
16:03:15.0676 0x0d40 tunnel - ok
16:03:15.0676 0x0d40 tzautoupdate - ok
16:03:15.0692 0x0d40 UASPStor - ok
16:03:15.0692 0x0d40 UcmCx0101 - ok
16:03:15.0692 0x0d40 UcmTcpciCx0101 - ok
16:03:15.0692 0x0d40 UcmUcsi - ok
16:03:15.0692 0x0d40 Ucx01000 - ok
16:03:15.0692 0x0d40 UdeCx - ok
16:03:15.0692 0x0d40 udfs - ok
16:03:15.0692 0x0d40 UEFI - ok
16:03:15.0707 0x0d40 UevAgentDriver - ok
16:03:15.0707 0x0d40 UevAgentService - ok
16:03:15.0707 0x0d40 Ufx01000 - ok
16:03:15.0707 0x0d40 UfxChipidea - ok
16:03:15.0707 0x0d40 ufxsynopsys - ok
16:03:15.0707 0x0d40 UI0Detect - ok
16:03:15.0723 0x0d40 umbus - ok
16:03:15.0723 0x0d40 UmPass - ok
16:03:15.0723 0x0d40 UmRdpService - ok
16:03:15.0723 0x0d40 UnistoreSvc - ok
16:03:15.0723 0x0d40 upnphost - ok
16:03:15.0723 0x0d40 UrsChipidea - ok
16:03:15.0723 0x0d40 UrsCx01000 - ok
16:03:15.0739 0x0d40 UrsSynopsys - ok
16:03:15.0739 0x0d40 usbccgp - ok
16:03:15.0739 0x0d40 usbcir - ok
16:03:15.0739 0x0d40 usbehci - ok
16:03:15.0739 0x0d40 usbhub - ok
16:03:15.0739 0x0d40 USBHUB3 - ok
16:03:15.0739 0x0d40 usbohci - ok
16:03:15.0754 0x0d40 usbprint - ok
16:03:15.0754 0x0d40 usbscan - ok
16:03:15.0754 0x0d40 usbser - ok
16:03:15.0754 0x0d40 USBSTOR - ok
16:03:15.0754 0x0d40 usbuhci - ok
16:03:15.0754 0x0d40 USBXHCI - ok
16:03:15.0754 0x0d40 UserDataSvc - ok
16:03:15.0770 0x0d40 UserManager - ok
16:03:15.0770 0x0d40 UsoSvc - ok
16:03:15.0770 0x0d40 VaultSvc - ok
16:03:15.0770 0x0d40 VBoxUSB - ok
16:03:15.0770 0x0d40 VClone - ok
16:03:15.0770 0x0d40 vdrvroot - ok
16:03:15.0770 0x0d40 vds - ok
16:03:15.0785 0x0d40 VerifierExt - ok
16:03:15.0785 0x0d40 vhdmp - ok
16:03:15.0785 0x0d40 vhf - ok
16:03:15.0785 0x0d40 vmbus - ok
16:03:15.0785 0x0d40 VMBusHID - ok
16:03:15.0785 0x0d40 vmgid - ok
16:03:15.0785 0x0d40 vmicguestinterface - ok
16:03:15.0801 0x0d40 vmicheartbeat - ok
16:03:15.0801 0x0d40 vmickvpexchange - ok
16:03:15.0801 0x0d40 vmicrdv - ok
16:03:15.0801 0x0d40 vmicshutdown - ok
16:03:15.0801 0x0d40 vmictimesync - ok
16:03:15.0801 0x0d40 vmicvmsession - ok
16:03:15.0801 0x0d40 vmicvss - ok
16:03:15.0817 0x0d40 volmgr - ok
16:03:15.0817 0x0d40 volmgrx - ok
16:03:15.0817 0x0d40 volsnap - ok
16:03:15.0817 0x0d40 volume - ok
16:03:15.0817 0x0d40 vpci - ok
16:03:15.0817 0x0d40 vsmraid - ok
16:03:15.0817 0x0d40 VSS - ok
16:03:15.0817 0x0d40 VSTXRAID - ok
16:03:15.0832 0x0d40 vwifibus - ok
16:03:15.0832 0x0d40 vwififlt - ok
16:03:15.0832 0x0d40 W32Time - ok
16:03:15.0832 0x0d40 WacomPen - ok
16:03:15.0832 0x0d40 WalletService - ok
16:03:15.0832 0x0d40 wanarp - ok
16:03:15.0832 0x0d40 wanarpv6 - ok
16:03:15.0848 0x0d40 wbengine - ok
16:03:15.0848 0x0d40 WbioSrvc - ok
16:03:15.0848 0x0d40 wcifs - ok
16:03:15.0848 0x0d40 Wcmsvc - ok
16:03:15.0848 0x0d40 wcncsvc - ok
16:03:15.0848 0x0d40 wcnfs - ok
16:03:15.0848 0x0d40 WdBoot - ok
16:03:15.0848 0x0d40 Wdf01000 - ok
16:03:15.0864 0x0d40 WdFilter - ok
16:03:15.0864 0x0d40 WdiServiceHost - ok
16:03:15.0864 0x0d40 WdiSystemHost - ok
16:03:15.0864 0x0d40 wdiwifi - ok
16:03:15.0864 0x0d40 WdNisDrv - ok
16:03:15.0864 0x0d40 WdNisSvc - ok
16:03:15.0864 0x0d40 WebClient - ok
16:03:15.0879 0x0d40 Wecsvc - ok
16:03:15.0879 0x0d40 WEPHOSTSVC - ok
16:03:15.0879 0x0d40 wercplsupport - ok
16:03:15.0879 0x0d40 WerSvc - ok
16:03:15.0879 0x0d40 WFPLWFS - ok
16:03:15.0879 0x0d40 WiaRpc - ok
16:03:15.0879 0x0d40 WIMMount - ok
16:03:15.0895 0x0d40 WinDefend - ok
16:03:15.0895 0x0d40 WindowsTrustedRT - ok
16:03:15.0895 0x0d40 WindowsTrustedRTProxy - ok
16:03:15.0895 0x0d40 WinHttpAutoProxySvc - ok
16:03:15.0895 0x0d40 WinMad - ok
16:03:15.0895 0x0d40 Winmgmt - ok
16:03:15.0910 0x0d40 WinRM - ok
16:03:15.0910 0x0d40 WINUSB - ok
16:03:15.0910 0x0d40 WinVerbs - ok
16:03:15.0910 0x0d40 wisvc - ok
16:03:15.0910 0x0d40 WlanSvc - ok
16:03:15.0926 0x0d40 wlidsvc - ok
16:03:15.0926 0x0d40 WmiAcpi - ok
16:03:15.0926 0x0d40 wmiApSrv - ok
16:03:15.0926 0x0d40 WMPNetworkSvc - ok
16:03:15.0926 0x0d40 Wof - ok
16:03:15.0926 0x0d40 workfolderssvc - ok
16:03:15.0942 0x0d40 WPDBusEnum - ok
16:03:15.0942 0x0d40 WpdUpFltr - ok
16:03:15.0942 0x0d40 WpnService - ok
16:03:15.0942 0x0d40 WpnUserService - ok
16:03:15.0942 0x0d40 ws2ifsl - ok
16:03:15.0942 0x0d40 wscsvc - ok
16:03:15.0957 0x0d40 WSearch - ok
16:03:15.0957 0x0d40 wuauserv - ok
16:03:15.0957 0x0d40 WudfPf - ok
16:03:15.0957 0x0d40 WUDFRd - ok
16:03:15.0957 0x0d40 wudfsvc - ok
16:03:15.0957 0x0d40 WwanSvc - ok
16:03:15.0973 0x0d40 XblAuthManager - ok
16:03:15.0973 0x0d40 XblGameSave - ok
16:03:15.0973 0x0d40 xboxgip - ok
16:03:15.0973 0x0d40 XboxNetApiSvc - ok
16:03:15.0973 0x0d40 xinputhid - ok
16:03:15.0973 0x0d40 xusb22 - ok
16:03:15.0973 0x0d40 ================ Scan global ===============================
16:03:15.0973 0x0d40 [ Global ] - ok
16:03:15.0973 0x0d40 ================ Scan MBR ==================================
16:03:15.0989 0x0d40 [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk0\DR0
16:03:16.0301 0x0d40 \Device\Harddisk0\DR0 - ok
16:03:16.0301 0x0d40 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk1\DR1
16:03:16.0426 0x0d40 \Device\Harddisk1\DR1 - ok
16:03:16.0426 0x0d40 ================ Scan VBR ==================================
16:03:16.0426 0x0d40 ================ Scan generic autorun ======================
16:03:16.0426 0x0d40 RTHDVCPL - ok
16:03:16.0426 0x0d40 XboxStat - ok
16:03:16.0426 0x0d40 StartCN - ok
16:03:16.0426 0x0d40 Malwarebytes TrayApp - ok
16:03:16.0426 0x0d40 Avira SystrayStartTrigger - ok
16:03:16.0426 0x0d40 avgnt - ok
16:03:16.0426 0x0d40 Lightshot - ok
16:03:16.0426 0x0d40 OneDriveSetup - ok
16:03:16.0426 0x0d40 OneDriveSetup - ok
16:03:16.0426 0x0d40 OneDriveSetup - ok
16:03:16.0426 0x0d40 OneDrive - ok
16:03:16.0442 0x0d40 Spotify Web Helper - ok
16:03:16.0442 0x0d40 CCleaner Monitoring - ok
16:03:16.0457 0x0d40 AV detected via SS2: Avira Antivirus, C:\Program Files (x86)\Avira\Antivirus\WindowsSecurityCenter.exe ( 15.0.25.151 ), 0x41000 ( enabled : updated )
16:03:16.0457 0x0d40 AV detected via SS2: Windows Defender, C:\Program Files\Windows Defender\MSASCui.exe ( 4.10.14393.187 ), 0x60100 ( disabled : updated )
16:03:16.0457 0x0d40 AV detected via SS2: Malwarebytes, C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe ( 3.0.0.138 ), 0x60000 ( disabled : updated )
16:03:16.0457 0x0d40 Win FW state via NFP2: enabled ( trusted )
16:03:16.0614 0x0d40 ============================================================
16:03:16.0614 0x0d40 Scan finished
16:03:16.0614 0x0d40 ============================================================
16:03:16.0629 0x233c Detected object count: 0
16:03:16.0629 0x233c Actual detected object count: 0
Malwarebytes: Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.0 (12.05.2016)
Operating System: Windows 10 Pro x64
Ran by Dominik (Administrator) on 27.02.2017 at 0:31:54,03
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 4
Successfully deleted: C:\WINDOWS\system32\Tasks\update-S-1-5-21-2232720161-2271080761-1308937938-1001 (Task)
Successfully deleted: C:\WINDOWS\system32\Tasks\update-sys (Task)
Successfully deleted: C:\WINDOWS\Tasks\update-S-1-5-21-2232720161-2271080761-1308937938-1001.job (Task)
Successfully deleted: C:\WINDOWS\Tasks\update-sys.job (Task)
Registry: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 27.02.2017 at 0:33:34,03
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
vom AdwCleaner wurde nichts gefunden.
Die Probleme habe ich seit einigen Monaten, ein genaues Datum kann ich nicht sagen. Aber ich würde mal so auf 4 Monate schätzen. Aber damals hab ich mich nicht weiter um das Problem gekümmert, da ich dachte das wäre normal. |
So funktioniert es:
FRST 32-Bit | FRST 64-Bit
TDSSKiller.exe und speichere diese Datei auf dem Desktop