| Irongenetics | 20.04.2018 12:23 |
Addition: Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 15.04.2018
durchgeführt von Admin (19-04-2018 18:13:45)
Gestartet von C:\Users\Admin\Desktop
Windows 10 Pro Version 1709 16299.371 (X64) (2017-12-18 18:58:19)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Admin (S-1-5-21-2112417269-1118582597-2908858126-1001 - Administrator - Enabled) => C:\Users\Admin
Administrator (S-1-5-21-2112417269-1118582597-2908858126-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-2112417269-1118582597-2908858126-503 - Limited - Disabled)
Gast (S-1-5-21-2112417269-1118582597-2908858126-501 - Limited - Disabled)
WDAGUtilityAccount (S-1-5-21-2112417269-1118582597-2908858126-504 - Limited - Disabled)
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Norton Security (Enabled - Up to date) {E3FDBD9F-8140-1400-F32B-8B58923F7C4D}
AS: Norton Security (Enabled - Up to date) {589C5C7B-A77A-1B8E-C99B-B02AE9B836F0}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Norton Security (Enabled) {DBC63CBA-CB2F-1558-D874-226D6CEC3B36}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 18.011.20038 - Adobe Systems Incorporated)
Adobe Connect 9 Add-in (HKU\S-1-5-21-2112417269-1118582597-2908858126-1001\...\Adobe Connect 9 Add-in) (Version: 11.9.979.366 - Adobe Systems Incorporated)
Adobe Flash Player 29 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 29.0.0.140 - Adobe Systems Incorporated)
Apple Application Support (32-Bit) (HKLM-x32\...\{543F829B-4591-4B2F-AF63-6E6E6AE59EB2}) (Version: 6.4 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{0ECA3BB5-4410-414B-B226-241FF1C12CD0}) (Version: 6.4 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{A05FDFEC-4377-49E0-82CB-B6D1386E89DA}) (Version: 11.3.0.9 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{A30EA700-5515-48F0-88B0-9E99DC356B88}) (Version: 2.6.0.1 - Apple Inc.)
Asmedia USB Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.16.26.1 - Asmedia Technology)
ASUS Product Register Program (HKLM-x32\...\{C87D79F6-F813-4812-B7A9-CCCAAB8B1188}) (Version: 1.0.030 - ASUSTek Computer Inc.)
Audacity 2.1.2 (HKLM-x32\...\Audacity®_is1) (Version: 2.1.2 - Audacity Team)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Canon Utilities Digital Photo Professional 4 (HKLM-x32\...\Digital Photo Professional 4 (x64)) (Version: 4.2.32.0 - Canon Inc.)
Canon Utilities EOS Lens Registration Tool (HKLM-x32\...\EOS Lens Registration Tool) (Version: 1.2.20.0 - Canon Inc.)
Canon Utilities EOS Utility 2 (HKLM-x32\...\EOS Utility 2) (Version: 2.14.20.0 - Canon Inc.)
Canon Utilities EOS Utility 3 (HKLM-x32\...\EOS Utility 3) (Version: 3.2.20.0 - Canon Inc.)
Canon Utilities EOS Web Service Registration Tool (HKLM-x32\...\EOS Web Service Registration Tool) (Version: 1.2.10.0 - Canon Inc.)
Canon Utilities Picture Style Editor (HKLM-x32\...\Picture Style Editor) (Version: 1.15.20.0 - Canon Inc.)
D3DX10 (HKLM-x32\...\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden
Epic Games Launcher (HKLM-x32\...\{5936CF50-D6B9-4E2D-B802-A3B25A073DF8}) (Version: 1.1.144.0 - Epic Games, Inc.)
Epic Games Launcher Prerequisites (x64) (HKLM\...\{66C5838F-B854-4A55-89E6-A6138747A4DF}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
FileZilla Client 3.25.1 (HKLM-x32\...\FileZilla Client) (Version: 3.25.1 - Tim Kosse)
Fotogalerie (HKLM-x32\...\{41BF4A3B-D60A-4E92-883F-C88C8C157261}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
GIMP 2.8.22 (HKLM\...\GIMP-2_is1) (Version: 2.8.22 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 66.0.3359.117 - Google Inc.)
Google Earth Pro (HKLM\...\{D9EF644E-2FAE-493B-8180-5617CC774C4F}) (Version: 7.3.1.4507 - Google)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
Gramblr (HKLM\...\Gramblr) (Version: 2.9.129 - Gramblr Team)
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.0.0.1162 - Intel Corporation)
Intel® Chipsatz-Gerätesoftware (HKLM-x32\...\{60c073df-e736-4210-9c3a-5fc2b651cef3}) (Version: 10.1.1.7 - Intel(R) Corporation) Hidden
Intel® Security Assist (HKLM-x32\...\{4B230374-6475-4A73-BA6E-41015E9C5013}) (Version: 1.0.0.532 - Intel Corporation)
iTunes (HKLM\...\{BC437DDC-48E8-4089-9EA0-58414984466E}) (Version: 12.7.4.76 - Apple Inc.)
Java 8 Update 161 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180161F0}) (Version: 8.0.1610.12 - Oracle Corporation)
KeePass Password Safe 2.37 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.37 - Dominik Reichl)
Launcher Prerequisites (x64) (HKLM-x32\...\{c6c5a357-c7ca-4a5f-9789-3bb1af579253}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
Microsoft Chart Controls for Microsoft .NET Framework 3.5 (HKLM-x32\...\{41785C66-90F2-40CE-8CB5-1C94BFC97280}) (Version: 3.5.0.0 - Microsoft Corporation)
Microsoft Office 365 ProPlus - de-de (HKLM\...\O365ProPlusRetail - de-de) (Version: 16.0.9126.2152 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2112417269-1118582597-2908858126-1001\...\OneDriveSetup.exe) (Version: 18.044.0301.0006 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 (HKLM-x32\...\{d992c12e-cab2-426f-bde3-fb8c53950b0d}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Movie Maker (HKLM-x32\...\{70C91B91-61E8-4D06-86D6-A9DCC291983A}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{DD67BE4B-7E62-4215-AFA3-F123A800A389}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 59.0.2 (x64 de) (HKLM\...\Mozilla Firefox 59.0.2 (x64 de)) (Version: 59.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 59.0.2 - Mozilla)
netis Wireless LAN Driver (HKLM-x32\...\{9DAABC60-A5EF-41FF-B2B9-17329590CD5}) (Version: 1.00.0193 - netis Systems Co.,Ltd.)
Norton Security (HKLM-x32\...\NGC) (Version: 22.14.0.54 - Symantec Corporation)
NVIDIA 3D Vision Controller-Treiber 369.04 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 369.04 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 388.13 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 388.13 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.9.0.97 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.9.0.97 - NVIDIA Corporation)
NVIDIA Grafiktreiber 388.13 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 388.13 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.35.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.35.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.17.0524 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.17.0524 - NVIDIA Corporation)
OBS Studio (HKLM-x32\...\OBS Studio) (Version: 21.1.0 - OBS Project)
Office 16 Click-to-Run Extensibility Component (HKLM-x32\...\{90160000-008C-0000-0000-0000000FF1CE}) (Version: 16.0.9126.2152 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM\...\{90160000-00DD-0000-1000-0000000FF1CE}) (Version: 16.0.9126.2152 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-008F-0000-1000-0000000FF1CE}) (Version: 16.0.9126.2152 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM-x32\...\{90160000-008C-0407-0000-0000000FF1CE}) (Version: 16.0.9126.2152 - Microsoft Corporation) Hidden
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.992 - Even Balance, Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.2.703.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7576 - Realtek Semiconductor Corp.)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.19 - TeamSpeak Systems GmbH)
Vulkan Run Time Libraries 1.0.61.0 (HKLM\...\VulkanRT1.0.61.0) (Version: 1.0.61.0 - LunarG, Inc.) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Wondershare Filmora(Build 8.5.1) (HKLM\...\Wondershare Filmora_is1) (Version: - Wondershare Software)
Wondershare Helper Compact 2.6.0 (HKLM-x32\...\{5363CE84-5F09-48A1-8B6C-6BB590FFEDF2}_is1) (Version: 2.6.0 - Wondershare)
XSplit Gamecaster (HKLM-x32\...\{8915913F-E4AF-46C5-B4EF-3535D83BFFDE}) (Version: 2.5.1507.3018 - SplitmediaLabs)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-2112417269-1118582597-2908858126-1001_Classes\CLSID\{CB2B673F-D441-4CD4-AFBE-DC4037CA4220}\InprocServer32 -> C:\Program Files\WinZip\adxloader64.dll => Keine Datei
ShellIconOverlayIdentifiers: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files\Norton Security\Engine\22.14.0.54\buShell.dll [2018-04-04] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files\Norton Security\Engine\22.14.0.54\buShell.dll [2018-04-04] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files\Norton Security\Engine\22.14.0.54\buShell.dll [2018-04-04] (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files\Norton Security\Engine\22.14.0.54\buShell.dll [2018-04-04] (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files\Norton Security\Engine\22.14.0.54\buShell.dll [2018-04-04] (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files\Norton Security\Engine\22.14.0.54\buShell.dll [2018-04-04] (Symantec Corporation)
ContextMenuHandlers1: [BUContextMenu] -> {F7CAA2A1-67A2-44BB-B20F-202FD8EB1DAB} => C:\Program Files\Norton Security\Engine\22.14.0.54\buShell.dll [2018-04-04] (Symantec Corporation)
ContextMenuHandlers1: [Symantec.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files\Norton Security\Engine\22.14.0.54\NavShExt.dll [2018-04-04] (Symantec Corporation)
ContextMenuHandlers2: [Symantec.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files\Norton Security\Engine\22.14.0.54\NavShExt.dll [2018-04-04] (Symantec Corporation)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\system32\nvshext.dll [2017-10-27] (NVIDIA Corporation)
ContextMenuHandlers6: [BUContextMenu] -> {F7CAA2A1-67A2-44BB-B20F-202FD8EB1DAB} => C:\Program Files\Norton Security\Engine\22.14.0.54\buShell.dll [2018-04-04] (Symantec Corporation)
ContextMenuHandlers6: [Symantec.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files\Norton Security\Engine\22.14.0.54\NavShExt.dll [2018-04-04] (Symantec Corporation)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {038FD60A-8F34-475B-93AB-A6616415B997} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-12-18] (Google Inc.)
Task: {042DFC06-3302-4AEE-8E22-926B389C08AA} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-09-19] (NVIDIA Corporation)
Task: {0EF8138A-104E-49E0-84D6-F63E7D65B32F} - System32\Tasks\ASUS\ASUS Product Register Service => C:\Program Files (x86)\ASUS\APRP\aprp.exe [2015-05-14] ()
Task: {259625EB-5359-434C-9E34-C85FACC21AB1} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2018-04-16] (Microsoft Corporation)
Task: {3C437858-482F-4C66-9528-23CD446893A3} - System32\Tasks\EPSON XP-530 Series Update {73ACD599-AFC5-4385-8520-AB0F341FBCC5} => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSPME.EXE
Task: {4277E693-30C1-4057-8ED9-BDB2D1C2DE32} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerLogon => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2018-04-16] (Microsoft Corporation)
Task: {49A44DD6-B461-4D5F-900E-725614768F0F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-12-18] (Google Inc.)
Task: {4B4ED3A5-F749-4E29-8260-EC220096F6C3} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_29_0_0_140_Plugin.exe [2018-04-10] (Adobe Systems Incorporated)
Task: {4B98AF95-C0BD-466B-958B-E3DD548BFBD5} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2017-09-19] (NVIDIA Corporation)
Task: {5C248C8A-C4FD-4781-8C88-970A3210F25D} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2018-04-16] (Microsoft Corporation)
Task: {5D794B99-AA4E-4A76-A45C-514B7D7F6238} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2017-09-19] (NVIDIA Corporation)
Task: {85E5995D-3E99-443E-A553-4799B24D6454} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-04-10] (Adobe Systems Incorporated)
Task: {86B79FDA-60A9-4983-9106-4F6350D2A4EA} - System32\Tasks\EPSON XP-530 Series Update {ED3C3761-C7EC-448E-9A34-87C2E9FF8F3C} => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSPME.EXE
Task: {8AE76C48-97D6-45AD-B1B6-70EC38D3D183} - System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe [2017-09-19] (NVIDIA Corporation)
Task: {8D328879-E27D-4E33-8FAB-C96072EC5A65} - System32\Tasks\EPSON XP-530 Series Update {1FB5C731-9113-4DC5-AEE1-87B1EEC62C02} => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSPME.EXE
Task: {8F33CEA1-A2E1-418A-9630-5DA6DE5A27F8} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2018-04-06] (Microsoft Corporation)
Task: {90473F04-78A6-43F0-9325-FC94AF929167} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2018-02-09] (Adobe Systems Incorporated)
Task: {97DD39B5-37BC-45BA-915A-D8DF8790525E} - System32\Tasks\Norton Security\Norton Security Error Processor => C:\Program Files\Norton Security\Engine\22.14.0.54\SymErr.exe [2018-04-04] (Symantec Corporation)
Task: {9A670954-847E-4617-9635-7CFC79E60091} - System32\Tasks\Norton Security\Norton Security Autofix => C:\Program Files\Norton Security\Engine\22.14.0.54\SymErr.exe [2018-04-04] (Symantec Corporation)
Task: {A2E77F36-4FE2-4CEF-BDE3-98E308614715} - System32\Tasks\Norton Security\Norton Security Error Analyzer => C:\Program Files\Norton Security\Engine\22.14.0.54\SymErr.exe [2018-04-04] (Symantec Corporation)
Task: {A3B22A82-D3D5-4C3C-9380-7CADF6EA9E22} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-09-19] (NVIDIA Corporation)
Task: {A4F95832-E205-49B0-B5BB-EF41C270C39A} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-09-19] (NVIDIA Corporation)
Task: {A740F7E3-5AED-42B3-9D92-281CFCB70F75} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-09-19] (NVIDIA Corporation)
Task: {B2EB1951-2A44-415F-8C51-8984D5B93514} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerRegistration => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2018-04-16] (Microsoft Corporation)
Task: {C18B6B62-A191-4D7C-8AEF-E1EABA1A6415} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2018-01-08] (Apple Inc.)
Task: {C650810E-D629-46D8-AF60-C1810EE2F494} - System32\Tasks\Remediation\AntimalwareMigrationTask => C:\Program Files\Common Files\AV\Norton Security\Upgrade.exe [2018-04-04] (Symantec Corporation)
Task: {CE51C9C7-E8B4-40C4-9731-2D0E1933E423} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-09-19] (NVIDIA Corporation)
Task: {D34BB77A-A590-4B36-BF9D-3749A7224C93} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton Security\Engine\22.14.0.54\WSCStub.exe [2018-04-04] (Symantec Corporation)
Task: {E60DD334-C3C4-47A6-A2EC-2AB13B357408} - \Microsoft\Windows\UNP\RunCampaignManager -> Keine Datei <==== ACHTUNG
Task: {E982FC23-5722-4D31-BBF5-607B9A11E48F} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2018-04-06] (Microsoft Corporation)
Task: {EF309164-545B-4E0E-9A5D-A40DDF874852} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2018-04-16] (Microsoft Corporation)
Task: {F1FE73A9-D75A-4F67-9B5A-E23FBF74CA9A} - System32\Tasks\EPSON XP-530 Series Update {45A03877-112C-4CB3-88FA-4CEF8D4F99F5} => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSPME.EXE
Task: {F384AB98-81D4-47F8-AA32-9D3C05B31DED} - System32\Tasks\{A9DF0E35-1EBB-49F6-8B4F-949583704E2C} => "c:\windows\system32\launchwinapp.exe" hxxps://ui.skype.com/ui/0/7.39.0.102/de/abandoninstall?page=tsProgressBar
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\EPSON XP-530 Series Update {1FB5C731-9113-4DC5-AEE1-87B1EEC62C02}.job => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSPME.EXE:/EXE:{1FB5C731-9113-4DC5-AEE1-87B1EEC62C02} /F:UpdateWORKGROUP\DESKTOP-7H5SFF1$ĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
Task: C:\WINDOWS\Tasks\EPSON XP-530 Series Update {45A03877-112C-4CB3-88FA-4CEF8D4F99F5}.job => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSPME.EXE:/EXE:{45A03877-112C-4CB3-88FA-4CEF8D4F99F5} /F:UpdateWORKGROUP\DESKTOP-7H5SFF1$ĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
Task: C:\WINDOWS\Tasks\EPSON XP-530 Series Update {73ACD599-AFC5-4385-8520-AB0F341FBCC5}.job => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSPME.EXE:/EXE:{73ACD599-AFC5-4385-8520-AB0F341FBCC5} /F:UpdateWORKGROUP\DESKTOP-7H5SFF1$ĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
Task: C:\WINDOWS\Tasks\EPSON XP-530 Series Update {ED3C3761-C7EC-448E-9A34-87C2E9FF8F3C}.job => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSPME.EXE:/EXE:{ED3C3761-C7EC-448E-9A34-87C2E9FF8F3C} /F:UpdateWORKGROUP\DESKTOP-7H5SFF1$ĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
==================== Verknüpfungen & WMI ========================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
ShortcutWithArgument: C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\69639df789022856\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory="Profile 1"
ShortcutWithArgument: C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\225bb61db2f318c1\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory="Profile 3"
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2017-09-29 15:41 - 2017-09-29 15:41 - 000184432 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2018-01-05 01:14 - 2018-01-05 01:14 - 000088888 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2018-03-16 15:19 - 2018-03-16 15:19 - 001356088 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2017-02-17 07:57 - 2018-03-29 22:14 - 012172368 _____ () C:\Program Files\Gramblr\gramblr.exe
2017-04-28 14:06 - 2017-04-28 14:06 - 000076888 _____ () C:\WINDOWS\SysWOW64\PnkBstrA.exe
2016-11-14 08:31 - 2017-09-19 09:23 - 001267136 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\libprotobuf.dll
2017-03-20 17:44 - 2017-03-20 17:44 - 000052392 _____ () C:\Program Files\FileZilla FTP Client\fzshellext_64.dll
2018-03-14 16:38 - 2018-02-22 02:26 - 011044864 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2018-03-14 16:38 - 2018-02-22 02:21 - 001804288 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2018-03-28 17:05 - 2018-03-28 17:05 - 000088888 _____ () C:\Program Files\iTunes\zlib1.dll
2018-03-28 17:05 - 2018-03-28 17:05 - 001356088 _____ () C:\Program Files\iTunes\libxml2.dll
2017-09-29 15:41 - 2017-09-29 15:41 - 001909248 _____ () C:\Windows\ShellExperiences\PeopleCommonControls.dll
2018-03-14 16:38 - 2018-02-22 02:29 - 001266176 _____ () C:\Windows\ShellExperiences\PeopleBarFlyout.dll
2018-04-11 11:53 - 2018-03-30 05:29 - 002988032 _____ () C:\Windows\ShellExperiences\WindowsInternal.People.PeoplePicker.dll
2017-09-29 15:41 - 2017-09-29 15:41 - 002459648 _____ () C:\Windows\ShellExperiences\WindowsInternal.People.Relevance.dll
2018-02-22 09:13 - 2018-02-22 09:13 - 027139072 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.17122.16211.1000_x64__8wekyb3d8bbwe\Video.UI.exe
2018-02-22 09:13 - 2018-02-22 09:13 - 000306176 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.17122.16211.1000_x64__8wekyb3d8bbwe\SharedUI.dll
2018-02-22 09:13 - 2018-02-22 09:13 - 006687744 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.17122.16211.1000_x64__8wekyb3d8bbwe\EntCommon.dll
2017-09-26 15:56 - 2017-09-26 15:56 - 003553704 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.17122.16211.1000_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2018-04-03 08:12 - 2018-04-03 08:12 - 000478720 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18022.15810.1000_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2018-04-03 08:12 - 2018-04-03 08:12 - 067038720 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18022.15810.1000_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2017-10-04 07:34 - 2017-10-04 07:35 - 002523136 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18022.15810.1000_x64__8wekyb3d8bbwe\UnityEngineDelegates.dll
2018-02-16 10:02 - 2018-02-16 10:02 - 000010240 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18022.15810.1000_x64__8wekyb3d8bbwe\RenderingPlugin.dll
2018-03-30 10:01 - 2018-03-30 10:02 - 004123648 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18022.15810.1000_x64__8wekyb3d8bbwe\MediaEngineCSWrapper.dll
2018-03-30 10:01 - 2018-03-30 10:02 - 000009216 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18022.15810.1000_x64__8wekyb3d8bbwe\ImagePipelineNative.dll
2018-03-30 10:01 - 2018-03-30 10:02 - 000035840 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18022.15810.1000_x64__8wekyb3d8bbwe\WinMLWrapper.UWP.dll
2018-03-30 10:01 - 2018-03-30 10:02 - 002283008 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18022.15810.1000_x64__8wekyb3d8bbwe\TrackingDLLUWP.dll
2018-04-03 08:12 - 2018-04-03 08:12 - 015329792 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18022.15810.1000_x64__8wekyb3d8bbwe\PhotosApp.Windows.dll
2018-03-30 10:01 - 2018-03-30 10:02 - 003962368 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18022.15810.1000_x64__8wekyb3d8bbwe\MediaEngine.dll
2018-04-03 08:12 - 2018-04-03 08:12 - 003250176 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18022.15810.1000_x64__8wekyb3d8bbwe\AppCore.Windows.dll
2018-03-01 10:00 - 2018-03-01 10:00 - 001369088 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18022.15810.1000_x64__8wekyb3d8bbwe\Microsoft.RichMedia.Ink.Controls.dll
2018-02-02 16:49 - 2018-02-02 16:50 - 004601048 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18022.15810.1000_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2018-03-30 10:01 - 2018-03-30 10:02 - 000094208 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18022.15810.1000_x64__8wekyb3d8bbwe\BendRealityNode.dll
2018-03-30 10:01 - 2018-03-30 10:02 - 000043008 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18022.15810.1000_x64__8wekyb3d8bbwe\Microsoft.Photos.Edit.Services.dll
2018-03-30 10:01 - 2018-03-30 10:02 - 000631296 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18022.15810.1000_x64__8wekyb3d8bbwe\RuntimeConfiguration.dll
2018-04-03 08:12 - 2018-04-03 08:12 - 000152064 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18022.15810.1000_x64__8wekyb3d8bbwe\SKU.dll
2018-04-19 16:17 - 2018-04-17 07:01 - 004443992 _____ () C:\Program Files (x86)\Google\Chrome\Application\66.0.3359.117\libglesv2.dll
2018-04-19 16:17 - 2018-04-17 07:01 - 000099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\66.0.3359.117\libegl.dll
2018-03-22 11:02 - 2018-01-11 04:05 - 000784672 _____ () D:\Steam\SDL2.dll
2018-04-06 08:43 - 2018-04-03 01:34 - 002631968 _____ () D:\Steam\video.dll
2016-12-18 21:32 - 2016-09-01 03:02 - 004969248 _____ () D:\Steam\v8.dll
2018-03-22 11:02 - 2017-12-20 03:43 - 000351520 _____ () D:\Steam\libavresample-3.dll
2018-03-22 11:02 - 2017-12-20 03:43 - 000695584 _____ () D:\Steam\libavformat-57.dll
2018-03-22 11:02 - 2017-12-20 03:43 - 000847136 _____ () D:\Steam\libavutil-55.dll
2018-03-22 11:02 - 2017-12-20 03:43 - 005137696 _____ () D:\Steam\libavcodec-57.dll
2016-12-18 21:32 - 2016-09-01 03:02 - 001563936 _____ () D:\Steam\icui18n.dll
2018-03-22 11:02 - 2017-12-20 03:43 - 000783648 _____ () D:\Steam\libswscale-4.dll
2016-12-18 21:32 - 2016-09-01 03:02 - 001195296 _____ () D:\Steam\icuuc.dll
2018-04-06 08:43 - 2018-04-03 01:34 - 000977184 _____ () D:\Steam\bin\chromehtml.DLL
2016-12-18 21:32 - 2016-07-05 00:17 - 000266560 _____ () D:\Steam\openvr_api.dll
2018-01-11 14:53 - 2016-07-21 11:54 - 000137728 _____ () C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSCreateVC.dll
2018-01-11 14:53 - 2017-09-12 11:34 - 001506304 _____ () C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\DAQExp.dll
2015-03-24 09:44 - 2015-03-24 09:44 - 000512000 _____ () C:\Program Files (x86)\Canon\EOS Utility\EDSDK.dll
2018-03-22 11:02 - 2017-12-13 23:16 - 071471392 _____ () D:\Steam\bin\cef\cef.win7\libcef.dll
2017-10-12 16:39 - 2017-09-07 04:04 - 000678400 _____ () D:\Steam\bin\cef\cef.win7\SDL2.dll
2016-12-18 21:32 - 2015-09-25 01:52 - 000119208 _____ () D:\Steam\winh264.dll
2015-08-07 01:09 - 2015-08-07 01:09 - 001243936 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2016-11-14 08:31 - 2017-09-19 09:23 - 001040320 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\libprotobuf.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\Users\Public\AppData:CSM [474]
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
IE trusted site: HKU\S-1-5-21-2112417269-1118582597-2908858126-1001\...\sharepoint.com -> hxxps://iubhfs-files.sharepoint.com
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2015-10-30 09:24 - 2015-10-30 09:21 - 000000824 _____ C:\WINDOWS\system32\Drivers\etc\hosts
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-2112417269-1118582597-2908858126-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [{6D656CA8-C0DE-46C9-BF3A-3932EAE99D7D}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{16507F7E-CCFD-45F5-9322-44E78BAF473C}] => (Allow) D:\Steam\steamapps\common\dayofinfamy\dayofinfamy_BE.exe
FirewallRules: [{069DD6F2-49A0-4E7B-A233-08D2AA63CEDB}] => (Allow) D:\Steam\steamapps\common\dayofinfamy\dayofinfamy_BE.exe
FirewallRules: [{CA22C68B-DE81-4CE5-BB2F-A799AB8D1E1A}] => (Allow) D:\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{BDC7E201-5577-4352-84AF-96E58B80E60A}] => (Allow) D:\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{D748D56D-6FEA-49D7-B4F3-5DF3AEC1A462}] => (Allow) C:\Program Files (x86)\EPSON Software\ECPrinterSetup\ENPApp.exe
FirewallRules: [{71A9291F-FBB2-40AB-A22C-34E5C162F305}] => (Allow) C:\Program Files (x86)\EPSON Software\ECPrinterSetup\ENPApp.exe
FirewallRules: [{51B5A8D0-75C0-47B0-8A51-429EB43BA859}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{61F26BEC-54BD-4E29-B8D6-425C2E12CC9F}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{C064889E-4981-44B9-A11C-15F0E01FD29D}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{97D16682-3489-4F68-BCBE-AAB95787270D}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{5F8C1620-BEE3-4AAD-8E18-F040F84B5515}] => (Allow) D:\Steam\steamapps\common\Rising Storm 2\Binaries\Win64\RisingStorm2.exe
FirewallRules: [{FC5E7253-18B6-49B8-9E17-1A642DE0217C}] => (Allow) D:\Steam\steamapps\common\Rising Storm 2\Binaries\Win64\RisingStorm2.exe
FirewallRules: [{4B9A6AA0-2052-4448-A57E-67175B893123}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{8473A7A3-0F8B-4F51-809D-A135A2E47B71}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{271B01F3-2963-4B9F-906F-76AB7D56250A}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{CC20F69B-A9AD-418A-9DAA-8B81151A16AB}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{CC1CFC47-100E-4B81-95CC-41BA5127B84F}] => (Allow) D:\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{5090D130-EE1E-48AA-9FDE-18B81EA83B5D}] => (Allow) D:\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{7FA15394-5BC5-415F-9E4B-2839D13D0F14}] => (Allow) D:\Steam\Steam.exe
FirewallRules: [{A0B8B88E-2ABB-4816-8F76-37BD6798BD72}] => (Allow) D:\Steam\Steam.exe
FirewallRules: [{8E768CEC-0541-4A89-924B-71E973ED9708}] => (Allow) C:\Users\Admin\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\EpsonNetSetup\Data\ENEasyApp.exe
FirewallRules: [{B0B5BB6A-5254-41F0-BD7B-B3FC6AD9B170}] => (Allow) C:\Users\Admin\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\EpsonNetSetup\Data\ENEasyApp.exe
FirewallRules: [{4002ABE3-FFB8-4FD8-8052-46934B5094B6}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{32815A3E-EDAF-4ED5-B4FF-287DEFD8A0FB}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{3E4B28FC-5C4E-46A7-949F-6C974CBF7ED6}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{AF09281E-B694-40FC-89A1-EAB615400C6E}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{342E251C-525C-4A0A-95D4-19EDD83DC168}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
FirewallRules: [{08EA1E15-60E5-4327-B956-875DAE73977B}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{A5CE7D16-B5B9-4DDE-8530-867CC239C9D3}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{816A0D9B-A731-4B10-B0F1-67673ADB81D6}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{3DC9BA21-ADF6-48A5-BA21-F6A33397304C}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{38F12341-3401-4C4A-A152-034B66CA78F6}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{E999D4F0-8729-4497-A5FC-68CA6E6052DC}] => (Allow) LPort=2869
FirewallRules: [{77122268-9752-4BB9-BFB8-6C7E6497A52B}] => (Allow) LPort=1900
FirewallRules: [{A08CEAF5-DD98-41D0-BED6-837F43EB3FB9}] => (Allow) D:\Steam\steamapps\common\POSTAL2Complete\System\Postal2.exe
FirewallRules: [{D440F664-A6F0-473A-9D88-649147862CB1}] => (Allow) D:\Steam\steamapps\common\POSTAL2Complete\System\Postal2.exe
FirewallRules: [{69EF7CA7-2447-48FF-AD55-085FF12839E7}] => (Allow) D:\Steam\steamapps\common\POSTAL2Complete\ShareThePain\System\Postal2MP.exe
FirewallRules: [{EF472E21-BA56-4574-8AF5-B97FA247F859}] => (Allow) D:\Steam\steamapps\common\POSTAL2Complete\ShareThePain\System\Postal2MP.exe
FirewallRules: [{EC3346E1-42B1-4D22-AB76-78F4FC797543}] => (Allow) D:\Steam\steamapps\common\Beat Hazard\BeatHazard.exe
FirewallRules: [{C2F9CD33-C4BB-41B1-A5F6-E4D9C30BAE9B}] => (Allow) D:\Steam\steamapps\common\Beat Hazard\BeatHazard.exe
FirewallRules: [{8B37F1AF-30A7-4368-A8D1-77E3103CA86B}] => (Allow) D:\Steam\steamapps\common\Beat Hazard\runme.exe
FirewallRules: [{76EBAD77-D05D-4DF0-90BB-6CE78A4C6160}] => (Allow) D:\Steam\steamapps\common\Beat Hazard\runme.exe
FirewallRules: [{C7B99746-7B41-4738-99A6-A87348A9B81B}] => (Allow) D:\Steam\steamapps\common\Day of Defeat Source\hl2.exe
FirewallRules: [{BE5CC39C-7AE5-4424-9E0B-C4C25D4B9CF3}] => (Allow) D:\Steam\steamapps\common\Day of Defeat Source\hl2.exe
FirewallRules: [{338A31A7-EC9F-4ED8-AFA4-56AFEB30D0C2}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{5DAD7D09-8B5C-4BAE-857A-C629B35AE813}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{0CF64A65-F638-409C-BA47-464107DE2658}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{C3216759-4AC2-4FE6-80CA-81C41E873C4D}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{F5EBF112-A375-438D-AD9E-62A9A32548F9}] => (Allow) C:\Program Files (x86)\Canon\EOS Utility\EOSUPNPSV.exe
FirewallRules: [{87092034-F9F5-49AE-A089-C28E74FE59F7}] => (Allow) C:\Program Files (x86)\Canon\EOS Utility\EOSUPNPSV.exe
FirewallRules: [{ABE4B4B1-38D4-4890-880B-1C56ABE704BE}] => (Allow) D:\Steam\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{AD556DF1-14B4-4DC6-AC31-386E87FF2D79}] => (Allow) D:\Steam\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{5D013AE0-ED53-4A3B-B323-892C54CB964B}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{15764F65-8176-4CBF-8E9B-738EE71646DD}] => (Allow) D:\Steam\steamapps\common\Half-Life 2 Deathmatch\hl2.exe
FirewallRules: [{A0DE799C-FE49-47AE-A1D9-43D615FFF599}] => (Allow) D:\Steam\steamapps\common\Half-Life 2 Deathmatch\hl2.exe
FirewallRules: [{9CE99DF8-8871-424D-9659-2C96A9F4B0E4}] => (Allow) D:\Steam\steamapps\common\GarrysMod\hl2.exe
FirewallRules: [{E78BF769-628F-463C-8113-D0ED1F66E575}] => (Allow) D:\Steam\steamapps\common\GarrysMod\hl2.exe
FirewallRules: [{48B1B732-3812-4A6D-AA09-BE33E16896BD}] => (Allow) D:\Steam\steamapps\common\chivalrymedievalwarfare\Binaries\Win64\CMW.exe
FirewallRules: [{DC4305FA-0D91-4268-A2EF-AE448C6341D2}] => (Allow) D:\Steam\steamapps\common\chivalrymedievalwarfare\Binaries\Win64\CMW.exe
FirewallRules: [{C831D58F-911A-4796-A281-F4E4763BE310}] => (Allow) D:\Steam\steamapps\common\chivalrymedievalwarfare\Binaries\Win32\CMW.exe
FirewallRules: [{C5BDD669-3A09-42C5-A391-A643DB2D57F9}] => (Allow) D:\Steam\steamapps\common\chivalrymedievalwarfare\Binaries\Win32\CMW.exe
FirewallRules: [{AAD34A2A-5762-4831-9226-583305813B53}] => (Allow) D:\Steam\steamapps\common\chivalrymedievalwarfare\ChivLauncher.exe
FirewallRules: [{FCFAF5E4-2D0C-4DED-95EE-119D2336B1CA}] => (Allow) D:\Steam\steamapps\common\chivalrymedievalwarfare\ChivLauncher.exe
FirewallRules: [{F0230FE3-EC1B-493D-B821-B52518FC7308}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
FirewallRules: [{B875504D-8155-43D9-9579-6CBE37B19B4E}] => (Allow) D:\Steam\steamapps\common\Counter-Strike Source\hl2.exe
FirewallRules: [{4F650063-434B-4FC4-8FA7-5B32B70E744B}] => (Allow) D:\Steam\steamapps\common\Counter-Strike Source\hl2.exe
FirewallRules: [{1E02EF6D-395B-4129-9D89-0B6A9CFD3C48}] => (Allow) D:\Steam\steamapps\common\killingfloor2\Binaries\Win64\KFGame.exe
FirewallRules: [{E3C95585-C9F0-487B-A0AE-4D04C36D4C1A}] => (Allow) D:\Steam\steamapps\common\killingfloor2\Binaries\Win64\KFGame.exe
FirewallRules: [{9EF54800-FCF9-4498-A37A-8108784D7FDF}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{8DCA54CB-0F55-4F39-9BA6-26263FF0232E}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{A2DFE5C4-5F93-43D4-9CD0-D71E8178A1B9}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{6CD2A744-1ED1-4945-AA21-595AE928B097}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Wiederherstellungspunkte =========================
18-04-2018 13:21:23 Geplanter Prüfpunkt
19-04-2018 15:13:49 Removed Skype™ 7.40
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (04/19/2018 04:34:17 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe.Manifest". Fehler in Manifest- oder Richtliniendatei "C:\Program Files (x86)\Microsoft Office\root\Office16\UccApi.DLL" in Zeile 1.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0".
Definition: UccApi,processorArchitecture="x86",type="win32",version="16.0.0.0".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (04/19/2018 04:29:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding 25 A.4.D.9.6.9.3.6.9.4.2.B.4.0.5.4.0.0.0.0.0.0.0.0.0.0.0.0.0.8.E.F.ip6.arpa. PTR DESKTOP-7H5SFF1-2.local.
Error: (04/19/2018 04:29:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.178.20:5353 23 A.4.D.9.6.9.3.6.9.4.2.B.4.0.5.4.0.0.0.0.0.0.0.0.0.0.0.0.0.8.E.F.ip6.arpa. PTR DESKTOP-7H5SFF1.local.
Error: (04/19/2018 04:29:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding 25 20.178.168.192.in-addr.arpa. PTR DESKTOP-7H5SFF1-2.local.
Error: (04/19/2018 04:29:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.178.20:5353 23 20.178.168.192.in-addr.arpa. PTR DESKTOP-7H5SFF1.local.
Error: (04/19/2018 04:29:06 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Local Hostname DESKTOP-7H5SFF1.local already in use; will try DESKTOP-7H5SFF1-2.local instead
Error: (04/19/2018 04:29:06 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: ProbeCount 2; will deregister 4 DESKTOP-7H5SFF1.local. Addr 192.168.178.20
Error: (04/19/2018 04:29:06 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.178.20:5353 16 DESKTOP-7H5SFF1.local. AAAA 2A0A:A541:517C:0000:4504:B249:6396:9D4A
Systemfehler:
=============
Error: (04/19/2018 06:08:50 PM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-7H5SFF1)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "DESKTOP-7H5SFF1\Admin" (SID: S-1-5-21-2112417269-1118582597-2908858126-1001) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
und der APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (04/19/2018 04:41:20 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Treiber konnte nicht geladen werden.
Error: (04/19/2018 04:41:20 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\Admin\AppData\Local\Temp\ehdrv.sys
Error: (04/19/2018 04:41:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Treiber konnte nicht geladen werden.
Error: (04/19/2018 04:41:19 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\Admin\AppData\Local\Temp\ehdrv.sys
Error: (04/19/2018 04:41:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Treiber konnte nicht geladen werden.
Error: (04/19/2018 04:41:19 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\Admin\AppData\Local\Temp\ehdrv.sys
Error: (04/19/2018 04:41:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Treiber konnte nicht geladen werden.
Windows Defender:
===================================
Date: 2018-04-19 16:29:03.526
Description:
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {6F445A8D-EECB-49BB-93E1-096FE9C1C095}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: DESKTOP-7H5SFF1\Admin
CodeIntegrity:
===================================
Date: 2018-04-19 18:12:17.866
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.
Date: 2018-04-19 18:12:17.862
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.
Date: 2018-04-19 18:11:41.779
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.
Date: 2018-04-19 18:11:41.778
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.
Date: 2018-04-19 17:57:17.827
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.
Date: 2018-04-19 17:57:17.823
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.
Date: 2018-04-19 17:56:41.371
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.
Date: 2018-04-19 17:56:41.370
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll that did not meet the Microsoft signing level requirements.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i7-6700 CPU @ 3.40GHz
Prozentuale Nutzung des RAM: 28%
Installierter physikalischer RAM: 16317.65 MB
Verfügbarer physikalischer RAM: 11700.23 MB
Summe virtueller Speicher: 18749.65 MB
Verfügbarer virtueller Speicher: 13290.94 MB
==================== Laufwerke ================================
Drive c: () (Fixed) (Total:221.62 GB) (Free:64.83 GB) NTFS
Drive d: (Volume) (Fixed) (Total:931.51 GB) (Free:552.51 GB) NTFS
Drive e: (1018_02092017) (CDROM) (Total:0.26 GB) (Free:0 GB) UDF
Drive f: (KEY) (Fixed) (Total:10.31 GB) (Free:10.29 GB) NTFS
\\?\Volume{57587fd1-0000-0000-0000-100000000000}\ (System-reserviert) (Fixed) (Total:0.49 GB) (Free:0.45 GB) NTFS
\\?\Volume{57587fd1-0000-0000-0000-208737000000}\ () (Fixed) (Total:0.46 GB) (Free:0.07 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 931.5 GB) (Disk ID: 43CCD3C5)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7/8/10) (Size: 232.9 GB) (Disk ID: 57587FD1)
Partition 1: (Active) - (Size=500 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=221.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=469 MB) - (Type=27)
Partition 4: (Not Active) - (Size=10.3 GB) - (Type=07 NTFS)
==================== Ende von Addition.txt ============================
Der Trojaner war laut ESET
https://forum.eset.com/topic/15300-jsretefet-trojan-from-skypebrowserhostexe/
Ein false positive.
Trotzdem mache ich mir sorgen um den Adwcleaner Fund
***** [ Chromium (and derivatives) ] *****
Deleted MSN Homepage & Bing Search Engine |
So funktioniert es:
FRST 32-Bit | FRST 64-Bit