Trojaner-Board - Offen Wie werde ich WORM/Autorun.UI.126.15 [worm] wieder los?

Code:

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:17-04-2016 01

durchgeführt von Saskia (Administrator) auf SASKIA (18-04-2016 10:27:00)

Gestartet von C:\Users\Saskia\Downloads

Geladene Profile: Saskia (Verfügbare Profile: Saskia)

Platform: Windows 8 (X64) Sprache: Deutsch (Deutschland)

Internet Explorer Version 10 (Standard-Browser: FF)

Start-Modus: Normal

Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Prozesse (Nicht auf der Ausnahmeliste) =================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe

(Sonic Solutions) C:\Program Files (x86)\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Sonic Solutions) C:\Program Files (x86)\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe

(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(Flux Software LLC) C:\Users\Saskia\AppData\Local\FluxSoftware\Flux\flux.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

() C:\Program Files (x86)\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe

(Wondershare) C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

(Sonic Solutions) C:\Program Files (x86)\Common Files\Roxio Shared\SharedCOM8\CPSHelpRunner.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

(Adobe Systems Incorporated) C:\Program Files\Adobe\Elements 13 Organizer\PhotoshopElementsFileAgent.exe

(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Microsoft Corporation) C:\Windows\System32\msiexec.exe
 
 

==================== Registry (Nicht auf der Ausnahmeliste) ===========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
 

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3015920 2013-02-06] (Synaptics Incorporated)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [557984 2014-08-27] (Adobe Systems Incorporated)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176952 2016-03-19] (Apple Inc.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7165000 2013-03-26] (Realtek Semiconductor)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-02-25] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [807392 2016-03-17] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [67384 2016-03-18] (Apple Inc.)

HKLM-x32\...\Run: [TkBellExe] => C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [295512 2013-10-11] (RealNetworks, Inc.)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [RoxWatchTray] => C:\Program Files (x86)\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe [163840 2006-02-14] ()

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.)

HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [475448 2014-03-26] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [66320 2015-09-10] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2087264 2014-09-11] (Wondershare)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\Run: [AmazonMP3DownloaderHelper] => C:\Users\Saskia\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] ()

HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\Run: [CCleaner Monitoring] => C:\Program Files (x86)\CCleaner\CCleaner64.exe [6482200 2014-09-26] (Piriform Ltd)

HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\Run: [f.lux] => C:\Users\Saskia\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-24] (Flux Software LLC)

HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1

Startup: C:\Users\Saskia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP ENVY 5640 series.lnk [2016-04-18]

ShortcutTarget: Tintenwarnungen überwachen - HP ENVY 5640 series.lnk -> C:\Program Files\HP\HP ENVY 5640 series\Bin\HPStatusBL.dll (Hewlett-Packard Development Company, LP)
 

==================== Internet (Nicht auf der Ausnahmeliste) ====================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
 

Winsock: Catalog9 01 C:\Windows\system32\LavasoftTcpService.dll Keine Datei 

Winsock: Catalog9 02 C:\Windows\system32\LavasoftTcpService.dll Keine Datei 

Winsock: Catalog9 03 C:\Windows\system32\LavasoftTcpService.dll Keine Datei 

Winsock: Catalog9 04 C:\Windows\system32\LavasoftTcpService.dll Keine Datei 

Winsock: Catalog9 15 C:\Windows\system32\LavasoftTcpService.dll Keine Datei 

Winsock: Catalog9-x64 01 C:\Windows\system32\LavasoftTcpService64.dll [425744 2015-10-14] (Lavasoft Limited)

Winsock: Catalog9-x64 02 C:\Windows\system32\LavasoftTcpService64.dll [425744 2015-10-14] (Lavasoft Limited)

Winsock: Catalog9-x64 03 C:\Windows\system32\LavasoftTcpService64.dll [425744 2015-10-14] (Lavasoft Limited)

Winsock: Catalog9-x64 04 C:\Windows\system32\LavasoftTcpService64.dll [425744 2015-10-14] (Lavasoft Limited)

Winsock: Catalog9-x64 15 C:\Windows\system32\LavasoftTcpService64.dll [425744 2015-10-14] (Lavasoft Limited)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Tcpip\..\Interfaces\{50125984-C1B4-4E99-85AD-1EF988A79E2C}: [DhcpNameServer] 192.168.2.1

Tcpip\..\Interfaces\{9F49EA48-57A1-49CB-9DAF-43692C100C63}: [DhcpNameServer] 40.20.1.201 40.20.1.203 40.20.1.202
 

Internet Explorer:

==================

HKU\S-1-5-21-1180511552-3395178981-381098957-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 

HKU\S-1-5-21-1180511552-3395178981-381098957-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT13/4

HKU\S-1-5-21-1180511552-3395178981-381098957-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT13/4

HKU\S-1-5-21-1180511552-3395178981-381098957-1001\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.uk.msn.com/HPNOT13/4

SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM -> {480F4056-4481-41A3-A47C-E268A0C1B586} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = 

SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 -> {480F4056-4481-41A3-A47C-E268A0C1B586} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = 

SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-1180511552-3395178981-381098957-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-1180511552-3395178981-381098957-1001 -> {480F4056-4481-41A3-A47C-E268A0C1B586} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKU\S-1-5-21-1180511552-3395178981-381098957-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2016-02-25] (HP)

BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2013-08-14] (RealDownloader)

BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2016-02-25] (HP)

Toolbar: HKU\S-1-5-21-1180511552-3395178981-381098957-1001 -> Kein Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  Keine Datei
 

FireFox:

========

FF ProfilePath: C:\Users\Saskia\AppData\Roaming\Mozilla\Firefox\Profiles\zdapoljn.default-1447890261049

FF Homepage: hxxp://www.google.com/

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_21_0_0_213.dll [2016-04-08] ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_213.dll [2016-04-08] ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2016-03-08] ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.66 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-09-29] (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-09-29] (Intel Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)

FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll [2013-10-11] (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [2013-08-14] (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2013-08-14] (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll [2013-08-14] (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll [2013-10-11] (RealPlayer)

FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [2013-08-14] (RealDownloader)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-01] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-01] (Google Inc.)

FF Plugin HKU\S-1-5-21-1180511552-3395178981-381098957-1001: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Saskia\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll [2013-05-22] (Amazon.com, Inc.)

FF Extension: YouTube mp3 - C:\Users\Saskia\AppData\Roaming\Mozilla\Firefox\Profiles\zdapoljn.default-1447890261049\Extensions\info@youtube-mp3.org.xpi [2015-11-19]

FF Extension: Adblock Plus - C:\Users\Saskia\AppData\Roaming\Mozilla\Firefox\Profiles\zdapoljn.default-1447890261049\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-02-24]

FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext

FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-10-11] [ist nicht signiert]

FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
 

Chrome: 

=======

CHR Profile: C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\default

CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14]
 

==================== Dienste (Nicht auf der Ausnahmeliste) ========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

R2 AdobeActiveFileMonitor13.0; C:\Program Files\Adobe\Elements 13 Organizer\PhotoshopElementsFileAgent.exe [231120 2015-01-30] (Adobe Systems Incorporated)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [955736 2016-03-17] (Avira Operations GmbH & Co. KG)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [466504 2016-03-17] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [466504 2016-03-17] (Avira Operations GmbH & Co. KG)

S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1424880 2016-03-17] (Avira Operations GmbH & Co. KG)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-03-02] (Apple Inc.)

S2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [240872 2015-09-10] (Avira Operations GmbH & Co. KG)

R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [26680 2016-02-18] (Hewlett-Packard Company)

R2 HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [469304 2014-03-26] (Hewlett-Packard Development Company, L.P.)

R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-04-10] (Intel Corporation)

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [Datei ist nicht signiert]

R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [732160 2012-12-10] (Intel(R) Corporation) [Datei ist nicht signiert]

S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131032 2013-01-14] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165336 2013-01-14] (Intel Corporation)

R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()

S2 RoxLiveShare; C:\Program Files (x86)\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe [233472 2006-02-14] (Sonic Solutions) [Datei ist nicht signiert]

R3 RoxMediaDB; C:\Program Files (x86)\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe [864256 2006-02-14] (Sonic Solutions) [Datei ist nicht signiert]

R2 RoxWatch; C:\Program Files (x86)\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe [155648 2006-02-14] (Sonic Solutions) [Datei ist nicht signiert]

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [239176 2013-02-20] (Realtek Semiconductor)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2015-07-06] (Microsoft Corporation)
 

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36520 2012-09-14] (Advanced Micro Devices, Inc.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128664 2016-03-17] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [137952 2016-03-17] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [35488 2015-12-24] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [68936 2016-03-17] (Avira Operations GmbH & Co. KG)

S1 cdudf_xp; C:\Windows\System32\Drivers\cdudf_xp.sys [344064 2005-10-22] (Sonic Solutions)

S3 dvd_2K; C:\Windows\System32\Drivers\dvd_2K.sys [33792 2005-10-22] (Sonic Solutions)

S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3265256 2013-03-23] (Broadcom Corporation)

S3 mmc_2K; C:\Windows\System32\Drivers\mmc_2K.sys [32768 2005-10-22] (Sonic Solutions)

S1 pwd_2k; C:\Windows\System32\Drivers\pwd_2k.sys [128512 2005-10-22] (Sonic Solutions)

R0 PxHlpa64; C:\Windows\System32\drivers\PxHlpa64.sys [56336 2013-09-03] (Corel Corporation)

S3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [288328 2013-01-24] (Realtek Semiconductor Corp.)

S3 RTSPER; C:\Windows\System32\DRIVERS\RtsPer.sys [448072 2013-02-02] (RTS Corporation)

R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [3029208 2013-07-12] (Realtek Semiconductor Corporation                           )

S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [28400 2013-02-06] (Synaptics Incorporated)

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31984 2013-02-06] (Synaptics Incorporated)

U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()

S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-06] (Microsoft Corporation)

S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [281944 2015-07-06] (Microsoft Corporation)

R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2012-08-31] (Hewlett-Packard Development Company, L.P.)
 

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
 

==================== Ein Monat: Erstellte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2016-04-18 10:27 - 2016-04-18 10:27 - 00023823 _____ C:\Users\Saskia\Downloads\FRST.txt

2016-04-18 10:26 - 2016-04-18 10:27 - 00000000 ____D C:\FRST

2016-04-18 10:24 - 2016-04-18 10:24 - 02375680 _____ (Farbar) C:\Users\Saskia\Downloads\FRST64.exe

2016-04-18 01:02 - 2016-04-18 01:02 - 00017393 _____ C:\Users\Saskia\Desktop\malwarebytes.txt

2016-04-18 01:02 - 2016-04-18 01:02 - 00017388 _____ C:\malware.txt

2016-04-18 00:05 - 2016-04-18 00:05 - 00002259 _____ C:\Windows\epplauncher.mif

2016-04-18 00:03 - 2016-04-18 00:04 - 14345408 _____ (Microsoft Corporation) C:\Users\Saskia\Downloads\mseinstall.exe

2016-04-12 18:38 - 2016-04-18 10:18 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2016-04-08 18:06 - 2016-04-08 18:06 - 00014164 _____ C:\Users\Saskia\Downloads\R_ckmeldung_zu_Ihrer_Anfrage.eml

2016-04-06 11:06 - 2016-04-18 10:16 - 00002183 _____ C:\Users\Public\Desktop\HP ENVY 5640 series.lnk

2016-04-06 11:06 - 2016-04-18 10:16 - 00001998 _____ C:\Users\Public\Desktop\HP Photo Creations.lnk

2016-04-06 11:06 - 2016-04-18 10:16 - 00001145 _____ C:\Users\Public\Desktop\Shop für Zubehör - HP ENVY 5640 series.lnk

2016-04-06 11:06 - 2016-04-13 18:24 - 00000000 ____D C:\Users\Saskia\AppData\Roaming\HpUpdate

2016-04-06 11:06 - 2016-04-06 11:06 - 00003608 _____ C:\Windows\System32\Tasks\HPCustParticipation HP ENVY 5640 series

2016-04-06 11:06 - 2016-04-06 11:06 - 00000000 ____D C:\ProgramData\Visan

2016-04-06 11:06 - 2016-04-06 11:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP

2016-04-06 11:06 - 2016-04-06 11:06 - 00000000 ____D C:\ProgramData\HP Photo Creations

2016-04-06 11:06 - 2016-04-06 11:06 - 00000000 ____D C:\Program Files (x86)\HP Photo Creations

2016-04-06 11:06 - 2014-08-22 05:12 - 00751624 ____N (Hewlett-Packard Development Company, LP) C:\Windows\system32\HPDiscoPMCC11.dll

2016-04-06 11:05 - 2016-04-06 11:17 - 00000000 ____D C:\ProgramData\HP

2016-04-06 11:05 - 2016-04-06 11:06 - 00000000 ____D C:\Program Files (x86)\HP

2016-04-06 11:05 - 2016-04-06 11:05 - 00000000 ____D C:\Program Files\HP

2016-04-06 11:04 - 2016-04-06 11:09 - 00000000 ____D C:\Users\Saskia\AppData\Local\HP

2016-04-06 11:04 - 2016-04-06 11:04 - 00000057 _____ C:\ProgramData\Ament.ini

2016-04-05 10:57 - 2016-04-05 10:57 - 00494544 _____ C:\Users\Saskia\Desktop\Garantie Drucker HP.pdf

2016-04-04 22:56 - 2016-04-18 10:16 - 00001790 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DTS Audio Control Panel.lnk

2016-04-04 22:49 - 2016-04-04 22:49 - 00000000 ____D C:\Windows\SysWOW64\RTCOM

2016-04-04 22:49 - 2016-04-04 22:49 - 00000000 ____D C:\Windows\LastGood

2016-04-04 22:49 - 2013-03-26 20:54 - 03376200 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys

2016-04-04 22:49 - 2013-03-26 19:34 - 00135240 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInstII64.dll

2016-04-04 22:49 - 2013-03-26 17:06 - 02797128 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll

2016-04-04 22:49 - 2013-03-26 16:05 - 00445929 _____ C:\Windows\system32\Drivers\RTAIODAT.DAT

2016-04-04 22:49 - 2013-03-26 15:40 - 03693128 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkAPO64.dll

2016-04-04 22:49 - 2013-03-26 14:38 - 01659464 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl

2016-04-04 22:49 - 2013-03-26 09:53 - 20461568 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoRes64.dat

2016-04-04 22:49 - 2013-03-12 18:16 - 00613448 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtDataProc64.dll

2016-04-04 22:47 - 2013-03-13 07:32 - 00208072 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll

2016-04-04 22:31 - 2016-04-04 22:40 - 00000000 ____D C:\Users\Saskia\Downloads\HP Downloads

2016-04-04 22:26 - 2016-04-04 22:27 - 03836976 _____ (Oleg N. Scherbakov) C:\Users\Saskia\Downloads\HPSupportSolutionsFramework-12.3.11.29.exe

2016-04-04 18:26 - 2016-04-04 18:26 - 00000000 ____D C:\Windows\LastGood.Tmp

2016-04-04 18:25 - 2013-06-04 17:26 - 00000008 _____ C:\Windows\system32\Drivers\rtkhdaud.dat

2016-03-28 18:41 - 2016-04-18 10:16 - 00001760 _____ C:\Users\Public\Desktop\iTunes.lnk

2016-03-28 18:41 - 2016-03-28 18:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2016-03-28 18:40 - 2016-03-28 18:40 - 00000000 ____D C:\Program Files\iPod

2016-03-28 18:37 - 2016-03-28 18:37 - 00000000 ____D C:\Windows\System32\Tasks\Apple

2016-03-28 18:37 - 2016-03-28 18:37 - 00000000 ____D C:\Program Files (x86)\Apple Software Update

2016-03-25 00:22 - 2016-03-25 00:22 - 00000000 ____D C:\Program Files\Google

2016-03-24 19:58 - 2016-03-24 20:18 - 450071920 _____ C:\Users\Saskia\Downloads\nikcollection-full-1.2.11.exe

2016-03-20 19:34 - 2016-03-20 19:34 - 00000000 ____D C:\Program Files\Bonjour

2016-03-20 19:34 - 2016-03-20 19:34 - 00000000 ____D C:\Program Files (x86)\Bonjour
 

==================== Ein Monat: Geänderte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2016-04-18 10:24 - 2013-10-09 11:20 - 00003596 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1180511552-3395178981-381098957-1001

2016-04-18 10:20 - 2015-01-08 00:18 - 00001128 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2016-04-18 10:19 - 2014-11-01 20:21 - 00001356 _____ C:\Windows\Tasks\DLOJNX.job

2016-04-18 10:19 - 2014-11-01 20:21 - 00001354 _____ C:\Windows\Tasks\YASOY.job

2016-04-18 10:19 - 2014-11-01 20:14 - 00001354 _____ C:\Windows\Tasks\FKEHU.job

2016-04-18 10:19 - 2014-11-01 20:14 - 00001348 _____ C:\Windows\Tasks\AA.job

2016-04-18 10:19 - 2013-10-09 11:10 - 00000000 ____D C:\Users\Saskia

2016-04-18 10:18 - 2013-10-09 11:21 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2016-04-18 10:18 - 2012-07-26 09:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2016-04-18 10:17 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\L2Schemas

2016-04-18 10:16 - 2015-11-13 23:55 - 00002234 _____ C:\Users\Saskia\Desktop\HP Support Assistant.lnk

2016-04-18 10:16 - 2015-04-08 00:41 - 00001057 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop Elements 13.lnk

2016-04-18 10:16 - 2015-04-08 00:41 - 00001045 _____ C:\Users\Public\Desktop\Adobe Photoshop Elements 13.lnk

2016-04-18 10:16 - 2015-01-16 23:56 - 00001234 _____ C:\Users\Public\Desktop\Wise Registry Cleaner.lnk

2016-04-18 10:16 - 2015-01-13 01:50 - 00002062 _____ C:\Users\Public\Desktop\Lightroom 5.4 64-Bit.lnk

2016-04-18 10:16 - 2014-12-08 23:41 - 00002056 _____ C:\Users\Public\Desktop\ViewNX 2.lnk

2016-04-18 10:16 - 2014-11-25 15:12 - 00001167 _____ C:\Users\Saskia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2016-04-18 10:16 - 2014-10-21 18:25 - 00001024 _____ C:\Users\Public\Desktop\CCleaner.lnk

2016-04-18 10:16 - 2014-09-29 23:57 - 00002267 _____ C:\Users\Saskia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

2016-04-18 10:16 - 2014-07-30 00:12 - 00001307 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\paint.net.lnk

2016-04-18 10:16 - 2014-03-26 14:09 - 00000602 _____ C:\Users\Saskia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\brushes.lnk

2016-04-18 10:16 - 2014-02-03 14:01 - 00000736 _____ C:\Users\Public\Desktop\Intel(R) HD Graphics Control Panel.lnk

2016-04-18 10:16 - 2013-12-16 23:58 - 00001098 _____ C:\Users\Saskia\Desktop\FilExile.lnk

2016-04-18 10:16 - 2013-11-11 14:07 - 00001354 _____ C:\Users\Saskia\Desktop\2pic.lnk

2016-04-18 10:16 - 2013-11-07 15:11 - 00002194 _____ C:\Users\Public\Desktop\Roxio PhotoSuite 8.lnk

2016-04-18 10:16 - 2013-11-07 14:28 - 00002859 _____ C:\Users\Saskia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Install Clean Up.lnk

2016-04-18 10:16 - 2013-10-22 11:27 - 00002026 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk

2016-04-18 10:16 - 2013-10-11 14:28 - 00001116 _____ C:\Users\Public\Desktop\OpenOffice 4.0.1.lnk

2016-04-18 10:16 - 2013-10-11 13:43 - 00001361 _____ C:\Users\Public\Desktop\RealPlayer.lnk

2016-04-18 10:16 - 2013-10-09 14:41 - 00001109 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2016-04-18 10:16 - 2013-10-09 13:59 - 00002519 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk

2016-04-18 10:16 - 2013-10-09 13:45 - 00001271 _____ C:\Users\Saskia\Desktop\Revo Uninstaller.lnk

2016-04-18 10:16 - 2013-10-09 13:45 - 00001113 _____ C:\Users\Public\Desktop\Free RAR Extract Frog.lnk

2016-04-18 10:16 - 2013-10-09 11:21 - 00001068 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2016-04-18 10:16 - 2013-10-09 11:21 - 00001056 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2016-04-18 10:16 - 2013-10-09 11:13 - 00002109 _____ C:\Users\Public\Desktop\Snapfish Fotos.lnk

2016-04-18 10:16 - 2013-06-02 01:35 - 00001106 _____ C:\Users\Public\Desktop\HP Quick Start.lnk

2016-04-18 10:16 - 2013-03-23 14:24 - 00001115 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Connected Music.lnk

2016-04-18 10:16 - 2013-03-23 14:24 - 00001103 _____ C:\Users\Public\Desktop\HP Connected Music.lnk

2016-04-18 01:05 - 2015-01-08 00:18 - 00001132 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2016-04-18 00:47 - 2016-03-02 11:33 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2016-04-18 00:33 - 2014-11-01 23:44 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2016-04-18 00:24 - 2014-11-01 23:32 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2016-04-17 22:56 - 2014-01-20 11:41 - 01952918 _____ C:\Windows\system32\PerfStringBackup.INI

2016-04-17 22:56 - 2013-03-23 21:59 - 00831158 _____ C:\Windows\system32\perfh007.dat

2016-04-17 22:56 - 2013-03-23 21:59 - 00188760 _____ C:\Windows\system32\perfc007.dat

2016-04-17 22:56 - 2012-07-26 07:37 - 00000000 ____D C:\Windows\Inf

2016-04-17 10:37 - 2013-10-10 18:52 - 00000000 ____D C:\Users\Saskia\AppData\Local\Adobe

2016-04-15 23:26 - 2013-10-10 13:24 - 00000000 ____D C:\Windows\system32\MRT

2016-04-15 23:20 - 2013-10-10 13:24 - 135176864 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2016-04-14 22:36 - 2013-11-22 23:42 - 00000000 ____D C:\Users\Saskia\Desktop\Neuer Ordner

2016-04-14 19:24 - 2014-01-04 15:34 - 00000000 ____D C:\Users\Saskia\Desktop\Neuer Ordner (2)

2016-04-14 18:13 - 2012-07-26 10:12 - 00000000 ___HD C:\Program Files\WindowsApps

2016-04-14 18:13 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\AUInstallAgent

2016-04-12 18:14 - 2015-05-14 11:05 - 00000000 ____D C:\Users\Saskia\Desktop\sisi2

2016-04-12 18:05 - 2012-07-26 07:26 - 00524288 ___SH C:\Windows\system32\config\BBI

2016-04-08 23:01 - 2014-10-18 23:55 - 00000000 ____D C:\Users\Saskia\Desktop\Unbenannter Export

2016-04-08 18:47 - 2016-03-11 23:47 - 05934784 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe

2016-04-08 18:47 - 2016-03-02 11:33 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2016-04-08 11:24 - 2015-03-22 10:53 - 00010824 _____ C:\Users\Saskia\Desktop\Unbenannt 1.odt

2016-04-07 18:26 - 2014-03-06 19:22 - 00000350 _____ C:\Windows\Tasks\HPCeeScheduleForSaskia.job

2016-04-06 11:09 - 2013-10-09 11:11 - 00000000 ____D C:\Users\Saskia\AppData\Local\Packages

2016-04-04 22:57 - 2013-06-02 01:15 - 00000000 ___HD C:\Program Files (x86)\Temp

2016-04-04 22:47 - 2013-03-23 14:27 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2016-04-04 22:45 - 2015-03-28 00:01 - 02666168 _____ C:\Windows\system32\FNTCACHE.DAT

2016-04-04 22:42 - 2013-06-02 01:14 - 00000000 ____D C:\Program Files (x86)\Realtek

2016-04-04 22:13 - 2013-11-01 20:08 - 00000000 ____D C:\Users\Saskia\AppData\Local\ElevatedDiagnostics

2016-04-04 18:24 - 2012-08-04 02:02 - 00000000 ____D C:\SWSetup

2016-04-04 00:17 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\NDF

2016-03-28 18:41 - 2013-12-17 00:09 - 00000000 ____D C:\Program Files\iTunes

2016-03-28 18:40 - 2013-12-17 00:09 - 00000000 ____D C:\Program Files (x86)\iTunes

2016-03-28 18:40 - 2013-10-09 13:59 - 00000000 ____D C:\Program Files\Common Files\Apple

2016-03-25 00:25 - 2015-01-08 00:18 - 00000000 ____D C:\ProgramData\Google

2016-03-25 00:25 - 2013-11-07 14:21 - 00000000 ____D C:\Users\Saskia\AppData\Local\Google

2016-03-24 23:43 - 2013-10-17 19:26 - 00000000 ____D C:\Users\Saskia\AppData\Roaming\DVDVideoSoft

2016-03-24 23:41 - 2015-10-14 18:58 - 00000000 ____D C:\Users\Saskia\AppData\Roaming\Solveig Multimedia

2016-03-24 23:41 - 2015-10-14 18:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Solveig Multimedia

2016-03-24 23:41 - 2015-10-14 18:57 - 00000000 ____D C:\Program Files (x86)\Solveig Multimedia

2016-03-20 19:37 - 2015-02-26 00:16 - 00000000 ____D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
 

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
 

2014-09-01 10:18 - 2014-09-01 10:18 - 0002086 _____ () C:\Users\Saskia\AppData\Roaming\AA

2013-10-14 00:05 - 2013-12-24 00:25 - 0000132 _____ () C:\Users\Saskia\AppData\Roaming\Adobe CS5-Voreinstellungen für BMP-Format

2014-09-01 10:18 - 2014-09-01 10:18 - 0002086 _____ () C:\Users\Saskia\AppData\Roaming\DLOJNX

2014-12-08 23:41 - 2014-12-08 23:41 - 0000268 ___RH () C:\Users\Saskia\AppData\Roaming\Drum Kits

2014-12-08 23:42 - 2014-12-08 23:42 - 0000268 ___RH () C:\Users\Saskia\AppData\Roaming\Drums

2014-12-08 23:41 - 2014-12-08 23:41 - 0000268 ___RH () C:\Users\Saskia\AppData\Roaming\Dynamic Library

2014-12-08 23:40 - 2014-12-08 23:40 - 0000268 ___RH () C:\Users\Saskia\AppData\Roaming\External Build System

2014-09-01 10:18 - 2014-09-01 10:18 - 0001248 _____ () C:\Users\Saskia\AppData\Roaming\FKEHU

2014-09-01 10:18 - 2014-09-01 10:18 - 0001248 _____ () C:\Users\Saskia\AppData\Roaming\YASOY

2016-04-06 11:04 - 2016-04-06 11:04 - 0000057 _____ () C:\ProgramData\Ament.ini

2014-12-08 23:41 - 2014-12-08 23:41 - 0000268 ___RH () C:\ProgramData\Effects

2014-12-08 23:42 - 2014-12-08 23:42 - 0000268 ___RH () C:\ProgramData\Electric Clav

2014-12-08 23:41 - 2014-12-08 23:41 - 0000268 ___RH () C:\ProgramData\Electric Piano

2014-12-08 23:40 - 2014-12-08 23:41 - 0000012 ___RH () C:\ProgramData\Filters

2014-12-08 23:42 - 2014-12-08 23:42 - 0000012 ___RH () C:\ProgramData\Flange Saw

2014-12-08 23:41 - 2014-12-08 23:41 - 0000012 ___RH () C:\ProgramData\Flowers

2014-12-08 23:40 - 2014-12-08 23:40 - 0000012 ___RH () C:\ProgramData\Helper Scripts

2014-12-08 23:40 - 2014-12-08 23:40 - 0000020 ____H () C:\ProgramData\PKP_DLeo.DAT

2014-12-08 23:42 - 2014-12-08 23:42 - 0000020 ____H () C:\ProgramData\PKP_DLes.DAT

2014-12-08 23:41 - 2015-04-03 23:54 - 0000020 ____H () C:\ProgramData\PKP_DLet.DAT

2014-12-08 23:41 - 2015-03-21 23:17 - 0000020 ____H () C:\ProgramData\PKP_DLev.DAT
 

Einige Dateien in TEMP:

====================

C:\Users\Saskia\AppData\Local\Temp\ACLMInstaller.exe

C:\Users\Saskia\AppData\Local\Temp\avgnt.exe

C:\Users\Saskia\AppData\Local\Temp\FreemakeVideoConverterFull.exe

C:\Users\Saskia\AppData\Local\Temp\HPSFUpdater.exe

C:\Users\Saskia\AppData\Local\Temp\UninstallHPSA.exe
 
 

==================== Bamital & volsnap =================
 

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
 

C:\Windows\system32\winlogon.exe => Datei ist digital signiert

C:\Windows\system32\wininit.exe => Datei ist digital signiert

C:\Windows\explorer.exe => Datei ist digital signiert

C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert

C:\Windows\system32\svchost.exe => Datei ist digital signiert

C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert

C:\Windows\system32\services.exe => Datei ist digital signiert

C:\Windows\system32\User32.dll => Datei ist digital signiert

C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert

C:\Windows\system32\userinit.exe => Datei ist digital signiert

C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert

C:\Windows\system32\rpcss.dll => Datei ist digital signiert

C:\Windows\system32\dnsapi.dll => Datei ist digital signiert

C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert

C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
 
 

LastRegBack: 2016-04-06 11:24
 

==================== Ende von FRST.txt ============================

Code:

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:17-04-2016 01

durchgeführt von Saskia (2016-04-18 10:28:24)

Gestartet von C:\Users\Saskia\Downloads

Windows 8 (X64) (2013-10-09 09:10:51)

Start-Modus: Normal

==========================================================
 
 

==================== Konten: =============================
 

Administrator (S-1-5-21-1180511552-3395178981-381098957-500 - Administrator - Disabled)

Gast (S-1-5-21-1180511552-3395178981-381098957-501 - Limited - Disabled)

Saskia (S-1-5-21-1180511552-3395178981-381098957-1001 - Administrator - Enabled) => C:\Users\Saskia
 

==================== Sicherheits-Center ========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
 

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AV: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installierte Programme ======================
 

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
 

2 Pic (HKLM-x32\...\2 Pic) (Version:  - )

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 20.0.0.204 - Adobe Systems Incorporated)

Adobe Flash Player 21 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 21.0.0.213 - Adobe Systems Incorporated)

Adobe Photoshop Elements 13 (HKLM-x32\...\{609818B9-23EB-4196-B466-EFE05E92A32F}) (Version: 13.1 - Adobe Systems Incorporated)

Adobe Photoshop Lightroom 5.4 64-bit (HKLM\...\{558B5965-CC1B-4AF1-BA07-5D6832404050}) (Version: 5.4.0 - Adobe Systems Incorporated)

Adobe Photoshop Lightroom 5.6 64-bit (HKLM\...\{D19E99C2-6D9D-4075-B446-B4387EAF70A5}) (Version: 5.6.0 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

Amazon MP3-Downloader 1.0.18 (HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\Amazon MP3-Downloader) (Version: 1.0.18 - Amazon Services LLC)

AMD Catalyst Install Manager (HKLM\...\{EA5160BE-7558-2716-01DB-FFE7F316957A}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)

Apple Application Support (32-Bit) (HKLM-x32\...\{FE5C2FAA-118D-4509-B51D-3F71CC9E1B3E}) (Version: 4.3 - Apple Inc.)

Apple Application Support (64-Bit) (HKLM\...\{2937FD88-C9D6-4B82-B539-37CD0A572F42}) (Version: 4.3 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{2E4AF2A6-50EA-4260-9BA4-5E582D11879A}) (Version: 9.3.0.15 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)

Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.16.282 - Avira Operations GmbH & Co. KG)

Avira Launcher (HKLM-x32\...\{5dfbeba9-9f22-463d-8c95-c861911810a2}) (Version: 1.1.47.11018 - Avira Operations GmbH & Co. KG)

Avira Launcher (x32 Version: 1.1.47.11018 - Avira Operations GmbH & Co. KG) Hidden

Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)

Capture NX-D (HKLM\...\{794529D3-D489-4CF2-B2ED-CF241809E5EC}) (Version: 1.0.3 - Nikon)

CCleaner (HKLM\...\CCleaner) (Version: 4.18 - Piriform)

Combined Community Codec Pack 2014-04-20 (HKLM-x32\...\Combined Community Codec Pack_is1) (Version: 2014.04.20.0 - CCCP Project)

CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.3.2606 - CyberLink Corp.)

CyberLink PowerDVD (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.8.5004 - CyberLink Corp.)

CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.6.6117 - CyberLink Corp.)

DHTML Editing Component (HKLM-x32\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)

DragToDisc64Install (Version: 1.00.0000 - Roxio, Inc.) Hidden

Energy Star (HKLM-x32\...\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)

f.lux (HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\Flux) (Version:  - )

FilExile (HKLM-x32\...\{1310229C-E62A-4F05-87DB-13979A5D2EFC}_is1) (Version: 1.51 - Bryan Carey)

Free RAR Extract Frog (HKLM-x32\...\Free RAR Extract Frog) (Version: 5.20 - Philipp Winterberg)

Google Update Helper (x32 Version: 1.3.29.5 - Google Inc.) Hidden

Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden

HP 3D DriveGuard (HKLM\...\{AB5BCC55-18E2-46C7-9405-FF61CB888F05}) (Version: 4.2.9.1 - Hewlett-Packard Company)

HP Connected Music (Meridian - installer) (HKLM-x32\...\StartHPConnectedMusic) (Version: 1.0 - Meridian Audio Ltd)

HP Connected Music (Meridian - player) (HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\HPConnectedMusic) (Version: 1.1 (build 112) hp - Meridian Audio Ltd)

HP CoolSense (HKLM-x32\...\{59F8C5AA-91BD-423D-BF05-09A80F39898F}) (Version: 2.10.62 - Hewlett-Packard Company)

HP Documentation (HKLM-x32\...\{B41C6B3F-F752-46EA-BC46-F26D3AD147B8}) (Version: 1.2.0.0 - Hewlett-Packard)

HP ENVY 5640 series - Grundlegende Software für das Gerät (HKLM\...\{8ED07F8D-A230-4DB7-B0A0-A67336FD7797}) (Version: 34.2.117.50647 - Hewlett-Packard Co.)

HP ENVY 5640 series Hilfe (HKLM-x32\...\{FE81C6FB-7A42-4ADE-A50A-2E44D6B7BD24}) (Version: 34.0.0 - Hewlett Packard)

HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)

HP Quick Start (HKLM-x32\...\{BB27C290-AB30-4D9E-A5D1-88745AAE42E9}) (Version: 1.0.4660.30220 - Hewlett-Packard)

HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.6317.4309 - Hewlett-Packard)

HP Support Solutions Framework (HKLM-x32\...\{B1AD4FFB-DD17-43EC-8C30-B9E71EAD9132}) (Version: 12.2.8.17 - Hewlett-Packard Company)

HP System Event Utility (HKLM-x32\...\{DEF23826-DB71-4654-BC00-D5D6C20802EA}) (Version: 1.1.4 - Hewlett-Packard Company)

HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)

HP Utility Center (HKLM\...\{73237EBB-B26F-4628-8754-4EFE563D72E9}) (Version: 2.1.5 - Hewlett-Packard Company)

HP Wireless Button Driver (HKLM-x32\...\{30B2D1D8-0A07-4B71-9553-0710C5D31E35}) (Version: 1.1.2.1 - Hewlett-Packard Company)

ICA (x32 Version: 17.0.0.199 - Corel Corporation) Hidden

iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.30.1349 - Intel Corporation)

Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3345 - Intel Corporation)

Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.0.7.1002 - Intel Corporation)

Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 3.0.0.63463 - Intel Corporation)

iTunes (HKLM\...\{A31C5565-90D9-4615-AE13-94D86C3836C7}) (Version: 12.3.3.17 - Apple Inc.)

K-Lite Codec Pack 10.5.0 Full (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.5.0 - )

Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)

Microsoft OneDrive (HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\OneDriveSetup.exe) (Version: 17.0.4035.0328 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{d07b0db5-8dad-40e1-be90-88026298a46b}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)

Mozilla Firefox 45.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 45.0.2 (x86 de)) (Version: 45.0.2 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 45.0.2.5941 - Mozilla)

MP3 Parser DirectShow Filter (remove only) (HKLM-x32\...\mp3parse) (Version:  - )

NEF Codec (HKLM-x32\...\{D6506521-0959-4FA3-875F-E2E28830B0D2}) (Version: 1.27.0 - Nikon Corporation)

Nik Collection (HKLM-x32\...\Nik Collection) (Version: 1.2.11 - Google)

Nikon Movie Editor (HKLM-x32\...\{5CAD3393-EEC0-44CE-9F93-BCAA365B77FB}) (Version: 2.8.0 - Nikon)

OEM Application Profile (HKLM-x32\...\{C89A97B6-F991-EBB5-77B7-927BCF420EBE}) (Version: 1.00.0000 - Ihr Firmenname)

OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)

paint.net (HKLM\...\{F509C1F4-0029-49F9-B145-A4C4E8DF481A}) (Version: 4.0.3 - dotPDN LLC)

Picture Control Utility 2 (HKLM\...\{D4893C47-704F-4B84-8486-9DE4974ACA6F}) (Version: 2.0.1 - Nikon)

Picture Control Utility x64 (HKLM\...\{11953C65-BB4E-4CA4-B0F0-2600A4B20040}) (Version: 1.4.15 - Nikon)

PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden

QuickTime (HKLM-x32\...\{0E64B098-8018-4256-BA23-C316A43AD9B0}) (Version: 7.72.80.56 - Apple Inc.)

RealDownloader (x32 Version: 1.3.3 - RealNetworks, Inc.) Hidden

RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden

RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden

RealPlayer (HKLM-x32\...\RealPlayer 16.0) (Version: 16.0.3 - RealNetworks)

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.7.1025.2012 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6870 - Realtek Semiconductor Corp.)

Realtek PCIE Card Reader (HKLM-x32\...\{BCDA54F6-C4B6-4519-A09E-FA064A6B4098}) (Version: 1.1.9200.007 - Realtek Semiconductor Corp.)

REALTEK Wireless LAN Driver (HKLM-x32\...\{A5107464-AA9B-4177-8129-5FF2F42DD322}) (Version: 1.00.12.0906 - REALTEK Semiconductor Corp.)

RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden

Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

Roxio PhotoSuite 8 (HKLM-x32\...\{56F62349-521A-44FD-A9E6-F8DF2B34F560}) (Version: 8.0.568 - Roxio, Inc.)

Studie zur Verbesserung von HP ENVY 5640 series (HKLM\...\{CC803199-ABD7-43B6-95CE-9B4D5695CF94}) (Version: 34.2.117.50647 - Hewlett-Packard Co.)

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.3.12.1 - Synaptics Incorporated)

Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)

ViewNX 2 (HKLM\...\{635BE602-BB9C-4C59-8CC5-93F9366E8A21}) (Version: 2.8.2 - Nikon)

Windows Installer Clean Up (HKLM-x32\...\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}) (Version: 3.00.00.0000 - Microsoft Corporation)

Wise Registry Cleaner 8.83 (HKLM-x32\...\Wise Registry Cleaner_is1) (Version: 8.83 - WiseCleaner.com, Inc.)
 

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
 

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

Task: {01B161B8-03A0-40C5-A5DD-0C654F9E8C47} - System32\Tasks\FKEHU => C:\Users\Saskia\AppData\Roaming\FKEHU.exe <==== ACHTUNG

Task: {08B0C342-F0F4-4F51-9C68-77D6AF832582} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-02-18] (Hewlett-Packard Company)

Task: {164BE35B-7654-48EC-B8F5-2EC2CF8B9632} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2016-03-02] (Hewlett-Packard)

Task: {2F6C5945-8903-406F-8C41-8A59375015D8} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1180511552-3395178981-381098957-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)

Task: {3201B3BD-6009-46B5-9356-310BE8092702} - System32\Tasks\DLOJNX => C:\Users\Saskia\AppData\Roaming\DLOJNX.exe <==== ACHTUNG

Task: {5261B04F-D8B0-47CD-B4C2-D254FC71E7AC} - System32\Tasks\AA => C:\Users\Saskia\AppData\Roaming\AA.exe <==== ACHTUNG

Task: {5597CBAF-EA3C-40C9-8237-4733E2C6B16E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-03-07] (Hewlett-Packard)

Task: {5D31BD8B-CBF3-4596-9FA7-8AA7F2A86A24} - System32\Tasks\YASOY => C:\Users\Saskia\AppData\Roaming\YASOY.exe <==== ACHTUNG

Task: {70D47C86-D9E6-4C03-90C9-9E7EA06B261A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)

Task: {80A3362D-433F-4A70-86DB-ED82FB4C7AEE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-04-08] (Adobe Systems Incorporated)

Task: {90E520EA-CCE5-40EA-B101-CF4E2C05F39D} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)

Task: {A74A4122-D26E-455E-AD3A-FBFB2DA90429} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)

Task: {A7B0515C-7D9A-452B-8BAC-DB6739DA1DB6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Active Health Launcher => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2016-03-02] (Hewlett-Packard)

Task: {CD50DC2C-302A-40FC-90A9-A867278FB344} - System32\Tasks\AdobeAAMUpdater-1.0-MicrosoftAccount-saskia.albert@t-online.de => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2014-08-27] (Adobe Systems Incorporated)

Task: {E1EA663B-8C6F-493A-9A3C-E285DF6635F0} - kein Dateipfad

Task: {EAA89597-B506-4D0F-9BF9-51C22EA6E6A0} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2016-03-11] (Hewlett-Packard)

Task: {F32916DE-1A6D-4FDC-AC49-329B97861342} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2013-01-17] (CyberLink)

Task: {F4E675ED-F756-4D18-BAB9-5AC8BA4352B5} - System32\Tasks\Hewlett-Packard\HP CoolSense\HP CoolSense Start at Logon => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [2012-11-05] (Hewlett-Packard Development Company, L.P.)

Task: {F804F1E3-5200-4C62-B7E0-05700D3CD2ED} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-02-18] (Hewlett-Packard Company)

Task: {FF35B817-EF81-4118-935E-80802023DB57} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2016-04-15] (Microsoft Corporation)

Task: {FF56D9C2-E0FC-466E-B519-F351C9C775B5} - System32\Tasks\HPCustParticipation HP ENVY 5640 series => C:\Program Files\HP\HP ENVY 5640 series\Bin\HPCustPartic.exe [2014-08-22] (Hewlett-Packard Development Company, LP)
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
 

Task: C:\Windows\Tasks\AA.job => C:\Users\Saskia\AppData\Roaming\AA.exe <==== ACHTUNG

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\DLOJNX.job => C:\Users\Saskia\AppData\Roaming\DLOJNX.exe <==== ACHTUNG

Task: C:\Windows\Tasks\FKEHU.job => C:\Users\Saskia\AppData\Roaming\FKEHU.exe <==== ACHTUNG

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\HPCeeScheduleForSaskia.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

Task: C:\Windows\Tasks\YASOY.job => C:\Users\Saskia\AppData\Roaming\YASOY.exe <==== ACHTUNG
 

==================== Verknüpfungen =============================
 

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
 

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
 

2016-03-18 22:56 - 2016-03-18 22:56 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

2016-03-18 22:56 - 2016-03-18 22:56 - 01329936 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

2013-08-14 15:19 - 2013-08-14 15:19 - 00039056 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe

2013-02-22 15:04 - 2013-02-22 15:04 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2006-02-14 18:46 - 2006-02-14 18:46 - 00163840 _____ () C:\Program Files (x86)\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe

2006-02-14 18:28 - 2006-02-14 18:28 - 04448256 ____R () C:\Program Files (x86)\Common Files\Roxio Shared\DLLShared\ROXIPP4.dll

2006-02-14 18:33 - 2006-02-14 18:33 - 00491520 _____ () C:\Program Files (x86)\Common Files\Roxio Shared\DLLShared\LayoutDll.dll

2015-10-14 18:31 - 2014-09-11 18:09 - 01498112 _____ () C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\DAQExp.dll

2015-10-14 18:31 - 2014-05-19 17:19 - 00137728 _____ () C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSCreateVC.dll

2013-06-02 01:14 - 2013-01-14 20:25 - 01200088 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
 

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
 

AlternateDataStreams: C:\Users\Saskia\Desktop\10438347_726107077450057_7576925251253422374_n.jpg:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\12814614_10153910208654694_2329379751559800168_n.jpg:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\1935201_1126591324020474_5046440346108704121_n.png:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\941221_550279898344137_2102593541_n.jpg:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Adobe:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Adobe Photoshop Elements 13:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Adobe Photoshop Elements 13 (PC Download):Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Adobe Photoshop Lightroom 5 deutsch WIN (Download):Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Ahnenforschung:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Alte Firefox-Daten:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\BEWERBUNGEN:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Dokumente u Schriftverkehr:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\fonts:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\jhfgjy.jpg:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Lightroom:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 10:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 11:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 12:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 13:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 2:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 3:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 4:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 5:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 6:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 7:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 8:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 9:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Neuer Ordner:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Neuer Ordner (2):Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\OpenOffice 4.0.1 (de) Installation Files:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Porta Westfalica 11.8.14:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Project01.jpg:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\sisi2:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\td-1.jpg:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Unbenannter Export:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Downloads\smartcurve:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\Adobe:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\Amazon Downloader Logs:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\Amazon MP3:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\before_the_rain:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\champignon:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\Corel PaintShop Pro:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\CyberLink:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\diane_de_france:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\DxO Optics Pro v8 logs:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\exmouth:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\Freemake:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\LightZone:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\lyric_dragon:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\My Weblog Posts:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\retroactive:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\scriptina:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\so_lonely:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\Vistumbler:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\Wondershare Filmora:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\Youcam:Roxio EMC Stream [38]
 

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
 
 

==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
 
 

==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
 

IE trusted site: HKU\.DEFAULT\...\localhost -> localhost

IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com

IE trusted site: HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\localhost -> localhost

IE trusted site: HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\webcompanion.com -> hxxp://webcompanion.com
 

==================== Hosts Inhalt: ===============================
 

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
 

2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 
 

==================== Andere Bereiche ============================
 

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
 

HKU\S-1-5-21-1180511552-3395178981-381098957-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Saskia\Desktop\Neuer Ordner\10314022_741446899252481_1009929526277762213_n.jpg

DNS Servers: 192.168.2.1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall ist aktiviert.
 

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
 

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
 

MSCONFIG\Services: RoxLiveShare => 2

MSCONFIG\Services: RoxMediaDB => 3

MSCONFIG\Services: RoxWatch => 2

HKLM\...\StartupApproved\Run: => "AdobeAAMUpdater-1.0"

HKLM\...\StartupApproved\Run: => "Ocs_SM"

HKLM\...\StartupApproved\Run32: => "iTunesHelper"

HKLM\...\StartupApproved\Run32: => "TkBellExe"

HKLM\...\StartupApproved\Run32: => "Adobe ARM"

HKLM\...\StartupApproved\Run32: => "QuickTime Task"

HKLM\...\StartupApproved\Run32: => "Ulead AutoDetector v2"

HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\StartupApproved\Run: => "AmazonMP3DownloaderHelper"

HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\StartupApproved\Run: => "CCleaner Monitoring"
 

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139

FirewallRules: [{9C84801F-6AEE-42EB-BD8D-B48EBF191B67}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe

FirewallRules: [{3A6FED2C-184C-4098-81B0-49EA5614E222}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe

FirewallRules: [{2DB4074C-5D37-4D4E-95A8-AB5D2F4F6709}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\HPConnectedMusic.exe

FirewallRules: [{B503FA71-CAEF-4E60-84D2-AB5E620D93CE}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\HPConnectedMusic.exe

FirewallRules: [{8CFA3CCB-5394-488E-A47B-31077D241959}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\spotify_helper.exe

FirewallRules: [{D8931A25-AEE1-4238-95C0-39F5A38CF5D3}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\spotify_helper.exe

FirewallRules: [{1DF90624-59ED-43AD-8192-315FFA64B5CE}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE

FirewallRules: [{D3D67B06-A648-4B3D-B414-1D05976A28B5}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDirector10\PDR10.EXE

FirewallRules: [{8CE88C7E-DEA0-45F4-9F55-8BACA46C8518}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{D7E70FD8-8070-4C3E-A968-2E4A127FAC23}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [TCP Query User{EAD69224-DF25-4B9B-8FEC-E626E536A36F}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe

FirewallRules: [UDP Query User{33DDB279-9479-47A5-A0EF-7E14FDF0E048}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe

FirewallRules: [{E88764D7-7FC7-4F5A-8ACE-72CECEC6FBE9}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{F84C3BD6-F7E6-4240-A74A-7EF3BD72D27C}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{9941878C-687C-47C9-A6DE-19DB5F8B8089}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{31580720-11C5-44E6-8C6C-6194444951C5}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{992D549F-F040-417B-B730-B8979EF7F77C}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{AD94C6C8-7536-4F49-88AF-AAD4D56E163D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{E44103D7-CD23-4521-8410-4031D38FA2CB}] => (Allow) C:\Program Files\iTunes\iTunes.exe

FirewallRules: [{EC344AB2-CA60-48C3-9B75-EFEA7C93CD9D}] => (Allow) C:\Program Files\HP\HP ENVY 5640 series\Bin\DeviceSetup.exe

FirewallRules: [{061821FC-F858-4CFC-9D32-05CD076C24A1}] => (Allow) LPort=5357

FirewallRules: [{6C1100EF-0B13-4584-BE0D-F9D20D54D4B5}] => (Allow) C:\Program Files\HP\HP ENVY 5640 series\Bin\HPNetworkCommunicatorCom.exe
 

==================== Wiederherstellungspunkte =========================
 

15-03-2016 19:36:35 Windows Update

24-03-2016 23:40:04 Revo Uninstaller's restore point - SolveigMM AVI Trimmer+ Version 5.0.1509.11

24-03-2016 23:42:12 Revo Uninstaller's restore point - Free Video Flip and Rotate version 1.0.10.616

04-04-2016 18:13:25 HPSF Applying updates

15-04-2016 23:19:40 Windows Update
 

==================== Fehlerhafte Geräte im Gerätemanager =============
 
 

==================== Fehlereinträge in der Ereignisanzeige: =========================
 

Applikationsfehler:

==================

Error: (04/18/2016 10:21:21 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: Avira.ServiceHost.exe, Version: 1.1.47.11018, Zeitstempel: 0x55f12efe

Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.2.9200.17366, Zeitstempel: 0x554d16f6

Ausnahmecode: 0xe0434352

Fehleroffset: 0x00010192

ID des fehlerhaften Prozesses: 0x134c

Startzeit der fehlerhaften Anwendung: 0xAvira.ServiceHost.exe0

Pfad der fehlerhaften Anwendung: Avira.ServiceHost.exe1

Pfad des fehlerhaften Moduls: Avira.ServiceHost.exe2

Berichtskennung: Avira.ServiceHost.exe3

Vollständiger Name des fehlerhaften Pakets: Avira.ServiceHost.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Avira.ServiceHost.exe5
 

Error: (04/18/2016 10:21:21 AM) (Source: .NET Runtime) (EventID: 1026) (User: )

Description: Anwendung: Avira.ServiceHost.exe

Frameworkversion: v4.0.30319

Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.

Ausnahmeinformationen: System.MissingMethodException

Stapel:

   bei Avira.OE.CertificateTools.AuthenticodeVerifier.HasTrustworthyAviraSignature(System.String)

   bei Avira.OE.CertificateTools.AuthenticodeVerifier.VerifyAviraSignature(System.String)

   bei Avira.OE.ServiceHost.AssemblyLoadVerifier.IsSignatureValid(Avira.OE.CertificateTools.IAuthenticodeVerifier, System.String)

   bei Avira.OE.ServiceHost.AssemblyLoadVerifier+<>c__DisplayClass2.<AreSignaturesValid>b__1(System.String)

   bei System.Linq.Enumerable.All[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.Collections.Generic.IEnumerable`1<System.__Canon>, System.Func`2<System.__Canon,Boolean>)

   bei Avira.OE.ServiceHost.AssemblyLoadVerifier.AreSignaturesValid(System.Collections.Generic.IEnumerable`1<System.String>)

   bei Avira.OE.ServiceHost.Program+<>c__DisplayClass1.<OnServiceStart>b__0(System.Object)

   bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)

   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)

   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)

   bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()

   bei System.Threading.ThreadPoolWorkQueue.Dispatch()

   bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
 

Error: (04/18/2016 10:21:10 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: Avira.ServiceHost.exe, Version: 1.1.47.11018, Zeitstempel: 0x55f12efe

Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.2.9200.17366, Zeitstempel: 0x554d16f6

Ausnahmecode: 0xe0434352

Fehleroffset: 0x00010192

ID des fehlerhaften Prozesses: 0x7d0

Startzeit der fehlerhaften Anwendung: 0xAvira.ServiceHost.exe0

Pfad der fehlerhaften Anwendung: Avira.ServiceHost.exe1

Pfad des fehlerhaften Moduls: Avira.ServiceHost.exe2

Berichtskennung: Avira.ServiceHost.exe3

Vollständiger Name des fehlerhaften Pakets: Avira.ServiceHost.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Avira.ServiceHost.exe5
 

Error: (04/18/2016 10:21:10 AM) (Source: .NET Runtime) (EventID: 1026) (User: )

Description: Anwendung: Avira.ServiceHost.exe

Frameworkversion: v4.0.30319

Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.

Ausnahmeinformationen: System.MissingMethodException

Stapel:

   bei Avira.OE.CertificateTools.AuthenticodeVerifier.HasTrustworthyAviraSignature(System.String)

   bei Avira.OE.CertificateTools.AuthenticodeVerifier.VerifyAviraSignature(System.String)

   bei Avira.OE.ServiceHost.AssemblyLoadVerifier.IsSignatureValid(Avira.OE.CertificateTools.IAuthenticodeVerifier, System.String)

   bei Avira.OE.ServiceHost.AssemblyLoadVerifier+<>c__DisplayClass2.<AreSignaturesValid>b__1(System.String)

   bei System.Linq.Enumerable.All[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.Collections.Generic.IEnumerable`1<System.__Canon>, System.Func`2<System.__Canon,Boolean>)

   bei Avira.OE.ServiceHost.AssemblyLoadVerifier.AreSignaturesValid(System.Collections.Generic.IEnumerable`1<System.String>)

   bei Avira.OE.ServiceHost.Program+<>c__DisplayClass1.<OnServiceStart>b__0(System.Object)

   bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)

   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)

   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)

   bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()

   bei System.Threading.ThreadPoolWorkQueue.Dispatch()

   bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
 

Error: (04/18/2016 10:19:55 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: Avira.ServiceHost.exe, Version: 1.1.47.11018, Zeitstempel: 0x55f12efe

Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.2.9200.17366, Zeitstempel: 0x554d16f6

Ausnahmecode: 0xe0434352

Fehleroffset: 0x00010192

ID des fehlerhaften Prozesses: 0xa08

Startzeit der fehlerhaften Anwendung: 0xAvira.ServiceHost.exe0

Pfad der fehlerhaften Anwendung: Avira.ServiceHost.exe1

Pfad des fehlerhaften Moduls: Avira.ServiceHost.exe2

Berichtskennung: Avira.ServiceHost.exe3

Vollständiger Name des fehlerhaften Pakets: Avira.ServiceHost.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Avira.ServiceHost.exe5
 

Error: (04/18/2016 10:19:54 AM) (Source: .NET Runtime) (EventID: 1026) (User: )

Description: Anwendung: Avira.ServiceHost.exe

Frameworkversion: v4.0.30319

Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.

Ausnahmeinformationen: System.MissingMethodException

Stapel:

   bei Avira.OE.CertificateTools.AuthenticodeVerifier.HasTrustworthyAviraSignature(System.String)

   bei Avira.OE.CertificateTools.AuthenticodeVerifier.VerifyAviraSignature(System.String)

   bei Avira.OE.ServiceHost.AssemblyLoadVerifier.IsSignatureValid(Avira.OE.CertificateTools.IAuthenticodeVerifier, System.String)

   bei Avira.OE.ServiceHost.AssemblyLoadVerifier+<>c__DisplayClass2.<AreSignaturesValid>b__1(System.String)

   bei System.Linq.Enumerable.All[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.Collections.Generic.IEnumerable`1<System.__Canon>, System.Func`2<System.__Canon,Boolean>)

   bei Avira.OE.ServiceHost.AssemblyLoadVerifier.AreSignaturesValid(System.Collections.Generic.IEnumerable`1<System.String>)

   bei Avira.OE.ServiceHost.Program+<>c__DisplayClass1.<OnServiceStart>b__0(System.Object)

   bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)

   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)

   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)

   bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()

   bei System.Threading.ThreadPoolWorkQueue.Dispatch()

   bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
 

Error: (04/18/2016 10:15:28 AM) (Source: ATIeRecord) (EventID: 16391) (User: )

Description: ATI EEU maximum number of session has been surpassed
 

Error: (04/18/2016 01:28:38 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 6282
 

Error: (04/18/2016 01:28:38 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 6282
 

Error: (04/18/2016 01:28:38 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 
 

Systemfehler:

=============

Error: (04/18/2016 10:21:31 AM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 3 Mal passiert.
 

Error: (04/18/2016 10:21:11 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (04/18/2016 10:20:59 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (04/18/2016 10:18:28 AM) (Source: Microsoft-Windows-TaskScheduler) (EventID: 413) (User: NT-AUTORITÄT)

Description: Beim Start des Aufgabenplanungsdiensts konnten Aufgaben nicht geladen werden. Zusätzliche Daten: Fehlerwert: 2147942402.
 

Error: (04/18/2016 10:18:15 AM) (Source: EventLog) (EventID: 6008) (User: )

Description: Das System wurde zuvor am ‎18.‎04.‎2016 um 10:15:18 unerwartet heruntergefahren.
 

Error: (04/12/2016 06:09:37 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 3 Mal passiert.
 

Error: (04/12/2016 06:09:17 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (04/12/2016 06:08:57 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (04/11/2016 10:01:48 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 3 Mal passiert.
 

Error: (04/11/2016 10:01:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
 
 

CodeIntegrity:

===================================

  Date: 2016-04-18 10:17:59.120

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\Drivers\cdudf_xp.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2016-04-18 10:17:58.979

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\Drivers\pwd_2k.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2016-04-12 18:06:45.305

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\Drivers\cdudf_xp.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2016-04-12 18:06:45.165

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\Drivers\pwd_2k.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2016-04-11 21:58:24.381

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\Drivers\cdudf_xp.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2016-04-11 21:58:24.241

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\Drivers\pwd_2k.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2016-04-04 22:45:11.247

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\Drivers\cdudf_xp.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2016-04-04 22:45:11.106

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\Drivers\pwd_2k.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2016-04-04 00:19:46.309

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\Drivers\cdudf_xp.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2016-04-04 00:19:46.153

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\Drivers\pwd_2k.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
 

==================== Speicherinformationen =========================== 
 

Prozessor: Intel(R) Core(TM) i7-3632QM CPU @ 2.20GHz

Prozentuale Nutzung des RAM: 33%

Installierter physikalischer RAM: 6036.27 MB

Verfügbarer physikalischer RAM: 3995.4 MB

Summe virtueller Speicher: 6996.27 MB

Verfügbarer virtueller Speicher: 4902.28 MB
 

==================== Laufwerke ================================
 

Drive c: (Windows) (Fixed) (Total:446.27 GB) (Free:281.09 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]

Drive d: (RECOVERY) (Fixed) (Total:18.72 GB) (Free:1.85 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
 

==================== MBR & Partitionstabelle ==================
 

========================================================

Disk: 0 (Size: 465.8 GB) (Disk ID: 5135DB13)
 

Partition: GPT.
 

==================== Ende von Addition.txt ============================

Habe ich zwischen den ganzen Anleitungen und Codes überlesen. So einfach ist das. Kein Grund gleich pampig zu werden.

Code:

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:17-04-2016 01

durchgeführt von Saskia (2016-04-19 22:46:06)

Gestartet von C:\Users\Saskia\Desktop

Windows 8 (X64) (2013-10-09 09:10:51)

Start-Modus: Normal

==========================================================
 
 

==================== Konten: =============================
 

Administrator (S-1-5-21-1180511552-3395178981-381098957-500 - Administrator - Disabled)

Gast (S-1-5-21-1180511552-3395178981-381098957-501 - Limited - Disabled)

Saskia (S-1-5-21-1180511552-3395178981-381098957-1001 - Administrator - Enabled) => C:\Users\Saskia
 

==================== Sicherheits-Center ========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
 

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installierte Programme ======================
 

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
 

2 Pic (HKLM-x32\...\2 Pic) (Version:  - )

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 20.0.0.204 - Adobe Systems Incorporated)

Adobe Flash Player 21 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 21.0.0.213 - Adobe Systems Incorporated)

Adobe Photoshop Elements 13 (HKLM-x32\...\{609818B9-23EB-4196-B466-EFE05E92A32F}) (Version: 13.1 - Adobe Systems Incorporated)

Adobe Photoshop Lightroom 5.4 64-bit (HKLM\...\{558B5965-CC1B-4AF1-BA07-5D6832404050}) (Version: 5.4.0 - Adobe Systems Incorporated)

Adobe Photoshop Lightroom 5.6 64-bit (HKLM\...\{D19E99C2-6D9D-4075-B446-B4387EAF70A5}) (Version: 5.6.0 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

Amazon MP3-Downloader 1.0.18 (HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\Amazon MP3-Downloader) (Version: 1.0.18 - Amazon Services LLC)

AMD Catalyst Install Manager (HKLM\...\{EA5160BE-7558-2716-01DB-FFE7F316957A}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)

Apple Application Support (32-Bit) (HKLM-x32\...\{FE5C2FAA-118D-4509-B51D-3F71CC9E1B3E}) (Version: 4.3 - Apple Inc.)

Apple Application Support (64-Bit) (HKLM\...\{2937FD88-C9D6-4B82-B539-37CD0A572F42}) (Version: 4.3 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{2E4AF2A6-50EA-4260-9BA4-5E582D11879A}) (Version: 9.3.0.15 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)

Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)

Capture NX-D (HKLM\...\{794529D3-D489-4CF2-B2ED-CF241809E5EC}) (Version: 1.0.3 - Nikon)

CCleaner (HKLM\...\CCleaner) (Version: 4.18 - Piriform)

Combined Community Codec Pack 2014-04-20 (HKLM-x32\...\Combined Community Codec Pack_is1) (Version: 2014.04.20.0 - CCCP Project)

CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.3.2606 - CyberLink Corp.)

CyberLink PowerDVD (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.8.5004 - CyberLink Corp.)

CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.6.6117 - CyberLink Corp.)

DHTML Editing Component (HKLM-x32\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)

DragToDisc64Install (Version: 1.00.0000 - Roxio, Inc.) Hidden

Energy Star (HKLM-x32\...\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)

f.lux (HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\Flux) (Version:  - )

FilExile (HKLM-x32\...\{1310229C-E62A-4F05-87DB-13979A5D2EFC}_is1) (Version: 1.51 - Bryan Carey)

Free RAR Extract Frog (HKLM-x32\...\Free RAR Extract Frog) (Version: 5.20 - Philipp Winterberg)

Google Update Helper (x32 Version: 1.3.29.5 - Google Inc.) Hidden

Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden

HP 3D DriveGuard (HKLM\...\{AB5BCC55-18E2-46C7-9405-FF61CB888F05}) (Version: 4.2.9.1 - Hewlett-Packard Company)

HP Connected Music (Meridian - installer) (HKLM-x32\...\StartHPConnectedMusic) (Version: 1.0 - Meridian Audio Ltd)

HP Connected Music (Meridian - player) (HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\HPConnectedMusic) (Version: 1.1 (build 112) hp - Meridian Audio Ltd)

HP CoolSense (HKLM-x32\...\{59F8C5AA-91BD-423D-BF05-09A80F39898F}) (Version: 2.10.62 - Hewlett-Packard Company)

HP Documentation (HKLM-x32\...\{B41C6B3F-F752-46EA-BC46-F26D3AD147B8}) (Version: 1.2.0.0 - Hewlett-Packard)

HP ENVY 5640 series - Grundlegende Software für das Gerät (HKLM\...\{8ED07F8D-A230-4DB7-B0A0-A67336FD7797}) (Version: 34.2.117.50647 - Hewlett-Packard Co.)

HP ENVY 5640 series Hilfe (HKLM-x32\...\{FE81C6FB-7A42-4ADE-A50A-2E44D6B7BD24}) (Version: 34.0.0 - Hewlett Packard)

HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)

HP Quick Start (HKLM-x32\...\{BB27C290-AB30-4D9E-A5D1-88745AAE42E9}) (Version: 1.0.4660.30220 - Hewlett-Packard)

HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.6317.4309 - Hewlett-Packard)

HP Support Solutions Framework (HKLM-x32\...\{B1AD4FFB-DD17-43EC-8C30-B9E71EAD9132}) (Version: 12.2.8.17 - Hewlett-Packard Company)

HP System Event Utility (HKLM-x32\...\{DEF23826-DB71-4654-BC00-D5D6C20802EA}) (Version: 1.1.4 - Hewlett-Packard Company)

HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)

HP Utility Center (HKLM\...\{73237EBB-B26F-4628-8754-4EFE563D72E9}) (Version: 2.1.5 - Hewlett-Packard Company)

HP Wireless Button Driver (HKLM-x32\...\{30B2D1D8-0A07-4B71-9553-0710C5D31E35}) (Version: 1.1.2.1 - Hewlett-Packard Company)

ICA (x32 Version: 17.0.0.199 - Corel Corporation) Hidden

iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.30.1349 - Intel Corporation)

Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3345 - Intel Corporation)

Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.0.7.1002 - Intel Corporation)

Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 3.0.0.63463 - Intel Corporation)

iTunes (HKLM\...\{A31C5565-90D9-4615-AE13-94D86C3836C7}) (Version: 12.3.3.17 - Apple Inc.)

K-Lite Codec Pack 10.5.0 Full (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.5.0 - )

Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)

Microsoft OneDrive (HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\OneDriveSetup.exe) (Version: 17.0.4035.0328 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{d07b0db5-8dad-40e1-be90-88026298a46b}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)

Mozilla Firefox 45.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 45.0.2 (x86 de)) (Version: 45.0.2 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 45.0.2.5941 - Mozilla)

MP3 Parser DirectShow Filter (remove only) (HKLM-x32\...\mp3parse) (Version:  - )

NEF Codec (HKLM-x32\...\{D6506521-0959-4FA3-875F-E2E28830B0D2}) (Version: 1.27.0 - Nikon Corporation)

Nik Collection (HKLM-x32\...\Nik Collection) (Version: 1.2.11 - Google)

Nikon Movie Editor (HKLM-x32\...\{5CAD3393-EEC0-44CE-9F93-BCAA365B77FB}) (Version: 2.8.0 - Nikon)

OEM Application Profile (HKLM-x32\...\{C89A97B6-F991-EBB5-77B7-927BCF420EBE}) (Version: 1.00.0000 - Ihr Firmenname)

OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)

paint.net (HKLM\...\{F509C1F4-0029-49F9-B145-A4C4E8DF481A}) (Version: 4.0.3 - dotPDN LLC)

Picture Control Utility 2 (HKLM\...\{D4893C47-704F-4B84-8486-9DE4974ACA6F}) (Version: 2.0.1 - Nikon)

Picture Control Utility x64 (HKLM\...\{11953C65-BB4E-4CA4-B0F0-2600A4B20040}) (Version: 1.4.15 - Nikon)

PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden

QuickTime (HKLM-x32\...\{0E64B098-8018-4256-BA23-C316A43AD9B0}) (Version: 7.72.80.56 - Apple Inc.)

RealDownloader (x32 Version: 1.3.3 - RealNetworks, Inc.) Hidden

RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden

RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden

RealPlayer (HKLM-x32\...\RealPlayer 16.0) (Version: 16.0.3 - RealNetworks)

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.7.1025.2012 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6870 - Realtek Semiconductor Corp.)

Realtek PCIE Card Reader (HKLM-x32\...\{BCDA54F6-C4B6-4519-A09E-FA064A6B4098}) (Version: 1.1.9200.007 - Realtek Semiconductor Corp.)

REALTEK Wireless LAN Driver (HKLM-x32\...\{A5107464-AA9B-4177-8129-5FF2F42DD322}) (Version: 1.00.12.0906 - REALTEK Semiconductor Corp.)

RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden

Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

Roxio PhotoSuite 8 (HKLM-x32\...\{56F62349-521A-44FD-A9E6-F8DF2B34F560}) (Version: 8.0.568 - Roxio, Inc.)

Studie zur Verbesserung von HP ENVY 5640 series (HKLM\...\{CC803199-ABD7-43B6-95CE-9B4D5695CF94}) (Version: 34.2.117.50647 - Hewlett-Packard Co.)

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.3.12.1 - Synaptics Incorporated)

Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)

ViewNX 2 (HKLM\...\{635BE602-BB9C-4C59-8CC5-93F9366E8A21}) (Version: 2.8.2 - Nikon)

Windows Installer Clean Up (HKLM-x32\...\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}) (Version: 3.00.00.0000 - Microsoft Corporation)

Wise Registry Cleaner 8.83 (HKLM-x32\...\Wise Registry Cleaner_is1) (Version: 8.83 - WiseCleaner.com, Inc.)
 

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
 

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

Task: {01B161B8-03A0-40C5-A5DD-0C654F9E8C47} - System32\Tasks\FKEHU => C:\Users\Saskia\AppData\Roaming\FKEHU.exe <==== ACHTUNG

Task: {08B0C342-F0F4-4F51-9C68-77D6AF832582} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-02-18] (Hewlett-Packard Company)

Task: {2F6C5945-8903-406F-8C41-8A59375015D8} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1180511552-3395178981-381098957-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)

Task: {3201B3BD-6009-46B5-9356-310BE8092702} - System32\Tasks\DLOJNX => C:\Users\Saskia\AppData\Roaming\DLOJNX.exe <==== ACHTUNG

Task: {5261B04F-D8B0-47CD-B4C2-D254FC71E7AC} - System32\Tasks\AA => C:\Users\Saskia\AppData\Roaming\AA.exe <==== ACHTUNG

Task: {5597CBAF-EA3C-40C9-8237-4733E2C6B16E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-03-07] (Hewlett-Packard)

Task: {5D31BD8B-CBF3-4596-9FA7-8AA7F2A86A24} - System32\Tasks\YASOY => C:\Users\Saskia\AppData\Roaming\YASOY.exe <==== ACHTUNG

Task: {70D47C86-D9E6-4C03-90C9-9E7EA06B261A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)

Task: {80A3362D-433F-4A70-86DB-ED82FB4C7AEE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-04-08] (Adobe Systems Incorporated)

Task: {90E520EA-CCE5-40EA-B101-CF4E2C05F39D} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)

Task: {A74A4122-D26E-455E-AD3A-FBFB2DA90429} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)

Task: {A7B0515C-7D9A-452B-8BAC-DB6739DA1DB6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Active Health Launcher => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2016-03-02] (Hewlett-Packard)

Task: {B41364F8-68FC-4254-A3C9-36FAB8818B83} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2016-03-02] (Hewlett-Packard)

Task: {CD50DC2C-302A-40FC-90A9-A867278FB344} - System32\Tasks\AdobeAAMUpdater-1.0-MicrosoftAccount-saskia.albert@t-online.de => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2014-08-27] (Adobe Systems Incorporated)

Task: {E1EA663B-8C6F-493A-9A3C-E285DF6635F0} - kein Dateipfad

Task: {EAA89597-B506-4D0F-9BF9-51C22EA6E6A0} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2016-03-11] (Hewlett-Packard)

Task: {F32916DE-1A6D-4FDC-AC49-329B97861342} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2013-01-17] (CyberLink)

Task: {F4E675ED-F756-4D18-BAB9-5AC8BA4352B5} - System32\Tasks\Hewlett-Packard\HP CoolSense\HP CoolSense Start at Logon => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [2012-11-05] (Hewlett-Packard Development Company, L.P.)

Task: {F804F1E3-5200-4C62-B7E0-05700D3CD2ED} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-02-18] (Hewlett-Packard Company)

Task: {FF35B817-EF81-4118-935E-80802023DB57} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2016-04-15] (Microsoft Corporation)

Task: {FF56D9C2-E0FC-466E-B519-F351C9C775B5} - System32\Tasks\HPCustParticipation HP ENVY 5640 series => C:\Program Files\HP\HP ENVY 5640 series\Bin\HPCustPartic.exe [2014-08-22] (Hewlett-Packard Development Company, LP)
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
 

Task: C:\Windows\Tasks\AA.job => C:\Users\Saskia\AppData\Roaming\AA.exe <==== ACHTUNG

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\DLOJNX.job => C:\Users\Saskia\AppData\Roaming\DLOJNX.exe <==== ACHTUNG

Task: C:\Windows\Tasks\FKEHU.job => C:\Users\Saskia\AppData\Roaming\FKEHU.exe <==== ACHTUNG

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\HPCeeScheduleForSaskia.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

Task: C:\Windows\Tasks\YASOY.job => C:\Users\Saskia\AppData\Roaming\YASOY.exe <==== ACHTUNG
 

==================== Verknüpfungen =============================
 

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
 

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
 

2016-03-18 22:56 - 2016-03-18 22:56 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

2016-03-18 22:56 - 2016-03-18 22:56 - 01329936 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

2013-08-14 15:19 - 2013-08-14 15:19 - 00039056 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe

2013-02-22 15:04 - 2013-02-22 15:04 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2006-02-14 18:46 - 2006-02-14 18:46 - 00163840 _____ () C:\Program Files (x86)\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe

2012-10-31 10:05 - 2012-10-31 10:05 - 00607744 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\JobCapsA.DLL

2014-12-30 22:48 - 2015-10-15 16:37 - 00262656 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\OpenHardwareMonitorLib.dll

2006-02-14 18:28 - 2006-02-14 18:28 - 04448256 ____R () C:\Program Files (x86)\Common Files\Roxio Shared\DLLShared\ROXIPP4.dll

2013-06-02 01:14 - 2013-01-14 20:25 - 01200088 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

2006-02-14 18:33 - 2006-02-14 18:33 - 00491520 _____ () C:\Program Files (x86)\Common Files\Roxio Shared\DLLShared\LayoutDll.dll
 

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
 

AlternateDataStreams: C:\Users\Saskia\Desktop\10438347_726107077450057_7576925251253422374_n.jpg:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\12814614_10153910208654694_2329379751559800168_n.jpg:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\1935201_1126591324020474_5046440346108704121_n.png:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\941221_550279898344137_2102593541_n.jpg:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Adobe:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Adobe Photoshop Elements 13:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Adobe Photoshop Elements 13 (PC Download):Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Adobe Photoshop Lightroom 5 deutsch WIN (Download):Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Ahnenforschung:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Alte Firefox-Daten:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\BEWERBUNGEN:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Dokumente u Schriftverkehr:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\fonts:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\jhfgjy.jpg:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Lightroom:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 10:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 11:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 12:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 13:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 2:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 3:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 4:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 5:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 6:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 7:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 8:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\LR Presets 9:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Neuer Ordner:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Neuer Ordner (2):Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\OpenOffice 4.0.1 (de) Installation Files:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Porta Westfalica 11.8.14:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Project01.jpg:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\sisi2:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\td-1.jpg:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Desktop\Unbenannter Export:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Downloads\smartcurve:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\Adobe:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\Amazon Downloader Logs:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\Amazon MP3:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\before_the_rain:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\champignon:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\Corel PaintShop Pro:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\CyberLink:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\diane_de_france:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\DxO Optics Pro v8 logs:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\exmouth:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\Freemake:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\LightZone:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\lyric_dragon:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\My Weblog Posts:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\retroactive:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\scriptina:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\so_lonely:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\Vistumbler:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\Wondershare Filmora:Roxio EMC Stream [38]

AlternateDataStreams: C:\Users\Saskia\Documents\Youcam:Roxio EMC Stream [38]
 

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
 
 

==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
 
 

==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
 

IE trusted site: HKU\.DEFAULT\...\localhost -> localhost

IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com

IE trusted site: HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\localhost -> localhost

IE trusted site: HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\webcompanion.com -> hxxp://webcompanion.com
 

==================== Hosts Inhalt: ===============================
 

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
 

2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 
 

==================== Andere Bereiche ============================
 

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
 

HKU\S-1-5-21-1180511552-3395178981-381098957-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Saskia\Desktop\Neuer Ordner\10314022_741446899252481_1009929526277762213_n.jpg

DNS Servers: 192.168.2.1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall ist aktiviert.
 

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
 

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
 

MSCONFIG\Services: RoxLiveShare => 2

MSCONFIG\Services: RoxMediaDB => 3

MSCONFIG\Services: RoxWatch => 2

HKLM\...\StartupApproved\Run: => "AdobeAAMUpdater-1.0"

HKLM\...\StartupApproved\Run: => "Ocs_SM"

HKLM\...\StartupApproved\Run32: => "iTunesHelper"

HKLM\...\StartupApproved\Run32: => "TkBellExe"

HKLM\...\StartupApproved\Run32: => "Adobe ARM"

HKLM\...\StartupApproved\Run32: => "QuickTime Task"

HKLM\...\StartupApproved\Run32: => "Ulead AutoDetector v2"

HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\StartupApproved\Run: => "AmazonMP3DownloaderHelper"

HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\StartupApproved\Run: => "CCleaner Monitoring"
 

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139

FirewallRules: [{9C84801F-6AEE-42EB-BD8D-B48EBF191B67}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe

FirewallRules: [{3A6FED2C-184C-4098-81B0-49EA5614E222}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe

FirewallRules: [{2DB4074C-5D37-4D4E-95A8-AB5D2F4F6709}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\HPConnectedMusic.exe

FirewallRules: [{B503FA71-CAEF-4E60-84D2-AB5E620D93CE}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\HPConnectedMusic.exe

FirewallRules: [{8CFA3CCB-5394-488E-A47B-31077D241959}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\spotify_helper.exe

FirewallRules: [{D8931A25-AEE1-4238-95C0-39F5A38CF5D3}] => (Allow) %LocalAppData%\HPConnectedMusic\Application\spotify_helper.exe

FirewallRules: [{1DF90624-59ED-43AD-8192-315FFA64B5CE}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE

FirewallRules: [{D3D67B06-A648-4B3D-B414-1D05976A28B5}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDirector10\PDR10.EXE

FirewallRules: [{8CE88C7E-DEA0-45F4-9F55-8BACA46C8518}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{D7E70FD8-8070-4C3E-A968-2E4A127FAC23}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [TCP Query User{EAD69224-DF25-4B9B-8FEC-E626E536A36F}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe

FirewallRules: [UDP Query User{33DDB279-9479-47A5-A0EF-7E14FDF0E048}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe

FirewallRules: [{E88764D7-7FC7-4F5A-8ACE-72CECEC6FBE9}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{F84C3BD6-F7E6-4240-A74A-7EF3BD72D27C}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{9941878C-687C-47C9-A6DE-19DB5F8B8089}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{31580720-11C5-44E6-8C6C-6194444951C5}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{992D549F-F040-417B-B730-B8979EF7F77C}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{AD94C6C8-7536-4F49-88AF-AAD4D56E163D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{E44103D7-CD23-4521-8410-4031D38FA2CB}] => (Allow) C:\Program Files\iTunes\iTunes.exe

FirewallRules: [{EC344AB2-CA60-48C3-9B75-EFEA7C93CD9D}] => (Allow) C:\Program Files\HP\HP ENVY 5640 series\Bin\DeviceSetup.exe

FirewallRules: [{061821FC-F858-4CFC-9D32-05CD076C24A1}] => (Allow) LPort=5357

FirewallRules: [{6C1100EF-0B13-4584-BE0D-F9D20D54D4B5}] => (Allow) C:\Program Files\HP\HP ENVY 5640 series\Bin\HPNetworkCommunicatorCom.exe
 

==================== Wiederherstellungspunkte =========================
 

24-03-2016 23:40:04 Revo Uninstaller's restore point - SolveigMM AVI Trimmer+ Version 5.0.1509.11

24-03-2016 23:42:12 Revo Uninstaller's restore point - Free Video Flip and Rotate version 1.0.10.616

04-04-2016 18:13:25 HPSF Applying updates

15-04-2016 23:19:40 Windows Update

19-04-2016 10:41:31 Revo Uninstaller's restore point - Avira Antivirus

19-04-2016 18:38:03 JRT Pre-Junkware Removal
 

==================== Fehlerhafte Geräte im Gerätemanager =============
 
 

==================== Fehlereinträge in der Ereignisanzeige: =========================
 

Applikationsfehler:

==================

Error: (04/19/2016 01:14:32 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: atieclxx.exe, Version: 6.14.11.1143, Zeitstempel: 0x512bf39a

Name des fehlerhaften Moduls: atieclxx.exe, Version: 6.14.11.1143, Zeitstempel: 0x512bf39a

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000000000002e629

ID des fehlerhaften Prozesses: 0xdc

Startzeit der fehlerhaften Anwendung: 0xatieclxx.exe0

Pfad der fehlerhaften Anwendung: atieclxx.exe1

Pfad des fehlerhaften Moduls: atieclxx.exe2

Berichtskennung: atieclxx.exe3

Vollständiger Name des fehlerhaften Pakets: atieclxx.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: atieclxx.exe5
 

Error: (04/18/2016 10:21:21 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: Avira.ServiceHost.exe, Version: 1.1.47.11018, Zeitstempel: 0x55f12efe

Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.2.9200.17366, Zeitstempel: 0x554d16f6

Ausnahmecode: 0xe0434352

Fehleroffset: 0x00010192

ID des fehlerhaften Prozesses: 0x134c

Startzeit der fehlerhaften Anwendung: 0xAvira.ServiceHost.exe0

Pfad der fehlerhaften Anwendung: Avira.ServiceHost.exe1

Pfad des fehlerhaften Moduls: Avira.ServiceHost.exe2

Berichtskennung: Avira.ServiceHost.exe3

Vollständiger Name des fehlerhaften Pakets: Avira.ServiceHost.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Avira.ServiceHost.exe5
 

Error: (04/18/2016 10:21:21 AM) (Source: .NET Runtime) (EventID: 1026) (User: )

Description: Anwendung: Avira.ServiceHost.exe

Frameworkversion: v4.0.30319

Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.

Ausnahmeinformationen: System.MissingMethodException

Stapel:

   bei Avira.OE.CertificateTools.AuthenticodeVerifier.HasTrustworthyAviraSignature(System.String)

   bei Avira.OE.CertificateTools.AuthenticodeVerifier.VerifyAviraSignature(System.String)

   bei Avira.OE.ServiceHost.AssemblyLoadVerifier.IsSignatureValid(Avira.OE.CertificateTools.IAuthenticodeVerifier, System.String)

   bei Avira.OE.ServiceHost.AssemblyLoadVerifier+<>c__DisplayClass2.<AreSignaturesValid>b__1(System.String)

   bei System.Linq.Enumerable.All[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.Collections.Generic.IEnumerable`1<System.__Canon>, System.Func`2<System.__Canon,Boolean>)

   bei Avira.OE.ServiceHost.AssemblyLoadVerifier.AreSignaturesValid(System.Collections.Generic.IEnumerable`1<System.String>)

   bei Avira.OE.ServiceHost.Program+<>c__DisplayClass1.<OnServiceStart>b__0(System.Object)

   bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)

   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)

   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)

   bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()

   bei System.Threading.ThreadPoolWorkQueue.Dispatch()

   bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
 

Error: (04/18/2016 10:21:10 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: Avira.ServiceHost.exe, Version: 1.1.47.11018, Zeitstempel: 0x55f12efe

Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.2.9200.17366, Zeitstempel: 0x554d16f6

Ausnahmecode: 0xe0434352

Fehleroffset: 0x00010192

ID des fehlerhaften Prozesses: 0x7d0

Startzeit der fehlerhaften Anwendung: 0xAvira.ServiceHost.exe0

Pfad der fehlerhaften Anwendung: Avira.ServiceHost.exe1

Pfad des fehlerhaften Moduls: Avira.ServiceHost.exe2

Berichtskennung: Avira.ServiceHost.exe3

Vollständiger Name des fehlerhaften Pakets: Avira.ServiceHost.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Avira.ServiceHost.exe5
 

Error: (04/18/2016 10:21:10 AM) (Source: .NET Runtime) (EventID: 1026) (User: )

Description: Anwendung: Avira.ServiceHost.exe

Frameworkversion: v4.0.30319

Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.

Ausnahmeinformationen: System.MissingMethodException

Stapel:

   bei Avira.OE.CertificateTools.AuthenticodeVerifier.HasTrustworthyAviraSignature(System.String)

   bei Avira.OE.CertificateTools.AuthenticodeVerifier.VerifyAviraSignature(System.String)

   bei Avira.OE.ServiceHost.AssemblyLoadVerifier.IsSignatureValid(Avira.OE.CertificateTools.IAuthenticodeVerifier, System.String)

   bei Avira.OE.ServiceHost.AssemblyLoadVerifier+<>c__DisplayClass2.<AreSignaturesValid>b__1(System.String)

   bei System.Linq.Enumerable.All[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.Collections.Generic.IEnumerable`1<System.__Canon>, System.Func`2<System.__Canon,Boolean>)

   bei Avira.OE.ServiceHost.AssemblyLoadVerifier.AreSignaturesValid(System.Collections.Generic.IEnumerable`1<System.String>)

   bei Avira.OE.ServiceHost.Program+<>c__DisplayClass1.<OnServiceStart>b__0(System.Object)

   bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)

   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)

   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)

   bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()

   bei System.Threading.ThreadPoolWorkQueue.Dispatch()

   bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
 

Error: (04/18/2016 10:19:55 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: Avira.ServiceHost.exe, Version: 1.1.47.11018, Zeitstempel: 0x55f12efe

Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.2.9200.17366, Zeitstempel: 0x554d16f6

Ausnahmecode: 0xe0434352

Fehleroffset: 0x00010192

ID des fehlerhaften Prozesses: 0xa08

Startzeit der fehlerhaften Anwendung: 0xAvira.ServiceHost.exe0

Pfad der fehlerhaften Anwendung: Avira.ServiceHost.exe1

Pfad des fehlerhaften Moduls: Avira.ServiceHost.exe2

Berichtskennung: Avira.ServiceHost.exe3

Vollständiger Name des fehlerhaften Pakets: Avira.ServiceHost.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Avira.ServiceHost.exe5
 

Error: (04/18/2016 10:19:54 AM) (Source: .NET Runtime) (EventID: 1026) (User: )

Description: Anwendung: Avira.ServiceHost.exe

Frameworkversion: v4.0.30319

Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.

Ausnahmeinformationen: System.MissingMethodException

Stapel:

   bei Avira.OE.CertificateTools.AuthenticodeVerifier.HasTrustworthyAviraSignature(System.String)

   bei Avira.OE.CertificateTools.AuthenticodeVerifier.VerifyAviraSignature(System.String)

   bei Avira.OE.ServiceHost.AssemblyLoadVerifier.IsSignatureValid(Avira.OE.CertificateTools.IAuthenticodeVerifier, System.String)

   bei Avira.OE.ServiceHost.AssemblyLoadVerifier+<>c__DisplayClass2.<AreSignaturesValid>b__1(System.String)

   bei System.Linq.Enumerable.All[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.Collections.Generic.IEnumerable`1<System.__Canon>, System.Func`2<System.__Canon,Boolean>)

   bei Avira.OE.ServiceHost.AssemblyLoadVerifier.AreSignaturesValid(System.Collections.Generic.IEnumerable`1<System.String>)

   bei Avira.OE.ServiceHost.Program+<>c__DisplayClass1.<OnServiceStart>b__0(System.Object)

   bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)

   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)

   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)

   bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()

   bei System.Threading.ThreadPoolWorkQueue.Dispatch()

   bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
 

Error: (04/18/2016 10:15:28 AM) (Source: ATIeRecord) (EventID: 16391) (User: )

Description: ATI EEU maximum number of session has been surpassed
 

Error: (04/18/2016 01:28:38 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 6282
 

Error: (04/18/2016 01:28:38 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 6282
 
 

Systemfehler:

=============

Error: (04/19/2016 06:34:00 PM) (Source: DCOM) (EventID: 10016) (User: SASKIA)

Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}SaskiaSaskiaS-1-5-21-1180511552-3395178981-381098957-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (04/19/2016 06:34:00 PM) (Source: DCOM) (EventID: 10016) (User: SASKIA)

Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}SaskiaSaskiaS-1-5-21-1180511552-3395178981-381098957-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (04/19/2016 06:33:27 PM) (Source: Microsoft-Windows-TaskScheduler) (EventID: 413) (User: NT-AUTORITÄT)

Description: Beim Start des Aufgabenplanungsdiensts konnten Aufgaben nicht geladen werden. Zusätzliche Daten: Fehlerwert: 2147942402.
 

Error: (04/19/2016 06:32:06 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)

Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
 

Modulpfad: C:\Windows\system32\Rtlihvs.dll
 

Error: (04/19/2016 06:32:06 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)

Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
 

Modulpfad: C:\Windows\system32\Rtlihvs.dll
 

Error: (04/19/2016 06:32:04 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)

Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
 

Modulpfad: C:\Windows\system32\Rtlihvs.dll
 

Error: (04/19/2016 06:32:04 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)

Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
 

Modulpfad: C:\Windows\system32\Rtlihvs.dll
 

Error: (04/19/2016 06:31:45 PM) (Source: Service Control Manager) (EventID: 7032) (User: )

Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Search" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler: 

%%1056
 

Error: (04/19/2016 06:31:15 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Intel(R) Management and Security Application User Notification Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (04/19/2016 06:31:15 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Intel(R) ME Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 
 

CodeIntegrity:

===================================

  Date: 2016-04-19 18:33:01.132

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\Drivers\cdudf_xp.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2016-04-19 18:33:00.975

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\Drivers\pwd_2k.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2016-04-19 11:39:11.792

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\Drivers\cdudf_xp.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2016-04-19 11:39:11.401

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\Drivers\pwd_2k.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2016-04-18 10:17:59.120

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\Drivers\cdudf_xp.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2016-04-18 10:17:58.979

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\Drivers\pwd_2k.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2016-04-12 18:06:45.305

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\Drivers\cdudf_xp.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2016-04-12 18:06:45.165

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\Drivers\pwd_2k.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2016-04-11 21:58:24.381

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\Drivers\cdudf_xp.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2016-04-11 21:58:24.241

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\Drivers\pwd_2k.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
 

==================== Speicherinformationen =========================== 
 

Prozessor: Intel(R) Core(TM) i7-3632QM CPU @ 2.20GHz

Prozentuale Nutzung des RAM: 28%

Installierter physikalischer RAM: 6036.27 MB

Verfügbarer physikalischer RAM: 4319.77 MB

Summe virtueller Speicher: 6996.27 MB

Verfügbarer virtueller Speicher: 5053.76 MB
 

==================== Laufwerke ================================
 

Drive c: (Windows) (Fixed) (Total:446.27 GB) (Free:281.12 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]

Drive d: (RECOVERY) (Fixed) (Total:18.72 GB) (Free:1.85 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
 

==================== MBR & Partitionstabelle ==================
 

========================================================

Disk: 0 (Size: 465.8 GB) (Disk ID: 5135DB13)
 

Partition: GPT.
 

==================== Ende von Addition.txt ============================

Code:

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:17-04-2016 01

durchgeführt von Saskia (Administrator) auf SASKIA (19-04-2016 22:44:07)

Gestartet von C:\Users\Saskia\Desktop

Geladene Profile: Saskia (Verfügbare Profile: Saskia)

Platform: Windows 8 (X64) Sprache: Deutsch (Deutschland)

Internet Explorer Version 10 (Standard-Browser: FF)

Start-Modus: Normal

Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Prozesse (Nicht auf der Ausnahmeliste) =================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
 

(AMD) C:\Windows\System32\atiesrxx.exe

(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE

(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe

(Sonic Solutions) C:\Program Files (x86)\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(Sonic Solutions) C:\Program Files (x86)\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

(Adobe Systems Incorporated) C:\Program Files\Adobe\Elements 13 Organizer\PhotoshopElementsFileAgent.exe

(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Microsoft Corporation) C:\Windows\System32\LogonUI.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(Flux Software LLC) C:\Users\Saskia\AppData\Local\FluxSoftware\Flux\flux.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe

() C:\Program Files (x86)\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

(Sonic Solutions) C:\Program Files (x86)\Common Files\Roxio Shared\SharedCOM8\CPSHelpRunner.exe

(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe

(Microsoft Corporation) C:\Windows\System32\msiexec.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\Executable Agent Data\Battery\BatteryTest.exe
 
 

==================== Registry (Nicht auf der Ausnahmeliste) ===========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
 

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3015920 2013-02-06] (Synaptics Incorporated)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [557984 2014-08-27] (Adobe Systems Incorporated)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176952 2016-03-19] (Apple Inc.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7165000 2013-03-26] (Realtek Semiconductor)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-02-25] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [67384 2016-03-18] (Apple Inc.)

HKLM-x32\...\Run: [TkBellExe] => C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [295512 2013-10-11] (RealNetworks, Inc.)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [RoxWatchTray] => C:\Program Files (x86)\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe [163840 2006-02-14] ()

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.)

HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [475448 2014-03-26] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\Run: [AmazonMP3DownloaderHelper] => C:\Users\Saskia\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] ()

HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\Run: [CCleaner Monitoring] => C:\Program Files (x86)\CCleaner\CCleaner64.exe [6482200 2014-09-26] (Piriform Ltd)

HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\Run: [f.lux] => C:\Users\Saskia\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-24] (Flux Software LLC)

HKU\S-1-5-21-1180511552-3395178981-381098957-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1

Startup: C:\Users\Saskia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP ENVY 5640 series.lnk [2016-04-19]

ShortcutTarget: Tintenwarnungen überwachen - HP ENVY 5640 series.lnk -> C:\Program Files\HP\HP ENVY 5640 series\Bin\HPStatusBL.dll (Hewlett-Packard Development Company, LP)
 

==================== Internet (Nicht auf der Ausnahmeliste) ====================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
 

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Tcpip\..\Interfaces\{50125984-C1B4-4E99-85AD-1EF988A79E2C}: [DhcpNameServer] 192.168.2.1

Tcpip\..\Interfaces\{9F49EA48-57A1-49CB-9DAF-43692C100C63}: [DhcpNameServer] 40.20.1.201 40.20.1.203 40.20.1.202
 

Internet Explorer:

==================

HKU\S-1-5-21-1180511552-3395178981-381098957-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 

HKU\S-1-5-21-1180511552-3395178981-381098957-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT13/4

HKU\S-1-5-21-1180511552-3395178981-381098957-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT13/4

HKU\S-1-5-21-1180511552-3395178981-381098957-1001\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.uk.msn.com/HPNOT13/4

SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM -> {480F4056-4481-41A3-A47C-E268A0C1B586} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = 

SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-1180511552-3395178981-381098957-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-1180511552-3395178981-381098957-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2016-02-25] (HP)

BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2013-08-14] (RealDownloader)

BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2016-02-25] (HP)

Toolbar: HKU\S-1-5-21-1180511552-3395178981-381098957-1001 -> Kein Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  Keine Datei
 

FireFox:

========

FF ProfilePath: C:\Users\Saskia\AppData\Roaming\Mozilla\Firefox\Profiles\zdapoljn.default-1447890261049

FF Homepage: hxxp://www.google.com/

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_21_0_0_213.dll [2016-04-08] ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_213.dll [2016-04-08] ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2016-03-08] ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.66 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-09-29] (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-09-29] (Intel Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)

FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll [2013-10-11] (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [2013-08-14] (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2013-08-14] (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll [2013-08-14] (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll [2013-10-11] (RealPlayer)

FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [2013-08-14] (RealDownloader)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-01] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-01] (Google Inc.)

FF Plugin HKU\S-1-5-21-1180511552-3395178981-381098957-1001: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Saskia\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll [2013-05-22] (Amazon.com, Inc.)

FF Extension: YouTube mp3 - C:\Users\Saskia\AppData\Roaming\Mozilla\Firefox\Profiles\zdapoljn.default-1447890261049\Extensions\info@youtube-mp3.org.xpi [2015-11-19]

FF Extension: Adblock Plus - C:\Users\Saskia\AppData\Roaming\Mozilla\Firefox\Profiles\zdapoljn.default-1447890261049\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-02-24]

FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext

FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-10-11] [ist nicht signiert]

FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
 

Chrome: 

=======

CHR Profile: C:\Users\Saskia\AppData\Local\Google\Chrome\User Data\default

CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14]
 

==================== Dienste (Nicht auf der Ausnahmeliste) ========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

R2 AdobeActiveFileMonitor13.0; C:\Program Files\Adobe\Elements 13 Organizer\PhotoshopElementsFileAgent.exe [231120 2015-01-30] (Adobe Systems Incorporated)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-03-02] (Apple Inc.)

R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [26680 2016-02-18] (Hewlett-Packard Company)

R2 HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [469304 2014-03-26] (Hewlett-Packard Development Company, L.P.)

R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-04-10] (Intel Corporation)

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [Datei ist nicht signiert]

R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [732160 2012-12-10] (Intel(R) Corporation) [Datei ist nicht signiert]

S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131032 2013-01-14] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165336 2013-01-14] (Intel Corporation)

R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()

S2 RoxLiveShare; C:\Program Files (x86)\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe [233472 2006-02-14] (Sonic Solutions) [Datei ist nicht signiert]

R3 RoxMediaDB; C:\Program Files (x86)\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe [864256 2006-02-14] (Sonic Solutions) [Datei ist nicht signiert]

R2 RoxWatch; C:\Program Files (x86)\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe [155648 2006-02-14] (Sonic Solutions) [Datei ist nicht signiert]

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [239176 2013-02-20] (Realtek Semiconductor)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2015-07-06] (Microsoft Corporation)
 

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36520 2012-09-14] (Advanced Micro Devices, Inc.)

S1 cdudf_xp; C:\Windows\System32\Drivers\cdudf_xp.sys [344064 2005-10-22] (Sonic Solutions)

S3 dvd_2K; C:\Windows\System32\Drivers\dvd_2K.sys [33792 2005-10-22] (Sonic Solutions)

S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3265256 2013-03-23] (Broadcom Corporation)

S3 mmc_2K; C:\Windows\System32\Drivers\mmc_2K.sys [32768 2005-10-22] (Sonic Solutions)

S1 pwd_2k; C:\Windows\System32\Drivers\pwd_2k.sys [128512 2005-10-22] (Sonic Solutions)

R0 PxHlpa64; C:\Windows\System32\drivers\PxHlpa64.sys [56336 2013-09-03] (Corel Corporation)

S3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [288328 2013-01-24] (Realtek Semiconductor Corp.)

S3 RTSPER; C:\Windows\System32\DRIVERS\RtsPer.sys [448072 2013-02-02] (RTS Corporation)

R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [3029208 2013-07-12] (Realtek Semiconductor Corporation                           )

S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [28400 2013-02-06] (Synaptics Incorporated)

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31984 2013-02-06] (Synaptics Incorporated)

U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()

S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44560 2015-07-06] (Microsoft Corporation)

R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [281944 2015-07-06] (Microsoft Corporation)

R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2012-08-31] (Hewlett-Packard Development Company, L.P.)
 

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
 

==================== Ein Monat: Erstellte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2016-04-19 22:44 - 2016-04-19 22:45 - 00020652 _____ C:\Users\Saskia\Desktop\FRST.txt

2016-04-19 18:42 - 2016-04-19 18:42 - 00004040 _____ C:\Users\Saskia\Desktop\JRT.txt

2016-04-19 18:18 - 2016-04-19 18:19 - 01610352 _____ (Malwarebytes) C:\Users\Saskia\Desktop\JRT.exe

2016-04-19 18:17 - 2016-04-19 18:18 - 03683904 _____ C:\Users\Saskia\Desktop\AdwCleaner_5.112.exe

2016-04-19 12:36 - 2016-04-19 12:36 - 00001194 _____ C:\Users\Saskia\Desktop\mbar2.txt

2016-04-19 11:46 - 2016-04-19 11:47 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2016-04-19 11:45 - 2016-04-19 11:45 - 00001109 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2016-04-19 11:36 - 2016-04-19 11:36 - 00001408 _____ C:\Users\Saskia\Desktop\sss.txt

2016-04-19 10:58 - 2016-04-14 01:45 - 00453280 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2016-04-19 10:47 - 2016-04-19 10:48 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Saskia\Downloads\mbar-1.09.3.1001.exe

2016-04-18 22:33 - 2016-04-18 22:33 - 00388608 _____ (Trend Micro Inc.) C:\Users\Saskia\Downloads\hijackthis_29344.exe

2016-04-18 10:28 - 2016-04-18 10:31 - 00047726 _____ C:\Users\Saskia\Downloads\Addition.txt

2016-04-18 10:27 - 2016-04-18 10:31 - 00040468 _____ C:\Users\Saskia\Downloads\FRST.txt

2016-04-18 10:26 - 2016-04-19 22:44 - 00000000 ____D C:\FRST

2016-04-18 10:24 - 2016-04-18 10:24 - 02375680 _____ (Farbar) C:\Users\Saskia\Desktop\FRST64.exe

2016-04-18 01:02 - 2016-04-18 01:02 - 00017388 _____ C:\malware.txt

2016-04-18 00:05 - 2016-04-18 00:05 - 00002259 _____ C:\Windows\epplauncher.mif

2016-04-18 00:03 - 2016-04-18 00:04 - 14345408 _____ (Microsoft Corporation) C:\Users\Saskia\Downloads\mseinstall.exe

2016-04-12 18:38 - 2016-04-18 10:18 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2016-04-08 18:06 - 2016-04-08 18:06 - 00014164 _____ C:\Users\Saskia\Downloads\R_ckmeldung_zu_Ihrer_Anfrage.eml

2016-04-06 11:06 - 2016-04-18 10:16 - 00002183 _____ C:\Users\Public\Desktop\HP ENVY 5640 series.lnk

2016-04-06 11:06 - 2016-04-18 10:16 - 00001998 _____ C:\Users\Public\Desktop\HP Photo Creations.lnk

2016-04-06 11:06 - 2016-04-18 10:16 - 00001145 _____ C:\Users\Public\Desktop\Shop für Zubehör - HP ENVY 5640 series.lnk

2016-04-06 11:06 - 2016-04-13 18:24 - 00000000 ____D C:\Users\Saskia\AppData\Roaming\HpUpdate

2016-04-06 11:06 - 2016-04-06 11:06 - 00003608 _____ C:\Windows\System32\Tasks\HPCustParticipation HP ENVY 5640 series

2016-04-06 11:06 - 2016-04-06 11:06 - 00000000 ____D C:\ProgramData\Visan

2016-04-06 11:06 - 2016-04-06 11:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP

2016-04-06 11:06 - 2016-04-06 11:06 - 00000000 ____D C:\ProgramData\HP Photo Creations

2016-04-06 11:06 - 2016-04-06 11:06 - 00000000 ____D C:\Program Files (x86)\HP Photo Creations

2016-04-06 11:06 - 2014-08-22 05:12 - 00751624 ____N (Hewlett-Packard Development Company, LP) C:\Windows\system32\HPDiscoPMCC11.dll

2016-04-06 11:05 - 2016-04-06 11:17 - 00000000 ____D C:\ProgramData\HP

2016-04-06 11:05 - 2016-04-06 11:06 - 00000000 ____D C:\Program Files (x86)\HP

2016-04-06 11:05 - 2016-04-06 11:05 - 00000000 ____D C:\Program Files\HP

2016-04-06 11:04 - 2016-04-06 11:09 - 00000000 ____D C:\Users\Saskia\AppData\Local\HP

2016-04-06 11:04 - 2016-04-06 11:04 - 00000057 _____ C:\ProgramData\Ament.ini

2016-04-05 10:57 - 2016-04-05 10:57 - 00494544 _____ C:\Users\Saskia\Desktop\Garantie Drucker HP.pdf

2016-04-04 22:56 - 2016-04-18 10:16 - 00001790 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DTS Audio Control Panel.lnk

2016-04-04 22:49 - 2016-04-04 22:49 - 00000000 ____D C:\Windows\SysWOW64\RTCOM

2016-04-04 22:49 - 2016-04-04 22:49 - 00000000 ____D C:\Windows\LastGood

2016-04-04 22:49 - 2013-03-26 20:54 - 03376200 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys

2016-04-04 22:49 - 2013-03-26 19:34 - 00135240 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInstII64.dll

2016-04-04 22:49 - 2013-03-26 17:06 - 02797128 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll

2016-04-04 22:49 - 2013-03-26 16:05 - 00445929 _____ C:\Windows\system32\Drivers\RTAIODAT.DAT

2016-04-04 22:49 - 2013-03-26 15:40 - 03693128 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkAPO64.dll

2016-04-04 22:49 - 2013-03-26 14:38 - 01659464 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl

2016-04-04 22:49 - 2013-03-26 09:53 - 20461568 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoRes64.dat

2016-04-04 22:49 - 2013-03-12 18:16 - 00613448 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtDataProc64.dll

2016-04-04 22:47 - 2013-03-13 07:32 - 00208072 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll

2016-04-04 22:31 - 2016-04-04 22:40 - 00000000 ____D C:\Users\Saskia\Downloads\HP Downloads

2016-04-04 22:26 - 2016-04-04 22:27 - 03836976 _____ (Oleg N. Scherbakov) C:\Users\Saskia\Downloads\HPSupportSolutionsFramework-12.3.11.29.exe

2016-04-04 18:26 - 2016-04-04 18:26 - 00000000 ____D C:\Windows\LastGood.Tmp

2016-04-04 18:25 - 2013-06-04 17:26 - 00000008 _____ C:\Windows\system32\Drivers\rtkhdaud.dat

2016-03-28 18:41 - 2016-04-18 10:16 - 00001760 _____ C:\Users\Public\Desktop\iTunes.lnk

2016-03-28 18:41 - 2016-03-28 18:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2016-03-28 18:40 - 2016-03-28 18:40 - 00000000 ____D C:\Program Files\iPod

2016-03-28 18:37 - 2016-03-28 18:37 - 00000000 ____D C:\Windows\System32\Tasks\Apple

2016-03-28 18:37 - 2016-03-28 18:37 - 00000000 ____D C:\Program Files (x86)\Apple Software Update

2016-03-25 00:22 - 2016-03-25 00:22 - 00000000 ____D C:\Program Files\Google

2016-03-24 19:58 - 2016-03-24 20:18 - 450071920 _____ C:\Users\Saskia\Downloads\nikcollection-full-1.2.11.exe

2016-03-20 19:34 - 2016-03-20 19:34 - 00000000 ____D C:\Program Files\Bonjour

2016-03-20 19:34 - 2016-03-20 19:34 - 00000000 ____D C:\Program Files (x86)\Bonjour
 

==================== Ein Monat: Geänderte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2016-04-19 22:37 - 2015-01-08 00:18 - 00001128 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2016-04-19 22:37 - 2014-11-01 20:21 - 00001356 _____ C:\Windows\Tasks\DLOJNX.job

2016-04-19 22:37 - 2014-11-01 20:21 - 00001354 _____ C:\Windows\Tasks\YASOY.job

2016-04-19 22:37 - 2014-11-01 20:14 - 00001354 _____ C:\Windows\Tasks\FKEHU.job

2016-04-19 22:37 - 2014-11-01 20:14 - 00001348 _____ C:\Windows\Tasks\AA.job

2016-04-19 18:40 - 2014-01-20 11:41 - 01952918 _____ C:\Windows\system32\PerfStringBackup.INI

2016-04-19 18:40 - 2013-03-23 21:59 - 00831158 _____ C:\Windows\system32\perfh007.dat

2016-04-19 18:40 - 2013-03-23 21:59 - 00188760 _____ C:\Windows\system32\perfc007.dat

2016-04-19 18:40 - 2012-07-26 07:37 - 00000000 ____D C:\Windows\Inf

2016-04-19 18:33 - 2012-07-26 09:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2016-04-19 18:32 - 2012-07-26 07:26 - 00524288 ___SH C:\Windows\system32\config\BBI

2016-04-19 18:31 - 2014-11-01 23:29 - 00000000 ____D C:\AdwCleaner

2016-04-19 12:22 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\rescache

2016-04-19 12:04 - 2013-10-09 11:20 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1180511552-3395178981-381098957-1001

2016-04-19 11:45 - 2014-11-01 23:32 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2016-04-19 11:45 - 2013-10-09 14:41 - 00000000 ____D C:\Users\Saskia\AppData\Roaming\Malwarebytes

2016-04-19 11:45 - 2013-10-09 14:41 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2016-04-19 10:46 - 2014-12-07 00:43 - 00000000 ____D C:\ProgramData\Package Cache

2016-04-19 10:46 - 2013-10-09 11:50 - 00000000 ____D C:\ProgramData\Avira

2016-04-19 10:42 - 2013-10-09 11:56 - 00000000 ____D C:\Users\Saskia\AppData\Roaming\Avira

2016-04-19 10:39 - 2015-05-14 11:05 - 00000000 ____D C:\Users\Saskia\Desktop\sisi2

2016-04-18 22:39 - 2014-11-25 20:04 - 00000000 ____D C:\Users\Saskia\Downloads\backups

2016-04-18 10:44 - 2013-10-09 11:10 - 00000000 ____D C:\Users\Saskia

2016-04-18 10:18 - 2013-10-09 11:21 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2016-04-18 10:17 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\L2Schemas

2016-04-18 10:16 - 2015-11-13 23:55 - 00002234 _____ C:\Users\Saskia\Desktop\HP Support Assistant.lnk

2016-04-18 10:16 - 2015-04-08 00:41 - 00001057 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop Elements 13.lnk

2016-04-18 10:16 - 2015-04-08 00:41 - 00001045 _____ C:\Users\Public\Desktop\Adobe Photoshop Elements 13.lnk

2016-04-18 10:16 - 2015-01-16 23:56 - 00001234 _____ C:\Users\Public\Desktop\Wise Registry Cleaner.lnk

2016-04-18 10:16 - 2015-01-13 01:50 - 00002062 _____ C:\Users\Public\Desktop\Lightroom 5.4 64-Bit.lnk

2016-04-18 10:16 - 2014-12-08 23:41 - 00002056 _____ C:\Users\Public\Desktop\ViewNX 2.lnk

2016-04-18 10:16 - 2014-11-25 15:12 - 00001167 _____ C:\Users\Saskia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2016-04-18 10:16 - 2014-10-21 18:25 - 00001024 _____ C:\Users\Public\Desktop\CCleaner.lnk

2016-04-18 10:16 - 2014-09-29 23:57 - 00002267 _____ C:\Users\Saskia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

2016-04-18 10:16 - 2014-07-30 00:12 - 00001307 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\paint.net.lnk

2016-04-18 10:16 - 2014-03-26 14:09 - 00000602 _____ C:\Users\Saskia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\brushes.lnk

2016-04-18 10:16 - 2014-02-03 14:01 - 00000736 _____ C:\Users\Public\Desktop\Intel(R) HD Graphics Control Panel.lnk

2016-04-18 10:16 - 2013-12-16 23:58 - 00001098 _____ C:\Users\Saskia\Desktop\FilExile.lnk

2016-04-18 10:16 - 2013-11-11 14:07 - 00001354 _____ C:\Users\Saskia\Desktop\2pic.lnk

2016-04-18 10:16 - 2013-11-07 15:11 - 00002194 _____ C:\Users\Public\Desktop\Roxio PhotoSuite 8.lnk

2016-04-18 10:16 - 2013-11-07 14:28 - 00002859 _____ C:\Users\Saskia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Install Clean Up.lnk

2016-04-18 10:16 - 2013-10-22 11:27 - 00002026 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk

2016-04-18 10:16 - 2013-10-11 14:28 - 00001116 _____ C:\Users\Public\Desktop\OpenOffice 4.0.1.lnk

2016-04-18 10:16 - 2013-10-11 13:43 - 00001361 _____ C:\Users\Public\Desktop\RealPlayer.lnk

2016-04-18 10:16 - 2013-10-09 13:59 - 00002519 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk

2016-04-18 10:16 - 2013-10-09 13:45 - 00001271 _____ C:\Users\Saskia\Desktop\Revo Uninstaller.lnk

2016-04-18 10:16 - 2013-10-09 13:45 - 00001113 _____ C:\Users\Public\Desktop\Free RAR Extract Frog.lnk

2016-04-18 10:16 - 2013-10-09 11:21 - 00001068 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2016-04-18 10:16 - 2013-10-09 11:21 - 00001056 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2016-04-18 10:16 - 2013-10-09 11:13 - 00002109 _____ C:\Users\Public\Desktop\Snapfish Fotos.lnk

2016-04-18 10:16 - 2013-06-02 01:35 - 00001106 _____ C:\Users\Public\Desktop\HP Quick Start.lnk

2016-04-18 10:16 - 2013-03-23 14:24 - 00001115 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Connected Music.lnk

2016-04-18 10:16 - 2013-03-23 14:24 - 00001103 _____ C:\Users\Public\Desktop\HP Connected Music.lnk

2016-04-18 01:05 - 2015-01-08 00:18 - 00001132 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2016-04-18 00:47 - 2016-03-02 11:33 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2016-04-17 10:37 - 2013-10-10 18:52 - 00000000 ____D C:\Users\Saskia\AppData\Local\Adobe

2016-04-15 23:26 - 2013-10-10 13:24 - 00000000 ____D C:\Windows\system32\MRT

2016-04-15 23:20 - 2013-10-10 13:24 - 135176864 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2016-04-14 22:36 - 2013-11-22 23:42 - 00000000 ____D C:\Users\Saskia\Desktop\Neuer Ordner

2016-04-14 19:24 - 2014-01-04 15:34 - 00000000 ____D C:\Users\Saskia\Desktop\Neuer Ordner (2)

2016-04-14 18:13 - 2012-07-26 10:12 - 00000000 ___HD C:\Program Files\WindowsApps

2016-04-14 18:13 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\AUInstallAgent

2016-04-08 23:01 - 2014-10-18 23:55 - 00000000 ____D C:\Users\Saskia\Desktop\Unbenannter Export

2016-04-08 18:47 - 2016-03-11 23:47 - 05934784 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe

2016-04-08 18:47 - 2016-03-02 11:33 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2016-04-08 11:24 - 2015-03-22 10:53 - 00010824 _____ C:\Users\Saskia\Desktop\Unbenannt 1.odt

2016-04-07 18:26 - 2014-03-06 19:22 - 00000350 _____ C:\Windows\Tasks\HPCeeScheduleForSaskia.job

2016-04-06 11:09 - 2013-10-09 11:11 - 00000000 ____D C:\Users\Saskia\AppData\Local\Packages

2016-04-04 22:57 - 2013-06-02 01:15 - 00000000 ___HD C:\Program Files (x86)\Temp

2016-04-04 22:47 - 2013-03-23 14:27 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2016-04-04 22:45 - 2015-03-28 00:01 - 02666168 _____ C:\Windows\system32\FNTCACHE.DAT

2016-04-04 22:42 - 2013-06-02 01:14 - 00000000 ____D C:\Program Files (x86)\Realtek

2016-04-04 22:13 - 2013-11-01 20:08 - 00000000 ____D C:\Users\Saskia\AppData\Local\ElevatedDiagnostics

2016-04-04 18:24 - 2012-08-04 02:02 - 00000000 ____D C:\SWSetup

2016-04-04 00:17 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\NDF

2016-03-28 18:41 - 2013-12-17 00:09 - 00000000 ____D C:\Program Files\iTunes

2016-03-28 18:40 - 2013-12-17 00:09 - 00000000 ____D C:\Program Files (x86)\iTunes

2016-03-28 18:40 - 2013-10-09 13:59 - 00000000 ____D C:\Program Files\Common Files\Apple

2016-03-25 00:25 - 2015-01-08 00:18 - 00000000 ____D C:\ProgramData\Google

2016-03-25 00:25 - 2013-11-07 14:21 - 00000000 ____D C:\Users\Saskia\AppData\Local\Google

2016-03-24 23:43 - 2013-10-17 19:26 - 00000000 ____D C:\Users\Saskia\AppData\Roaming\DVDVideoSoft

2016-03-24 23:41 - 2015-10-14 18:58 - 00000000 ____D C:\Users\Saskia\AppData\Roaming\Solveig Multimedia

2016-03-24 23:41 - 2015-10-14 18:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Solveig Multimedia

2016-03-24 23:41 - 2015-10-14 18:57 - 00000000 ____D C:\Program Files (x86)\Solveig Multimedia

2016-03-20 19:37 - 2015-02-26 00:16 - 00000000 ____D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
 

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
 

2014-09-01 10:18 - 2014-09-01 10:18 - 0002086 _____ () C:\Users\Saskia\AppData\Roaming\AA

2013-10-14 00:05 - 2013-12-24 00:25 - 0000132 _____ () C:\Users\Saskia\AppData\Roaming\Adobe CS5-Voreinstellungen für BMP-Format

2014-09-01 10:18 - 2014-09-01 10:18 - 0002086 _____ () C:\Users\Saskia\AppData\Roaming\DLOJNX

2014-12-08 23:41 - 2014-12-08 23:41 - 0000268 ___RH () C:\Users\Saskia\AppData\Roaming\Drum Kits

2014-12-08 23:42 - 2014-12-08 23:42 - 0000268 ___RH () C:\Users\Saskia\AppData\Roaming\Drums

2014-12-08 23:41 - 2014-12-08 23:41 - 0000268 ___RH () C:\Users\Saskia\AppData\Roaming\Dynamic Library

2014-12-08 23:40 - 2014-12-08 23:40 - 0000268 ___RH () C:\Users\Saskia\AppData\Roaming\External Build System

2014-09-01 10:18 - 2014-09-01 10:18 - 0001248 _____ () C:\Users\Saskia\AppData\Roaming\FKEHU

2014-09-01 10:18 - 2014-09-01 10:18 - 0001248 _____ () C:\Users\Saskia\AppData\Roaming\YASOY

2016-04-06 11:04 - 2016-04-06 11:04 - 0000057 _____ () C:\ProgramData\Ament.ini

2014-12-08 23:41 - 2014-12-08 23:41 - 0000268 ___RH () C:\ProgramData\Effects

2014-12-08 23:42 - 2014-12-08 23:42 - 0000268 ___RH () C:\ProgramData\Electric Clav

2014-12-08 23:41 - 2014-12-08 23:41 - 0000268 ___RH () C:\ProgramData\Electric Piano

2014-12-08 23:40 - 2014-12-08 23:41 - 0000012 ___RH () C:\ProgramData\Filters

2014-12-08 23:42 - 2014-12-08 23:42 - 0000012 ___RH () C:\ProgramData\Flange Saw

2014-12-08 23:41 - 2014-12-08 23:41 - 0000012 ___RH () C:\ProgramData\Flowers

2014-12-08 23:40 - 2014-12-08 23:40 - 0000012 ___RH () C:\ProgramData\Helper Scripts

2014-12-08 23:40 - 2014-12-08 23:40 - 0000020 ____H () C:\ProgramData\PKP_DLeo.DAT

2014-12-08 23:42 - 2014-12-08 23:42 - 0000020 ____H () C:\ProgramData\PKP_DLes.DAT

2014-12-08 23:41 - 2015-04-03 23:54 - 0000020 ____H () C:\ProgramData\PKP_DLet.DAT

2014-12-08 23:41 - 2015-03-21 23:17 - 0000020 ____H () C:\ProgramData\PKP_DLev.DAT
 

Einige Dateien in TEMP:

====================

C:\Users\Saskia\AppData\Local\Temp\ACLMInstaller.exe

C:\Users\Saskia\AppData\Local\Temp\avgnt.exe

C:\Users\Saskia\AppData\Local\Temp\FreemakeVideoConverterFull.exe

C:\Users\Saskia\AppData\Local\Temp\HPSFUpdater.exe

C:\Users\Saskia\AppData\Local\Temp\libeay32.dll

C:\Users\Saskia\AppData\Local\Temp\msvcr120.dll

C:\Users\Saskia\AppData\Local\Temp\sqlite3.dll

C:\Users\Saskia\AppData\Local\Temp\UninstallHPSA.exe
 
 

==================== Bamital & volsnap =================
 

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
 

C:\Windows\system32\winlogon.exe => Datei ist digital signiert

C:\Windows\system32\wininit.exe => Datei ist digital signiert

C:\Windows\explorer.exe => Datei ist digital signiert

C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert

C:\Windows\system32\svchost.exe => Datei ist digital signiert

C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert

C:\Windows\system32\services.exe => Datei ist digital signiert

C:\Windows\system32\User32.dll => Datei ist digital signiert

C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert

C:\Windows\system32\userinit.exe => Datei ist digital signiert

C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert

C:\Windows\system32\rpcss.dll => Datei ist digital signiert

C:\Windows\system32\dnsapi.dll => Datei ist digital signiert

C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert

C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
 
 

LastRegBack: 2016-04-06 11:24
 

==================== Ende von FRST.txt ============================