Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Malware, keylogger or trojan problem

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Malware, keylogger or trojan problem

Unread postby siqzz » January 23rd, 2016, 8:33 am

Hello again,

sorry for not reading the post and giving you the logs on my last post. I have a problem with my pc: I believe there is a trojan on it. My account got hacked in a game and somebody tried to make a purchase, which was not me. And I did not give anyone my personal information - I have not even been using that account for over 2 years. Furthermore I have problems downloading a windows update. When I shut my pc off it tries to download 11 updates, and never progresses - it's always stuck at update 1. Generally my pc has been a bit slower as well. I have not perceived any other symptoms until now.

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:06-01-2015
durchgeführt von Nutzer (Administrator) auf NUTZER-PC (23-01-2016 14:26:37)
Gestartet von C:\Users\Nutzer\Desktop
Geladene Profile: Nutzer (Verfügbare Profile: Nutzer)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 9 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files (x86)\Everything\Everything.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Dropbox, Inc.) C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\Dropbox.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Qihu Software Co. Limited) C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files (x86)\360\Total Security\LiveUpdate360.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM-x32\...\Run: [QHSafeTray] => C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe [1474168 2015-11-12] (QIHU 360 SOFTWARE CO. LIMITED)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => Keine Datei
Startup: C:\Users\Nutzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-12-12]
ShortcutTarget: Dropbox.lnk -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 178.233.140.110 176.240.150.250 46.197.15.60
Tcpip\..\Interfaces\{B4B33004-2526-44A5-A2D8-799D0327DCA7}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{B4B33004-2526-44A5-A2D8-799D0327DCA7}: [DhcpNameServer] 178.233.140.110 176.240.150.250 46.197.15.60
Tcpip\..\Interfaces\{ED726773-98F2-4D55-A6A5-D82511B439DD}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{ED726773-98F2-4D55-A6A5-D82511B439DD}: [DhcpNameServer] 178.233.140.110 176.240.150.250 46.197.15.60

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG
HKU\S-1-5-21-296788986-4175192466-186242963-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKU\S-1-5-21-296788986-4175192466-186242963-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKU\S-1-5-21-296788986-4175192466-186242963-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?pc=UP97&ocid=UP97DHP
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-296788986-4175192466-186242963-1000 -> DefaultScope {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-296788986-4175192466-186242963-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2012-12-23] (Oracle Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-10-12] (Microsoft Corporation)
BHO: SafeMon Class -> {B69F34DD-F0F9-42DC-9EDD-957187DA688D} -> C:\Program Files (x86)\360\Total Security\safemon\safemon64.dll [2015-11-12] (Qihu 360 Software Co., Ltd.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2012-12-23] (Oracle Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)
BHO-x32: SafeMon Class -> {B69F34DD-F0F9-42DC-9EDD-957187DA688D} -> C:\Program Files (x86)\360\Total Security\safemon\safemon.dll [2015-11-12] (Qihu 360 Software Co., Ltd.)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxps://fpdownload.macromedia.com/get/s ... wflash.cab
DPF: HKLM-x32 {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwar ... TSUEng.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwar ... /CTPID.cab
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-10-12] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2015-11-06] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2015-11-06] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2015-11-06] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2015-11-06] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\o9hzff6f.default
FF NetworkProxy: "user_pref("xpinstall.whitelist.add.36", "");type",
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_245.dll [2015-11-10] ()
FF Plugin: @java.com/DTPlugin,version=10.10.2 -> C:\Windows\system32\npDeployJava1.dll [2012-12-23] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.10.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2012-12-23] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-04] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_245.dll [2015-11-10] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.52 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2011-12-01] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2011-12-01] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2012-09-25] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-04] ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-01-10] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-01-10] (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [Keine Datei]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-03] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-03] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-09-27] (Adobe Systems Inc.)
StartMenuInternet: firefox.exe - firefox.exe

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://de.msn.com/?pc=UP97&ocid=UP97DHP"
CHR Plugin: (Shockwave Flash) - C:\Users\Nutzer\AppData\Local\Google\Chrome\User Data\PepperFlash\11.7.700.225\pepflashplayer.dll => Keine Datei
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.111\ppGoogleNaClPluginChrome.dll => Keine Datei
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.111\pdf.dll => Keine Datei
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll => Keine Datei
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll => Keine Datei
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll => Keine Datei
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll => Keine Datei
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll => Keine Datei
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll => Keine Datei
CHR Plugin: (Java Deployment Toolkit 7.0.90.5) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Profile: C:\Users\Nutzer\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (AdBlock) - C:\Users\Nutzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-01-19]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Nutzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-23]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-10-12]

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2015-12-20] (BitRaider, LLC)
S3 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2015-10-12] (Microsoft Corporation)
S3 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2015-10-12] (Microsoft Corporation)
S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2012-10-09] (Creative Labs) [Datei ist nicht signiert]
R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [307200 2008-11-18] (Creative Technology Ltd) [Datei ist nicht signiert]
R2 Everything; C:\Program Files (x86)\Everything\Everything.exe [1048576 2014-08-06] () [Datei ist nicht signiert] <==== ACHTUNG
S3 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2014-12-13] (NVIDIA Corporation)
S3 ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [160256 2011-08-30] (Intel Corporation) [Datei ist nicht signiert]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [Datei ist nicht signiert]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2011-12-16] (Intel Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2014-12-13] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2014-12-13] (NVIDIA Corporation)
R2 QHActiveDefense; C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe [903288 2015-11-12] (QIHU 360 SOFTWARE CO. LIMITED)
S3 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390672 2012-09-04] ()
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27760 2012-05-04] (VIA Technologies, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S3 ZAMSvc; C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe [12709688 2015-11-06] (Zemana Ltd.)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R1 360AntiHacker; C:\Windows\System32\Drivers\360AntiHacker64.sys [137808 2015-11-12] (360.cn)
R3 360AvFlt; C:\Windows\System32\DRIVERS\360AvFlt.sys [77904 2015-11-12] (360.cn)
R3 360AvFlt; C:\Windows\SysWOW64\DRIVERS\360AvFlt.sys [77904 2015-11-12] (360.cn)
R1 360Box64; C:\Windows\System32\DRIVERS\360Box64.sys [319568 2015-11-12] (360.cn)
S3 360Camera; C:\Windows\System32\Drivers\360Camera64.sys [40520 2015-11-12] (360.cn)
R1 360FsFlt; C:\Windows\System32\DRIVERS\360FsFlt.sys [367696 2015-11-12] (360.cn)
R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [21616 2011-11-02] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R1 BAPIDRV; C:\Windows\System32\DRIVERS\BAPIDRV64.sys [178768 2015-11-12] (360.cn)
S3 BRDriver64_1_3_3_E02B25FC; C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [78088 2015-12-24] (BitRaider)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
U5 GEARAspiWDM; C:\Windows\System32\Drivers\GEARAspiWDM.sys [33240 2012-10-03] (GEAR Software Inc.)
S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2012-10-09] ()
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-01-06] (Malwarebytes)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2014-12-13] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [50320 2015-01-29] (Panda Security, S.L.)
S3 ptun0901; C:\Windows\System32\DRIVERS\ptun0901.sys [27136 2014-08-08] (The OpenVPN Project)
R3 VUSB3HUB; C:\Windows\System32\DRIVERS\ViaHub3.sys [205312 2012-01-20] (VIA Technologies, Inc.)
R3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [254464 2012-01-20] (VIA Technologies, Inc.)
R1 ZAM; C:\Windows\System32\drivers\zam64.sys [199536 2015-11-17] (Zemana Ltd.)
R1 ZAM_Guard; C:\Windows\System32\drivers\zamguard64.sys [199536 2015-11-17] (Zemana Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 taphss6; system32\DRIVERS\taphss6.sys [X]
S3 trufos; system32\drivers\trufos.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2016-01-23 14:26 - 2016-01-23 14:26 - 00021369 _____ C:\Users\Nutzer\Desktop\FRST.txt
2016-01-20 18:53 - 2016-01-20 18:53 - 00001136 _____ C:\Users\Nutzer\Desktop\nativelog.txt
2016-01-19 16:36 - 2016-01-19 16:36 - 00112604 _____ C:\Users\Nutzer\Downloads\UnifrakturMaguntia.ttf
2016-01-19 16:36 - 2016-01-19 16:36 - 00089460 _____ C:\Users\Nutzer\Downloads\OldNewspaperTypes.ttf
2016-01-19 16:36 - 2016-01-19 16:36 - 00015560 _____ C:\Users\Nutzer\Downloads\Old Newspaper Font.ttf
2016-01-19 16:35 - 2016-01-19 19:38 - 00042202 _____ C:\Users\Nutzer\Downloads\le travail ecrit.odt
2016-01-17 22:05 - 2016-01-17 22:35 - 564744309 _____ C:\Users\Nutzer\Downloads\Windows6.1-KB947821-v34-x64.msu
2016-01-15 21:01 - 2016-01-15 21:01 - 00008957 _____ C:\Users\Nutzer\Desktop\GIF.odt
2016-01-13 16:47 - 2015-12-08 23:52 - 00312320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2016-01-13 16:47 - 2015-12-08 21:07 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-01-13 16:46 - 2015-12-30 21:08 - 05572544 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-01-13 16:46 - 2015-12-30 21:08 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-01-13 16:46 - 2015-12-30 21:08 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-01-13 16:46 - 2015-12-30 21:05 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-01-13 16:46 - 2015-12-30 21:02 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2016-01-13 16:46 - 2015-12-30 21:02 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2016-01-13 16:46 - 2015-12-30 21:02 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2016-01-13 16:46 - 2015-12-30 21:02 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-01-13 16:46 - 2015-12-30 21:02 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-01-13 16:46 - 2015-12-30 21:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2016-01-13 16:46 - 2015-12-30 21:01 - 01214464 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-01-13 16:46 - 2015-12-30 21:01 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2016-01-13 16:46 - 2015-12-30 21:01 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-01-13 16:46 - 2015-12-30 21:01 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-01-13 16:46 - 2015-12-30 21:01 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2016-01-13 16:46 - 2015-12-30 21:01 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-01-13 16:46 - 2015-12-30 21:01 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-01-13 16:46 - 2015-12-30 21:00 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2016-01-13 16:46 - 2015-12-30 20:59 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-01-13 16:46 - 2015-12-30 20:59 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-01-13 16:46 - 2015-12-30 20:59 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2016-01-13 16:46 - 2015-12-30 20:58 - 01461248 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-01-13 16:46 - 2015-12-30 20:58 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-01-13 16:46 - 2015-12-30 20:57 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2016-01-13 16:46 - 2015-12-30 20:57 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-01-13 16:46 - 2015-12-30 20:57 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2016-01-13 16:46 - 2015-12-30 20:55 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2016-01-13 16:46 - 2015-12-30 20:55 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2016-01-13 16:46 - 2015-12-30 20:55 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:47 - 03993536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2016-01-13 16:46 - 2015-12-30 20:47 - 03938240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2016-01-13 16:46 - 2015-12-30 20:44 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2016-01-13 16:46 - 2015-12-30 20:41 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2016-01-13 16:46 - 2015-12-30 20:41 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2016-01-13 16:46 - 2015-12-30 20:41 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2016-01-13 16:46 - 2015-12-30 20:41 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2016-01-13 16:46 - 2015-12-30 20:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2016-01-13 16:46 - 2015-12-30 20:41 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2016-01-13 16:46 - 2015-12-30 20:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2016-01-13 16:46 - 2015-12-30 20:41 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2016-01-13 16:46 - 2015-12-30 20:40 - 00251392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2016-01-13 16:46 - 2015-12-30 20:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2016-01-13 16:46 - 2015-12-30 20:39 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2016-01-13 16:46 - 2015-12-30 20:39 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2016-01-13 16:46 - 2015-12-30 20:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2016-01-13 16:46 - 2015-12-30 20:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2016-01-13 16:46 - 2015-12-30 20:38 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-01-13 16:46 - 2015-12-30 20:38 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 19:57 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2016-01-13 16:46 - 2015-12-30 19:50 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2016-01-13 16:46 - 2015-12-30 19:49 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2016-01-13 16:46 - 2015-12-30 19:44 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2016-01-13 16:46 - 2015-12-30 19:43 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-01-13 16:46 - 2015-12-30 19:42 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-01-13 16:46 - 2015-12-30 19:42 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-01-13 16:46 - 2015-12-30 19:41 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2016-01-13 16:46 - 2015-12-30 19:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-01-13 16:46 - 2015-12-30 19:32 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2016-01-13 16:46 - 2015-12-30 19:32 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2016-01-13 16:46 - 2015-12-30 19:32 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2016-01-13 16:46 - 2015-12-30 19:32 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2016-01-13 16:46 - 2015-12-30 19:30 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2016-01-13 16:46 - 2015-12-30 19:30 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 19:30 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 19:30 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 19:30 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2016-01-09 12:52 - 2016-01-09 12:52 - 00029859 _____ C:\ComboFix.txt
2016-01-09 12:40 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2016-01-09 12:40 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2016-01-09 12:40 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2016-01-09 12:40 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2016-01-09 12:40 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2016-01-09 12:40 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2016-01-09 12:40 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2016-01-09 12:40 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2016-01-09 12:37 - 2016-01-09 12:52 - 00000000 ____D C:\Qoobox
2016-01-09 12:35 - 2016-01-09 12:35 - 05646860 ____R (Swearware) C:\Users\Nutzer\Desktop\ComboFix.exe
2016-01-09 12:34 - 2016-01-09 12:35 - 05646860 _____ (Swearware) C:\Users\Nutzer\Downloads\ComboFix.exe
2016-01-07 18:47 - 2016-01-07 18:47 - 02827152 _____ (Reason Company Software Inc.) C:\Users\Nutzer\Downloads\herdProtectScan_Portable (1).exe
2016-01-07 17:10 - 2015-09-14 13:03 - 00039672 _____ C:\Windows\system32\Drivers\DasPtct.SYS
2016-01-07 17:10 - 2015-01-29 18:21 - 00050320 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys
2016-01-07 17:09 - 2016-01-09 13:03 - 00001282 _____ C:\Users\Public\Desktop\Panda Cloud Cleaner.lnk
2016-01-07 17:09 - 2016-01-07 17:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2016-01-07 17:09 - 2016-01-07 17:09 - 00000000 ____D C:\Program Files (x86)\Panda Security
2016-01-07 17:06 - 2016-01-07 17:07 - 35192968 _____ (Panda Security ) C:\Users\Nutzer\Downloads\PandaCloudCleaner.exe
2016-01-07 17:06 - 2016-01-07 17:06 - 02827152 _____ (Reason Company Software Inc.) C:\Users\Nutzer\Downloads\herdProtectScan_Portable.exe
2016-01-07 16:54 - 2016-01-07 16:58 - 00700956 _____ C:\TDSSKiller.3.1.0.9_07.01.2016_16.54.32_log.txt
2016-01-07 16:51 - 2016-01-07 16:51 - 00004300 _____ C:\TDSSKiller.3.1.0.9_07.01.2016_16.51.06_log.txt
2016-01-07 16:50 - 2016-01-07 16:50 - 04727984 _____ (Kaspersky Lab ZAO) C:\Users\Nutzer\Downloads\tdsskiller.exe
2016-01-07 16:47 - 2016-01-07 16:47 - 00002040 _____ C:\Users\Nutzer\Desktop\Rkill.txt
2016-01-07 16:46 - 2016-01-07 16:46 - 02032072 _____ (Bleeping Computer, LLC) C:\Users\Nutzer\Downloads\rkill.exe
2016-01-06 23:09 - 2016-01-06 23:29 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2016-01-06 23:08 - 2016-01-06 23:08 - 00000000 ____D C:\Users\Nutzer\Desktop\Neuer Ordner
2016-01-06 23:07 - 2016-01-06 23:08 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Nutzer\Downloads\mbar-1.09.3.1001.exe
2016-01-06 23:05 - 2016-01-06 23:05 - 00043763 _____ C:\Users\Nutzer\Downloads\Addition.txt
2016-01-06 23:03 - 2016-01-06 23:05 - 00042113 _____ C:\Users\Nutzer\Downloads\FRST.txt
2016-01-06 22:53 - 2016-01-06 22:55 - 00000000 ____D C:\AdwCleaner
2016-01-06 22:53 - 2016-01-06 22:53 - 02370560 _____ (Farbar) C:\Users\Nutzer\Desktop\FRST64.exe
2016-01-06 22:53 - 2016-01-06 22:53 - 01749504 _____ C:\Users\Nutzer\Downloads\adwcleaner_5.028.exe
2016-01-06 22:52 - 2016-01-06 22:53 - 02370560 _____ (Farbar) C:\Users\Nutzer\Downloads\FRST64.exe
2016-01-05 16:32 - 2016-01-05 16:32 - 01620280 _____ C:\Users\Nutzer\Downloads\Interne Bewertung 2015_Schüler_Ixmeier2015.pdf
2016-01-01 01:51 - 2016-01-01 01:51 - 00000000 ____D C:\Users\Nutzer\AppData\Local\Blizzard
2015-12-31 23:10 - 2015-12-31 23:10 - 00001181 _____ C:\Users\Public\Desktop\Hearthstone.lnk
2015-12-31 23:10 - 2015-12-31 23:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hearthstone
2015-12-31 22:24 - 2016-01-01 01:57 - 00000000 ____D C:\Program Files (x86)\Hearthstone
2015-12-31 19:20 - 2015-12-31 19:20 - 00000000 ____D C:\Users\Nutzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2015-12-31 19:03 - 2016-01-15 20:31 - 00000000 ____D C:\Users\Nutzer\AppData\Local\Battle.net
2015-12-31 19:03 - 2015-12-31 22:20 - 00000000 ____D C:\Users\Nutzer\AppData\Roaming\Battle.net
2015-12-31 19:03 - 2015-12-31 19:03 - 00001144 _____ C:\Users\Public\Desktop\Battle.net.lnk
2015-12-31 19:03 - 2015-12-31 19:03 - 00000000 ____D C:\Users\Nutzer\AppData\Local\Blizzard Entertainment
2015-12-31 19:03 - 2015-12-31 19:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2015-12-31 19:00 - 2016-01-15 19:56 - 00000000 ____D C:\Program Files (x86)\Battle.net
2015-12-31 18:58 - 2015-12-31 18:59 - 03142712 _____ (Blizzard Entertainment) C:\Users\Nutzer\Downloads\Hearthstone-Setup.exe
2015-12-31 16:32 - 2016-01-03 04:14 - 00020191 _____ C:\Users\Nutzer\Desktop\Ebay.odt
2015-12-31 14:51 - 2015-12-31 14:51 - 00000220 _____ C:\Users\Nutzer\Desktop\Rome Total War.url
2015-12-30 19:16 - 2015-12-30 19:16 - 00000000 ____D C:\Users\Nutzer\Desktop\yugioh
2015-12-28 17:46 - 2015-12-28 17:46 - 00000000 ____D C:\Users\Nutzer\Desktop\Foucault
2015-12-25 22:00 - 2015-12-25 22:00 - 00002672 _____ C:\Users\Nutzer\Downloads\Antitrust.zip
2015-12-25 21:50 - 2015-12-25 21:50 - 00010016 _____ C:\Users\Nutzer\Downloads\TibbettsUI + Keybinds.zip
2015-12-24 17:10 - 2015-12-24 17:10 - 00000000 ____D C:\Users\Nutzer\Documents\HeroBlade Logs
2015-12-24 17:10 - 2015-12-24 17:10 - 00000000 ____D C:\Users\Nutzer\AppData\Local\SWTOR

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2016-01-23 14:26 - 2015-11-16 21:15 - 00000000 ____D C:\FRST
2016-01-23 14:25 - 2009-07-14 06:45 - 00028944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-01-23 14:25 - 2009-07-14 06:45 - 00028944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-01-23 14:18 - 2014-09-23 17:46 - 00000000 ___RD C:\Users\Nutzer\Dropbox
2016-01-23 14:18 - 2014-09-23 16:57 - 00000000 ____D C:\Users\Nutzer\AppData\Roaming\Dropbox
2016-01-23 14:17 - 2015-11-19 22:14 - 00000000 ____D C:\Users\Nutzer\AppData\LocalLow\360WD
2016-01-23 14:16 - 2015-12-21 14:26 - 00000620 _____ C:\Windows\ZAM.krnl.trace
2016-01-23 14:16 - 2015-12-21 14:26 - 00000119 _____ C:\Windows\ZAM_Guard.krnl.trace
2016-01-23 14:16 - 2015-11-19 22:14 - 00000000 _RSHD C:\360SANDBOX
2016-01-23 14:16 - 2013-04-22 20:33 - 00000000 ____D C:\ProgramData\NVIDIA
2016-01-23 14:16 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-01-23 14:16 - 2009-07-14 05:20 - 00000000 ____D C:\Windows
2016-01-23 13:46 - 2015-12-03 22:41 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-01-23 02:18 - 2012-10-24 12:23 - 00000000 ____D C:\Users\Nutzer\AppData\Roaming\Skype
2016-01-23 01:22 - 2013-03-19 14:58 - 00000000 ____D C:\Users\Nutzer\AppData\Roaming\.minecraft
2016-01-21 19:38 - 2014-08-11 23:52 - 00000000 ____D C:\Program Files (x86)\Steam
2016-01-21 14:40 - 2015-11-21 14:52 - 00077312 _____ C:\Users\Nutzer\AppData\Local\GDIPFONTCACHEV1.DAT
2016-01-20 16:10 - 2015-11-19 22:33 - 05014776 _____ C:\Windows\system32\FNTCACHE.DAT
2016-01-19 20:48 - 2011-04-12 09:43 - 00699416 _____ C:\Windows\system32\perfh007.dat
2016-01-19 20:48 - 2011-04-12 09:43 - 00149556 _____ C:\Windows\system32\perfc007.dat
2016-01-19 20:48 - 2009-07-14 07:13 - 01620612 _____ C:\Windows\system32\PerfStringBackup.INI
2016-01-19 20:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2016-01-19 20:46 - 2014-10-17 22:44 - 00000000 ____D C:\Users\Nutzer\Desktop\Schule
2016-01-19 19:24 - 2015-11-25 19:10 - 00000000 ____D C:\Users\Nutzer\Desktop\Math Images
2016-01-14 19:22 - 2012-10-24 12:23 - 00000000 ____D C:\ProgramData\Skype
2016-01-09 12:50 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2016-01-08 13:43 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-01-07 18:40 - 2015-12-03 22:40 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-01-07 17:43 - 2015-11-19 19:56 - 00000000 ____D C:\Program Files\Reason
2016-01-07 17:08 - 2015-12-03 22:41 - 00004116 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-01-07 17:08 - 2015-12-03 22:40 - 00003866 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-01-06 23:31 - 2015-11-17 18:33 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-01-06 23:09 - 2015-11-17 18:32 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-01-06 22:55 - 2014-10-17 22:44 - 00000000 ____D C:\Users\Nutzer\Desktop\wallpaper
2016-01-02 01:33 - 2015-11-19 22:31 - 00000000 ____D C:\$360Section
2016-01-02 01:33 - 2015-11-19 22:19 - 00000000 ____D C:\ProgramData\360Quarant
2016-01-02 01:33 - 2015-11-17 17:20 - 00000000 ____D C:\Users\Nutzer\AppData\Roaming\ZHP
2015-12-31 14:51 - 2014-08-12 00:10 - 00000000 ____D C:\Users\Nutzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2015-12-29 19:45 - 2015-12-21 18:24 - 00028665 _____ C:\Users\Nutzer\Desktop\Blindness.odt

==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-09-10 23:49

==================== Ende von FRST.txt ============================

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:06-01-2015
durchgeführt von Nutzer (2016-01-23 14:27:12)
Gestartet von C:\Users\Nutzer\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2013-04-22 19:08:31)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-296788986-4175192466-186242963-500 - Administrator - Disabled)
Gast (S-1-5-21-296788986-4175192466-186242963-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-296788986-4175192466-186242963-1005 - Limited - Enabled)
Nutzer (S-1-5-21-296788986-4175192466-186242963-1000 - Administrator - Enabled) => C:\Users\Nutzer

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: 360 Total Security (Enabled - Up to date) {2B66EE1E-E5C8-C2F7-648F-4E55AC68D37D}
AS: 360 Total Security (Enabled - Up to date) {90070FFA-C3F2-CD79-5E3F-7527D7EF99C0}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

@BIOS (HKLM-x32\...\{B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83}) (Version: 2.24 - GIGABYTE)
µTorrent (HKU\S-1-5-21-296788986-4175192466-186242963-1000\...\uTorrent) (Version: 3.4.3.40760 - BitTorrent Inc.)
360 Total Security (HKLM-x32\...\360TotalSecurity) (Version: 8.0.0.1058 - 360 Security Center)
7-Zip 15.12 (x64) (HKLM\...\7-Zip) (Version: 15.12 - Igor Pavlov)
9-lab Removal Tool (HKLM-x32\...\9-lab Removal Tool) (Version: - )
Adobe Flash Player 19 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 19.0.0.245 - Adobe Systems Incorporated)
Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.245 - Adobe Systems Incorporated)
Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe Photoshop CS6 version 13.0.1 (HKLM-x32\...\{A724DC44-6241-42D3-BA57-778B178ABC17}_is1) (Version: 13.0.1 - Adobe Systems, Inc.)
Adobe Reader XI (11.0.13) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.13 - Adobe Systems Incorporated)
Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version: - Hidden Path Entertainment, Ensemble Studios)
Akamai NetSession Interface (HKU\S-1-5-21-296788986-4175192466-186242963-1000\...\Akamai) (Version: - Akamai Technologies, Inc)
Apple Application Support (32-Bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.0.4.4 - Atheros Communications Inc.)
AutoGreen B12.0206.1 (HKLM-x32\...\InstallShield_{C75FAD21-EC08-42F3-92D6-C9C0AB355345}) (Version: 1.00.0000 - GIGABYTE)
AutoGreen B12.0206.1 (x32 Version: 1.00.0000 - GIGABYTE) Hidden
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
BitRaider Streaming Client (HKLM-x32\...\BitRaider Streaming Client) (Version: 1.3.3.4098 - BitRaider, LLC)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.11 - Piriform)
Creative Audio-Systemsteuerung (HKLM-x32\...\AudioCS) (Version: 2.56 - Creative Technology Limited)
Creative Software AutoUpdate (HKLM-x32\...\Creative Software AutoUpdate) (Version: 1.40 - Creative Technology Limited)
Creative Sound Blaster Properties x64 Edition (HKLM-x32\...\Creative Sound Blaster Properties x64 Edition) (Version: - )
CyberLink PowerDirector 11 (HKLM-x32\...\InstallShield_{551F492A-01B0-4DC4-866F-875EC4EDC0A8}) (Version: 11.0.0.2027 - CyberLink Corp.)
CyberLink PowerDirector 11 (Version: 11.0.0.2027 - Ihr Firmenname) Hidden
Dropbox (HKU\S-1-5-21-296788986-4175192466-186242963-1000\...\Dropbox) (Version: 3.12.5 - Dropbox, Inc.)
Easy Tune 6 B12.0525.1 (HKLM-x32\...\InstallShield_{457D7505-D665-4F95-91C3-ECB8C56E9ACA}) (Version: 1.00.0000 - GIGABYTE)
Easy Tune 6 B12.0525.1 (x32 Version: 1.00.0000 - GIGABYTE) Hidden
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
Everything 1.3.4.686 (x86) (HKLM-x32\...\Everything) (Version: - )
FINAL FANTASY VII (HKLM-x32\...\Steam App 39140) (Version: - Square Enix)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 47.0.2526.111 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) Hidden
Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.0.1351 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.225 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{6199B534-A1B6-46ED-873B-97B0ECF8F81E}) (Version: 1.23.216.0 - Intel Corporation)
iTunes (HKLM\...\{93F2A022-6C37-48B8-B241-FFABD9F60C30}) (Version: 12.1.2.27 - Apple Inc.)
Java 7 Update 10 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417010FF}) (Version: 7.0.100 - Oracle)
Jazzpunk (HKLM-x32\...\Steam App 250260) (Version: - Necrophone Games)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games)
League of Legends (x32 Version: 3.0.1 - Riot Games) Hidden
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
marvell 91xx driver (HKLM-x32\...\MagniDriver) (Version: 1.2.0.1010 - Marvell)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.163.2 - McAfee, Inc.)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41105.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Newblue Art Effects for PowerDirector (HKLM\...\NewBlue Art Effects for PowerDirector) (Version: 2.0 - NewBlue)
NVIDIA 3D Vision Controller-Treiber 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 347.09 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 347.25 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 347.25 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.5 - NVIDIA Corporation)
NVIDIA Grafiktreiber 347.25 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.25 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.33.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.33.0 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
ON_OFF Charge B11.1102.1 (HKLM-x32\...\{3DECD372-76A1-4483-BF10-B547790A3261}) (Version: 1.00.0001 - GIGABYTE)
OpenOffice 4.1.1 (HKLM-x32\...\{9395F41D-0F80-432E-9A59-B8E477E7E163}) (Version: 4.11.9775 - Apache Software Foundation)
Panda Cloud Cleaner (HKLM-x32\...\{92B2B132-C7F0-43DC-921A-4493C04F78A4}_is1) (Version: 1.1.5 - Panda Security)
Platform (x32 Version: 1.39 - VIA Technologies, Inc.) Hidden
PrivaZer (HKLM-x32\...\PrivaZer) (Version: 2.39.2.0 - Goversoft LLC)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Rome: Total War (HKLM-x32\...\Steam App 4760) (Version: - The Creative Assembly)
SHIELD Streaming (Version: 3.1.3000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.18.9 - NVIDIA Corporation) Hidden
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.5.0.9082 - Microsoft Corporation)
Skype™ 7.17 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.17.105 - Skype Technologies S.A.)
SmartSound Quicktracks 5 (HKLM-x32\...\InstallShield_{2F8BA3FD-1FA9-4279-B696-712ABB12F09F}) (Version: 5.1.8 - SmartSound Software Inc.)
SmartSound Quicktracks 5 (x32 Version: 5.1.8 - SmartSound Software Inc.) Hidden
Sound Blaster Audigy (HKLM-x32\...\{4B5F5D06-7097-417E-9793-290D9D85DC6B}) (Version: 1.0 - Creative Technology Limited)
Speccy (HKLM\...\Speccy) (Version: 1.28 - Piriform)
Splashtop Connect for Firefox (HKLM-x32\...\{EF25F71D-F3E8-42A3-8B5A-DBF83C4B942F}) (Version: 2.0.5.2 - Splashtop Inc.)
Splashtop Connect for IE (HKLM-x32\...\{E2B086BD-75A9-45D1-A675-151624B259A1}) (Version: 2.0.5.1 - Splashtop Inc.)
Star Wars The Old Republic (HKLM-x32\...\swtor_swtor) (Version: - Bioware/EA)
Star Wars: The Old Republic (HKLM-x32\...\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)
Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
The Binding of Isaac: Rebirth (HKLM-x32\...\Steam App 250900) (Version: - Nicalis, Inc.)
Toolwiz Smart Defrag 2011 (HKLM-x32\...\Toolwiz Smart Defrag FREE_is1) (Version: 1.3.0.0 - Toolwiz.com.)
TP-LINK Wireless Client Utility (HKLM-x32\...\{385C8E5A-0B4F-4DCD-BBBD-2A8AE0400A76}) (Version: 7.0 - TP-LINK)
Unturned (HKLM-x32\...\Steam App 304930) (Version: - Smartly Dressed Games)
Vegas Pro 12.0 (64-bit) (HKLM\...\{A7C8BBDE-FE98-11E1-87C9-F04DA23A5C58}) (Version: 12.0.367 - Sony)
VIA Plattform-Geräte-Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.39 - VIA Technologies, Inc.)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
Zemana AntiMalware (HKLM-x32\...\{8F0CD7D1-42F3-4195-95CD-833578D45057}_is1) (Version: 2.18.263 - Zemana Ltd.)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-296788986-4175192466-186242963-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-296788986-4175192466-186242963-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-296788986-4175192466-186242963-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-296788986-4175192466-186242963-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-296788986-4175192466-186242963-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-296788986-4175192466-186242963-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-296788986-4175192466-186242963-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-296788986-4175192466-186242963-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-296788986-4175192466-186242963-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-296788986-4175192466-186242963-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-296788986-4175192466-186242963-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {3CA0DB93-5755-48F8-8987-03BFE54C1FBB} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {47536D45-EEEC-4BDC-8183-A4DC1F8DA9E4} - \Microsoft\Windows\Customer Experience Improvement Program\UsbCeip -> Keine Datei <==== ACHTUNG
Task: {4F586805-A46B-4122-9933-C502FA916B2A} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {5A40E926-9E86-4B89-9CFD-B12311724371} - System32\Tasks\Microsoft\Windows\UPnP\UPnPHostConfig => config upnphost start= auto
Task: {6D08FC84-8CD7-4F7B-B8D9-4AB7D88B955F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {88A411E6-6CA8-4F91-8A0D-FCF0679208F6} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {91F195DF-91C3-48B0-B3FE-CC055C1F3910} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {B0D56F18-E551-4391-A203-FE430CF2CFEF} - \CreateChoiceProcessTask -> Keine Datei <==== ACHTUNG
Task: {BFF8A4E4-B403-4F9D-A732-8ABC0BA70865} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {C016366B-7126-46CA-B36B-592A3D95A60B} - \Microsoft\Windows\Customer Experience Improvement Program\Consolidator -> Keine Datei <==== ACHTUNG
Task: {C80369EA-A697-4BC3-837B-EA2C0E3F0D77} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-10-19] (Piriform Ltd)
Task: {DD9F510C-95F4-499A-90C8-BAC5BC372FF4} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask => start sppsvc
Task: {DE166336-6B57-4D47-9FAE-FA747CFBD859} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {FDD56C73-F0D5-41B6-B767-6EFFD7966428} - \Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask -> Keine Datei <==== ACHTUNG

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2013-04-22 20:33 - 2015-01-10 01:29 - 00117392 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-11-24 20:47 - 2009-04-07 09:43 - 00027648 _____ () C:\Windows\System32\sxp3ml6.dll
2015-01-20 22:35 - 2015-01-20 22:35 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 22:35 - 2015-01-20 22:35 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-11-17 22:38 - 2014-08-06 03:01 - 01048576 _____ () C:\Program Files (x86)\Everything\Everything.exe
2015-11-19 22:14 - 2015-11-12 17:10 - 00615032 _____ () C:\Program Files (x86)\360\Total Security\LiveUpdate360.exe
2015-11-19 22:14 - 2015-11-12 17:10 - 00088184 _____ () C:\Program Files (x86)\360\Total Security\deepscan\qutmload.dll
2015-12-12 11:12 - 2015-10-31 02:59 - 00034768 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\_multiprocessing.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00019408 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\faulthandler.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00022848 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\Crypto.Random.OSRNG.winrandom.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00023352 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\Crypto.Util._counter.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00042296 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\Crypto.Cipher._AES.pyd
2015-12-12 11:12 - 2015-10-31 02:59 - 00116688 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\pywintypes27.dll
2015-12-12 11:12 - 2015-10-31 02:59 - 00093640 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\_ctypes.pyd
2015-12-12 11:12 - 2015-10-31 02:59 - 00018376 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\select.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00019760 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\tornado.speedups.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00105928 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32api.pyd
2015-12-12 11:12 - 2015-10-31 02:59 - 00392144 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\pythoncom27.dll
2015-12-12 11:12 - 2015-12-08 23:36 - 00381752 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32com.shell.shell.pyd
2015-12-12 11:12 - 2015-10-31 02:59 - 00692688 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\unicodedata.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00020816 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._constant_time.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00109520 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\_cffi_backend.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 01737032 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._openssl.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00020808 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._padding.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00020800 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\_cffi_python_x66cf7a7cx17a72769.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00021840 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\_cffi_unicode_environ_win32_x8bf8e68bx9968e850.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00038696 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\fastpath.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00024528 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32event.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00020936 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\mmapfile.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00114640 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32security.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00021320 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\_cffi_pywin_kernel32_xde9e4433x360333f0.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00124880 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32file.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00030160 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32pipe.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00043472 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32process.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00175560 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32gui.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00028616 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32ts.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00024016 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32clipboard.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00048592 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32service.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00024392 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\librsyncffi.compiled._librsyncffi.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00036296 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\librsync.dll
2015-12-12 11:12 - 2015-10-31 03:00 - 00024016 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32profile.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00117056 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\breakpad.client.windows.handler.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00023376 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\winscreenshot.compiled._CaptureScreenshot.pyd
2015-12-12 11:12 - 2015-10-31 02:59 - 00134608 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\_elementtree.pyd
2015-12-12 11:12 - 2015-10-31 02:59 - 00134088 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\pyexpat.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00240584 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\jpegtran.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00020280 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\cpuid.compiled._cpuid.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00052024 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\psutil._psutil_windows.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00021304 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\Crypto.Util.strxor.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00350152 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\winxpgui.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00084792 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\dropbox_sqlite_ext.DLL
2015-12-12 11:12 - 2015-12-08 23:36 - 01826608 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\PyQt5.QtCore.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00083912 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\sip.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 03891504 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\PyQt5.QtWidgets.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 01950000 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\PyQt5.QtGui.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00519984 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\PyQt5.QtNetwork.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00133936 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKit.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00225080 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKitWidgets.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00207672 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\PyQt5.QtPrintSupport.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00024904 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\_cffi_wpad_proxy_win_x752e3d61xdcfdcc84.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00486704 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\PyQt5.QtQuick.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00357680 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\PyQt5.QtQml.pyd
2015-03-04 23:45 - 2015-10-31 03:01 - 00019920 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll
2015-03-04 23:45 - 2015-10-31 03:00 - 00786904 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-07-31 15:44 - 2015-10-31 03:00 - 00063448 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\QtQuick\Layouts\qquicklayoutsplugin.dll
2015-03-04 23:45 - 2015-10-31 03:00 - 00019408 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll
2015-11-19 22:14 - 2015-11-12 17:10 - 00578168 _____ () C:\Program Files (x86)\360\Total Security\safemon\wdui2.dll
2014-10-16 13:35 - 2014-10-16 13:35 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\1eeea3ab8d69ec722bdcb28b8eb8dd75\IsdiInterop.ni.dll
2012-10-09 17:37 - 2012-02-01 16:25 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2012-10-09 17:35 - 2011-12-16 10:39 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2016-01-15 18:50 - 2016-01-12 18:35 - 01590088 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.111\libglesv2.dll
2016-01-15 18:50 - 2016-01-12 18:35 - 00087880 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.111\libegl.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)


==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2009-07-14 04:34 - 2015-11-21 14:56 - 00000035 ____A C:\Windows\system32\Drivers\etc\hosts


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-296788986-4175192466-186242963-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Nutzer\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 8.8.8.8 - 8.8.4.4
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

MSCONFIG\startupfolder: C:^Users^Nutzer^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupreg: Akamai NetSession Interface => "C:\Users\Nutzer\AppData\Local\Akamai\netsession_win.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: CCleaner => "C:\Program Files\CCleaner\CCleaner64.exe" /AUTO
MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
MSCONFIG\startupreg: Dropbox Update => "C:\Users\Nutzer\AppData\Local\Dropbox\Update\DropboxUpdate.exe" /c
MSCONFIG\startupreg: Everything => "C:\Program Files (x86)\Everything\Everything.exe" -startup
MSCONFIG\startupreg: HDAudDeck => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r
MSCONFIG\startupreg: IAStorIcon => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe "C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" 60
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: NvBackend => "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
MSCONFIG\startupreg: P17RunE => RunDll32 P17RunE.dll,RunDLLEntry
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: ShadowPlay => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: USB3MON => "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
MSCONFIG\startupreg: VIAxHCUtl => C:\VIA_XHCI\usb3Monitor.exe
MSCONFIG\startupreg: ZAM => "C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe" /minimized

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [TCP Query User{6BC0E109-D928-400B-A40E-09A53DA43132}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{EBA1D084-D216-400F-9A23-81C8460DB404}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{CF1F7C3D-07EF-477C-BA73-0CD16860E913}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{EBC43232-2B3F-42A5-B9C5-E51EE4068486}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{EEBD37CC-5DE4-4C52-BC18-B34A13B3EE5E}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{642644FB-1F90-4F8E-8506-B3AB8174C9B2}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{C21FADCE-3AE6-4D92-A792-81D3BDF6059E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Age2HD\Launcher.exe
FirewallRules: [{42EA6D8F-21AB-4A0C-A90A-9EBFD6F3FBB5}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Age2HD\Launcher.exe
FirewallRules: [TCP Query User{776070BB-5115-4253-8733-AD005A54CFBC}C:\users\nutzer\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\nutzer\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{A65D5C0B-5E67-4E5F-B96F-ECDF71505E60}C:\users\nutzer\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\nutzer\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{54E19D28-791A-4427-BD76-621655765900}] => (Allow) C:\Program Files (x86)\360\Total Security\LiveUpdate360.exe
FirewallRules: [{65258C1B-72CE-451C-A83B-31C4D1CEB2A1}] => (Allow) C:\Program Files (x86)\360\Total Security\LiveUpdate360.exe
FirewallRules: [TCP Query User{13C330CE-1641-49F0-A12C-0587D21FEB8F}C:\users\nutzer\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\nutzer\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{EF01B9C6-9A00-4A9E-87D2-3429BA68D586}C:\users\nutzer\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\nutzer\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{08F54B0D-5971-41F1-A375-1100AA3C7905}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{47CBC090-B4BD-4080-9D29-2F45EDFD0733}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Unturned\Unturned.exe
FirewallRules: [{43883513-2183-427B-8C21-216B988C85BE}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Unturned\Unturned.exe
FirewallRules: [{2BCE169A-9D78-4D08-9CAA-660B2AB01633}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe
FirewallRules: [{D680BF92-5383-4D48-9112-0033286D3190}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe
FirewallRules: [{7CA858E2-4BAD-4C8F-A2ED-5663C07ADD9A}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe
FirewallRules: [{57108762-B43F-4E95-AD91-99E5B27A4C00}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe
FirewallRules: [TCP Query User{FB893E6D-85FB-461C-8F6E-631E49769AE7}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{943E76EB-1FC1-4953-9DB3-9B6B61F72001}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{7397DBC1-A7CA-49F6-8552-3E8CAAE87462}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\FINAL FANTASY VII\FF7_Launcher.exe
FirewallRules: [{C2C449D9-A9B9-42F4-B15F-E5259A7D687C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\FINAL FANTASY VII\FF7_Launcher.exe
FirewallRules: [{6E31BBD2-BEF2-4565-9BAD-59D411F5703A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Rome Total War Gold\RomeTW.exe
FirewallRules: [{6E864121-A8C8-4D3E-B89D-CECA2EC47B9F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Rome Total War Gold\RomeTW.exe
FirewallRules: [{315E36D1-E570-415D-BAE3-93CC16103FAE}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Rome Total War Gold\RomeTW-BI.exe
FirewallRules: [{82CB104C-635F-4028-84B9-71B5829039AB}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Rome Total War Gold\RomeTW-BI.exe
FirewallRules: [TCP Query User{979DA555-BA0A-429B-A63F-7A824530683D}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [UDP Query User{3261F741-4384-496F-AB13-A9893B816120}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [{BE719624-66A1-4F74-AAAB-BB878891F900}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{86AA8B36-C300-4832-A6B2-6DFDA4D557B5}] => (Allow) C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe
FirewallRules: [{0D440F3B-7037-4805-8A25-5DA1700C4D25}] => (Allow) C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe

==================== Wiederherstellungspunkte =========================

12-01-2016 23:28:05 Windows Update
13-01-2016 21:20:27 Windows Update
16-01-2016 02:42:37 Windows Update
17-01-2016 00:52:05 Windows Update
17-01-2016 11:31:09 Windows Update
18-01-2016 03:00:23 Windows Update
21-01-2016 14:07:36 Windows Update
22-01-2016 00:46:19 Windows Update
23-01-2016 02:18:58 Windows Update

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (01/23/2016 02:18:39 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: PRIVAM~1.DLL, Version: 0.0.0.0, Zeitstempel: 0x52ff3140
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000002b5ca4
ID des fehlerhaften Prozesses: 0x738
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (01/23/2016 02:18:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/23/2016 02:19:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: TrustedInstaller.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7989b
Name des fehlerhaften Moduls: wcp.dll, Version: 6.1.7601.18766, Zeitstempel: 0x54e4396d
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000001fe629
ID des fehlerhaften Prozesses: 0xdfc
Startzeit der fehlerhaften Anwendung: 0xTrustedInstaller.exe0
Pfad der fehlerhaften Anwendung: TrustedInstaller.exe1
Pfad des fehlerhaften Moduls: TrustedInstaller.exe2
Berichtskennung: TrustedInstaller.exe3

Error: (01/22/2016 11:05:42 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/22/2016 11:04:45 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcCan't create NSS process. [0]

Error: (01/22/2016 11:04:45 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed to create process. [5]

Error: (01/22/2016 11:04:26 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcNvVAD initialization failed [6]

Error: (01/22/2016 11:04:26 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed to set NvVAD endpoint as default Audio endpoint [0]

Error: (01/22/2016 11:04:26 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcNvVAD endpoint registration failed [0]

Error: (01/22/2016 12:47:15 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: TrustedInstaller.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7989b
Name des fehlerhaften Moduls: wcp.dll, Version: 6.1.7601.18766, Zeitstempel: 0x54e4396d
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000001fe629
ID des fehlerhaften Prozesses: 0x1184
Startzeit der fehlerhaften Anwendung: 0xTrustedInstaller.exe0
Pfad der fehlerhaften Anwendung: TrustedInstaller.exe1
Pfad des fehlerhaften Moduls: TrustedInstaller.exe2
Berichtskennung: TrustedInstaller.exe3


Systemfehler:
=============
Error: (01/23/2016 02:19:04 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2140993535

Error: (01/23/2016 02:19:04 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet:
%%-2140993535

Error: (01/23/2016 02:19:04 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2140993535

Error: (01/23/2016 02:19:04 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet:
%%-2140993535

Error: (01/23/2016 02:19:04 PM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: 0x80630801

Error: (01/23/2016 02:19:04 PM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: 0x80630801

Error: (01/23/2016 02:18:20 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2140993535

Error: (01/23/2016 02:18:20 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet:
%%-2140993535

Error: (01/23/2016 02:18:20 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2140993535

Error: (01/23/2016 02:18:20 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet:
%%-2140993535


CodeIntegrity:
===================================
Date: 2015-11-19 20:18:58.541
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

Date: 2015-11-19 20:18:58.511
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Speicherinformationen ===========================

Prozessor: Intel(R) Core(TM) i7-2600K CPU @ 3.40GHz
Prozentuale Nutzung des RAM: 30%
Installierter physikalischer RAM: 8152.07 MB
Verfügbarer physikalischer RAM: 5691.68 MB
Summe virtueller Speicher: 16302.34 MB
Verfügbarer virtueller Speicher: 13622.95 MB

==================== Laufwerke ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:783.43 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 571572E2)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

==================== Ende von Addition.txt ============================
siqzz
Regular Member
 
Posts: 29
Joined: January 22nd, 2016, 8:13 pm
Advertisement
Register to Remove

Re: Malware, keylogger or trojan problem

Unread postby wannabeageek » January 23rd, 2016, 1:13 pm

Hello siqzz, and Welcome to MalWare Removal forums!

My name is wannabeageek and I'll be helping you with any malware problems.

Before we begin, please read and follow these important guidelines, so things will proceed smoothly.
  1. The instructions being given are for YOUR computer and system only!
    Using these instructions on a different computer can cause damage to that computer and possibly render it inoperable!
  2. You must have Administrator rights, permissions for this computer.
  3. DO NOT run any other fix or removal tools unless instructed to do so!
  4. DO NOT install any other software (or hardware) during the cleaning process until we are done as well as
    DO NOT Remove, or Scan with anything on your system unless I ask. This adds more items to be researched.
    Extra Additions and Removals of files make the analysis more difficult.
  5. Only post your problem at (1) one help site. Applying fixes from multiple help sites can cause problems.
  6. Print each set of instructions if possible - your Internet connection will not be available during some fix processes.
  7. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
  8. Only reply to this thread, do not start another one. Please, continue responding, until I give you the "All Clean!" :cheers:
    Absence of symptoms does not mean that everything is clear.


I am currently reviewing your logs and will return, as soon as possible, with additional instructions.


Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

I advise you to backup any personal files and folders before you start
wannabeageek
MRU Master
MRU Master
 
Posts: 1871
Joined: November 23rd, 2009, 10:21 pm
Location: California

Re: Malware, keylogger or trojan problem

Unread postby siqzz » January 23rd, 2016, 2:10 pm

"You must have Administrator rights, permissions for this computer."

How do I do that? Is it set like that normally or do I actually have to change it?
siqzz
Regular Member
 
Posts: 29
Joined: January 22nd, 2016, 8:13 pm

Re: Malware, keylogger or trojan problem

Unread postby wannabeageek » January 23rd, 2016, 2:37 pm

Hi siqzz,

"You must have Administrator rights, permissions for this computer."

How do I do that? Is it set like that normally or do I actually have to change it?
There is no need to change this. Your account is Administrator.



P2P Advisory!
IMPORTANT There are signs of one or more P2P (Peer to Peer) File Sharing Programs installed on your computer.
µTorrent

As long as you have the P2P program(s) installed, per Forum Policy, I can offer you no further assistance.
If you choose NOT to remove the program(s)...indicate that in your next reply and this topic will be closed.

Otherwise, please perform the following steps:

Step 1.
Remove P2P Program(s)
  1. Click on Start > Control Panel and double click on Programs and Features.
  2. Locate the following program:
    µTorrent
  3. Click on the Change/Remove button to uninstall it.
    Carefully read any prompts...
    Some uninstallers prompt in a way to trick you into keeping the program, sometimes, preventing them from being uninstalled again!
  4. When the program have been uninstalled... Close Control Panel.
By using any form of P2P networking to download files you can anticipate infestations of malware to occur. The P2P program
itself, may be safe but the files may not... use P2P at your own risk! Keep in mind that this practice may be the source of your current malware infestation.
Reference... siting risk factors, using P2P programs: How to Prevent the Online Invasion of Spyware and Adware


Step 2.
Post the following Log files:
2016-01-09 12:52 - 2016-01-09 12:52 - 00029859 _____ C:\ComboFix.txt
2016-01-07 16:54 - 2016-01-07 16:58 - 00700956 _____ C:\TDSSKiller.3.1.0.9_07.01.2016_16.54.32_log.txt
2016-01-07 16:51 - 2016-01-07 16:51 - 00004300 _____ C:\TDSSKiller.3.1.0.9_07.01.2016_16.51.06_log.txt
2016-01-07 16:47 - 2016-01-07 16:47 - 00002040 _____ C:\Users\Nutzer\Desktop\Rkill.txt

The above files are required for analysis.

Did you ask for help at another forum?
wannabeageek
MRU Master
MRU Master
 
Posts: 1871
Joined: November 23rd, 2009, 10:21 pm
Location: California

Re: Malware, keylogger or trojan problem

Unread postby siqzz » January 24th, 2016, 9:52 am

I deleted the utorrent.
I asked for help at another forum but that was weeks ago. The person stopped replying and I decided to seek help somewhere else.
I'm guessing that you want the logs I posted on that forum, right?

Rkill 2.8.3 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2016 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html
Program started at: 01/07/2016 04:47:08 PM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1
Checking for Windows services to stop:
* No malware services found to stop.
Checking for processes to terminate:
* No malware processes found to kill.
Checking Registry for malware related settings:
* No issues found in the Registry.
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
Performing miscellaneous checks:
* No issues found.
Checking Windows Service Integrity:
* No issues found.
Searching for Missing Digital Signatures:
* No issues found.
Checking HOSTS File:
* No issues found.
Program finished at: 01/07/2016 04:47:34 PM
Execution time: 0 hours(s), 0 minute(s), and 25 seconds(s)
siqzz
Regular Member
 
Posts: 29
Joined: January 22nd, 2016, 8:13 pm

Re: Malware, keylogger or trojan problem

Unread postby siqzz » January 24th, 2016, 9:55 am

Attached TDSS rootkit log
You do not have the required permissions to view the files attached to this post.
siqzz
Regular Member
 
Posts: 29
Joined: January 22nd, 2016, 8:13 pm

Re: Malware, keylogger or trojan problem

Unread postby siqzz » January 24th, 2016, 9:56 am

ComboFix 16-01-07.01 - Nutzer 09.01.2016 12:41:40.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.8152.5330 [GMT 2:00]
ausgeführt von:: c:\users\Nutzer\Desktop\ComboFix.exe
AV: 360 Total Security *Disabled/Updated* {2B66EE1E-E5C8-C2F7-648F-4E55AC68D37D}
SP: 360 Total Security *Disabled/Updated* {90070FFA-C3F2-CD79-5E3F-7527D7EF99C0}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\data
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-12-09 bis 2016-01-09 ))))))))))))))))))))))))))))))
.
.
2050-05-24 07:48 . 2050-05-24 07:48 -------- d-----w- c:\program files\Common Files
2016-01-09 10:50 . 2016-01-09 10:50 -------- d-----w- c:\users\Public\AppData\Local\temp
2016-01-09 10:50 . 2016-01-09 10:50 -------- d-----w- c:\users\Default\AppData\Local\temp
2016-01-08 11:51 . 2015-11-25 11:02 11154520 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E14005E5-D16F-4C3E-82D6-BDD71E750482}\mpengine.dll
2016-01-07 15:10 . 2015-01-29 16:21 50320 ----a-w- c:\windows\system32\drivers\PSKMAD.sys
2016-01-07 15:10 . 2015-09-14 11:03 39672 ----a-w- c:\windows\system32\drivers\DasPtct.SYS
2016-01-07 15:09 . 2016-01-07 15:09 -------- d-----w- c:\program files (x86)\Panda Security
2016-01-06 21:09 . 2016-01-06 21:29 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2016-01-06 20:53 . 2016-01-06 20:55 -------- d-----w- C:\AdwCleaner
2015-12-31 23:51 . 2015-12-31 23:51 -------- d-----w- c:\users\Nutzer\AppData\Local\Blizzard
2015-12-31 20:24 . 2015-12-31 23:57 -------- d-----w- c:\program files (x86)\Hearthstone
2015-12-31 17:03 . 2015-12-31 17:03 -------- d-----w- c:\users\Nutzer\AppData\Local\Blizzard Entertainment
2015-12-31 17:03 . 2016-01-02 00:19 -------- d-----w- c:\users\Nutzer\AppData\Local\Battle.net
2015-12-31 17:03 . 2015-12-31 20:20 -------- d-----w- c:\users\Nutzer\AppData\Roaming\Battle.net
2015-12-31 17:00 . 2016-01-01 19:34 -------- d-----w- c:\program files (x86)\Battle.net
2015-12-24 15:10 . 2015-12-24 15:10 -------- d-----w- c:\users\Nutzer\AppData\Local\SWTOR
2015-12-20 19:42 . 2015-12-20 19:42 -------- d-----w- c:\programdata\BitRaider
2015-12-20 19:36 . 2015-12-20 19:36 -------- d-----w- c:\program files (x86)\Common Files\BioWare
2015-12-20 19:36 . 2015-12-20 19:36 -------- d-----w- c:\program files (x86)\Electronic Arts
2015-12-14 17:06 . 2015-12-14 17:06 -------- d-----w- c:\program files (x86)\Common Files\Skype
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2016-01-06 21:31 . 2015-11-17 16:33 192216 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2016-01-06 21:09 . 2015-11-17 16:32 109272 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-12-09 21:50 . 2014-12-12 19:22 140158008 ----a-w- c:\windows\system32\MRT.exe
2015-12-02 11:18 . 2010-11-21 03:27 301728 ------w- c:\windows\system32\MpSigStub.exe
2015-11-20 18:54 . 2015-12-09 14:52 98816 ----a-w- c:\windows\system32\wudriver.dll
2015-11-20 18:54 . 2015-12-09 14:52 37888 ----a-w- c:\windows\system32\wups2.dll
2015-11-20 18:54 . 2015-12-09 14:52 36864 ----a-w- c:\windows\system32\wups.dll
2015-11-20 18:54 . 2015-12-09 14:52 3170304 ----a-w- c:\windows\system32\wucltux.dll
2015-11-20 18:54 . 2015-12-09 14:52 2609152 ----a-w- c:\windows\system32\wuaueng.dll
2015-11-20 18:54 . 2015-12-09 14:52 192512 ----a-w- c:\windows\system32\wuwebv.dll
2015-11-20 18:54 . 2015-12-09 14:52 709632 ----a-w- c:\windows\system32\wuapi.dll
2015-11-20 18:54 . 2015-12-09 14:52 91136 ----a-w- c:\windows\system32\WinSetupUI.dll
2015-11-20 18:54 . 2015-12-09 14:52 12288 ----a-w- c:\windows\system32\wu.upgrade.ps.dll
2015-11-20 18:54 . 2015-12-09 14:52 37888 ----a-w- c:\windows\system32\wuapp.exe
2015-11-20 18:54 . 2015-12-09 14:52 140288 ----a-w- c:\windows\system32\wuauclt.exe
2015-11-20 18:34 . 2015-12-09 14:52 93696 ----a-w- c:\windows\SysWow64\wudriver.dll
2015-11-20 18:34 . 2015-12-09 14:52 30208 ----a-w- c:\windows\SysWow64\wups.dll
2015-11-20 18:34 . 2015-12-09 14:52 174080 ----a-w- c:\windows\SysWow64\wuwebv.dll
2015-11-20 18:34 . 2015-12-09 14:52 573440 ----a-w- c:\windows\SysWow64\wuapi.dll
2015-11-20 18:33 . 2015-12-09 14:52 35328 ----a-w- c:\windows\SysWow64\wuapp.exe
2015-11-18 17:27 . 2015-11-18 17:27 632064 ----a-w- c:\windows\SysWow64\msvcr80.dll
2015-11-18 17:27 . 2015-11-18 17:27 554240 ----a-w- c:\windows\SysWow64\msvcp80.dll
2015-11-18 17:27 . 2015-11-18 17:27 572928 ----a-w- c:\windows\SysWow64\msvcp90.dll
2015-11-18 17:27 . 2015-11-18 17:27 655872 ----a-w- c:\windows\SysWow64\msvcr90.dll
2015-11-18 17:27 . 2015-11-18 17:27 156392 ----a-w- c:\windows\SysWow64\eEmpty.exe
2015-11-17 16:42 . 2015-11-17 16:31 290304 ----a-w- c:\windows\SysWow64\subinacl.exe
2015-11-17 15:52 . 2015-11-17 16:14 24064 ----a-w- c:\windows\zoek-delete.exe
2015-11-17 14:37 . 2015-11-17 14:37 199536 ----a-w- c:\windows\system32\drivers\zam64.sys
2015-11-17 14:37 . 2015-11-17 14:37 199536 ----a-w- c:\windows\system32\drivers\zamguard64.sys
2015-11-12 15:10 . 2015-11-19 20:14 77904 ----a-w- c:\windows\SysWow64\drivers\360AvFlt.sys
2015-11-12 15:10 . 2015-11-19 20:14 319568 ----a-w- c:\windows\system32\drivers\360Box64.sys
2015-11-12 15:10 . 2015-11-19 20:14 137808 ----a-w- c:\windows\system32\drivers\360AntiHacker64.sys
2015-11-12 15:10 . 2015-11-19 20:14 40520 ----a-w- c:\windows\system32\drivers\360Camera64.sys
2015-11-12 15:10 . 2015-11-19 20:14 77904 ----a-w- c:\windows\system32\drivers\360AvFlt.sys
2015-11-12 15:10 . 2015-11-19 20:14 367696 ----a-w- c:\windows\system32\drivers\360fsflt.sys
2015-11-12 15:10 . 2015-11-19 20:14 178768 ----a-w- c:\windows\system32\drivers\BAPIDRV64.SYS
2015-11-11 18:53 . 2015-12-09 14:51 1735680 ----a-w- c:\windows\system32\comsvcs.dll
2015-11-11 18:53 . 2015-12-09 14:51 525312 ----a-w- c:\windows\system32\catsrvut.dll
2015-11-11 18:39 . 2015-12-09 14:51 1242624 ----a-w- c:\windows\SysWow64\comsvcs.dll
2015-11-11 18:39 . 2015-12-09 14:51 487936 ----a-w- c:\windows\SysWow64\catsrvut.dll
2015-11-10 19:08 . 2012-10-14 14:33 780488 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-11-10 19:08 . 2012-10-14 14:33 142536 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-11-10 18:55 . 2015-12-09 14:52 1008640 ----a-w- c:\windows\system32\user32.dll
2015-11-10 18:55 . 2015-12-09 14:52 1148416 ----a-w- c:\windows\system32\FntCache.dll
2015-11-10 18:55 . 2015-12-09 14:52 1550848 ----a-w- c:\windows\system32\DWrite.dll
2015-11-10 18:38 . 2015-12-09 14:52 1081856 ----a-w- c:\windows\SysWow64\DWrite.dll
2015-11-10 18:37 . 2015-12-09 14:52 833024 ----a-w- c:\windows\SysWow64\user32.dll
2015-11-10 17:47 . 2015-12-09 14:52 3211264 ----a-w- c:\windows\system32\win32k.sys
2015-11-06 19:06 . 2015-12-09 14:51 1188864 ----a-w- c:\windows\system32\wininet.dll
2015-11-06 19:06 . 2015-12-09 14:51 290304 ----a-w- c:\windows\system32\webcheck.dll
2015-11-06 19:06 . 2015-12-09 14:51 588800 ----a-w- c:\windows\system32\vbscript.dll
2015-11-06 19:06 . 2015-12-09 14:51 1539584 ----a-w- c:\windows\system32\urlmon.dll
2015-11-06 19:06 . 2015-12-09 14:51 134144 ----a-w- c:\windows\system32\url.dll
2015-11-06 19:06 . 2015-12-09 14:51 189952 ----a-w- c:\windows\system32\occache.dll
2015-11-06 19:06 . 2015-12-09 14:51 9072128 ----a-w- c:\windows\system32\mshtml.dll
2015-11-06 19:06 . 2015-12-09 14:51 97280 ----a-w- c:\windows\system32\mshtmled.dll
2015-11-06 19:06 . 2015-12-09 14:51 82944 ----a-w- c:\windows\system32\msfeedsbs.dll
2015-11-06 19:06 . 2015-12-09 14:51 735232 ----a-w- c:\windows\system32\msfeeds.dll
2015-11-06 19:06 . 2015-12-09 14:51 241152 ----a-w- c:\windows\system32\msrating.dll
2015-11-06 19:06 . 2015-12-09 14:51 1031168 ----a-w- c:\windows\system32\mstime.dll
2015-11-06 19:06 . 2015-12-09 14:51 910848 ----a-w- c:\windows\system32\jscript.dll
2015-11-06 19:06 . 2015-12-09 14:51 64512 ----a-w- c:\windows\system32\jsproxy.dll
2015-11-06 19:06 . 2015-12-09 14:51 57856 ----a-w- c:\windows\system32\licmgr10.dll
2015-11-06 19:06 . 2015-12-09 14:51 12306432 ----a-w- c:\windows\system32\ieframe.dll
2015-11-06 19:06 . 2015-12-09 14:51 2470400 ----a-w- c:\windows\system32\iertutil.dll
2015-11-06 19:06 . 2015-12-09 14:51 445952 ----a-w- c:\windows\system32\iedkcs32.dll
2015-11-06 19:06 . 2015-12-09 14:51 252928 ----a-w- c:\windows\system32\iepeers.dll
2015-11-06 19:06 . 2015-12-09 14:51 247808 ----a-w- c:\windows\system32\ieui.dll
2015-11-06 19:06 . 2015-12-09 14:51 495616 ----a-w- c:\windows\system32\dxtmsft.dll
2015-11-06 19:06 . 2015-12-09 14:51 314880 ----a-w- c:\windows\system32\dxtrans.dll
2015-11-06 19:06 . 2015-12-09 14:51 22528 ----a-w- c:\windows\system32\corpol.dll
2015-11-06 19:05 . 2015-12-09 14:51 47616 ----a-w- c:\windows\system32\mshta.exe
2015-11-06 19:05 . 2015-12-09 14:51 16384 ----a-w- c:\windows\system32\msfeedssync.exe
2015-11-06 19:05 . 2015-12-09 14:51 174592 ----a-w- c:\windows\system32\ieUnatt.exe
2015-11-06 19:05 . 2015-12-09 14:51 1538048 ----a-w- c:\windows\system32\inetcpl.cpl
2015-11-06 18:48 . 2015-12-09 14:51 981504 ----a-w- c:\windows\SysWow64\wininet.dll
2015-11-06 18:47 . 2015-12-09 14:51 431616 ----a-w- c:\windows\SysWow64\vbscript.dll
2015-11-06 18:47 . 2015-12-09 14:51 44544 ----a-w- c:\windows\SysWow64\licmgr10.dll
2015-11-06 18:47 . 2015-12-09 14:51 18944 ----a-w- c:\windows\SysWow64\corpol.dll
2015-11-06 18:46 . 2015-12-09 14:51 50176 ----a-w- c:\windows\SysWow64\mshta.exe
2015-11-06 18:46 . 2015-12-09 14:51 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2015-11-06 18:46 . 2015-12-09 14:51 1466368 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2015-11-06 18:30 . 2015-12-09 14:51 483328 ----a-w- c:\windows\system32\html.iec
2015-11-06 18:11 . 2015-12-09 14:51 386560 ----a-w- c:\windows\SysWow64\html.iec
2015-11-06 18:07 . 2015-12-09 14:51 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2015-11-06 17:54 . 2015-12-09 14:51 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb
2015-11-05 19:05 . 2015-12-09 14:52 17408 ----a-w- c:\windows\system32\wshrm.dll
2015-11-05 19:02 . 2015-12-09 14:52 14848 ----a-w- c:\windows\SysWow64\wshrm.dll
2015-11-05 19:02 . 2015-12-09 14:52 2048 ----a-w- c:\windows\system32\tzres.dll
2015-11-05 19:00 . 2015-12-09 14:52 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2015-11-05 09:53 . 2015-12-09 14:52 146944 ----a-w- c:\windows\system32\drivers\rmcast.sys
2015-11-03 19:04 . 2015-12-09 14:52 802304 ----a-w- c:\windows\system32\usp10.dll
2015-11-03 19:04 . 2015-12-09 14:51 241664 ----a-w- c:\windows\system32\els.dll
2015-11-03 18:56 . 2015-12-09 14:52 627712 ----a-w- c:\windows\SysWow64\usp10.dll
2015-11-03 18:55 . 2015-12-09 14:51 179712 ----a-w- c:\windows\SysWow64\els.dll
2015-10-29 17:50 . 2015-11-11 14:44 6656 ----a-w- c:\windows\system32\shimeng.dll
2015-10-29 17:50 . 2015-11-11 14:44 342016 ----a-w- c:\windows\system32\apphelp.dll
2015-10-29 17:50 . 2015-11-11 14:44 72192 ----a-w- c:\windows\system32\aelupsvc.dll
2015-10-29 17:50 . 2015-11-11 14:44 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2015-10-29 17:50 . 2015-11-11 14:44 309248 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"QHSafeTray"="c:\program files (x86)\360\Total Security\safemon\QHSafeTray.exe" [2015-11-12 1474168]
.
c:\users\Nutzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Nutzer\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2015-5-5 24952456]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 360Camera;360Safe Camera Filter Service;c:\windows\system32\Drivers\360Camera64.sys;c:\windows\SYSNATIVE\Drivers\360Camera64.sys [x]
R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe;c:\windows\SYSNATIVE\AppleChargerSrv.exe [x]
R3 BRDriver64_1_3_3_E02B25FC;BRDriver64_1_3_3_E02B25FC;c:\programdata\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys;c:\programdata\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [x]
R3 BRSptStub;BitRaider Mini-Support Service Stub Loader;c:\programdata\BitRaider\BRSptStub.exe;c:\programdata\BitRaider\BRSptStub.exe [x]
R3 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
R3 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x]
R3 GfExperienceService;NVIDIA GeForce Experience Service;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [x]
R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys;c:\windows\GVTDrv64.sys [x]
R3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
R3 PSKMAD;PSKMAD;c:\windows\system32\DRIVERS\PSKMAD.sys;c:\windows\SYSNATIVE\DRIVERS\PSKMAD.sys [x]
R3 ptun0901;TAP Adapter V9 for Private Tunnel;c:\windows\system32\DRIVERS\ptun0901.sys;c:\windows\SYSNATIVE\DRIVERS\ptun0901.sys [x]
R3 RichVideo64;Cyberlink RichVideo64 Service(CRVS);c:\program files\CyberLink\Shared files\RichVideo64.exe;c:\program files\CyberLink\Shared files\RichVideo64.exe [x]
R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 ZAMSvc;ZAM Controller Service;c:\program files (x86)\Zemana AntiMalware\ZAM.exe;c:\program files (x86)\Zemana AntiMalware\ZAM.exe [x]
S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S1 360Box64;360Box mini-filter driver;c:\windows\system32\DRIVERS\360Box64.sys;c:\windows\SYSNATIVE\DRIVERS\360Box64.sys [x]
S1 360FsFlt;360FsFlt mini-filter driver;c:\windows\system32\DRIVERS\360FsFlt.sys;c:\windows\SYSNATIVE\DRIVERS\360FsFlt.sys [x]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys;c:\windows\SYSNATIVE\DRIVERS\AppleCharger.sys [x]
S1 BAPIDRV;BAPIDRV;c:\windows\system32\DRIVERS\BAPIDRV64.sys;c:\windows\SYSNATIVE\DRIVERS\BAPIDRV64.sys [x]
S1 ZAM;ZAM Helper Driver;c:\windows\System32\drivers\zam64.sys;c:\windows\SYSNATIVE\drivers\zam64.sys [x]
S1 ZAM_Guard;ZAM Guard Driver;c:\windows\System32\drivers\zamguard64.sys;c:\windows\SYSNATIVE\drivers\zamguard64.sys [x]
S2 Apple Mobile Device Service;Apple Mobile Device Service;c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe;c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 Everything;Everything;c:\program files (x86)\Everything\Everything.exe;c:\program files (x86)\Everything\Everything.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 QHActiveDefense;360 Total Security;c:\program files (x86)\360\Total Security\safemon\QHActiveDefense.exe;c:\program files (x86)\360\Total Security\safemon\QHActiveDefense.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 VIAKaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\viakaraokesrv.exe;c:\windows\SYSNATIVE\viakaraokesrv.exe [x]
S3 360AntiHacker;360Safe Anti Hacker Service;c:\windows\system32\Drivers\360AntiHacker64.sys;c:\windows\SYSNATIVE\Drivers\360AntiHacker64.sys [x]
S3 360AvFlt;360AvFlt mini-filter driver;c:\windows\system32\DRIVERS\360AvFlt.sys;c:\windows\SYSNATIVE\DRIVERS\360AvFlt.sys [x]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys;c:\windows\SYSNATIVE\DRIVERS\dc3d.sys [x]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
S3 VUSB3HUB;VIA USB 3 Root Hub Service;c:\windows\system32\DRIVERS\ViaHub3.sys;c:\windows\SYSNATIVE\DRIVERS\ViaHub3.sys [x]
S3 xhcdrv;VIA USB eXtensible Host Controller Service;c:\windows\system32\DRIVERS\xhcdrv.sys;c:\windows\SYSNATIVE\DRIVERS\xhcdrv.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-12-16 20:47 1000264 ----a-w- c:\program files (x86)\Google\Chrome\Application\47.0.2526.106\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2016-01-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-05 18:18]
.
2016-01-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-05 18:18]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2015-12-08 21:33 236352 ----a-w- c:\users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2015-12-08 21:33 236352 ----a-w- c:\users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2015-12-08 21:33 236352 ----a-w- c:\users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2015-12-08 21:33 236352 ----a-w- c:\users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2015-12-08 21:33 236352 ----a-w- c:\users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2015-12-08 21:33 236352 ----a-w- c:\users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2015-12-08 21:33 236352 ----a-w- c:\users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2015-12-08 21:33 236352 ----a-w- c:\users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Bar = hxxp://www.google.com
TCP: DhcpNameServer = 178.233.140.110 176.240.150.250 46.197.15.60
TCP: Interfaces\{B4B33004-2526-44A5-A2D8-799D0327DCA7}: NameServer = 8.8.8.8,8.8.4.4
TCP: Interfaces\{ED726773-98F2-4D55-A6A5-D82511B439DD}: NameServer = 8.8.8.8,8.8.4.4
DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} - hxxp://ccfiles.creative.com/Web/softwar ... TSUEng.cab
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-87214911.sys
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
AddRemove-Steam - c:\program files (x86)\Steam\uninstall.exe
.
.
"ImagePath"="\"c:\program files\CyberLink\Shared files\RichVideo64.exe\"\00Z
[\]^_‹\00\00‹\00\00\00\00HIJKLMNO\00\00\00\00\00\00\00\00\03\00\00\00|}~‹\00\00‹\00\00\00\00|\00\00\00\00\00\00\00\00‘’“"
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_19_0_0_245_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_19_0_0_245_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_19_0_0_245_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_19_0_0_245_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_19_0_0_245.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.19"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_19_0_0_245.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_19_0_0_245.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_19_0_0_245.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2016-01-09 12:52:13
ComboFix-quarantined-files.txt 2016-01-09 10:52
.
Vor Suchlauf: 19 Verzeichnis(se), 842.084.466.688 Bytes frei
Nach Suchlauf: 22 Verzeichnis(se), 841.916.907.520 Bytes frei
.
- - End Of File - - CD71A2CE66B729BB2A9689336223A26E
A36C5E4F47E84449FF07ED3517B43A31
siqzz
Regular Member
 
Posts: 29
Joined: January 22nd, 2016, 8:13 pm

Re: Malware, keylogger or trojan problem

Unread postby wannabeageek » January 24th, 2016, 6:46 pm

Hi siqzz,

I deleted the utorrent.
Thank you.
I asked for help at another forum but that was weeks ago. The person stopped replying and I decided to seek help somewhere else.
I'm guessing that you want the logs I posted on that forum, right?
If possible, would you post a link to the site where the helper stopped assisting you? It will save us both some work for addtional files needed. And, I would like to see why he/she had you run ComboFix.
wannabeageek
MRU Master
MRU Master
 
Posts: 1871
Joined: November 23rd, 2009, 10:21 pm
Location: California

Re: Malware, keylogger or trojan problem

Unread postby wannabeageek » January 24th, 2016, 10:20 pm

Hi Siqzz,

I found it. Trojan or Keylogger in my pc
Give me an extra day to review all this data and I will get back to you.

wbg
wannabeageek
MRU Master
MRU Master
 
Posts: 1871
Joined: November 23rd, 2009, 10:21 pm
Location: California

Re: Malware, keylogger or trojan problem

Unread postby siqzz » January 25th, 2016, 1:25 pm

For some reason the link does not work for me. Do you still want me to post the forum link?
siqzz
Regular Member
 
Posts: 29
Joined: January 22nd, 2016, 8:13 pm

Re: Malware, keylogger or trojan problem

Unread postby wannabeageek » January 25th, 2016, 1:45 pm

This link I posted is disabled. It is not necessary for you to re-post the link since I have the information I needed from that site.
wannabeageek
MRU Master
MRU Master
 
Posts: 1871
Joined: November 23rd, 2009, 10:21 pm
Location: California

Re: Malware, keylogger or trojan problem

Unread postby wannabeageek » January 25th, 2016, 5:31 pm

Hi siqzz

Please run the following and post the results in your next reply.

Step 1.
Create a batch file
  1. Open Notepad.
  2. Copy/paste the following text into the empty Notepad window.
    Code: Select all
    @echo off
    set >> "%userprofile%\desktop\look.txt"
    dir /a /s C:\AdwCleaner >> "%userprofile%\desktop\look.txt"
    dir /a /s C:\ProgramData\360Quarant >> "%userprofile%\desktop\look.txt"
    dir /a /s C:\Windows\erdnt >> "%userprofile%\desktop\look.txt"
    dir /a /s C:\FRST >> "%userprofile%\desktop\look.txt"
    dir /a  "C:\program files" >> "%userprofile%\desktop\look.txt"
    dir /a:d "C:\program files\Common Files" >> "%userprofile%\desktop\look.txt"
    dir /a /s C:\Qoobox >> "%userprofile%\desktop\look.txt"
    dir /a /s "C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware" >> "%userprofile%\desktop\look.txt"
    dir /a C:\Users >> "%userprofile%\desktop\look.txt"
    notepad %userprofile%\desktop\look.txt
    del %userprofile%\desktop\look.txt
    del %userprofile%\desktop\look.bat
  3. Save the file as look.bat on your desktop. Save it with the file type... all types *.*.
  4. Right click on the file look.bat select "Run As Administrator" to run it. If prompted by UAC, please allow it.
  5. Copy and Post the results from the open notepad window. The files will self delete when you close the notepad program.
wannabeageek
MRU Master
MRU Master
 
Posts: 1871
Joined: November 23rd, 2009, 10:21 pm
Location: California

Re: Malware, keylogger or trojan problem

Unread postby siqzz » January 26th, 2016, 10:33 am

ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Nutzer\AppData\Roaming
asl.log=Destination=file
CommonProgramFiles=C:\Program Files\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=NUTZER-PC
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Nutzer
LOCALAPPDATA=C:\Users\Nutzer\AppData\Local
LOGONSERVER=\\NUTZER-PC
NUMBER_OF_PROCESSORS=8
OS=Windows_NT
Path=C:\Windows\system32;C:\Windows;C:\Windows\system32\wbem;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Program Files (x86)\Intel\iCLS Client;C:\Program Files\Intel\iCLS Client;C:\Windows\System32\WindowsPowerShell\v1.0;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files (x86)\QuickTime\QTSystem;C:\Program Files (x86)\Skype\Phone;C:\Program Files (x86)\Skype\Phone\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 42 Stepping 7, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=2a07
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PROMPT=$P$G
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Nutzer\AppData\Local\Temp
TMP=C:\Users\Nutzer\AppData\Local\Temp
USERDOMAIN=Nutzer-PC
USERNAME=Nutzer
USERPROFILE=C:\Users\Nutzer
windir=C:\Windows
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 6099-878C

Verzeichnis von C:\AdwCleaner

06.01.2016 22:55 <DIR> .
06.01.2016 22:55 <DIR> ..
06.01.2016 22:55 906 AdwCleaner[C1].txt
06.01.2016 22:55 788 AdwCleaner[S1].txt
06.01.2016 22:55 <DIR> Quarantine
06.01.2016 22:55 44 Quarantine.log
3 Datei(en), 1.738 Bytes

Verzeichnis von C:\AdwCleaner\Quarantine

06.01.2016 22:55 <DIR> .
06.01.2016 22:55 <DIR> ..
06.01.2016 22:55 <DIR> C
0 Datei(en), 0 Bytes

Verzeichnis von C:\AdwCleaner\Quarantine\C

06.01.2016 22:55 <DIR> .
06.01.2016 22:55 <DIR> ..
20.12.2015 21:36 0 END.vir
1 Datei(en), 0 Bytes

Anzahl der angezeigten Dateien:
4 Datei(en), 1.738 Bytes
8 Verzeichnis(se), 838.969.344.000 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 6099-878C

Verzeichnis von C:\ProgramData\360Quarant

24.01.2016 15:41 <DIR> .
24.01.2016 15:41 <DIR> ..
19.12.2015 14:27 1.445 360safe.04B6746958F9B3D7E1957411630FD0FE.union1
19.11.2015 22:31 1.929 360safe.061699A8D41F8493DCCC3796A270FF7E.union1
22.12.2015 12:57 1.439 360safe.09A88CD88BFE997C02059528C8050E37.union1
20.12.2015 17:10 1.381 360safe.0E41372D0E6CF1DFDF85BC3B2C88C0B0.union1
22.11.2015 01:51 1.193 360safe.216DD2B31746D375D5F24016DAC66BFE.union1
20.12.2015 01:03 1.439 360safe.295D1F4E914750C265F75C7A9003D2F7.union1
04.12.2015 21:56 1.439 360safe.3E3DBD6F1BE836187984B727F5CDC4B3.union1
22.12.2015 12:56 1.445 360safe.3F84F8494541D7FEED8EC244358C25E0.union1
24.01.2016 15:41 1.499 360safe.4A9E7CF35D6CF6F6AE0CFF091CC822AA.union1
21.12.2015 14:43 1.439 360safe.4C4E27E0627E9602165564D735964B02.union1
16.12.2015 18:42 1.439 360safe.4EC0A6AB5CEE1287942611BD6FCDAD7C.union1
20.12.2015 16:49 1.445 360safe.557EEE127152B69AC1C884B2DC7630A5.union1
22.11.2015 01:53 1.193 360safe.56A5BB09A9FD0612829D9A45AFA20D67.union1
04.12.2015 21:56 1.481 360safe.5FA486FC0D4C061C9B29FD952C91FA73.union1
18.12.2015 21:34 1.439 360safe.6A2DFB90478E6C1250F7262782C86D76.union1
16.12.2015 18:48 1.509 360Safe.76002D42D2B7761D00DEC8866FF5A6AD.union1
21.12.2015 14:44 1.445 360safe.768DD08F835251B4E7968BE8C2E713A2.union1
20.12.2015 20:00 1.465 360safe.7AA6BDBD42F5493ADFEA9F137251C81B.union1
21.12.2015 15:13 1.465 360safe.7BC3D82D5A500DC94E36B6370E5F8237.union1
20.12.2015 00:33 1.381 360safe.7FF8C409EDBCA760AC51D93289B12360.union1
19.12.2015 14:27 1.439 360safe.81B332CC5BC035DE7A8A7BCEABA49923.union1
29.11.2015 21:59 1.481 360safe.8479E5C6C2FF0E56479D423456F227F7.union1
29.11.2015 21:58 1.439 360safe.8AEFA507D7CBEE37DD87FC61F17816DD.union1
18.12.2015 21:33 1.445 360safe.8FF26CA4740B62ED67A4F8E3377A4356.union1
02.01.2016 01:33 1.303 360safe.94223CAD44F5FF6E064516CAFB80F5CF.union1
22.11.2015 01:52 1.193 360safe.9A81F00524D60F74F0B48EB15D2A610C.union1
16.12.2015 18:44 1.381 360safe.AAA972D6AFD08A3BD9BABE77DA008878.union1
21.11.2015 22:13 1.193 360safe.B6DAA5F96AF2AE624E0CDF03009BA171.union1
16.12.2015 18:42 1.445 360safe.CE439F7A023038E39165DF7E7C87CED6.union1
16.12.2015 18:48 1.503 360Safe.D2BB7E0B1FFF3797137AECD0131B1A91.union1
03.12.2015 17:07 1.439 360safe.D483D44FAD9C15C0B5F8FB60DE8BED81.union1
03.12.2015 17:07 1.481 360safe.D7FCDB8727DE80D585BFC1401C1106AE.union1
16.12.2015 18:48 1.561 360Safe.DF385380E0B189ADA3906954EFB1FFD3.union1
02.01.2016 01:33 1.675 360Safe.E0643A7324AB530D1653AABBA9018741.union1
22.11.2015 01:52 1.193 360safe.E34C958BC6F81CD23F0151ACAD09D2A3.union1
20.12.2015 01:03 1.445 360safe.F42B66772BAA3061FEF93A75289A942E.union1
20.12.2015 16:48 1.439 360safe.F80BFD333E1BBCAF103773EE5F4E4D8E.union1
24.01.2016 15:41 68 360safe.Summary.union1
38 Datei(en), 53.033 Bytes

Anzahl der angezeigten Dateien:
38 Datei(en), 53.033 Bytes
2 Verzeichnis(se), 838.969.339.904 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 6099-878C

Verzeichnis von C:\Windows\erdnt

19.11.2015 20:20 <DIR> .
19.11.2015 20:20 <DIR> ..
19.11.2015 20:20 <DIR> cache64
19.11.2015 20:20 <DIR> cache86
09.01.2016 12:36 <DIR> Hiv-backup
0 Datei(en), 0 Bytes

Verzeichnis von C:\Windows\erdnt\cache64

19.11.2015 20:20 <DIR> .
19.11.2015 20:20 <DIR> ..
14.07.2009 02:10 23.040 asyncmac.sys
14.07.2009 03:52 24.128 atapi.sys
05.07.2012 00:13 136.704 browser.dll
14.07.2009 03:40 18.944 cngaudit.dll
24.04.2015 20:17 633.856 comctl32.dll
14.07.2009 03:26 1.297.408 comres.dll
27.04.2015 21:23 188.416 cryptsvc.dll
14.07.2009 03:39 9.728 ctfmon.exe
14.07.2009 03:40 402.944 es.dll
09.01.2016 12:51 3.366 FD_Cache.md5
14.07.2009 03:41 424.448 hnetcfg.dll
14.07.2009 03:41 167.424 imm32.dll
14.07.2009 03:48 50.768 kbdclass.sys
20.10.2015 03:05 1.164.800 kernel32.dll
14.07.2009 03:41 5.120 ksuser.dll
14.07.2009 03:41 29.696 linkinfo.dll
02.09.2015 05:04 41.984 lpk.dll
20.10.2015 03:04 31.232 lsass.exe
06.11.2015 21:06 9.072.128 mshtml.dll
14.07.2009 03:41 8.192 msimg32.dll
16.12.2011 10:46 634.880 msvcrt.dll
08.09.2013 04:27 327.168 mswsock.dll
13.10.2015 06:57 950.720 ndis.sys
21.11.2010 05:24 695.808 netlogon.dll
14.07.2009 03:41 360.448 netman.dll
24.01.2014 04:37 1.684.928 ntfs.sys
20.10.2015 03:12 5.570.496 ntoskrnl.exe
14.07.2009 01:19 6.144 null.sys
04.07.2015 20:07 2.087.424 ole32.dll
14.07.2009 03:41 167.424 powrprof.dll
21.11.2010 05:23 849.920 qmgr.dll
14.07.2009 03:41 159.232 regsvc.dll
21.11.2010 05:24 512.000 rpcss.dll
21.11.2010 05:24 232.960 scecli.dll
05.08.2015 19:56 1.110.016 schedsvc.dll
13.04.2015 05:28 328.704 services.exe
14.07.2009 03:33 3.072 sfc.dll
21.11.2010 05:23 370.688 shsvcs.dll
11.02.2012 08:36 559.104 spoolsv.exe
14.07.2009 03:41 193.024 ssdpsrv.dll
14.07.2009 03:39 27.136 svchost.exe
21.11.2010 05:24 316.928 tapisrv.dll
05.04.2014 04:47 1.903.552 tcpip.sys
13.10.2015 18:40 118.272 tdx.sys
14.10.2014 04:13 683.520 termsrv.dll
10.11.2015 20:55 1.008.640 user32.dll
21.11.2010 05:24 30.720 userinit.exe
03.11.2015 21:04 802.304 usp10.dll
06.11.2015 21:06 1.188.864 wininet.dll
14.07.2009 03:39 129.024 wininit.exe
17.07.2014 04:07 455.168 winlogon.exe
14.07.2009 03:34 4.608 ws2help.dll
21.11.2010 05:24 297.984 ws2_32.dll
20.11.2015 20:54 140.288 wuauclt.exe
54 Datei(en), 37.645.494 Bytes

Verzeichnis von C:\Windows\erdnt\cache86

19.11.2015 20:20 <DIR> .
19.11.2015 20:20 <DIR> ..
14.07.2009 03:15 12.288 cngaudit.dll
24.04.2015 19:56 530.432 comctl32.dll
27.04.2015 21:04 143.872 cryptsvc.dll
14.07.2009 03:14 8.704 ctfmon.exe
21.11.2010 05:24 1.828.352 d3d9.dll
14.07.2009 03:15 531.968 ddraw.dll
14.07.2009 03:15 453.632 dsound.dll
14.07.2009 03:15 271.360 es.dll
25.02.2011 08:19 2.871.808 explorer.exe
14.07.2009 03:15 19.456 ias.dll
06.11.2015 20:50 677.024 iexplore.exe
21.11.2010 05:24 119.808 imm32.dll
20.10.2015 02:44 1.114.112 kernel32.dll
14.07.2009 03:15 4.608 ksuser.dll
14.07.2009 03:15 22.016 linkinfo.dll
02.09.2015 04:47 25.600 lpk.dll
21.11.2010 05:24 954.288 mfc40u.dll
14.07.2009 03:15 16.896 midimap.dll
06.11.2015 20:47 6.036.480 mshtml.dll
14.07.2009 03:15 4.608 msimg32.dll
16.12.2011 09:52 690.688 msvcrt.dll
08.09.2013 04:03 231.424 mswsock.dll
21.11.2010 05:24 563.712 netlogon.dll
20.10.2015 02:52 3.991.488 ntkrnlpa.exe
20.10.2015 02:52 3.935.680 ntoskrnl.exe
04.07.2015 19:48 1.414.656 ole32.dll
21.11.2010 05:24 90.112 olepro32.dll
14.07.2009 03:16 39.424 perfctrs.dll
14.07.2009 03:16 145.408 powrprof.dll
14.07.2009 03:16 11.776 rasadhlp.dll
14.07.2009 03:39 427.008 regedit.exe
21.11.2010 05:23 175.616 scecli.dll
14.07.2009 03:10 2.560 sfc.dll
21.11.2010 05:24 328.192 shsvcs.dll
14.07.2009 03:14 20.992 svchost.exe
21.11.2010 05:24 242.176 tapisrv.dll
14.07.2009 03:16 266.752 upnphost.dll
10.11.2015 20:37 833.024 user32.dll
21.11.2010 05:23 26.624 userinit.exe
03.11.2015 20:56 627.712 usp10.dll
14.07.2009 03:16 21.504 version.dll
06.11.2015 20:48 981.504 wininet.dll
14.07.2009 03:14 96.256 wininit.exe
14.07.2009 03:11 4.608 ws2help.dll
21.11.2010 05:23 206.848 ws2_32.dll
14.07.2009 03:16 9.216 WSHTCPIP.DLL
46 Datei(en), 31.032.272 Bytes

Verzeichnis von C:\Windows\erdnt\Hiv-backup

09.01.2016 12:36 <DIR> .
09.01.2016 12:36 <DIR> ..
09.01.2016 12:36 32.768 BCD
09.01.2016 12:36 44.015.616 components
09.01.2016 12:36 315.392 DEFAULT
09.01.2016 12:36 947 ERDNT.CON
20.10.2005 14:02 163.328 ERDNT.EXE
09.01.2016 12:36 1.337 ERDNT.INF
31.08.2000 02:00 2.815 ERDNTDOS.LOC
31.08.2000 02:00 3.275 ERDNTWIN.LOC
09.01.2016 12:36 24.576 SAM
09.01.2016 12:36 28.672 SECURITY
09.01.2016 12:36 78.643.200 SOFTWARE
09.01.2016 12:36 18.776.064 SYSTEM
09.01.2016 12:36 <DIR> Users
12 Datei(en), 142.007.990 Bytes

Verzeichnis von C:\Windows\erdnt\Hiv-backup\Users

09.01.2016 12:36 <DIR> .
09.01.2016 12:36 <DIR> ..
09.01.2016 12:36 <DIR> 00000001
09.01.2016 12:36 <DIR> 00000002
09.01.2016 12:36 <DIR> 00000003
09.01.2016 12:36 <DIR> 00000004
09.01.2016 12:36 <DIR> 00000005
09.01.2016 12:36 <DIR> 00000006
0 Datei(en), 0 Bytes

Verzeichnis von C:\Windows\erdnt\Hiv-backup\Users\00000001

09.01.2016 12:36 <DIR> .
09.01.2016 12:36 <DIR> ..
09.01.2016 12:36 12.288 360SAN~1.SAV
1 Datei(en), 12.288 Bytes

Verzeichnis von C:\Windows\erdnt\Hiv-backup\Users\00000002

09.01.2016 12:36 <DIR> .
09.01.2016 12:36 <DIR> ..
09.01.2016 12:36 253.952 NTUSER.DAT
1 Datei(en), 253.952 Bytes

Verzeichnis von C:\Windows\erdnt\Hiv-backup\Users\00000003

09.01.2016 12:36 <DIR> .
09.01.2016 12:36 <DIR> ..
09.01.2016 12:36 249.856 NTUSER.DAT
1 Datei(en), 249.856 Bytes

Verzeichnis von C:\Windows\erdnt\Hiv-backup\Users\00000004

09.01.2016 12:36 <DIR> .
09.01.2016 12:36 <DIR> ..
09.01.2016 12:36 106.496 FILECA~1.DAT
1 Datei(en), 106.496 Bytes

Verzeichnis von C:\Windows\erdnt\Hiv-backup\Users\00000005

09.01.2016 12:36 <DIR> .
09.01.2016 12:36 <DIR> ..
09.01.2016 12:36 4.313.088 ntuser.dat
1 Datei(en), 4.313.088 Bytes

Verzeichnis von C:\Windows\erdnt\Hiv-backup\Users\00000006

09.01.2016 12:36 <DIR> .
09.01.2016 12:36 <DIR> ..
09.01.2016 12:36 4.902.912 UsrClass.dat
1 Datei(en), 4.902.912 Bytes

Anzahl der angezeigten Dateien:
118 Datei(en), 220.524.348 Bytes
32 Verzeichnis(se), 838.969.323.520 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 6099-878C

Verzeichnis von C:\FRST

23.01.2016 14:27 <DIR> .
23.01.2016 14:27 <DIR> ..
06.01.2016 23:03 <DIR> Hives
23.01.2016 14:27 <DIR> Logs
18.11.2015 17:47 <DIR> Quarantine
0 Datei(en), 0 Bytes

Verzeichnis von C:\FRST\Hives

06.01.2016 23:03 <DIR> .
06.01.2016 23:03 <DIR> ..
06.01.2016 23:03 32.768 BCD
06.01.2016 23:03 315.392 DEFAULT
06.01.2016 23:03 800 ERDNT.CON
20.11.2015 21:40 163.328 ERDNT.EXE
06.01.2016 23:03 834 ERDNT.INF
20.11.2015 21:36 2.815 ERDNTDOS.LOC
20.11.2015 21:36 3.275 ERDNTWIN.LOC
06.01.2016 23:03 24.576 SAM
06.01.2016 23:03 28.672 SECURITY
06.01.2016 23:03 78.643.200 SOFTWARE
06.01.2016 23:03 18.776.064 SYSTEM
06.01.2016 23:03 <DIR> Users
11 Datei(en), 97.991.724 Bytes

Verzeichnis von C:\FRST\Hives\Users

06.01.2016 23:03 <DIR> .
06.01.2016 23:03 <DIR> ..
06.01.2016 23:03 <DIR> 00000001
06.01.2016 23:03 <DIR> 00000002
0 Datei(en), 0 Bytes

Verzeichnis von C:\FRST\Hives\Users\00000001

06.01.2016 23:03 <DIR> .
06.01.2016 23:03 <DIR> ..
06.01.2016 23:03 4.313.088 ntuser.dat
1 Datei(en), 4.313.088 Bytes

Verzeichnis von C:\FRST\Hives\Users\00000002

06.01.2016 23:03 <DIR> .
06.01.2016 23:03 <DIR> ..
06.01.2016 23:03 4.902.912 UsrClass.dat
1 Datei(en), 4.902.912 Bytes

Verzeichnis von C:\FRST\Logs

23.01.2016 14:27 <DIR> .
23.01.2016 14:27 <DIR> ..
06.01.2016 23:05 43.763 Addition_06-01-2016_23-05-38.txt
23.01.2016 14:27 44.391 Addition_23-01-2016_14-27-43.txt
06.01.2016 23:05 42.113 FRST_06-01-2016_23-05-38.txt
23.01.2016 14:27 47.783 FRST_23-01-2016_14-27-43.txt
4 Datei(en), 178.050 Bytes

Verzeichnis von C:\FRST\Quarantine

18.11.2015 17:47 <DIR> .
18.11.2015 17:47 <DIR> ..
22.11.2015 01:58 <DIR> C
0 Datei(en), 0 Bytes

Verzeichnis von C:\FRST\Quarantine\C

22.11.2015 01:58 <DIR> .
22.11.2015 01:58 <DIR> ..
22.11.2015 01:58 <DIR> Windows
18.11.2015 21:15 <DIR> zoek_backup
0 Datei(en), 0 Bytes

Verzeichnis von C:\FRST\Quarantine\C\Windows

22.11.2015 01:58 <DIR> .
22.11.2015 01:58 <DIR> ..
22.11.2015 01:58 <DIR> winsxs
0 Datei(en), 0 Bytes

Verzeichnis von C:\FRST\Quarantine\C\Windows\winsxs

22.11.2015 01:58 <DIR> .
22.11.2015 01:58 <DIR> ..
09.09.2015 21:56 <DIR> amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.18939_none_fe0847a11d97ed01
13.05.2015 22:34 <DIR> amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.23040_none_fe7de82236c5fac8
10.06.2015 23:19 <DIR> amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.23072_none_fe5f78f236dc8149
09.09.2015 21:56 <DIR> amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.23142_none_fe7fea9c36c42a9d
18.11.2015 21:15 <DIR> FileMaps
18.11.2015 21:15 <DIR> Manifests
13.04.2015 19:09 <DIR> wow64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.18804_none_18fdc1e9a139c989
01.10.2015 23:09 <DIR> wow64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.18915_none_18f3f42da140fbf8
08.10.2015 21:47 <DIR> wow64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.19020_none_18e3faf1a14dcc78
0 Datei(en), 0 Bytes

Verzeichnis von C:\FRST\Quarantine\C\Windows\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.18939_none_fe0847a11d97ed01

09.09.2015 21:56 <DIR> .
09.09.2015 21:56 <DIR> ..
23.07.2015 02:02 1.390.592 diagtrack.dll
15.07.2015 00:22 1.016 telemetry.ASM-WindowsDefault.json
15.07.2015 00:22 795 utc.app.json
22.07.2015 18:48 41.984 UtcResources.dll
4 Datei(en), 1.434.387 Bytes

Verzeichnis von C:\FRST\Quarantine\C\Windows\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.23040_none_fe7de82236c5fac8

13.05.2015 22:34 <DIR> .
13.05.2015 22:34 <DIR> ..
27.04.2015 21:17 1.254.400 diagtrack.dll
24.01.2015 01:26 660 telemetry.ASM-WindowsDefault.json
24.01.2015 01:26 955 utc.app.json
27.04.2015 20:02 36.864 UtcResources.dll
4 Datei(en), 1.292.879 Bytes

Verzeichnis von C:\FRST\Quarantine\C\Windows\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.23072_none_fe5f78f236dc8149

10.06.2015 23:19 <DIR> .
10.06.2015 23:19 <DIR> ..
25.05.2015 20:22 1.255.424 diagtrack.dll
09.06.2015 20:16 5.513 telemetry.ASM-WindowsDefault.json
10.06.2015 21:36 20.925 utc.app.json
25.05.2015 19:02 36.864 UtcResources.dll
4 Datei(en), 1.318.726 Bytes

Verzeichnis von C:\FRST\Quarantine\C\Windows\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.23142_none_fe7fea9c36c42a9d

09.09.2015 21:56 <DIR> .
09.09.2015 21:56 <DIR> ..
23.07.2015 00:04 1.390.592 diagtrack.dll
15.07.2015 00:23 1.016 telemetry.ASM-WindowsDefault.json
15.07.2015 00:23 795 utc.app.json
22.07.2015 22:38 41.984 UtcResources.dll
4 Datei(en), 1.434.387 Bytes

Verzeichnis von C:\FRST\Quarantine\C\Windows\winsxs\FileMaps

18.11.2015 21:15 <DIR> .
18.11.2015 21:15 <DIR> ..
16.07.2015 02:12 608 $$_appcompat_appraiser_telemetry_94274e99519f58a9.cdf-ms.xBAD
08.10.2015 21:47 1.444 $$_system32_gwx_06654c71d047de88.cdf-ms.xBAD
01.10.2015 23:09 576 $$_system32_gwx_downloadswap_5098c1f0e1204caf.cdf-ms.xBAD
13.04.2015 19:09 572 $$_system32_gwx_download_27d68082ad334184.cdf-ms.xBAD
08.10.2015 21:47 732 $$_syswow64_gwx_1bf23be3a76673bc.cdf-ms.xBAD
5 Datei(en), 3.932 Bytes

Verzeichnis von C:\FRST\Quarantine\C\Windows\winsxs\Manifests

18.11.2015 21:15 <DIR> .
18.11.2015 21:15 <DIR> ..
04.12.2014 06:59 20.100 amd64_microsoft-windows-a..de-compat-telemetry_31bf3856ad364e35_6.1.7601.18683_none_e5857bbe102edef6.manifest.xBAD
04.02.2015 05:40 20.100 amd64_microsoft-windows-a..de-compat-telemetry_31bf3856ad364e35_6.1.7601.18742_none_e5afbd0a100f5302.manifest.xBAD
11.03.2015 06:35 20.100 amd64_microsoft-windows-a..de-compat-telemetry_31bf3856ad364e35_6.1.7601.18783_none_e5857da4102edc1d.manifest.xBAD
23.03.2015 05:49 20.100 amd64_microsoft-windows-a..de-compat-telemetry_31bf3856ad364e35_6.1.7601.18803_none_e5dbfeea0fedf9bc.manifest.xBAD
22.05.2015 20:44 20.100 amd64_microsoft-windows-a..de-compat-telemetry_31bf3856ad364e35_6.1.7601.18868_none_e5a020d4101a2015.manifest.xBAD
09.07.2015 20:29 20.100 amd64_microsoft-windows-a..de-compat-telemetry_31bf3856ad364e35_6.1.7601.18917_none_e5d5320c0ff27830.manifest.xBAD
25.07.2015 21:33 20.100 amd64_microsoft-windows-a..de-compat-telemetry_31bf3856ad364e35_6.1.7601.18942_none_e5afc0d6100f4d50.manifest.xBAD
28.07.2015 23:52 20.077 amd64_microsoft-windows-a..de-compat-telemetry_31bf3856ad364e35_6.1.7601.18944_none_e5b1c16a100d7ffe.manifest.xBAD
18.09.2015 21:54 2.471 amd64_microsoft-windows-a..de-compat-telemetry_31bf3856ad364e35_6.1.7601.19010_none_e5ce08280ff8fa11.manifest.xBAD
04.12.2014 06:59 5.799 amd64_microsoft-windows-a..ence-telemetry-sdbs_31bf3856ad364e35_6.1.7601.18683_none_65fd1fb660d6ece5.manifest.xBAD
04.02.2015 05:40 5.799 amd64_microsoft-windows-a..ence-telemetry-sdbs_31bf3856ad364e35_6.1.7601.18742_none_6627610260b760f1.manifest.xBAD
11.03.2015 06:34 5.799 amd64_microsoft-windows-a..ence-telemetry-sdbs_31bf3856ad364e35_6.1.7601.18783_none_65fd219c60d6ea0c.manifest.xBAD
23.03.2015 05:48 5.799 amd64_microsoft-windows-a..ence-telemetry-sdbs_31bf3856ad364e35_6.1.7601.18803_none_6653a2e2609607ab.manifest.xBAD
22.05.2015 20:43 5.799 amd64_microsoft-windows-a..ence-telemetry-sdbs_31bf3856ad364e35_6.1.7601.18868_none_6617c4cc60c22e04.manifest.xBAD
09.07.2015 20:29 5.799 amd64_microsoft-windows-a..ence-telemetry-sdbs_31bf3856ad364e35_6.1.7601.18917_none_664cd604609a861f.manifest.xBAD
25.07.2015 21:33 5.799 amd64_microsoft-windows-a..ence-telemetry-sdbs_31bf3856ad364e35_6.1.7601.18942_none_662764ce60b75b3f.manifest.xBAD
28.07.2015 23:52 5.799 amd64_microsoft-windows-a..ence-telemetry-sdbs_31bf3856ad364e35_6.1.7601.18944_none_6629656260b58ded.manifest.xBAD
18.09.2015 21:48 433 amd64_microsoft-windows-a..ence-telemetry-sdbs_31bf3856ad364e35_6.1.7601.19010_none_6645ac2060a10800.manifest.xBAD
21.11.2010 05:16 11.386 amd64_microsoft-windows-a..ion-telemetry-agent_31bf3856ad364e35_6.1.7601.17514_none_3092574c7d41010b.manifest.xBAD
25.03.2015 05:46 3.251 amd64_microsoft-windows-gwx-ins_31bf3856ad364e35_6.1.7601.18804_none_a89445d5683d40d3.manifest.xBAD
04.07.2015 20:33 3.251 amd64_microsoft-windows-gwx-ins_31bf3856ad364e35_6.1.7601.18915_none_a88a781968447342.manifest.xBAD
30.09.2015 20:25 3.251 amd64_microsoft-windows-gwx-ins_31bf3856ad364e35_6.1.7601.19020_none_a87a7edd685143c2.manifest.xBAD
25.03.2015 05:50 9.994 amd64_microsoft-windows-gwx-task_31bf3856ad364e35_6.1.7601.18804_none_b9f47bdfdb2d157c.manifest.xBAD
04.07.2015 20:36 10.393 amd64_microsoft-windows-gwx-task_31bf3856ad364e35_6.1.7601.18915_none_b9eaae23db3447eb.manifest.xBAD
30.09.2015 20:28 10.395 amd64_microsoft-windows-gwx-task_31bf3856ad364e35_6.1.7601.19020_none_b9dab4e7db41186b.manifest.xBAD
25.03.2015 05:54 1.210 amd64_microsoft-windows-gwx-uninstall_31bf3856ad364e35_6.1.7601.18804_none_0b633dc31207e297.manifest.xBAD
04.07.2015 20:41 1.210 amd64_microsoft-windows-gwx-uninstall_31bf3856ad364e35_6.1.7601.18915_none_0b597007120f1506.manifest.xBAD
30.09.2015 20:31 1.210 amd64_microsoft-windows-gwx-uninstall_31bf3856ad364e35_6.1.7601.19020_none_0b4976cb121be586.manifest.xBAD
25.03.2015 05:54 9.759 amd64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.18804_none_0ea917976cd9078e.manifest.xBAD
04.07.2015 20:40 11.934 amd64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.18915_none_0e9f49db6ce039fd.manifest.xBAD
30.09.2015 20:30 11.934 amd64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.19020_none_0e8f509f6ced0a7d.manifest.xBAD
27.04.2015 21:52 12.739 amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.18839_none_fe0845bb1d97efda.manifest.xBAD
25.05.2015 20:47 12.091 amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.18869_none_fde7d5f71db043ad.manifest.xBAD
23.07.2015 02:34 12.124 amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.18939_none_fe0847a11d97ed01.manifest.xBAD
27.04.2015 21:46 12.739 amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.23040_none_fe7de82236c5fac8.manifest.xBAD
25.05.2015 20:51 12.091 amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.23072_none_fe5f78f236dc8149.manifest.xBAD
23.07.2015 03:53 12.124 amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.23142_none_fe7fea9c36c42a9d.manifest.xBAD
25.03.2015 05:15 2.766 wow64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.18804_none_18fdc1e9a139c989.manifest.xBAD
04.07.2015 20:03 2.703 wow64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.18915_none_18f3f42da140fbf8.manifest.xBAD
30.09.2015 20:07 2.703 wow64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.19020_none_18e3faf1a14dcc78.manifest.xBAD
40 Datei(en), 381.331 Bytes

Verzeichnis von C:\FRST\Quarantine\C\Windows\winsxs\wow64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.18804_none_18fdc1e9a139c989

13.04.2015 19:09 <DIR> .
13.04.2015 19:09 <DIR> ..
25.03.2015 04:59 392.704 GWX.exe
1 Datei(en), 392.704 Bytes

Verzeichnis von C:\FRST\Quarantine\C\Windows\winsxs\wow64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.18915_none_18f3f42da140fbf8

01.10.2015 23:09 <DIR> .
01.10.2015 23:09 <DIR> ..
04.07.2015 19:47 438.784 GWX.exe
1 Datei(en), 438.784 Bytes

Verzeichnis von C:\FRST\Quarantine\C\Windows\winsxs\wow64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.19020_none_18e3faf1a14dcc78

08.10.2015 21:47 <DIR> .
08.10.2015 21:47 <DIR> ..
30.09.2015 19:46 445.952 GWX.exe
1 Datei(en), 445.952 Bytes

Verzeichnis von C:\FRST\Quarantine\C\zoek_backup

18.11.2015 21:15 <DIR> .
18.11.2015 21:15 <DIR> ..
17.11.2015 18:11 <DIR> C_windows_SysNative_Tasks_Microsoft_Windows_Setup_gwx
17.11.2015 18:11 <DIR> C_windows_SysNative_Tasks_Microsoft_Windows_Setup_GWXTriggers
0 Datei(en), 0 Bytes

Verzeichnis von C:\FRST\Quarantine\C\zoek_backup\C_windows_SysNative_Tasks_Microsoft_Windows_Setup_gwx

17.11.2015 18:11 <DIR> .
17.11.2015 18:11 <DIR> ..
01.10.2015 23:09 3.176 launchtrayprocess
01.10.2015 23:09 3.050 refreshgwxconfig
01.10.2015 23:09 3.664 refreshgwxconfigandcontent
01.10.2015 23:09 2.876 refreshgwxcontent
4 Datei(en), 12.766 Bytes

Verzeichnis von C:\FRST\Quarantine\C\zoek_backup\C_windows_SysNative_Tasks_Microsoft_Windows_Setup_GWXTriggers

17.11.2015 18:11 <DIR> .
17.11.2015 18:11 <DIR> ..
17.11.2015 16:35 3.964 refreshgwxconfig-B
1 Datei(en), 3.964 Bytes

Anzahl der angezeigten Dateien:
86 Datei(en), 114.545.586 Bytes
65 Verzeichnis(se), 838.969.307.136 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 6099-878C

Verzeichnis von C:\program files

29.11.2015 20:25 <DIR> .
29.11.2015 20:25 <DIR> ..
29.11.2015 20:25 <DIR> 7-Zip
18.11.2015 21:30 <DIR> 9-lab
02.05.2015 17:56 <DIR> Bonjour
04.12.2015 22:38 <DIR> CCleaner
24.05.2050 09:48 <DIR> Common Files
22.04.2013 21:13 <DIR> Creative
26.04.2013 17:46 <DIR> CyberLink
14.07.2009 06:54 174 desktop.ini
12.04.2011 09:55 <DIR> DVD Maker
22.04.2013 20:40 <DIR> GIGABYTE
22.04.2013 20:40 <DIR> Intel
10.12.2015 19:20 <DIR> Internet Explorer
02.05.2015 17:56 <DIR> iPod
02.05.2015 17:57 <DIR> iTunes
22.04.2013 20:40 <DIR> Java
03.09.2015 16:19 <DIR> McAfee Security Scan
12.04.2011 09:55 <DIR> Microsoft Games
07.01.2015 18:53 <DIR> Microsoft Mouse and Keyboard Center
09.12.2015 23:59 <DIR> Microsoft Silverlight
14.07.2009 07:32 <DIR> MSBuild
24.01.2015 14:25 <DIR> NVIDIA Corporation
07.01.2016 17:43 <DIR> Reason
14.07.2009 07:32 <DIR> Reference Assemblies
22.04.2013 20:42 <DIR> Sony
18.11.2015 21:11 <DIR> Speccy
04.07.2015 10:24 <DIR> TeamSpeak 3 Client
04.08.2013 20:55 <DIR> Windows Defender
11.11.2015 23:37 <DIR> Windows Journal
12.04.2011 09:43 <DIR> Windows Mail
11.06.2015 15:19 <DIR> Windows Media Player
22.04.2013 21:08 <DIR> Windows NT
12.04.2011 09:43 <DIR> Windows Photo Viewer
21.11.2010 05:31 <DIR> Windows Portable Devices
12.04.2011 09:43 <DIR> Windows Sidebar
22.04.2013 20:43 <DIR> WinRAR
1 Datei(en), 174 Bytes
36 Verzeichnis(se), 838.969.307.136 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 6099-878C

Verzeichnis von C:\program files\Common Files

24.05.2050 09:48 <DIR> .
24.05.2050 09:48 <DIR> ..
25.07.2014 14:16 <DIR> Adobe
02.05.2015 17:56 <DIR> Apple
22.04.2013 20:37 <DIR> Microsoft Shared
14.07.2009 05:20 <DIR> Services
14.07.2009 05:20 <DIR> SpeechEngines
24.04.2013 15:10 <DIR> System
0 Datei(en), 0 Bytes
8 Verzeichnis(se), 838.969.307.136 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 6099-878C

Verzeichnis von C:\Qoobox

09.01.2016 12:52 <DIR> .
09.01.2016 12:52 <DIR> ..
09.01.2016 12:51 2.354 Add-Remove Programs.txt
09.01.2016 12:41 <DIR> BackEnv
09.01.2016 12:52 542 ComboFix-quarantined-files.txt
09.01.2016 12:52 <DIR> Quarantine
2 Datei(en), 2.896 Bytes

Verzeichnis von C:\Qoobox\Quarantine

09.01.2016 12:52 <DIR> .
09.01.2016 12:52 <DIR> ..
09.01.2016 12:49 <DIR> C
09.01.2016 12:40 51 catchme.log
09.01.2016 12:52 512 MBR_HardDisk0.mbr
09.01.2016 12:51 <DIR> Registry_backups
2 Datei(en), 563 Bytes

Verzeichnis von C:\Qoobox\Quarantine\C

09.01.2016 12:49 <DIR> .
09.01.2016 12:49 <DIR> ..
09.01.2016 12:49 <DIR> data
0 Datei(en), 0 Bytes

Verzeichnis von C:\Qoobox\Quarantine\C\data

09.01.2016 12:49 <DIR> .
09.01.2016 12:49 <DIR> ..
0 Datei(en), 0 Bytes

Verzeichnis von C:\Qoobox\Quarantine\Registry_backups

09.01.2016 12:51 <DIR> .
09.01.2016 12:51 <DIR> ..
09.01.2016 12:51 558 SafeBoot-87214911.sys.reg.dat
09.01.2016 12:51 232 ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24}.reg.dat
09.01.2016 12:48 7.087 tcpip.reg
3 Datei(en), 7.877 Bytes

Anzahl der angezeigten Dateien:
7 Datei(en), 11.336 Bytes
15 Verzeichnis(se), 838.969.303.040 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 6099-878C

Verzeichnis von C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware

06.01.2016 23:52 <DIR> .
06.01.2016 23:52 <DIR> ..
06.01.2016 23:30 3.535 actions.ref
05.10.2015 09:46 92 akadomains.ref
05.10.2015 09:46 92 akaips.ref
17.11.2015 18:32 <DIR> Configuration
06.01.2016 23:30 377.674 domains.ref
05.10.2015 09:46 0 exclusions.dat
06.01.2016 23:31 114.758 ips.ref
06.01.2016 23:52 <DIR> Logs
17.11.2015 18:32 <DIR> Quarantine
06.01.2016 23:31 9.229.995 rules.ref
06.01.2016 23:30 27.731 swissarmy.ref
8 Datei(en), 9.753.877 Bytes

Verzeichnis von C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Configuration

17.11.2015 18:32 <DIR> .
17.11.2015 18:32 <DIR> ..
06.01.2016 23:29 4.596 build.conf
05.10.2015 09:48 4 database.conf
05.10.2015 09:48 4 gatekeeper.conf
06.01.2016 23:29 1.455 license.conf
06.01.2016 23:31 3.394 manifest.conf
03.12.2015 16:19 7.372 marketing.conf
06.01.2016 23:29 7.201 net.conf
05.10.2015 09:48 4 notifications.conf
17.11.2015 18:32 <DIR> Restore
06.01.2016 23:52 2.194 scheduler.conf
06.01.2016 23:52 2.155 settings.conf
17.11.2015 18:32 513 statistics.conf
11 Datei(en), 28.892 Bytes

Verzeichnis von C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore

17.11.2015 18:32 <DIR> .
17.11.2015 18:32 <DIR> ..
05.10.2015 09:48 4.178 build.conf
05.10.2015 09:48 4 database.conf
05.10.2015 09:48 4 gatekeeper.conf
05.10.2015 09:48 23 license.conf
05.10.2015 09:48 3.184 manifest.conf
05.10.2015 09:48 6.944 marketing.conf
05.10.2015 09:48 6.402 net.conf
05.10.2015 09:48 4 notifications.conf
05.10.2015 09:48 4 scheduler.conf
05.10.2015 09:48 1.725 settings.conf
05.10.2015 09:48 4 statistics.conf
11 Datei(en), 22.476 Bytes

Verzeichnis von C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs

06.01.2016 23:52 <DIR> .
06.01.2016 23:52 <DIR> ..
17.11.2015 19:16 2.634 mbam-log-2015-11-17 (18-44-24).xml
22.11.2015 03:15 2.634 mbam-log-2015-11-22 (02-59-25).xml
23.11.2015 16:47 2.636 mbam-log-2015-11-23 (16-26-08).xml
24.11.2015 16:42 2.636 mbam-log-2015-11-24 (16-23-53).xml
25.11.2015 16:30 2.636 mbam-log-2015-11-25 (16-13-21).xml
27.11.2015 14:01 2.608 mbam-log-2015-11-27 (13-44-07).xml
29.11.2015 20:37 2.606 mbam-log-2015-11-29 (20-15-58).xml
01.12.2015 14:06 2.636 mbam-log-2015-12-01 (13-42-21).xml
02.12.2015 16:29 2.634 mbam-log-2015-12-02 (16-12-32).xml
03.12.2015 16:34 2.638 mbam-log-2015-12-03 (16-12-32).xml
06.01.2016 23:52 2.636 mbam-log-2016-01-06 (23-30-21).xml
17.11.2015 22:43 14.818 protection-log-2015-11-17.xml
18.11.2015 22:27 18.653 protection-log-2015-11-18.xml
19.11.2015 22:34 19.959 protection-log-2015-11-19.xml
20.11.2015 23:57 10.350 protection-log-2015-11-20.xml
21.11.2015 23:03 11.198 protection-log-2015-11-21.xml
22.11.2015 22:04 17.698 protection-log-2015-11-22.xml
23.11.2015 22:53 15.120 protection-log-2015-11-23.xml
24.11.2015 22:04 14.847 protection-log-2015-11-24.xml
25.11.2015 22:58 20.640 protection-log-2015-11-25.xml
26.11.2015 21:46 11.202 protection-log-2015-11-26.xml
27.11.2015 23:00 15.435 protection-log-2015-11-27.xml
28.11.2015 23:23 22.043 protection-log-2015-11-28.xml
29.11.2015 20:37 12.389 protection-log-2015-11-29.xml
01.12.2015 21:03 13.057 protection-log-2015-12-01.xml
02.12.2015 19:50 13.049 protection-log-2015-12-02.xml
03.12.2015 16:34 2.191 protection-log-2015-12-03.xml
06.01.2016 23:52 1.954 protection-log-2016-01-06.xml
28 Datei(en), 263.537 Bytes

Verzeichnis von C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Quarantine

17.11.2015 18:32 <DIR> .
17.11.2015 18:32 <DIR> ..
0 Datei(en), 0 Bytes

Anzahl der angezeigten Dateien:
58 Datei(en), 10.068.782 Bytes
14 Verzeichnis(se), 838.969.298.944 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 6099-878C

Verzeichnis von C:\Users

24.01.2015 14:22 <DIR> .
24.01.2015 14:22 <DIR> ..
14.07.2009 07:08 <SYMLINKD> All Users [C:\ProgramData]
22.04.2013 21:08 <DIR> Default
14.07.2009 07:08 <VERBINDUNG> Default User [C:\Users\Default]
14.07.2009 06:54 174 desktop.ini
19.11.2015 20:18 <DIR> Nutzer
24.11.2015 20:50 <DIR> Public
1 Datei(en), 174 Bytes
7 Verzeichnis(se), 838.969.298.944 Bytes frei
siqzz
Regular Member
 
Posts: 29
Joined: January 22nd, 2016, 8:13 pm

Re: Malware, keylogger or trojan problem

Unread postby siqzz » January 26th, 2016, 10:33 am

ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Nutzer\AppData\Roaming
asl.log=Destination=file
CommonProgramFiles=C:\Program Files\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=NUTZER-PC
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Nutzer
LOCALAPPDATA=C:\Users\Nutzer\AppData\Local
LOGONSERVER=\\NUTZER-PC
NUMBER_OF_PROCESSORS=8
OS=Windows_NT
Path=C:\Windows\system32;C:\Windows;C:\Windows\system32\wbem;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Program Files (x86)\Intel\iCLS Client;C:\Program Files\Intel\iCLS Client;C:\Windows\System32\WindowsPowerShell\v1.0;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files (x86)\QuickTime\QTSystem;C:\Program Files (x86)\Skype\Phone;C:\Program Files (x86)\Skype\Phone\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 42 Stepping 7, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=2a07
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PROMPT=$P$G
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Nutzer\AppData\Local\Temp
TMP=C:\Users\Nutzer\AppData\Local\Temp
USERDOMAIN=Nutzer-PC
USERNAME=Nutzer
USERPROFILE=C:\Users\Nutzer
windir=C:\Windows
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 6099-878C

Verzeichnis von C:\AdwCleaner

06.01.2016 22:55 <DIR> .
06.01.2016 22:55 <DIR> ..
06.01.2016 22:55 906 AdwCleaner[C1].txt
06.01.2016 22:55 788 AdwCleaner[S1].txt
06.01.2016 22:55 <DIR> Quarantine
06.01.2016 22:55 44 Quarantine.log
3 Datei(en), 1.738 Bytes

Verzeichnis von C:\AdwCleaner\Quarantine

06.01.2016 22:55 <DIR> .
06.01.2016 22:55 <DIR> ..
06.01.2016 22:55 <DIR> C
0 Datei(en), 0 Bytes

Verzeichnis von C:\AdwCleaner\Quarantine\C

06.01.2016 22:55 <DIR> .
06.01.2016 22:55 <DIR> ..
20.12.2015 21:36 0 END.vir
1 Datei(en), 0 Bytes

Anzahl der angezeigten Dateien:
4 Datei(en), 1.738 Bytes
8 Verzeichnis(se), 838.969.344.000 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 6099-878C

Verzeichnis von C:\ProgramData\360Quarant

24.01.2016 15:41 <DIR> .
24.01.2016 15:41 <DIR> ..
19.12.2015 14:27 1.445 360safe.04B6746958F9B3D7E1957411630FD0FE.union1
19.11.2015 22:31 1.929 360safe.061699A8D41F8493DCCC3796A270FF7E.union1
22.12.2015 12:57 1.439 360safe.09A88CD88BFE997C02059528C8050E37.union1
20.12.2015 17:10 1.381 360safe.0E41372D0E6CF1DFDF85BC3B2C88C0B0.union1
22.11.2015 01:51 1.193 360safe.216DD2B31746D375D5F24016DAC66BFE.union1
20.12.2015 01:03 1.439 360safe.295D1F4E914750C265F75C7A9003D2F7.union1
04.12.2015 21:56 1.439 360safe.3E3DBD6F1BE836187984B727F5CDC4B3.union1
22.12.2015 12:56 1.445 360safe.3F84F8494541D7FEED8EC244358C25E0.union1
24.01.2016 15:41 1.499 360safe.4A9E7CF35D6CF6F6AE0CFF091CC822AA.union1
21.12.2015 14:43 1.439 360safe.4C4E27E0627E9602165564D735964B02.union1
16.12.2015 18:42 1.439 360safe.4EC0A6AB5CEE1287942611BD6FCDAD7C.union1
20.12.2015 16:49 1.445 360safe.557EEE127152B69AC1C884B2DC7630A5.union1
22.11.2015 01:53 1.193 360safe.56A5BB09A9FD0612829D9A45AFA20D67.union1
04.12.2015 21:56 1.481 360safe.5FA486FC0D4C061C9B29FD952C91FA73.union1
18.12.2015 21:34 1.439 360safe.6A2DFB90478E6C1250F7262782C86D76.union1
16.12.2015 18:48 1.509 360Safe.76002D42D2B7761D00DEC8866FF5A6AD.union1
21.12.2015 14:44 1.445 360safe.768DD08F835251B4E7968BE8C2E713A2.union1
20.12.2015 20:00 1.465 360safe.7AA6BDBD42F5493ADFEA9F137251C81B.union1
21.12.2015 15:13 1.465 360safe.7BC3D82D5A500DC94E36B6370E5F8237.union1
20.12.2015 00:33 1.381 360safe.7FF8C409EDBCA760AC51D93289B12360.union1
19.12.2015 14:27 1.439 360safe.81B332CC5BC035DE7A8A7BCEABA49923.union1
29.11.2015 21:59 1.481 360safe.8479E5C6C2FF0E56479D423456F227F7.union1
29.11.2015 21:58 1.439 360safe.8AEFA507D7CBEE37DD87FC61F17816DD.union1
18.12.2015 21:33 1.445 360safe.8FF26CA4740B62ED67A4F8E3377A4356.union1
02.01.2016 01:33 1.303 360safe.94223CAD44F5FF6E064516CAFB80F5CF.union1
22.11.2015 01:52 1.193 360safe.9A81F00524D60F74F0B48EB15D2A610C.union1
16.12.2015 18:44 1.381 360safe.AAA972D6AFD08A3BD9BABE77DA008878.union1
21.11.2015 22:13 1.193 360safe.B6DAA5F96AF2AE624E0CDF03009BA171.union1
16.12.2015 18:42 1.445 360safe.CE439F7A023038E39165DF7E7C87CED6.union1
16.12.2015 18:48 1.503 360Safe.D2BB7E0B1FFF3797137AECD0131B1A91.union1
03.12.2015 17:07 1.439 360safe.D483D44FAD9C15C0B5F8FB60DE8BED81.union1
03.12.2015 17:07 1.481 360safe.D7FCDB8727DE80D585BFC1401C1106AE.union1
16.12.2015 18:48 1.561 360Safe.DF385380E0B189ADA3906954EFB1FFD3.union1
02.01.2016 01:33 1.675 360Safe.E0643A7324AB530D1653AABBA9018741.union1
22.11.2015 01:52 1.193 360safe.E34C958BC6F81CD23F0151ACAD09D2A3.union1
20.12.2015 01:03 1.445 360safe.F42B66772BAA3061FEF93A75289A942E.union1
20.12.2015 16:48 1.439 360safe.F80BFD333E1BBCAF103773EE5F4E4D8E.union1
24.01.2016 15:41 68 360safe.Summary.union1
38 Datei(en), 53.033 Bytes

Anzahl der angezeigten Dateien:
38 Datei(en), 53.033 Bytes
2 Verzeichnis(se), 838.969.339.904 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 6099-878C

Verzeichnis von C:\Windows\erdnt

19.11.2015 20:20 <DIR> .
19.11.2015 20:20 <DIR> ..
19.11.2015 20:20 <DIR> cache64
19.11.2015 20:20 <DIR> cache86
09.01.2016 12:36 <DIR> Hiv-backup
0 Datei(en), 0 Bytes

Verzeichnis von C:\Windows\erdnt\cache64

19.11.2015 20:20 <DIR> .
19.11.2015 20:20 <DIR> ..
14.07.2009 02:10 23.040 asyncmac.sys
14.07.2009 03:52 24.128 atapi.sys
05.07.2012 00:13 136.704 browser.dll
14.07.2009 03:40 18.944 cngaudit.dll
24.04.2015 20:17 633.856 comctl32.dll
14.07.2009 03:26 1.297.408 comres.dll
27.04.2015 21:23 188.416 cryptsvc.dll
14.07.2009 03:39 9.728 ctfmon.exe
14.07.2009 03:40 402.944 es.dll
09.01.2016 12:51 3.366 FD_Cache.md5
14.07.2009 03:41 424.448 hnetcfg.dll
14.07.2009 03:41 167.424 imm32.dll
14.07.2009 03:48 50.768 kbdclass.sys
20.10.2015 03:05 1.164.800 kernel32.dll
14.07.2009 03:41 5.120 ksuser.dll
14.07.2009 03:41 29.696 linkinfo.dll
02.09.2015 05:04 41.984 lpk.dll
20.10.2015 03:04 31.232 lsass.exe
06.11.2015 21:06 9.072.128 mshtml.dll
14.07.2009 03:41 8.192 msimg32.dll
16.12.2011 10:46 634.880 msvcrt.dll
08.09.2013 04:27 327.168 mswsock.dll
13.10.2015 06:57 950.720 ndis.sys
21.11.2010 05:24 695.808 netlogon.dll
14.07.2009 03:41 360.448 netman.dll
24.01.2014 04:37 1.684.928 ntfs.sys
20.10.2015 03:12 5.570.496 ntoskrnl.exe
14.07.2009 01:19 6.144 null.sys
04.07.2015 20:07 2.087.424 ole32.dll
14.07.2009 03:41 167.424 powrprof.dll
21.11.2010 05:23 849.920 qmgr.dll
14.07.2009 03:41 159.232 regsvc.dll
21.11.2010 05:24 512.000 rpcss.dll
21.11.2010 05:24 232.960 scecli.dll
05.08.2015 19:56 1.110.016 schedsvc.dll
13.04.2015 05:28 328.704 services.exe
14.07.2009 03:33 3.072 sfc.dll
21.11.2010 05:23 370.688 shsvcs.dll
11.02.2012 08:36 559.104 spoolsv.exe
14.07.2009 03:41 193.024 ssdpsrv.dll
14.07.2009 03:39 27.136 svchost.exe
21.11.2010 05:24 316.928 tapisrv.dll
05.04.2014 04:47 1.903.552 tcpip.sys
13.10.2015 18:40 118.272 tdx.sys
14.10.2014 04:13 683.520 termsrv.dll
10.11.2015 20:55 1.008.640 user32.dll
21.11.2010 05:24 30.720 userinit.exe
03.11.2015 21:04 802.304 usp10.dll
06.11.2015 21:06 1.188.864 wininet.dll
14.07.2009 03:39 129.024 wininit.exe
17.07.2014 04:07 455.168 winlogon.exe
14.07.2009 03:34 4.608 ws2help.dll
21.11.2010 05:24 297.984 ws2_32.dll
20.11.2015 20:54 140.288 wuauclt.exe
54 Datei(en), 37.645.494 Bytes

Verzeichnis von C:\Windows\erdnt\cache86

19.11.2015 20:20 <DIR> .
19.11.2015 20:20 <DIR> ..
14.07.2009 03:15 12.288 cngaudit.dll
24.04.2015 19:56 530.432 comctl32.dll
27.04.2015 21:04 143.872 cryptsvc.dll
14.07.2009 03:14 8.704 ctfmon.exe
21.11.2010 05:24 1.828.352 d3d9.dll
14.07.2009 03:15 531.968 ddraw.dll
14.07.2009 03:15 453.632 dsound.dll
14.07.2009 03:15 271.360 es.dll
25.02.2011 08:19 2.871.808 explorer.exe
14.07.2009 03:15 19.456 ias.dll
06.11.2015 20:50 677.024 iexplore.exe
21.11.2010 05:24 119.808 imm32.dll
20.10.2015 02:44 1.114.112 kernel32.dll
14.07.2009 03:15 4.608 ksuser.dll
14.07.2009 03:15 22.016 linkinfo.dll
02.09.2015 04:47 25.600 lpk.dll
21.11.2010 05:24 954.288 mfc40u.dll
14.07.2009 03:15 16.896 midimap.dll
06.11.2015 20:47 6.036.480 mshtml.dll
14.07.2009 03:15 4.608 msimg32.dll
16.12.2011 09:52 690.688 msvcrt.dll
08.09.2013 04:03 231.424 mswsock.dll
21.11.2010 05:24 563.712 netlogon.dll
20.10.2015 02:52 3.991.488 ntkrnlpa.exe
20.10.2015 02:52 3.935.680 ntoskrnl.exe
04.07.2015 19:48 1.414.656 ole32.dll
21.11.2010 05:24 90.112 olepro32.dll
14.07.2009 03:16 39.424 perfctrs.dll
14.07.2009 03:16 145.408 powrprof.dll
14.07.2009 03:16 11.776 rasadhlp.dll
14.07.2009 03:39 427.008 regedit.exe
21.11.2010 05:23 175.616 scecli.dll
14.07.2009 03:10 2.560 sfc.dll
21.11.2010 05:24 328.192 shsvcs.dll
14.07.2009 03:14 20.992 svchost.exe
21.11.2010 05:24 242.176 tapisrv.dll
14.07.2009 03:16 266.752 upnphost.dll
10.11.2015 20:37 833.024 user32.dll
21.11.2010 05:23 26.624 userinit.exe
03.11.2015 20:56 627.712 usp10.dll
14.07.2009 03:16 21.504 version.dll
06.11.2015 20:48 981.504 wininet.dll
14.07.2009 03:14 96.256 wininit.exe
14.07.2009 03:11 4.608 ws2help.dll
21.11.2010 05:23 206.848 ws2_32.dll
14.07.2009 03:16 9.216 WSHTCPIP.DLL
46 Datei(en), 31.032.272 Bytes

Verzeichnis von C:\Windows\erdnt\Hiv-backup

09.01.2016 12:36 <DIR> .
09.01.2016 12:36 <DIR> ..
09.01.2016 12:36 32.768 BCD
09.01.2016 12:36 44.015.616 components
09.01.2016 12:36 315.392 DEFAULT
09.01.2016 12:36 947 ERDNT.CON
20.10.2005 14:02 163.328 ERDNT.EXE
09.01.2016 12:36 1.337 ERDNT.INF
31.08.2000 02:00 2.815 ERDNTDOS.LOC
31.08.2000 02:00 3.275 ERDNTWIN.LOC
09.01.2016 12:36 24.576 SAM
09.01.2016 12:36 28.672 SECURITY
09.01.2016 12:36 78.643.200 SOFTWARE
09.01.2016 12:36 18.776.064 SYSTEM
09.01.2016 12:36 <DIR> Users
12 Datei(en), 142.007.990 Bytes

Verzeichnis von C:\Windows\erdnt\Hiv-backup\Users

09.01.2016 12:36 <DIR> .
09.01.2016 12:36 <DIR> ..
09.01.2016 12:36 <DIR> 00000001
09.01.2016 12:36 <DIR> 00000002
09.01.2016 12:36 <DIR> 00000003
09.01.2016 12:36 <DIR> 00000004
09.01.2016 12:36 <DIR> 00000005
09.01.2016 12:36 <DIR> 00000006
0 Datei(en), 0 Bytes

Verzeichnis von C:\Windows\erdnt\Hiv-backup\Users\00000001

09.01.2016 12:36 <DIR> .
09.01.2016 12:36 <DIR> ..
09.01.2016 12:36 12.288 360SAN~1.SAV
1 Datei(en), 12.288 Bytes

Verzeichnis von C:\Windows\erdnt\Hiv-backup\Users\00000002

09.01.2016 12:36 <DIR> .
09.01.2016 12:36 <DIR> ..
09.01.2016 12:36 253.952 NTUSER.DAT
1 Datei(en), 253.952 Bytes

Verzeichnis von C:\Windows\erdnt\Hiv-backup\Users\00000003

09.01.2016 12:36 <DIR> .
09.01.2016 12:36 <DIR> ..
09.01.2016 12:36 249.856 NTUSER.DAT
1 Datei(en), 249.856 Bytes

Verzeichnis von C:\Windows\erdnt\Hiv-backup\Users\00000004

09.01.2016 12:36 <DIR> .
09.01.2016 12:36 <DIR> ..
09.01.2016 12:36 106.496 FILECA~1.DAT
1 Datei(en), 106.496 Bytes

Verzeichnis von C:\Windows\erdnt\Hiv-backup\Users\00000005

09.01.2016 12:36 <DIR> .
09.01.2016 12:36 <DIR> ..
09.01.2016 12:36 4.313.088 ntuser.dat
1 Datei(en), 4.313.088 Bytes

Verzeichnis von C:\Windows\erdnt\Hiv-backup\Users\00000006

09.01.2016 12:36 <DIR> .
09.01.2016 12:36 <DIR> ..
09.01.2016 12:36 4.902.912 UsrClass.dat
1 Datei(en), 4.902.912 Bytes

Anzahl der angezeigten Dateien:
118 Datei(en), 220.524.348 Bytes
32 Verzeichnis(se), 838.969.323.520 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 6099-878C

Verzeichnis von C:\FRST

23.01.2016 14:27 <DIR> .
23.01.2016 14:27 <DIR> ..
06.01.2016 23:03 <DIR> Hives
23.01.2016 14:27 <DIR> Logs
18.11.2015 17:47 <DIR> Quarantine
0 Datei(en), 0 Bytes

Verzeichnis von C:\FRST\Hives

06.01.2016 23:03 <DIR> .
06.01.2016 23:03 <DIR> ..
06.01.2016 23:03 32.768 BCD
06.01.2016 23:03 315.392 DEFAULT
06.01.2016 23:03 800 ERDNT.CON
20.11.2015 21:40 163.328 ERDNT.EXE
06.01.2016 23:03 834 ERDNT.INF
20.11.2015 21:36 2.815 ERDNTDOS.LOC
20.11.2015 21:36 3.275 ERDNTWIN.LOC
06.01.2016 23:03 24.576 SAM
06.01.2016 23:03 28.672 SECURITY
06.01.2016 23:03 78.643.200 SOFTWARE
06.01.2016 23:03 18.776.064 SYSTEM
06.01.2016 23:03 <DIR> Users
11 Datei(en), 97.991.724 Bytes

Verzeichnis von C:\FRST\Hives\Users

06.01.2016 23:03 <DIR> .
06.01.2016 23:03 <DIR> ..
06.01.2016 23:03 <DIR> 00000001
06.01.2016 23:03 <DIR> 00000002
0 Datei(en), 0 Bytes

Verzeichnis von C:\FRST\Hives\Users\00000001

06.01.2016 23:03 <DIR> .
06.01.2016 23:03 <DIR> ..
06.01.2016 23:03 4.313.088 ntuser.dat
1 Datei(en), 4.313.088 Bytes

Verzeichnis von C:\FRST\Hives\Users\00000002

06.01.2016 23:03 <DIR> .
06.01.2016 23:03 <DIR> ..
06.01.2016 23:03 4.902.912 UsrClass.dat
1 Datei(en), 4.902.912 Bytes

Verzeichnis von C:\FRST\Logs

23.01.2016 14:27 <DIR> .
23.01.2016 14:27 <DIR> ..
06.01.2016 23:05 43.763 Addition_06-01-2016_23-05-38.txt
23.01.2016 14:27 44.391 Addition_23-01-2016_14-27-43.txt
06.01.2016 23:05 42.113 FRST_06-01-2016_23-05-38.txt
23.01.2016 14:27 47.783 FRST_23-01-2016_14-27-43.txt
4 Datei(en), 178.050 Bytes

Verzeichnis von C:\FRST\Quarantine

18.11.2015 17:47 <DIR> .
18.11.2015 17:47 <DIR> ..
22.11.2015 01:58 <DIR> C
0 Datei(en), 0 Bytes

Verzeichnis von C:\FRST\Quarantine\C

22.11.2015 01:58 <DIR> .
22.11.2015 01:58 <DIR> ..
22.11.2015 01:58 <DIR> Windows
18.11.2015 21:15 <DIR> zoek_backup
0 Datei(en), 0 Bytes

Verzeichnis von C:\FRST\Quarantine\C\Windows

22.11.2015 01:58 <DIR> .
22.11.2015 01:58 <DIR> ..
22.11.2015 01:58 <DIR> winsxs
0 Datei(en), 0 Bytes

Verzeichnis von C:\FRST\Quarantine\C\Windows\winsxs

22.11.2015 01:58 <DIR> .
22.11.2015 01:58 <DIR> ..
09.09.2015 21:56 <DIR> amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.18939_none_fe0847a11d97ed01
13.05.2015 22:34 <DIR> amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.23040_none_fe7de82236c5fac8
10.06.2015 23:19 <DIR> amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.23072_none_fe5f78f236dc8149
09.09.2015 21:56 <DIR> amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.23142_none_fe7fea9c36c42a9d
18.11.2015 21:15 <DIR> FileMaps
18.11.2015 21:15 <DIR> Manifests
13.04.2015 19:09 <DIR> wow64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.18804_none_18fdc1e9a139c989
01.10.2015 23:09 <DIR> wow64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.18915_none_18f3f42da140fbf8
08.10.2015 21:47 <DIR> wow64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.19020_none_18e3faf1a14dcc78
0 Datei(en), 0 Bytes

Verzeichnis von C:\FRST\Quarantine\C\Windows\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.18939_none_fe0847a11d97ed01

09.09.2015 21:56 <DIR> .
09.09.2015 21:56 <DIR> ..
23.07.2015 02:02 1.390.592 diagtrack.dll
15.07.2015 00:22 1.016 telemetry.ASM-WindowsDefault.json
15.07.2015 00:22 795 utc.app.json
22.07.2015 18:48 41.984 UtcResources.dll
4 Datei(en), 1.434.387 Bytes

Verzeichnis von C:\FRST\Quarantine\C\Windows\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.23040_none_fe7de82236c5fac8

13.05.2015 22:34 <DIR> .
13.05.2015 22:34 <DIR> ..
27.04.2015 21:17 1.254.400 diagtrack.dll
24.01.2015 01:26 660 telemetry.ASM-WindowsDefault.json
24.01.2015 01:26 955 utc.app.json
27.04.2015 20:02 36.864 UtcResources.dll
4 Datei(en), 1.292.879 Bytes

Verzeichnis von C:\FRST\Quarantine\C\Windows\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.23072_none_fe5f78f236dc8149

10.06.2015 23:19 <DIR> .
10.06.2015 23:19 <DIR> ..
25.05.2015 20:22 1.255.424 diagtrack.dll
09.06.2015 20:16 5.513 telemetry.ASM-WindowsDefault.json
10.06.2015 21:36 20.925 utc.app.json
25.05.2015 19:02 36.864 UtcResources.dll
4 Datei(en), 1.318.726 Bytes

Verzeichnis von C:\FRST\Quarantine\C\Windows\winsxs\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.23142_none_fe7fea9c36c42a9d

09.09.2015 21:56 <DIR> .
09.09.2015 21:56 <DIR> ..
23.07.2015 00:04 1.390.592 diagtrack.dll
15.07.2015 00:23 1.016 telemetry.ASM-WindowsDefault.json
15.07.2015 00:23 795 utc.app.json
22.07.2015 22:38 41.984 UtcResources.dll
4 Datei(en), 1.434.387 Bytes

Verzeichnis von C:\FRST\Quarantine\C\Windows\winsxs\FileMaps

18.11.2015 21:15 <DIR> .
18.11.2015 21:15 <DIR> ..
16.07.2015 02:12 608 $$_appcompat_appraiser_telemetry_94274e99519f58a9.cdf-ms.xBAD
08.10.2015 21:47 1.444 $$_system32_gwx_06654c71d047de88.cdf-ms.xBAD
01.10.2015 23:09 576 $$_system32_gwx_downloadswap_5098c1f0e1204caf.cdf-ms.xBAD
13.04.2015 19:09 572 $$_system32_gwx_download_27d68082ad334184.cdf-ms.xBAD
08.10.2015 21:47 732 $$_syswow64_gwx_1bf23be3a76673bc.cdf-ms.xBAD
5 Datei(en), 3.932 Bytes

Verzeichnis von C:\FRST\Quarantine\C\Windows\winsxs\Manifests

18.11.2015 21:15 <DIR> .
18.11.2015 21:15 <DIR> ..
04.12.2014 06:59 20.100 amd64_microsoft-windows-a..de-compat-telemetry_31bf3856ad364e35_6.1.7601.18683_none_e5857bbe102edef6.manifest.xBAD
04.02.2015 05:40 20.100 amd64_microsoft-windows-a..de-compat-telemetry_31bf3856ad364e35_6.1.7601.18742_none_e5afbd0a100f5302.manifest.xBAD
11.03.2015 06:35 20.100 amd64_microsoft-windows-a..de-compat-telemetry_31bf3856ad364e35_6.1.7601.18783_none_e5857da4102edc1d.manifest.xBAD
23.03.2015 05:49 20.100 amd64_microsoft-windows-a..de-compat-telemetry_31bf3856ad364e35_6.1.7601.18803_none_e5dbfeea0fedf9bc.manifest.xBAD
22.05.2015 20:44 20.100 amd64_microsoft-windows-a..de-compat-telemetry_31bf3856ad364e35_6.1.7601.18868_none_e5a020d4101a2015.manifest.xBAD
09.07.2015 20:29 20.100 amd64_microsoft-windows-a..de-compat-telemetry_31bf3856ad364e35_6.1.7601.18917_none_e5d5320c0ff27830.manifest.xBAD
25.07.2015 21:33 20.100 amd64_microsoft-windows-a..de-compat-telemetry_31bf3856ad364e35_6.1.7601.18942_none_e5afc0d6100f4d50.manifest.xBAD
28.07.2015 23:52 20.077 amd64_microsoft-windows-a..de-compat-telemetry_31bf3856ad364e35_6.1.7601.18944_none_e5b1c16a100d7ffe.manifest.xBAD
18.09.2015 21:54 2.471 amd64_microsoft-windows-a..de-compat-telemetry_31bf3856ad364e35_6.1.7601.19010_none_e5ce08280ff8fa11.manifest.xBAD
04.12.2014 06:59 5.799 amd64_microsoft-windows-a..ence-telemetry-sdbs_31bf3856ad364e35_6.1.7601.18683_none_65fd1fb660d6ece5.manifest.xBAD
04.02.2015 05:40 5.799 amd64_microsoft-windows-a..ence-telemetry-sdbs_31bf3856ad364e35_6.1.7601.18742_none_6627610260b760f1.manifest.xBAD
11.03.2015 06:34 5.799 amd64_microsoft-windows-a..ence-telemetry-sdbs_31bf3856ad364e35_6.1.7601.18783_none_65fd219c60d6ea0c.manifest.xBAD
23.03.2015 05:48 5.799 amd64_microsoft-windows-a..ence-telemetry-sdbs_31bf3856ad364e35_6.1.7601.18803_none_6653a2e2609607ab.manifest.xBAD
22.05.2015 20:43 5.799 amd64_microsoft-windows-a..ence-telemetry-sdbs_31bf3856ad364e35_6.1.7601.18868_none_6617c4cc60c22e04.manifest.xBAD
09.07.2015 20:29 5.799 amd64_microsoft-windows-a..ence-telemetry-sdbs_31bf3856ad364e35_6.1.7601.18917_none_664cd604609a861f.manifest.xBAD
25.07.2015 21:33 5.799 amd64_microsoft-windows-a..ence-telemetry-sdbs_31bf3856ad364e35_6.1.7601.18942_none_662764ce60b75b3f.manifest.xBAD
28.07.2015 23:52 5.799 amd64_microsoft-windows-a..ence-telemetry-sdbs_31bf3856ad364e35_6.1.7601.18944_none_6629656260b58ded.manifest.xBAD
18.09.2015 21:48 433 amd64_microsoft-windows-a..ence-telemetry-sdbs_31bf3856ad364e35_6.1.7601.19010_none_6645ac2060a10800.manifest.xBAD
21.11.2010 05:16 11.386 amd64_microsoft-windows-a..ion-telemetry-agent_31bf3856ad364e35_6.1.7601.17514_none_3092574c7d41010b.manifest.xBAD
25.03.2015 05:46 3.251 amd64_microsoft-windows-gwx-ins_31bf3856ad364e35_6.1.7601.18804_none_a89445d5683d40d3.manifest.xBAD
04.07.2015 20:33 3.251 amd64_microsoft-windows-gwx-ins_31bf3856ad364e35_6.1.7601.18915_none_a88a781968447342.manifest.xBAD
30.09.2015 20:25 3.251 amd64_microsoft-windows-gwx-ins_31bf3856ad364e35_6.1.7601.19020_none_a87a7edd685143c2.manifest.xBAD
25.03.2015 05:50 9.994 amd64_microsoft-windows-gwx-task_31bf3856ad364e35_6.1.7601.18804_none_b9f47bdfdb2d157c.manifest.xBAD
04.07.2015 20:36 10.393 amd64_microsoft-windows-gwx-task_31bf3856ad364e35_6.1.7601.18915_none_b9eaae23db3447eb.manifest.xBAD
30.09.2015 20:28 10.395 amd64_microsoft-windows-gwx-task_31bf3856ad364e35_6.1.7601.19020_none_b9dab4e7db41186b.manifest.xBAD
25.03.2015 05:54 1.210 amd64_microsoft-windows-gwx-uninstall_31bf3856ad364e35_6.1.7601.18804_none_0b633dc31207e297.manifest.xBAD
04.07.2015 20:41 1.210 amd64_microsoft-windows-gwx-uninstall_31bf3856ad364e35_6.1.7601.18915_none_0b597007120f1506.manifest.xBAD
30.09.2015 20:31 1.210 amd64_microsoft-windows-gwx-uninstall_31bf3856ad364e35_6.1.7601.19020_none_0b4976cb121be586.manifest.xBAD
25.03.2015 05:54 9.759 amd64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.18804_none_0ea917976cd9078e.manifest.xBAD
04.07.2015 20:40 11.934 amd64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.18915_none_0e9f49db6ce039fd.manifest.xBAD
30.09.2015 20:30 11.934 amd64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.19020_none_0e8f509f6ced0a7d.manifest.xBAD
27.04.2015 21:52 12.739 amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.18839_none_fe0845bb1d97efda.manifest.xBAD
25.05.2015 20:47 12.091 amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.18869_none_fde7d5f71db043ad.manifest.xBAD
23.07.2015 02:34 12.124 amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.18939_none_fe0847a11d97ed01.manifest.xBAD
27.04.2015 21:46 12.739 amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.23040_none_fe7de82236c5fac8.manifest.xBAD
25.05.2015 20:51 12.091 amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.23072_none_fe5f78f236dc8149.manifest.xBAD
23.07.2015 03:53 12.124 amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_6.1.7601.23142_none_fe7fea9c36c42a9d.manifest.xBAD
25.03.2015 05:15 2.766 wow64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.18804_none_18fdc1e9a139c989.manifest.xBAD
04.07.2015 20:03 2.703 wow64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.18915_none_18f3f42da140fbf8.manifest.xBAD
30.09.2015 20:07 2.703 wow64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.19020_none_18e3faf1a14dcc78.manifest.xBAD
40 Datei(en), 381.331 Bytes

Verzeichnis von C:\FRST\Quarantine\C\Windows\winsxs\wow64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.18804_none_18fdc1e9a139c989

13.04.2015 19:09 <DIR> .
13.04.2015 19:09 <DIR> ..
25.03.2015 04:59 392.704 GWX.exe
1 Datei(en), 392.704 Bytes

Verzeichnis von C:\FRST\Quarantine\C\Windows\winsxs\wow64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.18915_none_18f3f42da140fbf8

01.10.2015 23:09 <DIR> .
01.10.2015 23:09 <DIR> ..
04.07.2015 19:47 438.784 GWX.exe
1 Datei(en), 438.784 Bytes

Verzeichnis von C:\FRST\Quarantine\C\Windows\winsxs\wow64_microsoft-windows-gwx_31bf3856ad364e35_6.1.7601.19020_none_18e3faf1a14dcc78

08.10.2015 21:47 <DIR> .
08.10.2015 21:47 <DIR> ..
30.09.2015 19:46 445.952 GWX.exe
1 Datei(en), 445.952 Bytes

Verzeichnis von C:\FRST\Quarantine\C\zoek_backup

18.11.2015 21:15 <DIR> .
18.11.2015 21:15 <DIR> ..
17.11.2015 18:11 <DIR> C_windows_SysNative_Tasks_Microsoft_Windows_Setup_gwx
17.11.2015 18:11 <DIR> C_windows_SysNative_Tasks_Microsoft_Windows_Setup_GWXTriggers
0 Datei(en), 0 Bytes

Verzeichnis von C:\FRST\Quarantine\C\zoek_backup\C_windows_SysNative_Tasks_Microsoft_Windows_Setup_gwx

17.11.2015 18:11 <DIR> .
17.11.2015 18:11 <DIR> ..
01.10.2015 23:09 3.176 launchtrayprocess
01.10.2015 23:09 3.050 refreshgwxconfig
01.10.2015 23:09 3.664 refreshgwxconfigandcontent
01.10.2015 23:09 2.876 refreshgwxcontent
4 Datei(en), 12.766 Bytes

Verzeichnis von C:\FRST\Quarantine\C\zoek_backup\C_windows_SysNative_Tasks_Microsoft_Windows_Setup_GWXTriggers

17.11.2015 18:11 <DIR> .
17.11.2015 18:11 <DIR> ..
17.11.2015 16:35 3.964 refreshgwxconfig-B
1 Datei(en), 3.964 Bytes

Anzahl der angezeigten Dateien:
86 Datei(en), 114.545.586 Bytes
65 Verzeichnis(se), 838.969.307.136 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 6099-878C

Verzeichnis von C:\program files

29.11.2015 20:25 <DIR> .
29.11.2015 20:25 <DIR> ..
29.11.2015 20:25 <DIR> 7-Zip
18.11.2015 21:30 <DIR> 9-lab
02.05.2015 17:56 <DIR> Bonjour
04.12.2015 22:38 <DIR> CCleaner
24.05.2050 09:48 <DIR> Common Files
22.04.2013 21:13 <DIR> Creative
26.04.2013 17:46 <DIR> CyberLink
14.07.2009 06:54 174 desktop.ini
12.04.2011 09:55 <DIR> DVD Maker
22.04.2013 20:40 <DIR> GIGABYTE
22.04.2013 20:40 <DIR> Intel
10.12.2015 19:20 <DIR> Internet Explorer
02.05.2015 17:56 <DIR> iPod
02.05.2015 17:57 <DIR> iTunes
22.04.2013 20:40 <DIR> Java
03.09.2015 16:19 <DIR> McAfee Security Scan
12.04.2011 09:55 <DIR> Microsoft Games
07.01.2015 18:53 <DIR> Microsoft Mouse and Keyboard Center
09.12.2015 23:59 <DIR> Microsoft Silverlight
14.07.2009 07:32 <DIR> MSBuild
24.01.2015 14:25 <DIR> NVIDIA Corporation
07.01.2016 17:43 <DIR> Reason
14.07.2009 07:32 <DIR> Reference Assemblies
22.04.2013 20:42 <DIR> Sony
18.11.2015 21:11 <DIR> Speccy
04.07.2015 10:24 <DIR> TeamSpeak 3 Client
04.08.2013 20:55 <DIR> Windows Defender
11.11.2015 23:37 <DIR> Windows Journal
12.04.2011 09:43 <DIR> Windows Mail
11.06.2015 15:19 <DIR> Windows Media Player
22.04.2013 21:08 <DIR> Windows NT
12.04.2011 09:43 <DIR> Windows Photo Viewer
21.11.2010 05:31 <DIR> Windows Portable Devices
12.04.2011 09:43 <DIR> Windows Sidebar
22.04.2013 20:43 <DIR> WinRAR
1 Datei(en), 174 Bytes
36 Verzeichnis(se), 838.969.307.136 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 6099-878C

Verzeichnis von C:\program files\Common Files

24.05.2050 09:48 <DIR> .
24.05.2050 09:48 <DIR> ..
25.07.2014 14:16 <DIR> Adobe
02.05.2015 17:56 <DIR> Apple
22.04.2013 20:37 <DIR> Microsoft Shared
14.07.2009 05:20 <DIR> Services
14.07.2009 05:20 <DIR> SpeechEngines
24.04.2013 15:10 <DIR> System
0 Datei(en), 0 Bytes
8 Verzeichnis(se), 838.969.307.136 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 6099-878C

Verzeichnis von C:\Qoobox

09.01.2016 12:52 <DIR> .
09.01.2016 12:52 <DIR> ..
09.01.2016 12:51 2.354 Add-Remove Programs.txt
09.01.2016 12:41 <DIR> BackEnv
09.01.2016 12:52 542 ComboFix-quarantined-files.txt
09.01.2016 12:52 <DIR> Quarantine
2 Datei(en), 2.896 Bytes

Verzeichnis von C:\Qoobox\Quarantine

09.01.2016 12:52 <DIR> .
09.01.2016 12:52 <DIR> ..
09.01.2016 12:49 <DIR> C
09.01.2016 12:40 51 catchme.log
09.01.2016 12:52 512 MBR_HardDisk0.mbr
09.01.2016 12:51 <DIR> Registry_backups
2 Datei(en), 563 Bytes

Verzeichnis von C:\Qoobox\Quarantine\C

09.01.2016 12:49 <DIR> .
09.01.2016 12:49 <DIR> ..
09.01.2016 12:49 <DIR> data
0 Datei(en), 0 Bytes

Verzeichnis von C:\Qoobox\Quarantine\C\data

09.01.2016 12:49 <DIR> .
09.01.2016 12:49 <DIR> ..
0 Datei(en), 0 Bytes

Verzeichnis von C:\Qoobox\Quarantine\Registry_backups

09.01.2016 12:51 <DIR> .
09.01.2016 12:51 <DIR> ..
09.01.2016 12:51 558 SafeBoot-87214911.sys.reg.dat
09.01.2016 12:51 232 ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24}.reg.dat
09.01.2016 12:48 7.087 tcpip.reg
3 Datei(en), 7.877 Bytes

Anzahl der angezeigten Dateien:
7 Datei(en), 11.336 Bytes
15 Verzeichnis(se), 838.969.303.040 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 6099-878C

Verzeichnis von C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware

06.01.2016 23:52 <DIR> .
06.01.2016 23:52 <DIR> ..
06.01.2016 23:30 3.535 actions.ref
05.10.2015 09:46 92 akadomains.ref
05.10.2015 09:46 92 akaips.ref
17.11.2015 18:32 <DIR> Configuration
06.01.2016 23:30 377.674 domains.ref
05.10.2015 09:46 0 exclusions.dat
06.01.2016 23:31 114.758 ips.ref
06.01.2016 23:52 <DIR> Logs
17.11.2015 18:32 <DIR> Quarantine
06.01.2016 23:31 9.229.995 rules.ref
06.01.2016 23:30 27.731 swissarmy.ref
8 Datei(en), 9.753.877 Bytes

Verzeichnis von C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Configuration

17.11.2015 18:32 <DIR> .
17.11.2015 18:32 <DIR> ..
06.01.2016 23:29 4.596 build.conf
05.10.2015 09:48 4 database.conf
05.10.2015 09:48 4 gatekeeper.conf
06.01.2016 23:29 1.455 license.conf
06.01.2016 23:31 3.394 manifest.conf
03.12.2015 16:19 7.372 marketing.conf
06.01.2016 23:29 7.201 net.conf
05.10.2015 09:48 4 notifications.conf
17.11.2015 18:32 <DIR> Restore
06.01.2016 23:52 2.194 scheduler.conf
06.01.2016 23:52 2.155 settings.conf
17.11.2015 18:32 513 statistics.conf
11 Datei(en), 28.892 Bytes

Verzeichnis von C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Configuration\Restore

17.11.2015 18:32 <DIR> .
17.11.2015 18:32 <DIR> ..
05.10.2015 09:48 4.178 build.conf
05.10.2015 09:48 4 database.conf
05.10.2015 09:48 4 gatekeeper.conf
05.10.2015 09:48 23 license.conf
05.10.2015 09:48 3.184 manifest.conf
05.10.2015 09:48 6.944 marketing.conf
05.10.2015 09:48 6.402 net.conf
05.10.2015 09:48 4 notifications.conf
05.10.2015 09:48 4 scheduler.conf
05.10.2015 09:48 1.725 settings.conf
05.10.2015 09:48 4 statistics.conf
11 Datei(en), 22.476 Bytes

Verzeichnis von C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs

06.01.2016 23:52 <DIR> .
06.01.2016 23:52 <DIR> ..
17.11.2015 19:16 2.634 mbam-log-2015-11-17 (18-44-24).xml
22.11.2015 03:15 2.634 mbam-log-2015-11-22 (02-59-25).xml
23.11.2015 16:47 2.636 mbam-log-2015-11-23 (16-26-08).xml
24.11.2015 16:42 2.636 mbam-log-2015-11-24 (16-23-53).xml
25.11.2015 16:30 2.636 mbam-log-2015-11-25 (16-13-21).xml
27.11.2015 14:01 2.608 mbam-log-2015-11-27 (13-44-07).xml
29.11.2015 20:37 2.606 mbam-log-2015-11-29 (20-15-58).xml
01.12.2015 14:06 2.636 mbam-log-2015-12-01 (13-42-21).xml
02.12.2015 16:29 2.634 mbam-log-2015-12-02 (16-12-32).xml
03.12.2015 16:34 2.638 mbam-log-2015-12-03 (16-12-32).xml
06.01.2016 23:52 2.636 mbam-log-2016-01-06 (23-30-21).xml
17.11.2015 22:43 14.818 protection-log-2015-11-17.xml
18.11.2015 22:27 18.653 protection-log-2015-11-18.xml
19.11.2015 22:34 19.959 protection-log-2015-11-19.xml
20.11.2015 23:57 10.350 protection-log-2015-11-20.xml
21.11.2015 23:03 11.198 protection-log-2015-11-21.xml
22.11.2015 22:04 17.698 protection-log-2015-11-22.xml
23.11.2015 22:53 15.120 protection-log-2015-11-23.xml
24.11.2015 22:04 14.847 protection-log-2015-11-24.xml
25.11.2015 22:58 20.640 protection-log-2015-11-25.xml
26.11.2015 21:46 11.202 protection-log-2015-11-26.xml
27.11.2015 23:00 15.435 protection-log-2015-11-27.xml
28.11.2015 23:23 22.043 protection-log-2015-11-28.xml
29.11.2015 20:37 12.389 protection-log-2015-11-29.xml
01.12.2015 21:03 13.057 protection-log-2015-12-01.xml
02.12.2015 19:50 13.049 protection-log-2015-12-02.xml
03.12.2015 16:34 2.191 protection-log-2015-12-03.xml
06.01.2016 23:52 1.954 protection-log-2016-01-06.xml
28 Datei(en), 263.537 Bytes

Verzeichnis von C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Quarantine

17.11.2015 18:32 <DIR> .
17.11.2015 18:32 <DIR> ..
0 Datei(en), 0 Bytes

Anzahl der angezeigten Dateien:
58 Datei(en), 10.068.782 Bytes
14 Verzeichnis(se), 838.969.298.944 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 6099-878C

Verzeichnis von C:\Users

24.01.2015 14:22 <DIR> .
24.01.2015 14:22 <DIR> ..
14.07.2009 07:08 <SYMLINKD> All Users [C:\ProgramData]
22.04.2013 21:08 <DIR> Default
14.07.2009 07:08 <VERBINDUNG> Default User [C:\Users\Default]
14.07.2009 06:54 174 desktop.ini
19.11.2015 20:18 <DIR> Nutzer
24.11.2015 20:50 <DIR> Public
1 Datei(en), 174 Bytes
7 Verzeichnis(se), 838.969.298.944 Bytes frei
siqzz
Regular Member
 
Posts: 29
Joined: January 22nd, 2016, 8:13 pm

Re: Malware, keylogger or trojan problem

Unread postby wannabeageek » January 26th, 2016, 9:04 pm

Hi siqzz,

Thank you for patience as I needed time.

These programs need to be removed.
Akamai NetSession Interface - Slows performance
BitRaider Streaming Client - Slows performance
Java 7 Update 10 - Outdated
McAfee Security Scan Plus - Duplicate AV/SP Program

If you use BitRaider for SWTOR, I can help with a work-around for the automatic reinstall when you run the game. The only inconvenience is the SWTOR WILL reload the entire 25 GB game - unless you have the 9GB disks.
Also, now would be a real good time do delete any programs and files you downloaded with the Torrent program. They should be considered suspect as infected and removed.

Step 1.
Uninstall Programs
I need you to uninstall some program(s).
  1. Click on Start...then... Click the Start Search box on the Start Menu.
  2. Copy and paste the value below, into the open text entry box:
    appwiz.cpl
  3. then press enter.
    • Locate the following program(s):
      Akamai NetSession Interface
      BitRaider Streaming Client
      Java 7 Update 10
      McAfee Security Scan Plus
    • Select the program and click on Uninstall to uninstall it.
      Carefully read any prompts...
      Some uninstallers prompt in a way to trick you into keeping the program, sometimes, preventing them from being uninstalled again!
    • Repeat steps 3 - 4 for each program in the list. When finished... Close the Control Panel window.


CCleaner
Registry cleaners are extremely powerful applications.
There are a number of them available and some are more safe than others. Keep in mind that no two registry cleaners work entirely the way. Each vendor uses different criteria as to what constitutes a "bad" entry. One cleaner may find entries on your system that will not cause a problem when removed, another may not find the same entries, and still
another may want to remove entries required for a program to work.
The Windows registry is a central repository (database) for storing configuration data, user settings and machine-dependent settings, and options for the operating system. It contains information and settings for all hardware, software, users, and preferences. Whenever a user makes changes to settings, file associations, system policies, or installed software, the changes are reflected and stored in this repository. The registry is a crucial component because it is where Windows "remembers" all this information, how it works together, how Windows boots the system and what files it uses when it does. The registry is also a vulnerable subsystem, in that relatively small changes done incorrectly, can render the system unbootable.
The usefulness of cleaning the registry, has been highly overrated and can be dangerous. In most cases, using a cleaner to remove obsolete, invalid, and erroneous entries does not affect system performance but it can result in "unpredictable results". Unless you have a particular problem that requires a registry edit to correct it, I would suggest you leave the registry alone.
Using registry cleaning tools unnecessarily or incorrectly can have disastrous effects on your operating system such as preventing it from ever starting again.
For routine use by those not familiar with the registry, the benefits to your computer are negligible while the potential risks are great.

If you insist on using a registry cleaner, always back up your registry before making any changes. If your not familiar with working in the registry, then you should NOT attempt to make any changes on your own. Improper changes to the registry could adversely affect your computer and render it inoperable.


Step 2.
Registry Backup (TCRB)
TCRB should still be on your desktop - if not;
Please download tweaking.com_registry_backup_setup.exe
Choose a download site for the installer... download and save it to your desktop.
Double click on the "...setup.exe" program and install the program. Let the install use the default installation. How to tutorial here.

Once the program is installed...
  1. Right mouse click the Tweaking.com Registry Backup icon, select "Run As Administrator" to run it... if UAC prompts, please allow it.
  2. It should open with the Backup Registry tab selected and all file options checked. Check any that are not already checked.
  3. Click on Backup Now to create a backup of your Registry.
    You'll see "Waiting for Volume Shadow Copy snapshot..." this may take a few moments, just be patient.
  4. When completed you should see a message saying something like ... Successful ??/?? Registry Files Backed Up ... ?? is total number of files, both numbers should match.
  5. Close and exit the program.

< STOP > If you did not successfully complete this step. < STOP > Do not continue with any other steps, post back and let me know!



Step 3.
  • Click Start
  • Type notepad.exe in the search programs and files box and click Enter.
  • A blank Notepad page should open.
    • Copy/Paste the contents of the code box below into Notepad.
    • To make this easy, click the "select all" button then hover over the highlighted text and right mouse click to select copy.
Code: Select all
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => Keine Datei
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG
HKU\S-1-5-21-296788986-4175192466-186242963-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [Keine Datei]
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.111\pdf.dll => Keine Datei
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll => Keine Datei
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll => Keine Datei
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll => Keine Datei
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll => Keine Datei
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll => Keine Datei
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll => Keine Datei
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 taphss6; system32\DRIVERS\taphss6.sys [X]
S3 trufos; system32\drivers\trufos.sys [X]
Task: {3CA0DB93-5755-48F8-8987-03BFE54C1FBB} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {47536D45-EEEC-4BDC-8183-A4DC1F8DA9E4} - \Microsoft\Windows\Customer Experience Improvement Program\UsbCeip -> Keine Datei <==== ACHTUNG
Task: {4F586805-A46B-4122-9933-C502FA916B2A} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {88A411E6-6CA8-4F91-8A0D-FCF0679208F6} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {B0D56F18-E551-4391-A203-FE430CF2CFEF} - \CreateChoiceProcessTask -> Keine Datei <==== ACHTUNG
Task: {BFF8A4E4-B403-4F9D-A732-8ABC0BA70865} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {C016366B-7126-46CA-B36B-592A3D95A60B} - \Microsoft\Windows\Customer Experience Improvement Program\Consolidator -> Keine Datei <==== ACHTUNG
Task: {DE166336-6B57-4D47-9FAE-FA747CFBD859} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {FDD56C73-F0D5-41B6-B767-6EFFD7966428} - \Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask -> Keine Datei <==== ACHTUNG
EmptyTemp:

    • Save it to the same folder/directory that FRST.exe is in, naming it as fixlist.txt

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

  • Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
    • Press the Fix button once and wait.
    • FRST will process fixlist.txt
    • When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
    • Please post me the log




What I need back from you:
Post each separately.
  1. Contents of fixlist.txt
  2. Any problem executing the instructions?
Thanks,
wbg
wannabeageek
MRU Master
MRU Master
 
Posts: 1871
Joined: November 23rd, 2009, 10:21 pm
Location: California
Advertisement
Register to Remove

Next

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 115 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware