Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Malware, keylogger or trojan problem

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Malware, keylogger or trojan problem

Unread postby siqzz » January 23rd, 2016, 8:33 am

Hello again,

sorry for not reading the post and giving you the logs on my last post. I have a problem with my pc: I believe there is a trojan on it. My account got hacked in a game and somebody tried to make a purchase, which was not me. And I did not give anyone my personal information - I have not even been using that account for over 2 years. Furthermore I have problems downloading a windows update. When I shut my pc off it tries to download 11 updates, and never progresses - it's always stuck at update 1. Generally my pc has been a bit slower as well. I have not perceived any other symptoms until now.

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:06-01-2015
durchgeführt von Nutzer (Administrator) auf NUTZER-PC (23-01-2016 14:26:37)
Gestartet von C:\Users\Nutzer\Desktop
Geladene Profile: Nutzer (Verfügbare Profile: Nutzer)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 9 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files (x86)\Everything\Everything.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Dropbox, Inc.) C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\Dropbox.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Qihu Software Co. Limited) C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files (x86)\360\Total Security\LiveUpdate360.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM-x32\...\Run: [QHSafeTray] => C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe [1474168 2015-11-12] (QIHU 360 SOFTWARE CO. LIMITED)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll [2015-12-08] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => Keine Datei
Startup: C:\Users\Nutzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-12-12]
ShortcutTarget: Dropbox.lnk -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 178.233.140.110 176.240.150.250 46.197.15.60
Tcpip\..\Interfaces\{B4B33004-2526-44A5-A2D8-799D0327DCA7}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{B4B33004-2526-44A5-A2D8-799D0327DCA7}: [DhcpNameServer] 178.233.140.110 176.240.150.250 46.197.15.60
Tcpip\..\Interfaces\{ED726773-98F2-4D55-A6A5-D82511B439DD}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{ED726773-98F2-4D55-A6A5-D82511B439DD}: [DhcpNameServer] 178.233.140.110 176.240.150.250 46.197.15.60

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG
HKU\S-1-5-21-296788986-4175192466-186242963-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKU\S-1-5-21-296788986-4175192466-186242963-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKU\S-1-5-21-296788986-4175192466-186242963-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?pc=UP97&ocid=UP97DHP
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-296788986-4175192466-186242963-1000 -> DefaultScope {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-296788986-4175192466-186242963-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2012-12-23] (Oracle Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-10-12] (Microsoft Corporation)
BHO: SafeMon Class -> {B69F34DD-F0F9-42DC-9EDD-957187DA688D} -> C:\Program Files (x86)\360\Total Security\safemon\safemon64.dll [2015-11-12] (Qihu 360 Software Co., Ltd.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2012-12-23] (Oracle Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)
BHO-x32: SafeMon Class -> {B69F34DD-F0F9-42DC-9EDD-957187DA688D} -> C:\Program Files (x86)\360\Total Security\safemon\safemon.dll [2015-11-12] (Qihu 360 Software Co., Ltd.)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxps://fpdownload.macromedia.com/get/s ... wflash.cab
DPF: HKLM-x32 {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwar ... TSUEng.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwar ... /CTPID.cab
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-10-12] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation)
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2015-11-06] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2015-11-06] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2015-11-06] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2015-11-06] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\o9hzff6f.default
FF NetworkProxy: "user_pref("xpinstall.whitelist.add.36", "");type",
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_245.dll [2015-11-10] ()
FF Plugin: @java.com/DTPlugin,version=10.10.2 -> C:\Windows\system32\npDeployJava1.dll [2012-12-23] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.10.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2012-12-23] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-04] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_245.dll [2015-11-10] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.52 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2011-12-01] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2011-12-01] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2012-09-25] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-04] ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-01-10] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-01-10] (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [Keine Datei]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-03] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-03] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-09-27] (Adobe Systems Inc.)
StartMenuInternet: firefox.exe - firefox.exe

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://de.msn.com/?pc=UP97&ocid=UP97DHP"
CHR Plugin: (Shockwave Flash) - C:\Users\Nutzer\AppData\Local\Google\Chrome\User Data\PepperFlash\11.7.700.225\pepflashplayer.dll => Keine Datei
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.111\ppGoogleNaClPluginChrome.dll => Keine Datei
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.111\pdf.dll => Keine Datei
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll => Keine Datei
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll => Keine Datei
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll => Keine Datei
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll => Keine Datei
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll => Keine Datei
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll => Keine Datei
CHR Plugin: (Java Deployment Toolkit 7.0.90.5) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Profile: C:\Users\Nutzer\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (AdBlock) - C:\Users\Nutzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-01-19]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Nutzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-23]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-10-12]

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2015-12-20] (BitRaider, LLC)
S3 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2015-10-12] (Microsoft Corporation)
S3 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2015-10-12] (Microsoft Corporation)
S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2012-10-09] (Creative Labs) [Datei ist nicht signiert]
R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [307200 2008-11-18] (Creative Technology Ltd) [Datei ist nicht signiert]
R2 Everything; C:\Program Files (x86)\Everything\Everything.exe [1048576 2014-08-06] () [Datei ist nicht signiert] <==== ACHTUNG
S3 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2014-12-13] (NVIDIA Corporation)
S3 ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [160256 2011-08-30] (Intel Corporation) [Datei ist nicht signiert]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [Datei ist nicht signiert]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2011-12-16] (Intel Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2014-12-13] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2014-12-13] (NVIDIA Corporation)
R2 QHActiveDefense; C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe [903288 2015-11-12] (QIHU 360 SOFTWARE CO. LIMITED)
S3 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390672 2012-09-04] ()
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27760 2012-05-04] (VIA Technologies, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S3 ZAMSvc; C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe [12709688 2015-11-06] (Zemana Ltd.)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R1 360AntiHacker; C:\Windows\System32\Drivers\360AntiHacker64.sys [137808 2015-11-12] (360.cn)
R3 360AvFlt; C:\Windows\System32\DRIVERS\360AvFlt.sys [77904 2015-11-12] (360.cn)
R3 360AvFlt; C:\Windows\SysWOW64\DRIVERS\360AvFlt.sys [77904 2015-11-12] (360.cn)
R1 360Box64; C:\Windows\System32\DRIVERS\360Box64.sys [319568 2015-11-12] (360.cn)
S3 360Camera; C:\Windows\System32\Drivers\360Camera64.sys [40520 2015-11-12] (360.cn)
R1 360FsFlt; C:\Windows\System32\DRIVERS\360FsFlt.sys [367696 2015-11-12] (360.cn)
R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [21616 2011-11-02] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R1 BAPIDRV; C:\Windows\System32\DRIVERS\BAPIDRV64.sys [178768 2015-11-12] (360.cn)
S3 BRDriver64_1_3_3_E02B25FC; C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [78088 2015-12-24] (BitRaider)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
U5 GEARAspiWDM; C:\Windows\System32\Drivers\GEARAspiWDM.sys [33240 2012-10-03] (GEAR Software Inc.)
S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2012-10-09] ()
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-01-06] (Malwarebytes)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2014-12-13] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [50320 2015-01-29] (Panda Security, S.L.)
S3 ptun0901; C:\Windows\System32\DRIVERS\ptun0901.sys [27136 2014-08-08] (The OpenVPN Project)
R3 VUSB3HUB; C:\Windows\System32\DRIVERS\ViaHub3.sys [205312 2012-01-20] (VIA Technologies, Inc.)
R3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [254464 2012-01-20] (VIA Technologies, Inc.)
R1 ZAM; C:\Windows\System32\drivers\zam64.sys [199536 2015-11-17] (Zemana Ltd.)
R1 ZAM_Guard; C:\Windows\System32\drivers\zamguard64.sys [199536 2015-11-17] (Zemana Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 taphss6; system32\DRIVERS\taphss6.sys [X]
S3 trufos; system32\drivers\trufos.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2016-01-23 14:26 - 2016-01-23 14:26 - 00021369 _____ C:\Users\Nutzer\Desktop\FRST.txt
2016-01-20 18:53 - 2016-01-20 18:53 - 00001136 _____ C:\Users\Nutzer\Desktop\nativelog.txt
2016-01-19 16:36 - 2016-01-19 16:36 - 00112604 _____ C:\Users\Nutzer\Downloads\UnifrakturMaguntia.ttf
2016-01-19 16:36 - 2016-01-19 16:36 - 00089460 _____ C:\Users\Nutzer\Downloads\OldNewspaperTypes.ttf
2016-01-19 16:36 - 2016-01-19 16:36 - 00015560 _____ C:\Users\Nutzer\Downloads\Old Newspaper Font.ttf
2016-01-19 16:35 - 2016-01-19 19:38 - 00042202 _____ C:\Users\Nutzer\Downloads\le travail ecrit.odt
2016-01-17 22:05 - 2016-01-17 22:35 - 564744309 _____ C:\Users\Nutzer\Downloads\Windows6.1-KB947821-v34-x64.msu
2016-01-15 21:01 - 2016-01-15 21:01 - 00008957 _____ C:\Users\Nutzer\Desktop\GIF.odt
2016-01-13 16:47 - 2015-12-08 23:52 - 00312320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2016-01-13 16:47 - 2015-12-08 21:07 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-01-13 16:46 - 2015-12-30 21:08 - 05572544 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-01-13 16:46 - 2015-12-30 21:08 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-01-13 16:46 - 2015-12-30 21:08 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-01-13 16:46 - 2015-12-30 21:05 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-01-13 16:46 - 2015-12-30 21:02 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2016-01-13 16:46 - 2015-12-30 21:02 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2016-01-13 16:46 - 2015-12-30 21:02 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2016-01-13 16:46 - 2015-12-30 21:02 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-01-13 16:46 - 2015-12-30 21:02 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-01-13 16:46 - 2015-12-30 21:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2016-01-13 16:46 - 2015-12-30 21:01 - 01214464 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-01-13 16:46 - 2015-12-30 21:01 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2016-01-13 16:46 - 2015-12-30 21:01 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-01-13 16:46 - 2015-12-30 21:01 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-01-13 16:46 - 2015-12-30 21:01 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2016-01-13 16:46 - 2015-12-30 21:01 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-01-13 16:46 - 2015-12-30 21:01 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-01-13 16:46 - 2015-12-30 21:00 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2016-01-13 16:46 - 2015-12-30 20:59 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-01-13 16:46 - 2015-12-30 20:59 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-01-13 16:46 - 2015-12-30 20:59 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2016-01-13 16:46 - 2015-12-30 20:58 - 01461248 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-01-13 16:46 - 2015-12-30 20:58 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-01-13 16:46 - 2015-12-30 20:57 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2016-01-13 16:46 - 2015-12-30 20:57 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-01-13 16:46 - 2015-12-30 20:57 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2016-01-13 16:46 - 2015-12-30 20:55 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2016-01-13 16:46 - 2015-12-30 20:55 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2016-01-13 16:46 - 2015-12-30 20:55 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:47 - 03993536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2016-01-13 16:46 - 2015-12-30 20:47 - 03938240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2016-01-13 16:46 - 2015-12-30 20:44 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2016-01-13 16:46 - 2015-12-30 20:41 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2016-01-13 16:46 - 2015-12-30 20:41 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2016-01-13 16:46 - 2015-12-30 20:41 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2016-01-13 16:46 - 2015-12-30 20:41 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2016-01-13 16:46 - 2015-12-30 20:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2016-01-13 16:46 - 2015-12-30 20:41 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2016-01-13 16:46 - 2015-12-30 20:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2016-01-13 16:46 - 2015-12-30 20:41 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2016-01-13 16:46 - 2015-12-30 20:40 - 00251392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2016-01-13 16:46 - 2015-12-30 20:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2016-01-13 16:46 - 2015-12-30 20:39 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2016-01-13 16:46 - 2015-12-30 20:39 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2016-01-13 16:46 - 2015-12-30 20:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2016-01-13 16:46 - 2015-12-30 20:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2016-01-13 16:46 - 2015-12-30 20:38 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-01-13 16:46 - 2015-12-30 20:38 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 20:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 19:57 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2016-01-13 16:46 - 2015-12-30 19:50 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2016-01-13 16:46 - 2015-12-30 19:49 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2016-01-13 16:46 - 2015-12-30 19:44 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2016-01-13 16:46 - 2015-12-30 19:43 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-01-13 16:46 - 2015-12-30 19:42 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-01-13 16:46 - 2015-12-30 19:42 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-01-13 16:46 - 2015-12-30 19:41 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2016-01-13 16:46 - 2015-12-30 19:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-01-13 16:46 - 2015-12-30 19:32 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2016-01-13 16:46 - 2015-12-30 19:32 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2016-01-13 16:46 - 2015-12-30 19:32 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2016-01-13 16:46 - 2015-12-30 19:32 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2016-01-13 16:46 - 2015-12-30 19:30 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2016-01-13 16:46 - 2015-12-30 19:30 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 19:30 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 19:30 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2016-01-13 16:46 - 2015-12-30 19:30 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2016-01-09 12:52 - 2016-01-09 12:52 - 00029859 _____ C:\ComboFix.txt
2016-01-09 12:40 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2016-01-09 12:40 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2016-01-09 12:40 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2016-01-09 12:40 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2016-01-09 12:40 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2016-01-09 12:40 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2016-01-09 12:40 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2016-01-09 12:40 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2016-01-09 12:37 - 2016-01-09 12:52 - 00000000 ____D C:\Qoobox
2016-01-09 12:35 - 2016-01-09 12:35 - 05646860 ____R (Swearware) C:\Users\Nutzer\Desktop\ComboFix.exe
2016-01-09 12:34 - 2016-01-09 12:35 - 05646860 _____ (Swearware) C:\Users\Nutzer\Downloads\ComboFix.exe
2016-01-07 18:47 - 2016-01-07 18:47 - 02827152 _____ (Reason Company Software Inc.) C:\Users\Nutzer\Downloads\herdProtectScan_Portable (1).exe
2016-01-07 17:10 - 2015-09-14 13:03 - 00039672 _____ C:\Windows\system32\Drivers\DasPtct.SYS
2016-01-07 17:10 - 2015-01-29 18:21 - 00050320 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys
2016-01-07 17:09 - 2016-01-09 13:03 - 00001282 _____ C:\Users\Public\Desktop\Panda Cloud Cleaner.lnk
2016-01-07 17:09 - 2016-01-07 17:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2016-01-07 17:09 - 2016-01-07 17:09 - 00000000 ____D C:\Program Files (x86)\Panda Security
2016-01-07 17:06 - 2016-01-07 17:07 - 35192968 _____ (Panda Security ) C:\Users\Nutzer\Downloads\PandaCloudCleaner.exe
2016-01-07 17:06 - 2016-01-07 17:06 - 02827152 _____ (Reason Company Software Inc.) C:\Users\Nutzer\Downloads\herdProtectScan_Portable.exe
2016-01-07 16:54 - 2016-01-07 16:58 - 00700956 _____ C:\TDSSKiller.3.1.0.9_07.01.2016_16.54.32_log.txt
2016-01-07 16:51 - 2016-01-07 16:51 - 00004300 _____ C:\TDSSKiller.3.1.0.9_07.01.2016_16.51.06_log.txt
2016-01-07 16:50 - 2016-01-07 16:50 - 04727984 _____ (Kaspersky Lab ZAO) C:\Users\Nutzer\Downloads\tdsskiller.exe
2016-01-07 16:47 - 2016-01-07 16:47 - 00002040 _____ C:\Users\Nutzer\Desktop\Rkill.txt
2016-01-07 16:46 - 2016-01-07 16:46 - 02032072 _____ (Bleeping Computer, LLC) C:\Users\Nutzer\Downloads\rkill.exe
2016-01-06 23:09 - 2016-01-06 23:29 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2016-01-06 23:08 - 2016-01-06 23:08 - 00000000 ____D C:\Users\Nutzer\Desktop\Neuer Ordner
2016-01-06 23:07 - 2016-01-06 23:08 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Nutzer\Downloads\mbar-1.09.3.1001.exe
2016-01-06 23:05 - 2016-01-06 23:05 - 00043763 _____ C:\Users\Nutzer\Downloads\Addition.txt
2016-01-06 23:03 - 2016-01-06 23:05 - 00042113 _____ C:\Users\Nutzer\Downloads\FRST.txt
2016-01-06 22:53 - 2016-01-06 22:55 - 00000000 ____D C:\AdwCleaner
2016-01-06 22:53 - 2016-01-06 22:53 - 02370560 _____ (Farbar) C:\Users\Nutzer\Desktop\FRST64.exe
2016-01-06 22:53 - 2016-01-06 22:53 - 01749504 _____ C:\Users\Nutzer\Downloads\adwcleaner_5.028.exe
2016-01-06 22:52 - 2016-01-06 22:53 - 02370560 _____ (Farbar) C:\Users\Nutzer\Downloads\FRST64.exe
2016-01-05 16:32 - 2016-01-05 16:32 - 01620280 _____ C:\Users\Nutzer\Downloads\Interne Bewertung 2015_Schüler_Ixmeier2015.pdf
2016-01-01 01:51 - 2016-01-01 01:51 - 00000000 ____D C:\Users\Nutzer\AppData\Local\Blizzard
2015-12-31 23:10 - 2015-12-31 23:10 - 00001181 _____ C:\Users\Public\Desktop\Hearthstone.lnk
2015-12-31 23:10 - 2015-12-31 23:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hearthstone
2015-12-31 22:24 - 2016-01-01 01:57 - 00000000 ____D C:\Program Files (x86)\Hearthstone
2015-12-31 19:20 - 2015-12-31 19:20 - 00000000 ____D C:\Users\Nutzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2015-12-31 19:03 - 2016-01-15 20:31 - 00000000 ____D C:\Users\Nutzer\AppData\Local\Battle.net
2015-12-31 19:03 - 2015-12-31 22:20 - 00000000 ____D C:\Users\Nutzer\AppData\Roaming\Battle.net
2015-12-31 19:03 - 2015-12-31 19:03 - 00001144 _____ C:\Users\Public\Desktop\Battle.net.lnk
2015-12-31 19:03 - 2015-12-31 19:03 - 00000000 ____D C:\Users\Nutzer\AppData\Local\Blizzard Entertainment
2015-12-31 19:03 - 2015-12-31 19:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2015-12-31 19:00 - 2016-01-15 19:56 - 00000000 ____D C:\Program Files (x86)\Battle.net
2015-12-31 18:58 - 2015-12-31 18:59 - 03142712 _____ (Blizzard Entertainment) C:\Users\Nutzer\Downloads\Hearthstone-Setup.exe
2015-12-31 16:32 - 2016-01-03 04:14 - 00020191 _____ C:\Users\Nutzer\Desktop\Ebay.odt
2015-12-31 14:51 - 2015-12-31 14:51 - 00000220 _____ C:\Users\Nutzer\Desktop\Rome Total War.url
2015-12-30 19:16 - 2015-12-30 19:16 - 00000000 ____D C:\Users\Nutzer\Desktop\yugioh
2015-12-28 17:46 - 2015-12-28 17:46 - 00000000 ____D C:\Users\Nutzer\Desktop\Foucault
2015-12-25 22:00 - 2015-12-25 22:00 - 00002672 _____ C:\Users\Nutzer\Downloads\Antitrust.zip
2015-12-25 21:50 - 2015-12-25 21:50 - 00010016 _____ C:\Users\Nutzer\Downloads\TibbettsUI + Keybinds.zip
2015-12-24 17:10 - 2015-12-24 17:10 - 00000000 ____D C:\Users\Nutzer\Documents\HeroBlade Logs
2015-12-24 17:10 - 2015-12-24 17:10 - 00000000 ____D C:\Users\Nutzer\AppData\Local\SWTOR

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2016-01-23 14:26 - 2015-11-16 21:15 - 00000000 ____D C:\FRST
2016-01-23 14:25 - 2009-07-14 06:45 - 00028944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-01-23 14:25 - 2009-07-14 06:45 - 00028944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-01-23 14:18 - 2014-09-23 17:46 - 00000000 ___RD C:\Users\Nutzer\Dropbox
2016-01-23 14:18 - 2014-09-23 16:57 - 00000000 ____D C:\Users\Nutzer\AppData\Roaming\Dropbox
2016-01-23 14:17 - 2015-11-19 22:14 - 00000000 ____D C:\Users\Nutzer\AppData\LocalLow\360WD
2016-01-23 14:16 - 2015-12-21 14:26 - 00000620 _____ C:\Windows\ZAM.krnl.trace
2016-01-23 14:16 - 2015-12-21 14:26 - 00000119 _____ C:\Windows\ZAM_Guard.krnl.trace
2016-01-23 14:16 - 2015-11-19 22:14 - 00000000 _RSHD C:\360SANDBOX
2016-01-23 14:16 - 2013-04-22 20:33 - 00000000 ____D C:\ProgramData\NVIDIA
2016-01-23 14:16 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-01-23 14:16 - 2009-07-14 05:20 - 00000000 ____D C:\Windows
2016-01-23 13:46 - 2015-12-03 22:41 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-01-23 02:18 - 2012-10-24 12:23 - 00000000 ____D C:\Users\Nutzer\AppData\Roaming\Skype
2016-01-23 01:22 - 2013-03-19 14:58 - 00000000 ____D C:\Users\Nutzer\AppData\Roaming\.minecraft
2016-01-21 19:38 - 2014-08-11 23:52 - 00000000 ____D C:\Program Files (x86)\Steam
2016-01-21 14:40 - 2015-11-21 14:52 - 00077312 _____ C:\Users\Nutzer\AppData\Local\GDIPFONTCACHEV1.DAT
2016-01-20 16:10 - 2015-11-19 22:33 - 05014776 _____ C:\Windows\system32\FNTCACHE.DAT
2016-01-19 20:48 - 2011-04-12 09:43 - 00699416 _____ C:\Windows\system32\perfh007.dat
2016-01-19 20:48 - 2011-04-12 09:43 - 00149556 _____ C:\Windows\system32\perfc007.dat
2016-01-19 20:48 - 2009-07-14 07:13 - 01620612 _____ C:\Windows\system32\PerfStringBackup.INI
2016-01-19 20:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2016-01-19 20:46 - 2014-10-17 22:44 - 00000000 ____D C:\Users\Nutzer\Desktop\Schule
2016-01-19 19:24 - 2015-11-25 19:10 - 00000000 ____D C:\Users\Nutzer\Desktop\Math Images
2016-01-14 19:22 - 2012-10-24 12:23 - 00000000 ____D C:\ProgramData\Skype
2016-01-09 12:50 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2016-01-08 13:43 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-01-07 18:40 - 2015-12-03 22:40 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-01-07 17:43 - 2015-11-19 19:56 - 00000000 ____D C:\Program Files\Reason
2016-01-07 17:08 - 2015-12-03 22:41 - 00004116 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-01-07 17:08 - 2015-12-03 22:40 - 00003866 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-01-06 23:31 - 2015-11-17 18:33 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-01-06 23:09 - 2015-11-17 18:32 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-01-06 22:55 - 2014-10-17 22:44 - 00000000 ____D C:\Users\Nutzer\Desktop\wallpaper
2016-01-02 01:33 - 2015-11-19 22:31 - 00000000 ____D C:\$360Section
2016-01-02 01:33 - 2015-11-19 22:19 - 00000000 ____D C:\ProgramData\360Quarant
2016-01-02 01:33 - 2015-11-17 17:20 - 00000000 ____D C:\Users\Nutzer\AppData\Roaming\ZHP
2015-12-31 14:51 - 2014-08-12 00:10 - 00000000 ____D C:\Users\Nutzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2015-12-29 19:45 - 2015-12-21 18:24 - 00028665 _____ C:\Users\Nutzer\Desktop\Blindness.odt

==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-09-10 23:49

==================== Ende von FRST.txt ============================

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:06-01-2015
durchgeführt von Nutzer (2016-01-23 14:27:12)
Gestartet von C:\Users\Nutzer\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2013-04-22 19:08:31)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-296788986-4175192466-186242963-500 - Administrator - Disabled)
Gast (S-1-5-21-296788986-4175192466-186242963-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-296788986-4175192466-186242963-1005 - Limited - Enabled)
Nutzer (S-1-5-21-296788986-4175192466-186242963-1000 - Administrator - Enabled) => C:\Users\Nutzer

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: 360 Total Security (Enabled - Up to date) {2B66EE1E-E5C8-C2F7-648F-4E55AC68D37D}
AS: 360 Total Security (Enabled - Up to date) {90070FFA-C3F2-CD79-5E3F-7527D7EF99C0}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

@BIOS (HKLM-x32\...\{B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83}) (Version: 2.24 - GIGABYTE)
µTorrent (HKU\S-1-5-21-296788986-4175192466-186242963-1000\...\uTorrent) (Version: 3.4.3.40760 - BitTorrent Inc.)
360 Total Security (HKLM-x32\...\360TotalSecurity) (Version: 8.0.0.1058 - 360 Security Center)
7-Zip 15.12 (x64) (HKLM\...\7-Zip) (Version: 15.12 - Igor Pavlov)
9-lab Removal Tool (HKLM-x32\...\9-lab Removal Tool) (Version: - )
Adobe Flash Player 19 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 19.0.0.245 - Adobe Systems Incorporated)
Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.245 - Adobe Systems Incorporated)
Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe Photoshop CS6 version 13.0.1 (HKLM-x32\...\{A724DC44-6241-42D3-BA57-778B178ABC17}_is1) (Version: 13.0.1 - Adobe Systems, Inc.)
Adobe Reader XI (11.0.13) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.13 - Adobe Systems Incorporated)
Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version: - Hidden Path Entertainment, Ensemble Studios)
Akamai NetSession Interface (HKU\S-1-5-21-296788986-4175192466-186242963-1000\...\Akamai) (Version: - Akamai Technologies, Inc)
Apple Application Support (32-Bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.0.4.4 - Atheros Communications Inc.)
AutoGreen B12.0206.1 (HKLM-x32\...\InstallShield_{C75FAD21-EC08-42F3-92D6-C9C0AB355345}) (Version: 1.00.0000 - GIGABYTE)
AutoGreen B12.0206.1 (x32 Version: 1.00.0000 - GIGABYTE) Hidden
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
BitRaider Streaming Client (HKLM-x32\...\BitRaider Streaming Client) (Version: 1.3.3.4098 - BitRaider, LLC)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.11 - Piriform)
Creative Audio-Systemsteuerung (HKLM-x32\...\AudioCS) (Version: 2.56 - Creative Technology Limited)
Creative Software AutoUpdate (HKLM-x32\...\Creative Software AutoUpdate) (Version: 1.40 - Creative Technology Limited)
Creative Sound Blaster Properties x64 Edition (HKLM-x32\...\Creative Sound Blaster Properties x64 Edition) (Version: - )
CyberLink PowerDirector 11 (HKLM-x32\...\InstallShield_{551F492A-01B0-4DC4-866F-875EC4EDC0A8}) (Version: 11.0.0.2027 - CyberLink Corp.)
CyberLink PowerDirector 11 (Version: 11.0.0.2027 - Ihr Firmenname) Hidden
Dropbox (HKU\S-1-5-21-296788986-4175192466-186242963-1000\...\Dropbox) (Version: 3.12.5 - Dropbox, Inc.)
Easy Tune 6 B12.0525.1 (HKLM-x32\...\InstallShield_{457D7505-D665-4F95-91C3-ECB8C56E9ACA}) (Version: 1.00.0000 - GIGABYTE)
Easy Tune 6 B12.0525.1 (x32 Version: 1.00.0000 - GIGABYTE) Hidden
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
Everything 1.3.4.686 (x86) (HKLM-x32\...\Everything) (Version: - )
FINAL FANTASY VII (HKLM-x32\...\Steam App 39140) (Version: - Square Enix)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 47.0.2526.111 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) Hidden
Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.0.1351 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.225 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{6199B534-A1B6-46ED-873B-97B0ECF8F81E}) (Version: 1.23.216.0 - Intel Corporation)
iTunes (HKLM\...\{93F2A022-6C37-48B8-B241-FFABD9F60C30}) (Version: 12.1.2.27 - Apple Inc.)
Java 7 Update 10 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417010FF}) (Version: 7.0.100 - Oracle)
Jazzpunk (HKLM-x32\...\Steam App 250260) (Version: - Necrophone Games)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games)
League of Legends (x32 Version: 3.0.1 - Riot Games) Hidden
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
marvell 91xx driver (HKLM-x32\...\MagniDriver) (Version: 1.2.0.1010 - Marvell)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.163.2 - McAfee, Inc.)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41105.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Newblue Art Effects for PowerDirector (HKLM\...\NewBlue Art Effects for PowerDirector) (Version: 2.0 - NewBlue)
NVIDIA 3D Vision Controller-Treiber 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 347.09 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 347.25 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 347.25 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.5 - NVIDIA Corporation)
NVIDIA Grafiktreiber 347.25 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.25 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.33.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.33.0 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
ON_OFF Charge B11.1102.1 (HKLM-x32\...\{3DECD372-76A1-4483-BF10-B547790A3261}) (Version: 1.00.0001 - GIGABYTE)
OpenOffice 4.1.1 (HKLM-x32\...\{9395F41D-0F80-432E-9A59-B8E477E7E163}) (Version: 4.11.9775 - Apache Software Foundation)
Panda Cloud Cleaner (HKLM-x32\...\{92B2B132-C7F0-43DC-921A-4493C04F78A4}_is1) (Version: 1.1.5 - Panda Security)
Platform (x32 Version: 1.39 - VIA Technologies, Inc.) Hidden
PrivaZer (HKLM-x32\...\PrivaZer) (Version: 2.39.2.0 - Goversoft LLC)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Rome: Total War (HKLM-x32\...\Steam App 4760) (Version: - The Creative Assembly)
SHIELD Streaming (Version: 3.1.3000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.18.9 - NVIDIA Corporation) Hidden
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.5.0.9082 - Microsoft Corporation)
Skype™ 7.17 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.17.105 - Skype Technologies S.A.)
SmartSound Quicktracks 5 (HKLM-x32\...\InstallShield_{2F8BA3FD-1FA9-4279-B696-712ABB12F09F}) (Version: 5.1.8 - SmartSound Software Inc.)
SmartSound Quicktracks 5 (x32 Version: 5.1.8 - SmartSound Software Inc.) Hidden
Sound Blaster Audigy (HKLM-x32\...\{4B5F5D06-7097-417E-9793-290D9D85DC6B}) (Version: 1.0 - Creative Technology Limited)
Speccy (HKLM\...\Speccy) (Version: 1.28 - Piriform)
Splashtop Connect for Firefox (HKLM-x32\...\{EF25F71D-F3E8-42A3-8B5A-DBF83C4B942F}) (Version: 2.0.5.2 - Splashtop Inc.)
Splashtop Connect for IE (HKLM-x32\...\{E2B086BD-75A9-45D1-A675-151624B259A1}) (Version: 2.0.5.1 - Splashtop Inc.)
Star Wars The Old Republic (HKLM-x32\...\swtor_swtor) (Version: - Bioware/EA)
Star Wars: The Old Republic (HKLM-x32\...\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)
Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
The Binding of Isaac: Rebirth (HKLM-x32\...\Steam App 250900) (Version: - Nicalis, Inc.)
Toolwiz Smart Defrag 2011 (HKLM-x32\...\Toolwiz Smart Defrag FREE_is1) (Version: 1.3.0.0 - Toolwiz.com.)
TP-LINK Wireless Client Utility (HKLM-x32\...\{385C8E5A-0B4F-4DCD-BBBD-2A8AE0400A76}) (Version: 7.0 - TP-LINK)
Unturned (HKLM-x32\...\Steam App 304930) (Version: - Smartly Dressed Games)
Vegas Pro 12.0 (64-bit) (HKLM\...\{A7C8BBDE-FE98-11E1-87C9-F04DA23A5C58}) (Version: 12.0.367 - Sony)
VIA Plattform-Geräte-Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.39 - VIA Technologies, Inc.)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
Zemana AntiMalware (HKLM-x32\...\{8F0CD7D1-42F3-4195-95CD-833578D45057}_is1) (Version: 2.18.263 - Zemana Ltd.)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-296788986-4175192466-186242963-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-296788986-4175192466-186242963-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-296788986-4175192466-186242963-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-296788986-4175192466-186242963-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-296788986-4175192466-186242963-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-296788986-4175192466-186242963-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-296788986-4175192466-186242963-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-296788986-4175192466-186242963-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-296788986-4175192466-186242963-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-296788986-4175192466-186242963-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-296788986-4175192466-186242963-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.28.dll (Dropbox, Inc.)

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {3CA0DB93-5755-48F8-8987-03BFE54C1FBB} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {47536D45-EEEC-4BDC-8183-A4DC1F8DA9E4} - \Microsoft\Windows\Customer Experience Improvement Program\UsbCeip -> Keine Datei <==== ACHTUNG
Task: {4F586805-A46B-4122-9933-C502FA916B2A} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {5A40E926-9E86-4B89-9CFD-B12311724371} - System32\Tasks\Microsoft\Windows\UPnP\UPnPHostConfig => config upnphost start= auto
Task: {6D08FC84-8CD7-4F7B-B8D9-4AB7D88B955F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {88A411E6-6CA8-4F91-8A0D-FCF0679208F6} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {91F195DF-91C3-48B0-B3FE-CC055C1F3910} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {B0D56F18-E551-4391-A203-FE430CF2CFEF} - \CreateChoiceProcessTask -> Keine Datei <==== ACHTUNG
Task: {BFF8A4E4-B403-4F9D-A732-8ABC0BA70865} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {C016366B-7126-46CA-B36B-592A3D95A60B} - \Microsoft\Windows\Customer Experience Improvement Program\Consolidator -> Keine Datei <==== ACHTUNG
Task: {C80369EA-A697-4BC3-837B-EA2C0E3F0D77} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-10-19] (Piriform Ltd)
Task: {DD9F510C-95F4-499A-90C8-BAC5BC372FF4} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask => start sppsvc
Task: {DE166336-6B57-4D47-9FAE-FA747CFBD859} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {FDD56C73-F0D5-41B6-B767-6EFFD7966428} - \Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask -> Keine Datei <==== ACHTUNG

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2013-04-22 20:33 - 2015-01-10 01:29 - 00117392 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-11-24 20:47 - 2009-04-07 09:43 - 00027648 _____ () C:\Windows\System32\sxp3ml6.dll
2015-01-20 22:35 - 2015-01-20 22:35 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 22:35 - 2015-01-20 22:35 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-11-17 22:38 - 2014-08-06 03:01 - 01048576 _____ () C:\Program Files (x86)\Everything\Everything.exe
2015-11-19 22:14 - 2015-11-12 17:10 - 00615032 _____ () C:\Program Files (x86)\360\Total Security\LiveUpdate360.exe
2015-11-19 22:14 - 2015-11-12 17:10 - 00088184 _____ () C:\Program Files (x86)\360\Total Security\deepscan\qutmload.dll
2015-12-12 11:12 - 2015-10-31 02:59 - 00034768 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\_multiprocessing.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00019408 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\faulthandler.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00022848 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\Crypto.Random.OSRNG.winrandom.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00023352 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\Crypto.Util._counter.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00042296 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\Crypto.Cipher._AES.pyd
2015-12-12 11:12 - 2015-10-31 02:59 - 00116688 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\pywintypes27.dll
2015-12-12 11:12 - 2015-10-31 02:59 - 00093640 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\_ctypes.pyd
2015-12-12 11:12 - 2015-10-31 02:59 - 00018376 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\select.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00019760 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\tornado.speedups.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00105928 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32api.pyd
2015-12-12 11:12 - 2015-10-31 02:59 - 00392144 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\pythoncom27.dll
2015-12-12 11:12 - 2015-12-08 23:36 - 00381752 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32com.shell.shell.pyd
2015-12-12 11:12 - 2015-10-31 02:59 - 00692688 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\unicodedata.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00020816 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._constant_time.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00109520 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\_cffi_backend.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 01737032 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._openssl.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00020808 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._padding.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00020800 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\_cffi_python_x66cf7a7cx17a72769.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00021840 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\_cffi_unicode_environ_win32_x8bf8e68bx9968e850.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00038696 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\fastpath.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00024528 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32event.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00020936 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\mmapfile.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00114640 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32security.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00021320 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\_cffi_pywin_kernel32_xde9e4433x360333f0.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00124880 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32file.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00030160 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32pipe.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00043472 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32process.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00175560 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32gui.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00028616 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32ts.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00024016 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32clipboard.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00048592 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32service.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00024392 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\librsyncffi.compiled._librsyncffi.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00036296 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\librsync.dll
2015-12-12 11:12 - 2015-10-31 03:00 - 00024016 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\win32profile.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00117056 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\breakpad.client.windows.handler.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00023376 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\winscreenshot.compiled._CaptureScreenshot.pyd
2015-12-12 11:12 - 2015-10-31 02:59 - 00134608 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\_elementtree.pyd
2015-12-12 11:12 - 2015-10-31 02:59 - 00134088 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\pyexpat.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00240584 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\jpegtran.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00020280 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\cpuid.compiled._cpuid.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00052024 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\psutil._psutil_windows.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00021304 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\Crypto.Util.strxor.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00350152 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\winxpgui.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00084792 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\dropbox_sqlite_ext.DLL
2015-12-12 11:12 - 2015-12-08 23:36 - 01826608 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\PyQt5.QtCore.pyd
2015-12-12 11:12 - 2015-10-31 03:00 - 00083912 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\sip.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 03891504 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\PyQt5.QtWidgets.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 01950000 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\PyQt5.QtGui.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00519984 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\PyQt5.QtNetwork.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00133936 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKit.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00225080 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKitWidgets.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00207672 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\PyQt5.QtPrintSupport.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00024904 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\_cffi_wpad_proxy_win_x752e3d61xdcfdcc84.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00486704 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\PyQt5.QtQuick.pyd
2015-12-12 11:12 - 2015-12-08 23:36 - 00357680 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\PyQt5.QtQml.pyd
2015-03-04 23:45 - 2015-10-31 03:01 - 00019920 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll
2015-03-04 23:45 - 2015-10-31 03:00 - 00786904 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-07-31 15:44 - 2015-10-31 03:00 - 00063448 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\QtQuick\Layouts\qquicklayoutsplugin.dll
2015-03-04 23:45 - 2015-10-31 03:00 - 00019408 _____ () C:\Users\Nutzer\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll
2015-11-19 22:14 - 2015-11-12 17:10 - 00578168 _____ () C:\Program Files (x86)\360\Total Security\safemon\wdui2.dll
2014-10-16 13:35 - 2014-10-16 13:35 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\1eeea3ab8d69ec722bdcb28b8eb8dd75\IsdiInterop.ni.dll
2012-10-09 17:37 - 2012-02-01 16:25 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2012-10-09 17:35 - 2011-12-16 10:39 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2016-01-15 18:50 - 2016-01-12 18:35 - 01590088 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.111\libglesv2.dll
2016-01-15 18:50 - 2016-01-12 18:35 - 00087880 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.111\libegl.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)


==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2009-07-14 04:34 - 2015-11-21 14:56 - 00000035 ____A C:\Windows\system32\Drivers\etc\hosts


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-296788986-4175192466-186242963-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Nutzer\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 8.8.8.8 - 8.8.4.4
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

MSCONFIG\startupfolder: C:^Users^Nutzer^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupreg: Akamai NetSession Interface => "C:\Users\Nutzer\AppData\Local\Akamai\netsession_win.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: CCleaner => "C:\Program Files\CCleaner\CCleaner64.exe" /AUTO
MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
MSCONFIG\startupreg: Dropbox Update => "C:\Users\Nutzer\AppData\Local\Dropbox\Update\DropboxUpdate.exe" /c
MSCONFIG\startupreg: Everything => "C:\Program Files (x86)\Everything\Everything.exe" -startup
MSCONFIG\startupreg: HDAudDeck => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r
MSCONFIG\startupreg: IAStorIcon => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe "C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" 60
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: NvBackend => "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
MSCONFIG\startupreg: P17RunE => RunDll32 P17RunE.dll,RunDLLEntry
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: ShadowPlay => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: USB3MON => "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
MSCONFIG\startupreg: VIAxHCUtl => C:\VIA_XHCI\usb3Monitor.exe
MSCONFIG\startupreg: ZAM => "C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe" /minimized

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [TCP Query User{6BC0E109-D928-400B-A40E-09A53DA43132}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{EBA1D084-D216-400F-9A23-81C8460DB404}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{CF1F7C3D-07EF-477C-BA73-0CD16860E913}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{EBC43232-2B3F-42A5-B9C5-E51EE4068486}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{EEBD37CC-5DE4-4C52-BC18-B34A13B3EE5E}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{642644FB-1F90-4F8E-8506-B3AB8174C9B2}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{C21FADCE-3AE6-4D92-A792-81D3BDF6059E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Age2HD\Launcher.exe
FirewallRules: [{42EA6D8F-21AB-4A0C-A90A-9EBFD6F3FBB5}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Age2HD\Launcher.exe
FirewallRules: [TCP Query User{776070BB-5115-4253-8733-AD005A54CFBC}C:\users\nutzer\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\nutzer\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{A65D5C0B-5E67-4E5F-B96F-ECDF71505E60}C:\users\nutzer\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\nutzer\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{54E19D28-791A-4427-BD76-621655765900}] => (Allow) C:\Program Files (x86)\360\Total Security\LiveUpdate360.exe
FirewallRules: [{65258C1B-72CE-451C-A83B-31C4D1CEB2A1}] => (Allow) C:\Program Files (x86)\360\Total Security\LiveUpdate360.exe
FirewallRules: [TCP Query User{13C330CE-1641-49F0-A12C-0587D21FEB8F}C:\users\nutzer\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\nutzer\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{EF01B9C6-9A00-4A9E-87D2-3429BA68D586}C:\users\nutzer\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\nutzer\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{08F54B0D-5971-41F1-A375-1100AA3C7905}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{47CBC090-B4BD-4080-9D29-2F45EDFD0733}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Unturned\Unturned.exe
FirewallRules: [{43883513-2183-427B-8C21-216B988C85BE}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Unturned\Unturned.exe
FirewallRules: [{2BCE169A-9D78-4D08-9CAA-660B2AB01633}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe
FirewallRules: [{D680BF92-5383-4D48-9112-0033286D3190}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe
FirewallRules: [{7CA858E2-4BAD-4C8F-A2ED-5663C07ADD9A}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe
FirewallRules: [{57108762-B43F-4E95-AD91-99E5B27A4C00}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe
FirewallRules: [TCP Query User{FB893E6D-85FB-461C-8F6E-631E49769AE7}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{943E76EB-1FC1-4953-9DB3-9B6B61F72001}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{7397DBC1-A7CA-49F6-8552-3E8CAAE87462}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\FINAL FANTASY VII\FF7_Launcher.exe
FirewallRules: [{C2C449D9-A9B9-42F4-B15F-E5259A7D687C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\FINAL FANTASY VII\FF7_Launcher.exe
FirewallRules: [{6E31BBD2-BEF2-4565-9BAD-59D411F5703A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Rome Total War Gold\RomeTW.exe
FirewallRules: [{6E864121-A8C8-4D3E-B89D-CECA2EC47B9F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Rome Total War Gold\RomeTW.exe
FirewallRules: [{315E36D1-E570-415D-BAE3-93CC16103FAE}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Rome Total War Gold\RomeTW-BI.exe
FirewallRules: [{82CB104C-635F-4028-84B9-71B5829039AB}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Rome Total War Gold\RomeTW-BI.exe
FirewallRules: [TCP Query User{979DA555-BA0A-429B-A63F-7A824530683D}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [UDP Query User{3261F741-4384-496F-AB13-A9893B816120}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [{BE719624-66A1-4F74-AAAB-BB878891F900}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{86AA8B36-C300-4832-A6B2-6DFDA4D557B5}] => (Allow) C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe
FirewallRules: [{0D440F3B-7037-4805-8A25-5DA1700C4D25}] => (Allow) C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe

==================== Wiederherstellungspunkte =========================

12-01-2016 23:28:05 Windows Update
13-01-2016 21:20:27 Windows Update
16-01-2016 02:42:37 Windows Update
17-01-2016 00:52:05 Windows Update
17-01-2016 11:31:09 Windows Update
18-01-2016 03:00:23 Windows Update
21-01-2016 14:07:36 Windows Update
22-01-2016 00:46:19 Windows Update
23-01-2016 02:18:58 Windows Update

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (01/23/2016 02:18:39 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: PRIVAM~1.DLL, Version: 0.0.0.0, Zeitstempel: 0x52ff3140
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000002b5ca4
ID des fehlerhaften Prozesses: 0x738
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (01/23/2016 02:18:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/23/2016 02:19:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: TrustedInstaller.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7989b
Name des fehlerhaften Moduls: wcp.dll, Version: 6.1.7601.18766, Zeitstempel: 0x54e4396d
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000001fe629
ID des fehlerhaften Prozesses: 0xdfc
Startzeit der fehlerhaften Anwendung: 0xTrustedInstaller.exe0
Pfad der fehlerhaften Anwendung: TrustedInstaller.exe1
Pfad des fehlerhaften Moduls: TrustedInstaller.exe2
Berichtskennung: TrustedInstaller.exe3

Error: (01/22/2016 11:05:42 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/22/2016 11:04:45 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcCan't create NSS process. [0]

Error: (01/22/2016 11:04:45 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed to create process. [5]

Error: (01/22/2016 11:04:26 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcNvVAD initialization failed [6]

Error: (01/22/2016 11:04:26 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed to set NvVAD endpoint as default Audio endpoint [0]

Error: (01/22/2016 11:04:26 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcNvVAD endpoint registration failed [0]

Error: (01/22/2016 12:47:15 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: TrustedInstaller.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7989b
Name des fehlerhaften Moduls: wcp.dll, Version: 6.1.7601.18766, Zeitstempel: 0x54e4396d
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000001fe629
ID des fehlerhaften Prozesses: 0x1184
Startzeit der fehlerhaften Anwendung: 0xTrustedInstaller.exe0
Pfad der fehlerhaften Anwendung: TrustedInstaller.exe1
Pfad des fehlerhaften Moduls: TrustedInstaller.exe2
Berichtskennung: TrustedInstaller.exe3


Systemfehler:
=============
Error: (01/23/2016 02:19:04 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2140993535

Error: (01/23/2016 02:19:04 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet:
%%-2140993535

Error: (01/23/2016 02:19:04 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2140993535

Error: (01/23/2016 02:19:04 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet:
%%-2140993535

Error: (01/23/2016 02:19:04 PM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: 0x80630801

Error: (01/23/2016 02:19:04 PM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: 0x80630801

Error: (01/23/2016 02:18:20 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2140993535

Error: (01/23/2016 02:18:20 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet:
%%-2140993535

Error: (01/23/2016 02:18:20 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2140993535

Error: (01/23/2016 02:18:20 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet:
%%-2140993535


CodeIntegrity:
===================================
Date: 2015-11-19 20:18:58.541
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

Date: 2015-11-19 20:18:58.511
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Speicherinformationen ===========================

Prozessor: Intel(R) Core(TM) i7-2600K CPU @ 3.40GHz
Prozentuale Nutzung des RAM: 30%
Installierter physikalischer RAM: 8152.07 MB
Verfügbarer physikalischer RAM: 5691.68 MB
Summe virtueller Speicher: 16302.34 MB
Verfügbarer virtueller Speicher: 13622.95 MB

==================== Laufwerke ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:783.43 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 571572E2)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

==================== Ende von Addition.txt ============================
siqzz
Regular Member
 
Posts: 29
Joined: January 22nd, 2016, 8:13 pm
Advertisement
Register to Remove

Re: Malware, keylogger or trojan problem

Unread postby Gary R » January 23rd, 2016, 12:06 pm

Duplicate topic
This topic is a duplicate of the original post ... viewtopic.php?f=11&t=64277 ... the original topic, will be left open.


This topic has been closed.
User avatar
Gary R
Administrator
Administrator
 
Posts: 25888
Joined: June 28th, 2005, 11:36 am
Location: Yorkshire


  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 125 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware