| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Kaspersky 2015 meldet dauernd not-a-virusWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
08.08.2015, 12:27
| #1 |
 |  Kaspersky 2015 meldet dauernd not-a-virus HalloHallo Mein Kaspersky meldet dauernd not-a-virus irgendwo aufm Laptop. Er schiebt die Dateien dann in die Quarantäne und zum Teil löscht er sie auch, desinfizieren nicht möglich. Die Logs hab ich erstellt. Kann es aber nicht mit den Code Tags einfügen da der Text ansonsten zu lange ist.  Wie soll ich sonst die Logs posten damit ihr mir helfen könnt? |
|
08.08.2015, 12:58
| #2 |
| /// Malwareteam  | Kaspersky 2015 meldet dauernd not-a-virus Ich habe dein Thema in Arbeit und melde mich so schnell als möglich mit weiteren Anweisungen. Bitte beachte, dass alle meine Antworten zuerst von einem Ausbilder freigegeben werden müssen, bevor ich diese hier posten darf. Dies garantiert, dass Du Hilfe von einem ausgebildeten Helfer bekommst. Ich bedanke mich für deine Geduld  Bitte einfach auf mehrere Posts aufteilen
__________________ |
|
08.08.2015, 19:55
| #4 |
| /// Malwareteam | Kaspersky 2015 meldet dauernd not-a-virus Post die erste Hälfte vom GMER-Log, dann die zweite. Das gleiche mit FRST. Is ja egal wenn das mehrere Posts braucht. Schreib aber bitte immer dazu, der wievielte Teil das von welchem ist. |
|
08.08.2015, 21:00
| #5 |
| | Kaspersky 2015 meldet dauernd not-a-virus okeli  Gmer Teil 1 Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-08-08 12:59:30
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 MTFDDAK2 rev.07TA 238.47GB
Running: Gmer-19357.exe; Driver: C:\Users\admin\AppData\Local\Temp\axddapow.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtClose 0000000077bbfa2c 5 bytes JMP 000000016d19ea93
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtOpenKey 0000000077bbfa74 5 bytes JMP 000000016d19f0f8
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateValueKey 0000000077bbfa8c 5 bytes JMP 000000016d19d830
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtQueryKey 0000000077bbfadc 5 bytes JMP 000000016d19d38c
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey 0000000077bbfaf4 5 bytes JMP 000000016d19d67d
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtCreateKey 0000000077bbfb8c 5 bytes JMP 000000016d19f338
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile 0000000077bbfc84 5 bytes JMP 000000016d1aa713
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateKey 0000000077bbfd98 5 bytes JMP 000000016d19d1d4
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 0000000077bbfdb0 5 bytes JMP 000000016d1a9d35
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile 0000000077bbfde4 5 bytes JMP 000000016d1aa030
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtDuplicateObject 0000000077bbfe90 5 bytes JMP 000000016d19e668
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile 0000000077bbfea8 5 bytes JMP 000000016d1a9e5e
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 0000000077bc0100 5 bytes JMP 000000016d1a9b7a
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000077bc0210 5 bytes JMP 000000016d19d9d8
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtCreateKeyTransacted 0000000077bc07a0 5 bytes JMP 000000016d19f3da
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtDeleteFile 0000000077bc0a30 5 bytes JMP 000000016d1a9d72
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtDeleteKey 0000000077bc0a48 5 bytes JMP 000000016d19cfa8
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000077bc0a90 5 bytes JMP 000000016d19db8e
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtFlushKey 0000000077bc0bcc 5 bytes JMP 000000016d19d0be
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeKey 0000000077bc0fbc 5 bytes JMP 000000016d19e01b
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeMultipleKeys 0000000077bc0fd4 5 bytes JMP 000000016d19e1b7
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyEx 0000000077bc1064 5 bytes JMP 000000016d19f185
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyTransacted 0000000077bc107c 5 bytes JMP 000000016d19f2a8
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyTransactedEx 0000000077bc1094 5 bytes JMP 000000016d19f215
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile 0000000077bc1388 5 bytes JMP 000000016d1a9f47
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtQueryMultipleValueKey 0000000077bc14c8 5 bytes JMP 000000016d19de8e
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtQuerySecurityObject 0000000077bc1574 5 bytes JMP 000000016d19e37b
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtRenameKey 0000000077bc1764 5 bytes JMP 000000016d19dd06
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationKey 0000000077bc1aa4 5 bytes JMP 000000016d19d535
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtSetSecurityObject 0000000077bc1be8 5 bytes JMP 000000016d19e4fd
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\kernel32.dll!CreateProcessW 0000000075d3103d 5 bytes JMP 000000016d183904
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\kernel32.dll!CreateProcessA 0000000075d31072 5 bytes JMP 000000016d183d68
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\kernel32.dll!CreateProcessAsUserW 0000000075d5c9b5 5 bytes JMP 000000016d183a1e
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\kernel32.dll!WinExec 0000000075db3051 5 bytes JMP 000000016d183c62
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ADVAPI32.dll!CreateProcessAsUserA 0000000076f7280a 5 bytes JMP 000000016d183f75
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!CoResumeClassObjects + 7 000000007604ea09 7 bytes JMP 000000016d1be370
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!OleRun 00000000760507de 5 bytes JMP 000000016d1bde9e
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!CoRegisterClassObject 00000000760521e1 5 bytes JMP 000000016d1c1745
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!OleUninitialize 000000007605eba1 6 bytes JMP 000000016d1bde15
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!OleInitialize 000000007605efd7 5 bytes JMP 000000016d1bddcd
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!CoGetClassObject 00000000760754ad 5 bytes JMP 000000016d1bfdbb
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!CoInitializeEx 00000000760809ad 5 bytes JMP 000000016d1bdd6d
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!CoUninitialize 00000000760886d3 5 bytes JMP 000000016d1c07cf
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076089d0b 5 bytes JMP 000000016d1c14ec
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!CoCreateInstanceEx 0000000076089d4e 5 bytes JMP 000000016d1bf3c7
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!CoSuspendClassObjects + 7 00000000760abaf9 7 bytes JMP 000000016d1bdee6
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!CoRevokeClassObject 00000000760ceabf 5 bytes JMP 000000016d1bfa7c
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!CoGetInstanceFromFile 000000007610352c 5 bytes JMP 000000016d1c08cf
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!OleRegEnumFormatEtc 000000007614d0f1 5 bytes JMP 000000016d1bde56
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\OLEAUT32.dll!RegisterActiveObject 00000000774227a6 5 bytes JMP 000000016d1c03db
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\OLEAUT32.dll!RevokeActiveObject 000000007742329c 5 bytes JMP 000000016d1bdd25
.text C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\OLEAUT32.dll!GetActiveObject 0000000077438f68 5 bytes JMP 000000016d1c056f
.text C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExW + 17 0000000077171401 2 bytes JMP 75d5b21b C:\Windows\syswow64\kernel32.dll
.text C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!EnumProcessModules + 17 0000000077171419 2 bytes JMP 75d5b346 C:\Windows\syswow64\kernel32.dll
.text C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 17 0000000077171431 2 bytes JMP 75dd8f29 C:\Windows\syswow64\kernel32.dll
.text C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 42 000000007717144a 2 bytes CALL 75d3489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!EnumDeviceDrivers + 17 00000000771714dd 2 bytes JMP 75dd8822 C:\Windows\syswow64\kernel32.dll
.text C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameA + 17 00000000771714f5 2 bytes JMP 75dd89f8 C:\Windows\syswow64\kernel32.dll
.text C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!QueryWorkingSetEx + 17 000000007717150d 2 bytes JMP 75dd8718 C:\Windows\syswow64\kernel32.dll
.text C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameW + 17 0000000077171525 2 bytes JMP 75dd8ae2 C:\Windows\syswow64\kernel32.dll
.text C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameW + 17 000000007717153d 2 bytes JMP 75d4fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!EnumProcesses + 17 0000000077171555 2 bytes JMP 75d568ef C:\Windows\syswow64\kernel32.dll
.text C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetProcessMemoryInfo + 17 000000007717156d 2 bytes JMP 75dd8fe3 C:\Windows\syswow64\kernel32.dll
.text C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetPerformanceInfo + 17 0000000077171585 2 bytes JMP 75dd8b42 C:\Windows\syswow64\kernel32.dll
.text C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!QueryWorkingSet + 17 000000007717159d 2 bytes JMP 75dd86dc C:\Windows\syswow64\kernel32.dll
.text C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameA + 17 00000000771715b5 2 bytes JMP 75d4fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExA + 17 00000000771715cd 2 bytes JMP 75d5b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 20 00000000771716b2 2 bytes JMP 75dd8ea4 C:\Windows\syswow64\kernel32.dll
.text C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 31 00000000771716bd 2 bytes JMP 75dd8671 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077171401 2 bytes JMP 75d5b21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077171419 2 bytes JMP 75d5b346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077171431 2 bytes JMP 75dd8f29 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007717144a 2 bytes CALL 75d3489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000771714dd 2 bytes JMP 75dd8822 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000771714f5 2 bytes JMP 75dd89f8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007717150d 2 bytes JMP 75dd8718 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077171525 2 bytes JMP 75dd8ae2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007717153d 2 bytes JMP 75d4fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077171555 2 bytes JMP 75d568ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007717156d 2 bytes JMP 75dd8fe3 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077171585 2 bytes JMP 75dd8b42 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007717159d 2 bytes JMP 75dd86dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000771715b5 2 bytes JMP 75d4fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000771715cd 2 bytes JMP 75d5b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000771716b2 2 bytes JMP 75dd8ea4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000771716bd 2 bytes JMP 75dd8671 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe[4972] C:\Windows\syswow64\user32.dll!UserClientDllInitialize + 779 000000007701b9f8 4 bytes [10, 3D, FB, 74]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe[4972] C:\Windows\syswow64\user32.dll!CallNextHookEx + 196 0000000077026349 5 bytes JMP 0000000174fb4ae0
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe[4972] C:\Windows\syswow64\user32.dll!RemovePropA + 92 00000000770282e0 5 bytes JMP 0000000174fb4a60
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe[4972] C:\Windows\syswow64\user32.dll!GetRawInputDeviceInfoW + 16 000000007705c1b9 5 bytes JMP 0000000174fb4790
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe[4972] C:\Windows\syswow64\user32.dll!GetRawInputDeviceInfoW + 167 000000007705c250 5 bytes JMP 0000000174fb49d0
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe[4972] C:\Windows\syswow64\user32.dll!GetRawInputDeviceInfoA + 231 00000000770769f2 5 bytes JMP 0000000174fb4700
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe[4972] C:\Windows\syswow64\user32.dll!GetRawInputDeviceInfoA + 382 0000000077076a89 5 bytes JMP 0000000174fb4940
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000779c13ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 00000000779c1544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000779c18ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 00000000779c1ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000779c1d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000779c1e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 00000000779c1f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 00000000779c2238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531 00000000779c2683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000779c26a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000779c26c2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000779c271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 00000000779c2788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 4
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000779c2b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 00000000779c2b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000779c306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 00000000779c31f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000779c388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000779c38e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000779c39b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000779c3f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 00000000779c4001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 00000000779c4075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 00000000779c41b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 00000000779c41f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609 00000000779c4461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 00000000779c464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 00000000779c4713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 00000000779c4807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 00000000779c4926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 00000000779c4a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 00000000779c4aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 00000000779c4ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 00000000779c4ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 00000000779c4fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483 00000000779c5193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 00000000779c5f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198 00000000779c6016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 00000000779c610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 00000000779c62fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 00000000779c633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 00000000779c6354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 00000000779c63ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 00000000779c6b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077a0dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077a0de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077a0de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077a0df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077a0e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077a0e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077a0e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077a0f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000750913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 000000007509146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000750916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000750919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000750919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000075091a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000779c13ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 00000000779c1544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000779c18ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 00000000779c1ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000779c1d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000779c1e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 00000000779c1f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 00000000779c2238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531 00000000779c2683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000779c26a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000779c26c2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000779c271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 00000000779c2788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 4
Code:
ATTFilter Library c:\users\admin\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzmwujs.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208](2015-08-08 10:32:17) 000000006c210000
Library C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5Core.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:24) 000000006bab0000
Library C:\Users\admin\AppData\Roaming\Dropbox\bin\icuin55.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (ICU I18N DLL/The ICU Project)(2015-07-31 13:08:55) 000000004a900000
Library C:\Users\admin\AppData\Roaming\Dropbox\bin\icuuc55.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (ICU Common DLL/The ICU Project)(2015-07-31 13:08:55) 0000000006be0000
Library C:\Users\admin\AppData\Roaming\Dropbox\bin\icudt55.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (ICU Data DLL/The ICU Project)(2015-07-31 13:08:55) 000000006a1f0000
Code:
ATTFilter Library C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5Widgets.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:28) 0000000069d30000
Library C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5Gui.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 00000000698f0000
Library C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5Network.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 0000000069750000
Library C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5WebKit.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 0000000068730000
Library C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5Quick.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 00000000684e0000
Library C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5Qml.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 0000000068270000
Library C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5WebChannel.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-07-31 13:08:55) 0000000068250000
Library C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5Sql.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 0000000068220000
Library C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5WebKitWidgets.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:28) 00000000681e0000
Library C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5PrintSupport.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 0000000068190000
Library C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5OpenGL.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 0000000068140000
Library C:\Users\admin\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:30) 0000000068050000
Library C:\Users\admin\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:30) 0000000067890000
Library C:\Users\admin\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208](2015-03-04 21:45:30) 0000000067060000
Library C:\Users\admin\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208](2015-03-04 21:45:30) 0000000066e60000
Library C:\Users\admin\AppData\Roaming\Dropbox\bin\QtQuick\Layouts\qquicklayoutsplugin.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208](2015-07-31 13:08:56) 0000000066e40000
Library C:\Users\admin\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208](2015-03-04 21:45:30) 0000000066e30000
---- EOF - GMER 2.1 ----
Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:08-08-2015
durchgeführt von admin (Administrator) auf PHOENIX (08-08-2015 12:51:27)
Gestartet von C:\Users\admin\Downloads
Geladene Profile: admin (Verfügbare Profile: admin)
Platform: Windows 7 Professional Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Opera)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe
(Hewlett-Packard Company) C:\Program Files (x86)\HP\Common\HPSupportSolutionsFrameworkService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP ENVY 5640 series\Bin\ScanToPCActivationApp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE
(Dropbox, Inc.) C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe
(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP ENVY 5640 series\Bin\HPNetworkCommunicatorCom.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera_crashreporter.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
==================== Registry (Nicht auf der Ausnahmeliste) ==================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1664000 2012-11-12] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2812656 2014-01-24] (Synaptics Incorporated)
HKLM-x32\...\Run: [QLBController] => C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe [336672 2014-02-10] (Hewlett-Packard Company)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-29] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292088 2013-02-22] (Intel Corporation)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7063832 2014-11-21] (Piriform Ltd)
HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\...\Run: [HP ENVY 5640 series (NET)] => C:\Program Files\HP\HP ENVY 5640 series\Bin\ScanToPCActivationApp.exe [3483656 2014-08-22] (Hewlett-Packard Development Company, LP)
HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\...\Run: [Dropbox Update] => C:\Users\admin\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-19] (Dropbox, Inc.)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-05-13] (Microsoft Corporation)
Startup: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2014-08-17]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-10-10]
ShortcutTarget: Dropbox.lnk -> C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk [2015-07-04]
ShortcutTarget: phase-6 Reminder.lnk -> C:\Users\admin\AppData\Local\phase-6\phase-6-compendio\reminder\reminder.exe (phase-6)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-24] (Dropbox, Inc.)
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}
HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=dspp&ts=1417814128&from=cvs&uid=MTFDDAK256MAM&q={searchTerms}
HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249
HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249
HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=dspp&ts=1417814128&from=cvs&uid=MTFDDAK256MAM&q={searchTerms}
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://Lasaoren.com/results.php?f=4&q={searchTerms}&a=lrn_secureddownload_14_45_ff&cd=2XzuyEtN2Y1L1QzuzzyEtA0AyE0BtDtBzy0E0B0DtCtByD0DtN0D0Tzu0StCtDyEyEtN1L2XzutAtFyCtFtCtFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyB0AyDtCyDtByD0AtGyBzy0C0AtGtDzyyByDtGtAyC0ByCtGtDyD0B0DtB0CyBzz0AyC0C0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0DyEtAtAtAyB0AtDtG0AyE0EyCtGyE0EyD0CtGzz0DyD0BtGtAyDyEtD0CzytByDyD0D0E0C2Q&cr=814032143&ir=
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000 -> {A25AC313-DD19-4238-ACA2-401D6BEE4321} URL = hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-06-09] (Microsoft Corporation)
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-25] (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-06-09] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-06-16] (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: LuckyTab Class -> {51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F} -> C:\Program Files (x86)\MiuiTab\SupTab.dll [2015-06-16] (Thinknice Co. Limited)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-25] (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-07-04] (Oracle Corporation)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-06-09] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-07-04] (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
Toolbar: HKLM - Perfect PDF 8 - {FE6BE06B-7324-4D38-AD78-79507F307D7D} - C:\Program Files (x86)\soft Xpansion\Perfect PDF 8\ieagent64.dll [2014-12-14] (soft Xpansion)
Toolbar: HKLM-x32 - Perfect PDF 8 - {FE6BE06B-7324-4D38-AD78-79507F307D7D} - C:\Program Files (x86)\soft Xpansion\Perfect PDF 8\ieagent32.dll [2014-12-14] (soft Xpansion)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{AE055004-6C80-4B3B-9C81-902050B152BE}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{F059243C-D0C1-44EE-AE24-7E9B8859776A}: [DhcpNameServer] 192.168.1.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
|
|
08.08.2015, 21:01
| #6 |
| | Kaspersky 2015 meldet dauernd not-a-virus Frst Teil 2 Code:
ATTFilter FireFox:
========
FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default
FF NewTab: hxxp://www.delta-homes.com/newtab/?type=nt&ts=1434713643&z=24f644d9902c60e32aeef35g1z3c4z7m0g7caqdzbz&from=ient06192&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249
FF DefaultSearchEngine: delta-homes
FF SelectedSearchEngine: delta-homes
FF Homepage: hxxp://www.delta-homes.com/?type=hp&ts=1434713643&z=24f644d9902c60e32aeef35g1z3c4z7m0g7caqdzbz&from=ient06192&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-10] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-01-31] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-10] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-07-04] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-07-04] (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-10-25] ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-10-25] ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-10-25] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-08-16] (Microsoft Corporation)
FF Plugin-x32: @soft-xpansion/npsxpdf -> C:\Program Files (x86)\Common Files\soft Xpansion\np-sxpdf.dll [2014-12-14] (soft-Xpansion)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1824315975-2186341827-1397389162-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2015-08-08] ()
FF user.js: detected! => C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\user.js [2015-07-04]
FF SearchPlugin: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\searchplugins\delta-homes.xml [2015-06-19]
FF SearchPlugin: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\searchplugins\Lasaoren.xml [2014-11-10]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\webssearches.xml [2014-12-05]
FF Extension: Fast Start - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\faststartff@gmail.com [2014-12-05]
FF Extension: QuickSearch - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\quick_searchff@gmail.com [2015-06-07]
FF Extension: Search Enginer - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\searchengine@gmail.com [2015-04-07]
FF Extension: Search Enginer - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\sweetsearch@gmail.com [2015-06-19]
FF Extension: Mozilla Firefox Hotfixer - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\veggy@veggyAddon.com [2015-06-07]
FF Extension: Elegant Advisor - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\{20fec063-c59d-0c63-9ae8-03180eee7f1e} [2015-06-07]
FF Extension: My Swisscom Assistant - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\{} [2015-02-10]
FF Extension: Express Find - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\{7ab3cbb3-34f1-440b-b048-404cfae819c0}.xpi [2015-04-11]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [{067A541B-C896-42F1-92EA-79C69EF90ED5}] - C:\ProgramData\soft Xpansion\Perfect PDF 8\Data\fftb
FF Extension: Perfect PDF 8 - C:\ProgramData\soft Xpansion\Perfect PDF 8\Data\fftb [2014-12-14]
FF HKLM-x32\...\Firefox\Extensions: [searchengine@gmail.com] - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\searchengine@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [istart_ffnt@gmail.com] - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\istart_ffnt@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [sweetsearch@gmail.com] - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com
FF HKLM-x32\...\Thunderbird\Extensions: [{067A541B-C896-42F1-92EA-79C69EF90ED5}] - C:\ProgramData\soft Xpansion\Perfect PDF 8\Data\fftb
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2015-08-02] (BitRaider, LLC)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2753720 2015-07-01] (Microsoft Corporation)
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe [683296 2014-02-10] (Hewlett-Packard Company)
R3 hpqwmiex; C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe [1006424 2013-01-23] (Hewlett-Packard Company) [Datei ist nicht signiert]
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89840 2015-03-28] (Hewlett-Packard Company)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2013-10-11] ()
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [327680 2012-11-12] (IDT, Inc.) [Datei ist nicht signiert]
S3 SXDS10; C:\Program Files (x86)\Common Files\soft Xpansion\sxds10.exe [234096 2014-12-14] (soft Xpansion)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3671792 2013-10-11] (Intel® Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [141320 2014-10-25] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [793800 2014-10-25] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1866080 2012-11-28] ()
U3 Winsock; kein ImagePath
S3 BRDriver64_1_3_3_E02B25FC; \??\C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-08-08 12:51 - 2015-08-08 12:51 - 00030204 _____ C:\Users\admin\Downloads\FRST.txt
2015-08-08 12:51 - 2015-08-08 12:51 - 00000000 ____D C:\FRST
2015-08-08 12:50 - 2015-08-08 12:51 - 02169856 _____ (Farbar) C:\Users\admin\Downloads\FRST64.exe
2015-08-08 12:49 - 2015-08-08 12:49 - 00000472 _____ C:\Users\admin\Downloads\defogger_disable.log
2015-08-08 12:49 - 2015-08-08 12:49 - 00000000 _____ C:\Users\admin\defogger_reenable
2015-08-08 12:48 - 2015-08-08 12:48 - 00050477 _____ C:\Users\admin\Downloads\Defogger.exe
2015-08-08 12:32 - 2015-08-08 12:32 - 00000056 _____ C:\Windows\setupact.log
2015-08-08 12:32 - 2015-08-08 12:32 - 00000000 _____ C:\Windows\setuperr.log
2015-08-08 01:11 - 2015-08-08 01:11 - 00000000 ____D C:\Users\admin\AppData\Local\Ubisoft Game Launcher
2015-08-08 00:52 - 2015-08-08 00:52 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2015-08-08 00:52 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2015-08-08 00:52 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2015-08-08 00:52 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2015-08-08 00:52 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2015-08-08 00:52 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2015-08-08 00:52 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll
2015-08-08 00:52 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2015-08-08 00:52 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2015-08-08 00:52 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2015-08-08 00:52 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2015-08-08 00:52 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2015-08-08 00:52 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2015-08-02 19:52 - 2015-08-02 19:52 - 00010214 _____ C:\Users\admin\Documents\Uninstall STAR WARS The Old Republic.log
2015-08-02 19:45 - 2015-08-02 19:45 - 00000000 ____D C:\Users\Public\Documents\BitRaider
2015-08-02 19:45 - 2015-08-02 19:45 - 00000000 ____D C:\ProgramData\BitRaider
2015-08-02 19:44 - 2015-08-02 19:44 - 00000000 ____D C:\Users\admin\AppData\Local\SWTORPerf
2015-08-02 19:40 - 2015-08-02 19:40 - 00000000 ____D C:\Program Files (x86)\Electronic Arts
2015-08-02 19:37 - 2015-08-02 19:40 - 00017478 _____ C:\Users\admin\Documents\Install STAR WARS The Old Republic.log
2015-08-02 19:36 - 2015-08-02 19:37 - 29720272 _____ C:\Users\admin\Downloads\SWTOR_setup.exe
2015-08-01 02:21 - 2015-08-08 01:10 - 00000000 ____D C:\ProgramData\Solidshield
2015-07-31 18:34 - 2009-03-16 14:18 - 00521560 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll
2015-07-31 18:34 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2015-07-31 18:34 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2015-07-31 18:34 - 2009-03-16 14:18 - 00174936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll
2015-07-31 18:34 - 2009-03-16 14:18 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll
2015-07-31 18:34 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 05425496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 02430312 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_41.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 01846632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_41.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 00520544 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_41.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2015-07-31 18:34 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2015-07-31 18:34 - 2008-07-10 11:00 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2015-07-31 18:34 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2015-07-31 18:34 - 2008-07-10 11:00 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2015-07-31 18:34 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2015-07-31 18:34 - 2008-07-10 11:00 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2015-07-31 18:34 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll
2015-07-31 18:34 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2015-07-31 18:34 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2015-07-31 18:34 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll
2015-07-31 18:34 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll
2015-07-31 18:34 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2015-07-31 18:34 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2015-07-31 18:34 - 2008-05-30 14:16 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 04991496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 01941528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2015-07-31 18:34 - 2008-03-05 16:04 - 00489480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll
2015-07-31 18:34 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll
2015-07-31 18:34 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2015-07-31 18:34 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll
2015-07-31 18:34 - 2008-03-05 16:00 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll
2015-07-31 18:34 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll
2015-07-31 18:34 - 2008-03-05 15:56 - 04910088 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll
2015-07-31 18:34 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2015-07-31 18:34 - 2008-03-05 15:56 - 01860120 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll
2015-07-31 18:34 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll
2015-07-31 18:34 - 2008-02-05 23:07 - 00529424 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll
2015-07-31 18:34 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll
2015-07-31 18:34 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll
2015-07-31 18:34 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2015-07-31 18:34 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll
2015-07-31 18:34 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
2015-07-31 18:34 - 2007-10-12 15:14 - 05081608 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_36.dll
2015-07-31 18:34 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
2015-07-31 18:34 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll
2015-07-31 18:34 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
2015-07-31 18:34 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll
2015-07-31 18:34 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
2015-07-31 18:34 - 2007-07-20 00:57 - 00411496 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_9.dll
2015-07-31 18:34 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 01985904 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_35.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_35.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2015-07-31 18:34 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2015-07-31 18:34 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2015-07-31 18:34 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2015-07-31 18:34 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2015-07-31 18:34 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2015-07-31 18:34 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2015-07-31 18:34 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll
2015-07-31 18:34 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2015-07-31 18:34 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2015-07-31 18:34 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2015-07-31 18:34 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll
2015-07-31 18:34 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2015-07-31 18:34 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2015-07-31 18:34 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2015-07-31 18:34 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2015-07-31 18:34 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2015-07-31 18:34 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2015-07-31 18:34 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2015-07-31 18:34 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2015-07-31 18:34 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2015-07-31 18:34 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll
2015-07-31 18:34 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2015-07-31 18:34 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2015-07-31 18:34 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2015-07-31 18:34 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2015-07-31 18:34 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
2015-07-31 18:34 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2015-07-31 18:34 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2015-07-31 18:34 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2015-07-31 18:34 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2015-07-31 18:34 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2015-07-31 18:34 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2015-07-31 18:34 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2015-07-31 18:34 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
2015-07-31 18:34 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2015-07-31 18:34 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2015-07-31 18:34 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2015-07-31 18:34 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2015-07-31 18:34 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2015-07-31 18:34 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2015-07-31 18:34 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2015-07-31 18:34 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2015-07-31 18:34 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2015-07-31 18:34 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2015-07-31 18:34 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2015-07-31 18:34 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2015-07-31 18:34 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2015-07-31 18:34 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2015-07-31 18:34 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2015-07-31 18:34 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2015-07-31 18:34 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2015-07-31 18:34 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2015-07-31 18:34 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2015-07-31 18:34 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2015-07-31 15:08 - 2015-07-31 15:08 - 00000000 ____D C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-07-29 10:55 - 2015-07-25 20:07 - 00017856 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-07-29 10:55 - 2015-07-25 20:04 - 00765440 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-07-29 10:55 - 2015-07-25 20:04 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-07-29 10:55 - 2015-07-25 20:03 - 01085440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-07-29 10:55 - 2015-07-25 20:03 - 00433664 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-07-29 10:55 - 2015-07-25 20:03 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-07-29 10:55 - 2015-07-25 20:03 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-07-29 10:55 - 2015-07-25 19:55 - 01145856 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-07-26 13:39 - 2015-05-09 20:26 - 00493504 _____ (Microsoft Corporation) C:\Windows\system32\mcupdate_GenuineIntel.dll
2015-07-26 13:39 - 2015-03-14 05:21 - 01632768 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-07-26 13:39 - 2015-03-14 05:21 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2015-07-26 13:39 - 2015-03-14 05:04 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-07-26 13:39 - 2015-03-14 05:04 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2015-07-24 18:53 - 2015-07-24 18:53 - 05439072 _____ (TeamViewer) C:\Users\admin\Downloads\TeamViewerQS_de.exe
2015-07-24 18:53 - 2015-07-24 18:53 - 00000000 ____D C:\Users\admin\AppData\Roaming\TeamViewer
2015-07-23 23:41 - 2015-06-02 02:07 - 00254976 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll
2015-07-23 23:41 - 2015-06-02 01:47 - 00210432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cewmdm.dll
2015-07-23 23:40 - 2015-07-15 05:19 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-07-23 23:40 - 2015-07-15 05:19 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-07-23 23:40 - 2015-07-15 05:19 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-07-23 23:40 - 2015-07-15 05:19 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-07-23 23:40 - 2015-07-15 04:55 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-07-23 23:40 - 2015-07-15 04:55 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-07-23 23:40 - 2015-07-15 04:55 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-07-23 23:40 - 2015-07-15 04:54 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-07-23 23:40 - 2015-07-15 03:59 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-07-23 23:40 - 2015-07-15 03:52 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-07-23 23:40 - 2015-07-09 19:58 - 03154944 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-07-23 23:40 - 2015-07-09 19:58 - 02603008 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-07-23 23:40 - 2015-07-09 19:58 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-07-23 23:40 - 2015-07-09 19:58 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-07-23 23:40 - 2015-07-09 19:58 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-07-23 23:40 - 2015-07-09 19:58 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-07-23 23:40 - 2015-07-09 19:58 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-07-23 23:40 - 2015-07-09 19:58 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-07-23 23:40 - 2015-07-09 19:58 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-07-23 23:40 - 2015-07-09 19:58 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-07-23 23:40 - 2015-07-09 19:58 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-07-23 23:40 - 2015-07-09 19:43 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-07-23 23:40 - 2015-07-09 19:43 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-07-23 23:40 - 2015-07-09 19:43 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-07-23 23:40 - 2015-07-09 19:43 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-07-23 23:40 - 2015-07-09 19:42 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-07-23 23:39 - 2015-06-09 20:03 - 03180544 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-07-23 23:39 - 2015-06-09 20:03 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-07-23 23:38 - 2015-06-25 10:57 - 03207168 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-07-23 23:38 - 2015-06-17 19:47 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-23 23:38 - 2015-06-17 19:37 - 00312320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-07-23 23:37 - 2015-07-02 23:21 - 19877376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-07-23 23:37 - 2015-07-02 23:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-07-23 23:37 - 2015-07-02 22:50 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-07-23 23:37 - 2015-07-02 22:49 - 25193984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-07-23 23:37 - 2015-07-02 22:46 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-07-23 23:37 - 2015-07-02 22:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-07-23 23:37 - 2015-07-02 22:23 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-07-23 23:37 - 2015-07-02 22:19 - 12855296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-07-23 23:37 - 2015-07-02 22:12 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-07-23 23:37 - 2015-07-02 21:55 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-07-23 23:37 - 2015-07-02 21:20 - 14453248 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-07-23 23:37 - 2015-07-02 20:59 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-07-23 23:37 - 2015-06-27 04:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-07-23 23:37 - 2015-06-27 04:43 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-07-23 23:37 - 2015-06-27 03:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-07-23 23:37 - 2015-06-27 03:39 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-07-23 23:35 - 2015-06-25 20:09 - 00389832 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-07-23 23:35 - 2015-06-25 19:43 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-07-23 23:35 - 2015-06-20 22:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-07-23 23:35 - 2015-06-20 21:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-07-23 23:35 - 2015-06-20 21:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-07-23 23:35 - 2015-06-20 21:49 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-07-23 23:35 - 2015-06-20 21:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-07-23 23:35 - 2015-06-20 21:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-07-23 23:35 - 2015-06-20 21:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-07-23 23:35 - 2015-06-20 21:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-07-23 23:35 - 2015-06-20 21:34 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-07-23 23:35 - 2015-06-20 21:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-07-23 23:35 - 2015-06-20 21:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-07-23 23:35 - 2015-06-20 21:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-07-23 23:35 - 2015-06-20 21:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-07-23 23:35 - 2015-06-20 21:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-07-23 23:35 - 2015-06-20 21:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-07-23 23:35 - 2015-06-20 21:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-07-23 23:35 - 2015-06-20 21:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-07-23 23:35 - 2015-06-20 20:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-07-23 23:35 - 2015-06-20 20:48 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-07-23 23:35 - 2015-06-20 20:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-07-23 23:35 - 2015-06-20 20:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-07-23 23:35 - 2015-06-20 20:26 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-07-23 23:35 - 2015-06-20 20:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-07-23 23:35 - 2015-06-19 20:25 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-07-23 23:35 - 2015-06-19 20:25 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-07-23 23:35 - 2015-06-19 20:24 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-07-23 23:35 - 2015-06-19 20:24 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-07-23 23:35 - 2015-06-19 20:23 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-07-23 23:35 - 2015-06-19 20:17 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-07-23 23:35 - 2015-06-19 20:16 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-07-23 23:35 - 2015-06-19 20:13 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-07-23 23:35 - 2015-06-19 20:13 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-07-23 23:35 - 2015-06-19 20:03 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-07-23 23:35 - 2015-06-19 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-07-23 23:35 - 2015-06-19 19:53 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-07-23 23:35 - 2015-06-19 19:52 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-07-23 23:35 - 2015-06-19 19:51 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-07-23 23:35 - 2015-06-19 19:40 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-07-23 23:35 - 2015-06-19 19:40 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-07-23 23:35 - 2015-06-19 19:39 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-07-23 23:35 - 2015-06-19 19:15 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-07-23 23:35 - 2015-06-19 19:11 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-07-23 23:33 - 2015-06-11 19:57 - 06131200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-07-23 23:33 - 2015-06-11 19:57 - 00856064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2015-07-23 23:33 - 2015-06-11 19:57 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2015-07-23 23:33 - 2015-06-11 19:56 - 07077376 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-07-23 23:33 - 2015-06-11 19:56 - 01057792 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2015-07-23 23:33 - 2015-06-11 19:56 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2015-07-23 23:33 - 2015-06-11 15:15 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2015-07-23 23:32 - 2015-07-04 20:07 - 02087424 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-23 23:32 - 2015-07-04 19:48 - 01414656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-07-23 23:32 - 2015-04-27 21:23 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-07-23 23:32 - 2015-04-27 21:23 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-07-23 23:32 - 2015-04-27 21:23 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-07-23 23:32 - 2015-04-27 21:23 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-07-23 23:32 - 2015-04-27 21:05 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-07-23 23:32 - 2015-04-27 21:04 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-07-23 23:32 - 2015-04-27 21:04 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-07-23 23:32 - 2015-04-27 21:04 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-07-23 23:31 - 2015-07-01 22:56 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-07-23 23:31 - 2015-07-01 22:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-07-23 23:31 - 2015-07-01 22:49 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-07-23 23:31 - 2015-07-01 22:49 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-07-23 23:31 - 2015-07-01 22:49 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-23 23:31 - 2015-07-01 22:49 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-07-23 23:31 - 2015-07-01 22:49 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-07-23 23:31 - 2015-07-01 22:49 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-07-23 23:31 - 2015-07-01 22:49 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-07-23 23:31 - 2015-07-01 22:49 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-07-23 23:31 - 2015-07-01 22:49 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-07-23 23:31 - 2015-07-01 22:49 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-07-23 23:31 - 2015-07-01 22:49 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-07-23 23:31 - 2015-07-01 22:48 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-07-23 23:31 - 2015-07-01 22:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-07-23 23:31 - 2015-07-01 22:47 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-07-23 23:31 - 2015-07-01 22:47 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-07-23 23:31 - 2015-07-01 22:43 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-07-23 23:31 - 2015-07-01 22:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-07-23 23:31 - 2015-07-01 22:39 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-07-23 23:31 - 2015-07-01 22:30 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-07-23 23:31 - 2015-07-01 22:30 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-07-23 23:31 - 2015-07-01 22:30 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-07-23 23:31 - 2015-07-01 22:30 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-07-23 23:31 - 2015-07-01 22:30 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-07-23 23:31 - 2015-07-01 22:30 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-07-23 23:31 - 2015-07-01 22:30 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-07-23 23:31 - 2015-07-01 22:30 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-07-23 23:31 - 2015-07-01 22:30 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-07-23 23:31 - 2015-07-01 22:29 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-07-23 23:31 - 2015-07-01 22:29 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-07-23 23:31 - 2015-07-01 22:29 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-07-23 23:31 - 2015-07-01 22:27 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-07-23 23:31 - 2015-07-01 22:26 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-07-23 23:31 - 2015-07-01 22:24 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-07-23 23:31 - 2015-07-01 21:27 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-07-23 23:31 - 2015-07-01 21:26 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-07-23 23:31 - 2015-07-01 21:26 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-07-23 23:31 - 2015-06-15 23:50 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-07-23 23:31 - 2015-06-15 23:45 - 03242496 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-23 23:31 - 2015-06-15 23:45 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-07-23 23:31 - 2015-06-15 23:45 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2015-07-23 23:31 - 2015-06-15 23:45 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-07-23 23:31 - 2015-06-15 23:44 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-23 23:31 - 2015-06-15 23:43 - 02364416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-07-23 23:31 - 2015-06-15 23:43 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-07-23 23:31 - 2015-06-15 23:43 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2015-07-23 23:31 - 2015-06-15 23:42 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-07-23 23:31 - 2015-06-15 23:42 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2015-07-23 23:31 - 2015-06-15 23:37 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2015-07-11 20:49 - 2015-07-11 20:49 - 00000000 ____D C:\Users\admin\Desktop\CD's für Auto
2015-07-10 19:29 - 2015-07-29 11:39 - 00000000 ___HD C:\$Windows.~BT
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-08-08 12:49 - 2013-12-05 22:18 - 00000000 ____D C:\Users\admin
2015-08-08 12:47 - 2009-07-14 06:45 - 00026528 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-08-08 12:47 - 2009-07-14 06:45 - 00026528 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-08-08 12:38 - 2015-06-19 13:33 - 00000000 ____D C:\Program Files (x86)\MiuiTab
2015-08-08 12:38 - 2009-07-14 19:58 - 00699342 _____ C:\Windows\system32\perfh007.dat
2015-08-08 12:38 - 2009-07-14 19:58 - 00149450 _____ C:\Windows\system32\perfc007.dat
2015-08-08 12:38 - 2009-07-14 07:13 - 01619284 _____ C:\Windows\system32\PerfStringBackup.INI
2015-08-08 12:36 - 2015-01-14 20:35 - 01124122 _____ C:\Windows\WindowsUpdate.log
2015-08-08 12:32 - 2015-06-19 13:34 - 00000000 ____D C:\Users\admin\AppData\Everything
2015-08-08 12:32 - 2014-10-25 17:14 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2015-08-08 12:32 - 2014-10-10 15:37 - 00000000 ___RD C:\Users\admin\Dropbox
2015-08-08 12:32 - 2014-10-10 15:35 - 00000000 ____D C:\Users\admin\AppData\Roaming\Dropbox
2015-08-08 12:32 - 2014-08-14 14:20 - 00000435 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2015-08-08 12:32 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-08-08 12:13 - 2015-06-19 22:52 - 00001224 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000UA.job
2015-08-08 01:16 - 2014-05-13 19:21 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-08-08 01:16 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-08-08 00:35 - 2015-02-14 22:56 - 00003850 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1423947365
2015-08-08 00:35 - 2015-02-14 22:55 - 00000000 ____D C:\Program Files (x86)\Opera
2015-08-03 03:59 - 2015-06-19 22:52 - 00001172 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000Core.job
2015-08-02 19:40 - 2014-12-05 23:16 - 00000000 _____ C:\END
2015-08-01 15:53 - 2015-07-04 13:46 - 00000000 ____D C:\Users\admin\.phase-6
2015-08-01 15:07 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-07-31 15:13 - 2015-04-13 12:37 - 00000000 ___SD C:\Windows\system32\GWX
2015-07-29 11:30 - 2013-12-05 22:07 - 00000000 ____D C:\Windows\Panther
2015-07-29 11:00 - 2015-04-13 12:37 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-07-29 11:00 - 2014-05-13 21:48 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-07-27 07:26 - 2009-07-14 06:45 - 00499752 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-27 07:25 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-07-26 13:44 - 2014-05-13 21:39 - 01593564 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2015-07-26 13:43 - 2014-05-13 19:48 - 00000000 ____D C:\Windows\system32\MRT
2015-07-26 13:31 - 2014-12-11 13:59 - 00000000 ____D C:\Windows\system32\appraiser
2015-07-25 13:25 - 2014-08-16 21:49 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-07-25 13:22 - 2015-01-19 12:32 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-07-24 14:14 - 2015-05-12 14:56 - 00000000 ____D C:\Users\admin\Documents\TAMY
2015-07-23 23:08 - 2015-06-19 22:52 - 00004194 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000UA
2015-07-23 23:08 - 2015-06-19 22:52 - 00003798 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000Core
2015-07-23 23:06 - 2014-08-16 21:14 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-07-12 00:05 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-07-09 22:25 - 2015-05-12 14:56 - 00000000 ____D C:\Users\admin\Documents\SANDRO
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2015-04-24 12:11 - 2015-04-24 12:11 - 0001099 _____ () C:\Users\admin\AppData\Roaming\ShiftN.ini
2015-02-13 17:54 - 2015-02-13 17:54 - 0000057 _____ () C:\ProgramData\Ament.ini
Einige Dateien in TEMP:
====================
C:\Users\admin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzmwujs.dll
==================== Bamital & volsnap Check =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2015-08-02 18:46
==================== Ende von log ============================
|
|
08.08.2015, 21:40
| #7 |
| /// Malwareteam | Kaspersky 2015 meldet dauernd not-a-virus Und die Addition.txt? |
|
09.08.2015, 13:51
| #8 |
| | Kaspersky 2015 meldet dauernd not-a-virus ou, vor lauter aufteilung total vergessen  Addition Teil 1 Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:08-08-2015
durchgeführt von admin (2015-08-08 12:51:58)
Gestartet von C:\Users\admin\Downloads
Start-Modus: Normal
==========================================================
==================== Konten: =============================
admin (S-1-5-21-1824315975-2186341827-1397389162-1000 - Administrator - Enabled) => C:\Users\admin
Administrator (S-1-5-21-1824315975-2186341827-1397389162-500 - Administrator - Disabled)
Gast (S-1-5-21-1824315975-2186341827-1397389162-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1824315975-2186341827-1397389162-1016 - Limited - Enabled)
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 17 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 17.0.0.134 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.12) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)
ANNO 1503 GOLD (HKLM-x32\...\{DB833EF9-A198-49BE-970A-BD46F30BFBB4}) (Version: 1.05.00 - )
BitRaider Streaming Client (HKLM-x32\...\BitRaider Streaming Client) (Version: 1.3.3.4098 - BitRaider, LLC)
CCleaner (HKLM\...\CCleaner) (Version: 5.00 - Piriform)
Dropbox (HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\...\Dropbox) (Version: 3.8.5 - Dropbox, Inc.)
eFisc2014 (HKLM-x32\...\{A2A7EAA2-1EFE-450D-A5E2-64BAE3D9C939}) (Version: 1.2.2 - Abraxas Informatik AG)
Free YouTube to MP3 Converter version 3.12.57.324 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.57.324 - DVDVideoSoft Ltd.)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
HP ENVY 5640 series - Grundlegende Software für das Gerät (HKLM\...\{8ED07F8D-A230-4DB7-B0A0-A67336FD7797}) (Version: 34.2.117.50647 - Hewlett-Packard Co.)
HP ENVY 5640 series Hilfe (HKLM-x32\...\{FE81C6FB-7A42-4ADE-A50A-2E44D6B7BD24}) (Version: 34.0.0 - Hewlett Packard)
HP HD Webcam Driver (HKLM-x32\...\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 6.0.1112.2_WHQL - Sonix)
HP Hotkey Support (HKLM-x32\...\{53C48A27-4079-49EB-8E73-76BA85D2BF6F}) (Version: 5.0.24.1 - Hewlett-Packard Company)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)
HP Support Solutions Framework (HKLM-x32\...\{FC3C2B77-6800-48C6-A15D-9D1031130C16}) (Version: 11.51.0049 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6435.0 - IDT)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 17.3 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2867 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.8.251 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{105fa5c4-72e1-41f2-a82c-884d8aa4b381}) (Version: 16.6.0 - Intel Corporation)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.0.463 - Kaspersky Lab) Hidden
MAGIX Foto & Grafik Designer 10 (HKLM-x32\...\MX.{ACC8C3C2-A29D-4287-85FB-230EDDA84488}) (Version: 10.1.1.34941 - MAGIX Software GmbH)
MAGIX Foto & Grafik Designer 10 (Version: 10.1.1.34941 - MAGIX Software GmbH) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4737.1003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\...\OneDriveSetup.exe) (Version: 17.0.4023.1211 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 35.0.1 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
Opera Stable 31.0.1889.99 (HKLM-x32\...\Opera 31.0.1889.99) (Version: 31.0.1889.99 - Opera Software)
phase-6-compendio 2.3.5 (HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\...\phase-6-compendio) (Version: 2.3.5 - phase-6)
Photo & Graphic Designer 10 Update (Version: 10.1.4.36142 - MAGIX Software GmbH) Hidden
Photo & Graphic Designer 10 Update (Version: 10.1.6.37584 - MAGIX Software GmbH) Hidden
Picexa (HKLM-x32\...\Picexa) (Version: - Taiwan Shui Mu Chih Ching Technology Limited)
soft Xpansion Perfect PDF 8 (HKLM-x32\...\{4E42E18A-7500-4ef6-A8DC-A5994B5F1BCD}) (Version: 8.0.4.0 - soft Xpansion)
Stronghold Crusader Extreme (HKLM-x32\...\{8C3727F2-8E37-49E4-820C-03B1677F53B6}) (Version: 1.20.0000 - Firefly Studios)
Studie zur Verbesserung von HP ENVY 5640 series (HKLM\...\{CC803199-ABD7-43B6-95CE-9B4D5695CF94}) (Version: 34.2.117.50647 - Hewlett-Packard Co.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.18.17 - Synaptics Incorporated)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
Validity Fingerprint Sensor Driver (HKLM\...\{AA51ED2E-DCE7-415F-9C32-CB9B561D216D}) (Version: 4.4.228.0 - Validity Sensors, Inc.)
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\admin\AppData\Local\Microsoft\SkyDrive\17.0.4023.1211\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\admin\AppData\Local\Microsoft\SkyDrive\17.0.4023.1211\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\admin\AppData\Local\Microsoft\SkyDrive\17.0.4023.1211\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\admin\AppData\Local\Microsoft\SkyDrive\17.0.4023.1211\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\admin\AppData\Local\Microsoft\SkyDrive\17.0.4023.1211\amd64\FileSyncApi64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
==================== Wiederherstellungspunkte =========================
27-07-2015 07:08:51 Windows Update
29-07-2015 11:00:09 Windows Update
31-07-2015 18:33:40 DirectX wurde installiert
01-08-2015 12:52:35 Windows Update
08-08-2015 00:34:16 Windows Update
08-08-2015 00:50:56 DirectX wurde installiert
08-08-2015 00:52:47 Installed Ubisoft Game Launcher
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {07988186-E275-4DC6-BFB5-3AD97F0A2108} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-11-21] (Piriform Ltd)
Task: {1AB28D63-43C6-4F38-8905-75EB330B9CEE} - System32\Tasks\HPCustParticipation HP ENVY 5640 series => C:\Program Files\HP\HP ENVY 5640 series\Bin\HPCustPartic.exe [2014-08-22] (Hewlett-Packard Development Company, LP)
Task: {43AEB2F7-E9CA-406C-AE4F-7EA13A007501} - System32\Tasks\{D1B4DCDC-80CC-4483-A3C0-7C0C9D81DE0B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [2015-07-24] (Dropbox, Inc.)
Task: {49819460-E7F0-4D77-8E3B-24FA4BBDCCF7} - System32\Tasks\{D46DF4DC-16C0-4483-8489-33989792B7BB} => pcalua.exe -a "C:\Program Files (x86)\Picexa\uninstall.exe"
Task: {5B0A892F-BAAD-4CA6-8726-C67E57ADAC6E} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000Core => C:\Users\admin\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-19] (Dropbox, Inc.)
Task: {5ECD4F44-504E-4D38-A3B3-89DC793548CC} - System32\Tasks\{92967924-6A9D-44ED-8511-59B1FD4AAF62} => C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [2015-07-24] (Dropbox, Inc.)
Task: {7E7E622A-F8C9-4E92-9DD1-29A5C0F1A722} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000UA => C:\Users\admin\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-19] (Dropbox, Inc.)
Task: {905E170C-8E1A-4667-A617-2D6CF5E4C847} - System32\Tasks\Opera scheduled Autoupdate 1423947365 => C:\Program Files (x86)\Opera\launcher.exe [2015-07-30] (Opera Software)
Task: {A33FA311-F91B-4F8F-9099-27E116ED31BF} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-01] (Microsoft Corporation)
Task: {BA9181C6-BDD6-4C18-8D36-5513AB0AE252} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {BF885F03-AB02-4863-A643-11A35D01E11E} - System32\Tasks\{F9F6E89F-E106-4160-A974-653817E63E70} => C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [2015-07-24] (Dropbox, Inc.)
Task: {E78502F9-CC97-46AD-9598-9BB4EB32D2DD} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-01] (Microsoft Corporation)
Task: {F8ACBA80-9334-4330-8831-E22FB0B4AD88} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-06-09] (Microsoft Corporation)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000Core.job => C:\Users\admin\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000UA.job => C:\Users\admin\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Code:
ATTFilter =================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2014-08-16 21:14 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2013-01-17 18:25 - 2013-01-17 18:25 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-11-22 02:03 - 2014-11-22 02:03 - 00053248 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2014-03-06 15:00 - 2014-03-06 15:00 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\kpcengine.2.3.dll
2014-11-22 19:50 - 2014-11-22 19:50 - 00316576 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream32.dll
2015-08-08 12:32 - 2015-08-08 12:32 - 00071168 _____ () c:\users\admin\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzmwujs.dll
2015-03-04 23:45 - 2015-07-17 02:31 - 00012800 _____ () C:\Users\admin\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll
2015-03-04 23:45 - 2015-07-17 02:31 - 00779776 _____ () C:\Users\admin\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-07-31 15:08 - 2015-07-17 02:31 - 00056320 _____ () C:\Users\admin\AppData\Roaming\Dropbox\bin\QtQuick\Layouts\qquicklayoutsplugin.dll
2015-03-04 23:45 - 2015-07-17 02:31 - 00012288 _____ () C:\Users\admin\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll
2014-10-24 19:25 - 2014-10-24 19:25 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\1eeea3ab8d69ec722bdcb28b8eb8dd75\IsdiInterop.ni.dll
2014-05-13 19:30 - 2012-02-01 17:25 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2015-08-08 00:35 - 2015-08-08 00:35 - 58599032 _____ () C:\Program Files (x86)\Opera\31.0.1889.99\opera.dll
2015-08-08 00:35 - 2015-08-08 00:34 - 01781368 _____ () C:\Program Files (x86)\Opera\31.0.1889.99\libglesv2.dll
2015-08-08 00:35 - 2015-08-08 00:34 - 00081528 _____ () C:\Program Files (x86)\Opera\31.0.1889.99\libegl.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer trusted/restricted ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 2) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{21E1CDB8-012B-4240-9670-F0758C7CA484}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{93A9DBF0-88AA-4DAC-B07A-8594315AAF44}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{A0EBF6F0-FAB0-46E2-BEF4-A93F7E05E9B7}] => (Allow) C:\Users\admin\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{739A8CB3-D456-422B-818E-39AA45CE462C}] => (Allow) C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{0A465F55-1677-4475-A522-2903854C596F}] => (Allow) C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{9094D041-DE7F-454F-BD4D-99F9D3DDE1AC}C:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{E6427678-1205-4256-8FB2-FF80473F4DA3}C:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{E43DC60F-54AD-4903-9E04-EE30F92F22B0}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{3C95E61F-172F-48FC-B824-8C514CC72144}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{C621C19E-C58A-487B-A914-39926DA59C7C}] => (Allow) C:\Program Files\HP\HP ENVY 5640 series\Bin\DeviceSetup.exe
FirewallRules: [{E506CAFE-B0E8-40B9-8B9F-16F41CC75340}] => (Allow) LPort=5357
FirewallRules: [{F96AC161-56F6-4A24-9956-CDA9A9B7D519}] => (Allow) C:\Program Files\HP\HP ENVY 5640 series\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{AC36D2ED-378A-47B9-95EA-FF34FA014F83}] => (Allow) C:\Users\admin\Documents\SANDRO\Spiele\Stronghold\Stronghold_Crusader_Extreme.exe
FirewallRules: [{54A897D7-3774-46CC-B3F2-D2F263052965}] => (Allow) C:\Users\admin\Documents\SANDRO\Spiele\Stronghold\Stronghold Crusader.exe
FirewallRules: [{D83B0290-D5CC-40F0-A36F-1665D38D1735}] => (Allow) C:\Users\admin\Documents\SANDRO\Spiele\Stronghold\Stronghold_Crusader_Extreme.exe
FirewallRules: [{24E3D750-66F9-42DF-9AEA-316ECB0A6AEF}] => (Allow) C:\Users\admin\Documents\SANDRO\Spiele\Stronghold\Stronghold Crusader.exe
FirewallRules: [{50160966-6B6D-40BA-A393-A3ECC2649FC2}] => (Allow) C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe
FirewallRules: [{C6B8D293-40F9-4678-A647-8965C370F6D3}] => (Allow) C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe
==================== Fehlerhafte Geräte im Gerätemanager =============
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: BCM20702A0
Description: BCM20702A0
Class Guid:
Manufacturer:
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Basissystemgerät
Description: Basissystemgerät
Class Guid:
Manufacturer:
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: HP hs2350 HSPA+ MobileBroadband
Description: HP hs2350 HSPA+ MobileBroadband
Class Guid:
Manufacturer:
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (08/08/2015 12:32:20 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: Der Index kann nicht initialisiert werden.
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (08/08/2015 12:32:20 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Die Anwendung kann nicht initialisiert werden.
Kontext: Windows Anwendung
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (08/08/2015 12:32:20 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (08/08/2015 12:32:20 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Element nicht gefunden. (HRESULT : 0x80070490) (0x80070490)
Error: (08/08/2015 12:32:19 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (08/08/2015 12:32:19 PM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Die Eigenschaftenspeicherdaten können von Windows Search nicht geladen werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800) (0xc0041800)
Error: (08/08/2015 12:32:19 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (08/08/2015 12:32:19 PM) (Source: Windows Search Service) (EventID: 7040) (User: )
Description: Vom Suchdienst wurden beschädigte Datendateien im Index {id=4700} erkannt. Vom Dienst wird versucht, dieses Problem durch Neuerstellung des Indexes automatisch zu beheben.
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (08/08/2015 12:32:19 PM) (Source: Windows Search Service) (EventID: 9000) (User: )
Description: Der Jet-Eigenschaftenspeicher kann von Windows Search nicht geöffnet werden.
Details:
0x%08x (0xc0041800 - Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800))
Error: (08/08/2015 12:32:19 PM) (Source: ESENT) (EventID: 455) (User: )
Description: Windows (4524) Windows: Fehler -1811 beim Öffnen von Protokolldatei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0006F.log.
Systemfehler:
=============
Error: (08/08/2015 12:32:20 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (08/08/2015 12:32:20 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1073473535.
Error: (08/08/2015 12:32:18 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0
Error: (08/08/2015 12:32:11 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 08.08.2015 um 12:31:39 unerwartet heruntergefahren.
Error: (08/08/2015 08:19:15 AM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0
Error: (08/08/2015 12:43:37 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80240020 fehlgeschlagen: Upgrade auf Windows 10 Pro
Error: (08/03/2015 07:25:58 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80240020 fehlgeschlagen: Upgrade auf Windows 10 Pro
Error: (08/03/2015 07:23:13 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description:
Error: (08/03/2015 07:22:10 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description:
Error: (08/03/2015 10:29:27 AM) (Source: ipnathlp) (EventID: 1233) (User: )
Description:
Microsoft Office:
=========================
Error: (08/08/2015 12:32:20 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description:
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (08/08/2015 12:32:20 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Kontext: Windows Anwendung
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (08/08/2015 12:32:20 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (08/08/2015 12:32:20 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Element nicht gefunden. (HRESULT : 0x80070490) (0x80070490)
Search.TripoliIndexer
Error: (08/08/2015 12:32:19 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Search.JetPropStore
Error: (08/08/2015 12:32:19 PM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800) (0xc0041800)
Error: (08/08/2015 12:32:19 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description:
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
The catalog is corrupt
Error: (08/08/2015 12:32:19 PM) (Source: Windows Search Service) (EventID: 7040) (User: )
Description:
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
4700
Error: (08/08/2015 12:32:19 PM) (Source: Windows Search Service) (EventID: 9000) (User: )
Description:
Details:
0x%08x (0xc0041800 - Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800))
Error: (08/08/2015 12:32:19 PM) (Source: ESENT) (EventID: 455) (User: )
Description: Windows4524Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0006F.log-1811
CodeIntegrity:
===================================
Date: 2015-07-29 11:36:06.196
Description: Die Integrität der Datei "\Device\HarddiskVolume2\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_47662a2706182d6f\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.
Date: 2015-07-29 11:36:06.196
Description: Die Integrität der Datei "\Device\HarddiskVolume2\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_47662a2706182d6f\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.
Date: 2015-07-29 11:36:04.194
Description: Die Integrität der Datei "\Device\HarddiskVolume2\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_a384c5aabe759ea5\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.
Date: 2015-07-29 11:36:04.179
Description: Die Integrität der Datei "\Device\HarddiskVolume2\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_a384c5aabe759ea5\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.
Date: 2015-07-29 11:36:03.180
Description: Die Integrität der Datei "\Device\HarddiskVolume2\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.10074.1_none_f3153036f55ab3f5\werfault.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.
Date: 2015-07-29 11:36:03.180
Description: Die Integrität der Datei "\Device\HarddiskVolume2\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.10074.1_none_f3153036f55ab3f5\werfault.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.
Date: 2015-07-29 11:36:00.140
Description: Die Integrität der Datei "\Device\HarddiskVolume2\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.10074.1_none_96f694b33cfd42bf\werfault.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.
Date: 2015-07-29 11:36:00.140
Description: Die Integrität der Datei "\Device\HarddiskVolume2\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.10074.1_none_96f694b33cfd42bf\werfault.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.
Date: 2015-02-16 10:13:43.264
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-02-16 10:13:43.186
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Speicherinformationen ===========================
Processor: Intel(R) Core(TM) i7-3520M CPU @ 2.90GHz
Percentage of memory in use: 54%
Total physical RAM: 3961.51 MB
Available physical RAM: 1819.04 MB
Total Virtual: 7921.22 MB
Available Virtual: 5493.05 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:238.37 GB) (Free:176.17 GB) NTFS
Drive d: (1503GOLD_DVD) (CDROM) (Total:1.15 GB) (Free:0 GB) CDFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: 00089B90)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=238.4 GB) - (Type=07 NTFS)
==================== Ende von log ============================
|
|
09.08.2015, 13:52
| #9 |
| | Kaspersky 2015 meldet dauernd not-a-virus Vom Kaspersky hätte ich da noch n'Systembericht Code:
ATTFilter <?xml version="1.0" encoding="WINDOWS-1251"?>
-<AVZ CompHash="4709EDDDBB9AD8E30C760BAE92C4680E" MainDBDate="30.12.1899 00:00:00" IsSRDisabled="False" Base64Mode="False" IsAdmin="True" IsWow64="True" Domain="WORKGROUP" Session="" ProfileDir="C:\Windows\system32\config\systemprofile" OS_CSDV="Service Pack 1" BootMode="0" OS_ProductName="Windows 7 Professional" OS_Build="7601" OS_MiVer="1" OS_MjVer="6" WinDir="C:\Windows\" LogDate="08.08.2015 13:06:43" Version="4.43">
-<PROCESS>
<ITEM IsPE="1" Ver="1.0.12.0" OFN="HPSupportSolutionsFrameworkService.exe" Product="SolutionsFrameworkService" Vendor="Hewlett-Packard Company" MD5="1878A79551F2EDAE7EBD110AAE6D33AD" ChangeDate="28.03.2015 12:58:42" CreateDate="28.03.2015 12:58:42" Attr="rsAh" Size="89840" CmdLine=""C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe"" Hidden="0" LegalCopyright="Copyright © Hewlett-Packard Company 2013" Descr="SolutionsFrameworkService" CheckResult="0" File="c:\program files (x86)\hp\common\hpsupportsolutionsframeworkservice.exe" PID="2004"/>
<ITEM IsPE="1" Ver="11.1.0.1006" OFN="IAStorDataMgrSvc.exe" Product="IAStorDataSvc" Vendor="Intel Corporation" MD5="7DEC78C80C628E9D36883C06C3C07E3C" ChangeDate="29.02.2012 18:06:36" CreateDate="13.05.2014 19:30:28" Attr="rsAh" Size="13592" CmdLine=""C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"" Hidden="0" LegalCopyright="Copyright © Intel Corporation 2009-2012" Descr="IAStorDataSvc" CheckResult="0" File="c:\program files (x86)\intel\intel(r) rapid storage technology\iastordatamgrsvc.exe" PID="6704"/>
<ITEM IsPE="1" Ver="11.1.0.1006" OFN="IAStorIcon.exe" Product="IAStorIcon" Vendor="Intel Corporation" MD5="CE4FA8A9D55E0031596387F7F59F2D4F" ChangeDate="29.02.2012 18:06:42" CreateDate="13.05.2014 19:30:28" Attr="rsAh" Size="284440" CmdLine=""C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe"" Hidden="0" LegalCopyright="Copyright © Intel Corporation 2009-2012" Descr="IAStorIcon" CheckResult="0" File="c:\program files (x86)\intel\intel(r) rapid storage technology\iastoricon.exe" PID="5912"/>
</PROCESS>
-<DLL>
<ITEM IsPE="1" Ver="4.0.30319.34209" OFN="System.ServiceProcess.dll" Product="Microsoft® .NET Framework" Vendor="Microsoft Corporation" MD5="236ED5BE9BCFEEA50EF0A2EB0E7E8870" ChangeDate="26.07.2015 13:47:51" CreateDate="26.07.2015 13:47:51" Attr="rsAh" Size="219648" Hidden="0" LegalCopyright="© Microsoft Corporation. All rights reserved." Descr=".NET Framework" CheckResult="-1" File="C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Serv759bfb78#\9b0793d9104deb6a366ceb6f77bcafc3\System.ServiceProcess.ni.dll" IsDLL="1" UsedBy="2004"/>
<ITEM IsPE="1" Ver="4.0.30319.34209" OFN="System.Core.dll" Product="Microsoft® .NET Framework" Vendor="Microsoft Corporation" MD5="F4876CD41FE61C6D2EDA9915BF746612" ChangeDate="26.07.2015 13:46:01" CreateDate="26.07.2015 13:46:01" Attr="rsAh" Size="7002624" Hidden="0" LegalCopyright="© Microsoft Corporation. All rights reserved." Descr=".NET Framework" CheckResult="-1" File="C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\02a4633b5f85cdbec8e14a51bdb028f9\System.Core.ni.dll" IsDLL="1" UsedBy="2004"/>
<ITEM IsPE="1" Ver="4.0.30319.34209" OFN="System.Configuration.dll" Product="Microsoft® .NET Framework" Vendor="Microsoft Corporation" MD5="E073F5E891F171D5B8AACB64936057D9" ChangeDate="26.07.2015 13:46:02" CreateDate="26.07.2015 13:46:02" Attr="rsAh" Size="972288" Hidden="0" LegalCopyright="© Microsoft Corporation. All rights reserved." Descr="System.Configuration.dll" CheckResult="-1" File="C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\93729611cd078029e0000b18ee38f506\System.Configuration.ni.dll" IsDLL="1" UsedBy="2004"/>
<ITEM IsPE="1" Ver="11.1.0.1006" OFN="IAStorDataMgrSvc.exe" Product="IAStorDataSvc" Vendor="Intel Corporation" MD5="8B226A71000914537EAB4A28B84D5794" ChangeDate="24.10.2014 19:25:09" CreateDate="24.10.2014 19:25:09" Attr="rsAh" Size="19968" Hidden="0" LegalCopyright="Copyright © Intel Corporation 2009-2012" Descr="IAStorDataSvc" CheckResult="-1" File="C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorDataMgrSvc\f539c02fbdad496b98cf56b8bd4d57b5\IAStorDataMgrSvc.ni.exe" IsDLL="1" UsedBy="6704"/>
<ITEM IsPE="1" Ver="11.1.0.1006" OFN="IAStorDataMgr.dll" Product="IAStorService" Vendor="Intel Corporation" MD5="2F9029C934C17ADBD36864551D4DF988" ChangeDate="18.05.2015 17:36:35" CreateDate="18.05.2015 17:36:35" Attr="rsAh" Size="228864" Hidden="0" LegalCopyright="Copyright © Intel Corporation 2009-2012" Descr="IAStorService" CheckResult="-1" File="C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorDataMgr\b2915c048820efe3f5dc73fcb4626626\IAStorDataMgr.ni.dll" IsDLL="1" UsedBy="6704"/>
<ITEM IsPE="1" Ver="11.1.0.1006" OFN="IAStorUtil.dll" Product="IAStorUtil" Vendor="Intel Corporation" MD5="249401F72F30ADFE73E1C34DC480A15B" ChangeDate="18.05.2015 17:36:35" CreateDate="18.05.2015 17:36:35" Attr="rsAh" Size="489472" Hidden="0" LegalCopyright="Copyright © Intel Corporation 2009-2012" Descr="IAStorUtil" CheckResult="-1" File="C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\425d7cea7addf909ff04be98b8292b99\IAStorUtil.ni.dll" IsDLL="1" UsedBy="6704,5912"/>
</DLL>
-<KERNELOBJ>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="C:\Users\admin\AppData\Local\Temp\axddapow.sys" MemSize="010000" Base="8E95000"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="C:\Windows\System32\Drivers\dump_dumpfve.sys" MemSize="013000" Base="81DC000"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="C:\Windows\System32\Drivers\dump_iaStor.sys" MemSize="3A4000" Base="7E38000"/>
</KERNELOBJ>
<Service> </Service>
-<Drivers>
<ITEM CheckResult="-1" File="C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys" State="1" Type="2" Name="BRDriver64_1_3_3_E02B25FC"/>
</Drivers>
-<AUTORUN>
<ITEM CheckResult="-1" File="C:\Program" Type="REG" Is64="0" X4="C:\Program Files (x86)" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\PicexaService" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\IPSEventLogMsg.dll" Type="REG" Is64="0" X4="%CommonProgramFiles%\Microsoft Shared\Ink\IPSEventLogMsg.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Handwriting Recognition" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Program Files (x86)\DVD" Type="REG" Is64="0" X4="%ProgramFiles%\DVD Maker\DVDMaker.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Dvd Maker" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Program Files (x86)\Synaptics\SynTP\SynTPCpl.dll" Type="REG" Is64="1" X4="Synaptics Control Panel" X3="{2F603045-309F-11CF-9774-0020AFD0CFF6}" X2="Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe" Type="REG" Is64="1" X4="%ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe" X3="SynTPEnh" X2="Software\Microsoft\Windows\CurrentVersion\Run" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Program Files (x86)\Windows Defender\MpEvMsg.dll" Type="REG" Is64="0" X4="%ProgramFiles%\Windows Defender\MpEvMsg.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\WinDefend" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Program Files (x86)\Windows Defender\mpsvc.dll" Type="REG" Is64="0" X4="%ProgramFiles%\Windows Defender\mpsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\WinDefend\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\ProgramData\WindowsMangerPro" Type="REG" Is64="0" X4="C:\ProgramData\WindowsMangerPro" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\Audiosrv.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\Audiosrv.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\AudioEndpointBuilder\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\Audiosrv.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\Audiosrv.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\AudioSrv\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\AxInstSV.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\AxInstSV.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\AxInstSV\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\AxInstSv.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\AxInstSv.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-AxInstallService" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\DFDTS.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\DFDTS.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Windows Disk Diagnostic" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\DispCI.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\DispCI.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Display" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\Drivers\Netwsw00.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\Drivers\Netwsw00.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\NETwNs64" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\Drivers\Pcmcia.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\Drivers\Pcmcia.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\pcmcia" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\Drivers\VolSnap.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\Drivers\VolSnap.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Volsnap" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\Drivers\acpi.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\Drivers\acpi.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\ACPI" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\Drivers\hidbth.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\Drivers\hidbth.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\HidBth" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\MsSpellCheckingFacility.dll" Type="REG" Is64="0" X4="%systemroot%\System32\MsSpellCheckingFacility.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-Spell-Checking" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\MsSpellCheckingFacility.dll" Type="REG" Is64="0" X4="%systemroot%\System32\MsSpellCheckingFacility.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-SpellChecker" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\MsSpellCheckingFacility.dll" Type="REG" Is64="0" X4="%systemroot%\System32\MsSpellCheckingFacility.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Spell-Checking" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\MsSpellCheckingFacility.dll" Type="REG" Is64="0" X4="%systemroot%\System32\MsSpellCheckingFacility.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-SpellChecker" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\RdpGroupPolicyExtension.dll" Type="REG" Is64="1" X4="C:\Windows\System32\RdpGroupPolicyExtension.dll" X3="DLLName" X2="Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{6cfb9c5c-138e-4bb3-8a3d-d5383e910e57}" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\RpcEpMap.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\RpcEpMap.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\RpcEptMapper\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\SCardSvr.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\SCardSvr.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\SCardSvr\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\SDRSVC.dll" Type="REG" Is64="0" X4="%Systemroot%\System32\SDRSVC.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\SDRSVC\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\SPReview\SPReview.exe" Type="REG" Is64="0" X4=""C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"hxxp://go.microsoft.com/fwlink/?LinkID=122915" /build:7601" X3="SPReview" X2=".DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce" X1="HKEY_USERS" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\SPReview\SPReview.exe" Type="REG" Is64="0" X4=""C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"hxxp://go.microsoft.com/fwlink/?LinkID=122915" /build:7601" X3="SPReview" X2="S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce" X1="HKEY_USERS" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\TabSvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\TabSvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\TabletInputService\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll" Type="REG" Is64="1" X4="C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll" X3="DLLName" X2="Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4bcd6cde-777b-48b6-9804-43568e23545d}" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\UI0Detect.exe" Type="REG" Is64="0" X4="%SystemRoot%\System32\UI0Detect.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Interactive Services detection" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\VSSVC.EXE" Type="REG" Is64="0" X4="%SystemRoot%\System32\VSSVC.EXE" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\VSS" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\VSSVC.EXE" Type="REG" Is64="0" X4="%SystemRoot%\System32\VSSVC.EXE" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Security\VSSAudit" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\WUDFHost.exe" Type="REG" Is64="1" X4="C:\Windows\System32\WUDFHost.exe" X3="HostProcessImagePath" X2="Software\Microsoft\Windows NT\CurrentVersion\WUDF\Services\{193a1820-d9ac-4997-8c55-be817523f6aa}" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\WUDFSvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\WUDFSvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\wudfsvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\WerSvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\WerSvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\WerSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\aelupsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\aelupsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\AeLookupSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\aelupsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\aelupsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\AeLookupSvc" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\appidsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\appidsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\AppIDSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\appinfo.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\appinfo.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\Appinfo\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\bdesvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\bdesvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\BDESVC\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\bfe.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\bfe.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\BFE\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\browser.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\browser.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\Browser\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\certprop.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\certprop.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\CertPropSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\certprop.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\certprop.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\SCPolicySvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\cscsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\cscsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\CscService\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\defragsvc.dll" Type="REG" Is64="0" X4="%Systemroot%\System32\defragsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\defragsvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\dnsrslvr.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\dnsrslvr.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\dot3svc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\dot3svc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\dot3svc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\HECIx64.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\HECIx64.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\MEIx64" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\MTConfig.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\MTConfig.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\MTConfig" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\SynTP.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\SynTP.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\SynTP" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\Wdf01000.sys" Type="REG" Is64="0" X4="C:\Windows\System32\drivers\Wdf01000.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\wdf01000" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\amdk8.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\amdk8.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\AmdK8" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\amdppm.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\amdppm.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\AmdPPM" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\avipbb.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\avipbb.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\avipbb" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\avkmgr.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\avkmgr.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\avkmgr" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\b57nd60a.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\b57nd60a.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\b57nd60a" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\bxvbda.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\bxvbda.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\b06bdrv" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\evbda.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\evbda.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\ebdrv" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\fltmgr.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\fltmgr.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\FltMgr" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\i8042prt.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\i8042prt.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\i8042prt" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\iaStor.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\iaStor.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\iaStor" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\iaStorV.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\iaStorV.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\iaStorV" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\intelppm.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\intelppm.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\intelppm" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\ipmidrv.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\ipmidrv.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\IPMIDRV" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\isapnp.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\isapnp.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\isapnp" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\kbdclass.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\kbdclass.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\kbdclass" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\kbdhid.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\kbdhid.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\kbdhid" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\mouclass.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\mouclass.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\mouclass" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\mouhid.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\mouhid.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\mouhid" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\mpio.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\mpio.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\mpio" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\nvstor.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\nvstor.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\nvstor" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\parport.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\parport.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Parport" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\processr.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\processr.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Processor" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\sbp2port.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\sbp2port.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\sbp2port" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\serial.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\serial.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Serial" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\sermouse.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\sermouse.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\sermouse" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\tpm.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\tpm.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\TPM" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\tsusbflt.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\tsusbflt.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\TsUsbFlt" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\vgapnp.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\vgapnp.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\vga" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\wacompen.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\wacompen.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\WacomPen" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\wd.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\wd.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Wd" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\e1cmsg.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\e1cmsg.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\e1cexpress" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\eapsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\eapsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\EapHost\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\gpsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\gpsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\gpsvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\ikeext.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\ikeext.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\IKEEXT\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\iphlpsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\iphlpsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\ipnathlp.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\ipnathlp.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\ipsecsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\ipsecsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\PolicyAgent\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\iscsiexe.dll" Type="REG" Is64="0" X4="%systemroot%\System32\iscsiexe.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\MSiSCSI" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\iscsilog.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\iscsilog.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\iScsiPrt" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\lltdsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\lltdsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\lltdsvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\lmhsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\lmhsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\lmhosts\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\lsasrv.dll" Type="REG" Is64="0" X4="%windir%\System32\lsasrv.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\LsaSrv" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\lsasrv.dll" Type="REG" Is64="0" X4="%windir%\System32\lsasrv.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Schannel" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\mctadmin.exe" Type="REG" Is64="0" X4="C:\Windows\System32\mctadmin.exe" X3="mctadmin" X2="S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce" X1="HKEY_USERS" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\mctadmin.exe" Type="REG" Is64="0" X4="C:\Windows\System32\mctadmin.exe" X3="mctadmin" X2="S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce" X1="HKEY_USERS" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\mdsched.exe" Type="REG" Is64="0" X4="%SystemRoot%\System32\mdsched.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-MemoryDiagnostics-Schedule" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\netman.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\netman.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\Netman\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\nlasvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\nlasvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\pcasvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\pcasvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\PcaSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\profsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\profsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-User Profiles Service" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\profsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\profsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Profsvc" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\qmgr.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\qmgr.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\BITS\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\rasauto.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\rasauto.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\RasAuto\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\rasmans.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\rasmans.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\RasMan\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\relpost.exe" Type="REG" Is64="0" X4="%SystemRoot%\System32\relpost.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-MemoryDiagnostics-Results" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\samsrv.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\samsrv.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Directory-Services-SAM" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\samsrv.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\samsrv.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\SAM" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\snmptrap.exe" Type="REG" Is64="0" X4="%SystemRoot%\System32\snmptrap.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\SNMPTRAP" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\ssdpsrv.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\ssdpsrv.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\SSDPSRV\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\sstpsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\sstpsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-RasSstp" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\swprv.dll" Type="REG" Is64="0" X4="%Systemroot%\System32\swprv.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\swprv\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\tbssvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\tbssvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\TBS\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\tcpmon.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\tcpmon.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\TCPMon" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\termsrv.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\termsrv.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\TermService\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\trkwks.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\trkwks.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\TrkWks\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\umpnpmgr.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\umpnpmgr.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\PlugPlayManager" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\umpo.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\umpo.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Power" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\umrdp.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\umrdp.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\UmRdpService\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\umrdp.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\umrdp.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\UmRdpService" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\uxsms.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\uxsms.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\UxSms\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\vds.exe" Type="REG" Is64="0" X4="%SystemRoot%\System32\vds.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Virtual Disk Service" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\vmbusres.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\vmbusres.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\vmbus" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\vmictimeprovider.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\vmictimeprovider.dll" X3="DllName" X2="SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\vmstorfltres.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\vmstorfltres.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\storflt" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\wbiosrvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wbiosrvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\WbioSrvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\wecsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wecsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\wecsvc" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\wercplsupport.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wercplsupport.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\wercplsupport\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\wersvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wersvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application Hang" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\wersvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wersvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\WerSvc" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\wevtsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wevtsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Security\Microsoft-Windows-Eventlog" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\wevtsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wevtsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Eventlog" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\wiaservc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wiaservc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\stisvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\wiaservc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wiaservc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\StillImage" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\win32k.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\win32k.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Win32k" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\winlogon.exe" Type="REG" Is64="0" X4="%SystemRoot%\System32\winlogon.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Winlogon" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\winlogon.exe" Type="REG" Is64="0" X4="%SystemRoot%\System32\winlogon.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Wlclntfy" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\wkssvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wkssvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\wlansvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wlansvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\Wlansvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\wscsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wscsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\wscsvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\wscsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wscsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\SecurityCenter" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\System32\wwansvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wwansvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\WwanSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\BlbEvents.dll" Type="REG" Is64="0" X4="%windir%\system32\BlbEvents.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-Backup" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\DRIVERS\iusb3hub.sys" Type="REG" Is64="0" X4="C:\Windows\system32\DRIVERS\iusb3hub.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\iusb3hub" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\DRIVERS\iusb3xhc.sys" Type="REG" Is64="0" X4="C:\Windows\system32\DRIVERS\iusb3xhc.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\iusb3xhc" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\EventProviders\spcmsg.dll" Type="REG" Is64="0" X4="%systemroot%\system32\EventProviders\spcmsg.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Service Pack Installer" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\FntCache.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\FntCache.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\FontCache\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\ListSvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\ListSvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\HomeGroupListener\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\Mcx2Svc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\Mcx2Svc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\Mcx2Svc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\WINSAT.EXE" Type="REG" Is64="0" X4="%SystemRoot%\system32\WINSAT.EXE" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-WindowsSystemAssessmentTool" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\WUDFPlatform.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\WUDFPlatform.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-DriverFrameworks-UserMode" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\Wat\WatUX.exe" Type="REG" Is64="0" X4="%SystemRoot%\system32\Wat\WatUX.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Windows Activation Technologies" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\bthserv.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\bthserv.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\bthserv\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\certprop.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\certprop.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-SCPNP" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\cofiredm.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\cofiredm.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-CorruptedFileRecovery-Client" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\cofiredm.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\cofiredm.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-CorruptedFileRecovery-Server" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\config\systemprofile\AppData\Local\phase-6\phase-6-compendio\reminder\reminder.exe" Type="LNK" Is64="1" X4="" X3="" X2="C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk" X1="C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\config\systemprofile\AppData\Roaming\Dropbox\bin\Dropbox.exe" Type="LNK" Is64="1" X4="" X3="" X2="C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk" X1="C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\cscsvc.dll" Type="REG" Is64="0" X4="%systemroot%\system32\cscsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-OfflineFiles" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\csrsrv.dll" Type="REG" Is64="0" X4="%windir%\system32\csrsrv.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Subsys-SMSS" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\defragsvc.dll" Type="REG" Is64="0" X4="%systemroot%\system32\defragsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-Defrag" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\dfdts.dll" Type="REG" Is64="0" X4="%windir%\system32\dfdts.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-DiskDiagnostic" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\diagtrack.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\diagtrack.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\DiagTrack\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\dps.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\dps.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\DPS\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\drivers\HTTP.SYS" Type="REG" Is64="0" X4="%SystemRoot%\system32\drivers\HTTP.SYS" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-HttpEvent" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\drivers\fltmgr.sys" Type="REG" Is64="0" X4="%SystemRoot%\system32\drivers\fltmgr.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-FilterManager" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\drivers\fvevol.sys" Type="REG" Is64="0" X4="%SystemRoot%\system32\drivers\fvevol.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-BitLocker-Driver" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\drivers\ntfs.sys" Type="REG" Is64="0" X4="%SystemRoot%\system32\drivers\ntfs.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Ntfs" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\dwm.exe" Type="REG" Is64="0" X4="%SystemRoot%\system32\dwm.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Desktop Window Manager" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\eapsvc.dll" Type="REG" Is64="0" X4="%systemroot%\system32\eapsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-EapHost" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\fdPHost.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\fdPHost.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\fdPHost\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\fdphost.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\fdphost.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-FunctionDiscoveryHost" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\fdrespub.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\fdrespub.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\FDResPub\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\fdrespub.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\fdrespub.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-ResourcePublication" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\fveapi.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\fveapi.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-BitLocker-API" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\fxsevent.dll" Type="REG" Is64="0" X4="%systemroot%\system32\fxsevent.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft Fax" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\gpsvc.dll" Type="REG" Is64="0" X4="%systemroot%\system32\gpsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-GroupPolicy" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\hkcmd.exe" Type="REG" Is64="1" X4="C:\Windows\system32\hkcmd.exe" X3="HotKeysCmds" X2="Software\Microsoft\Windows\CurrentVersion\Run" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\igfxpers.exe" Type="REG" Is64="1" X4="C:\Windows\system32\igfxpers.exe" X3="Persistence" X2="Software\Microsoft\Windows\CurrentVersion\Run" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\igfxtray.exe" Type="REG" Is64="1" X4="C:\Windows\system32\igfxtray.exe" X3="IgfxTray" X2="Software\Microsoft\Windows\CurrentVersion\Run" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\ipbusenum.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\ipbusenum.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\IPBusEnum\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\ipbusenum.dll" Type="REG" Is64="0" X4="%systemroot%\system32\ipbusenum.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-IPBusEnum" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\iphlpsvc.dll" Type="REG" Is64="0" X4="%windir%\system32\iphlpsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Iphlpsvc" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\iscsiexe.dll" Type="REG" Is64="0" X4="%systemroot%\system32\iscsiexe.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\MSiSCSI\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\kmsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\kmsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\hkmsvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\lpksetup.exe" Type="REG" Is64="0" X4="%SystemRoot%\system32\lpksetup.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-LanguagePackSetup" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\lsm.exe" Type="REG" Is64="0" X4="%SystemRoot%\system32\lsm.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\LSM" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\lsm.exe" Type="REG" Is64="0" X4="%SystemRoot%\system32\lsm.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-TerminalServices-LocalSessionManager" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\microsoft-windows-hal-events.dll" Type="REG" Is64="0" X4="%systemroot%\system32\microsoft-windows-hal-events.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-HAL" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\microsoft-windows-kernel-power-events.dll" Type="REG" Is64="0" X4="%systemroot%\system32\microsoft-windows-kernel-power-events.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Kernel-Power" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\microsoft-windows-kernel-processor-power-events.dll" Type="REG" Is64="0" X4="%systemroot%\system32\microsoft-windows-kernel-processor-power-events.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Kernel-Processor-Power" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\mmcss.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\mmcss.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\MMCSS\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\mmcss.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\mmcss.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\THREADORDER\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\mpssvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\mpssvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\mpssvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\mpssvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Firewall" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\msdtckrm.dll" Type="REG" Is64="0" X4="%systemroot%\system32\msdtckrm.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\KtmRm\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\nsisvc.dll" Type="REG" Is64="0" X4="%systemroot%\system32\nsisvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\nsi\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\oobe\winsetup.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\oobe\winsetup.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Setup" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\p2psvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\p2psvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\p2psvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\peerdistsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\peerdistsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\PeerDistSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\pnrpauto.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\pnrpauto.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\PNRPAutoReg\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\pnrpsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\pnrpsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\p2pimsvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\pnrpsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\pnrpsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\PNRPsvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\profsvc.dll" Type="REG" Is64="0" X4="%systemroot%\system32\profsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\ProfSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\psxss.exe" Type="REG" Is64="0" X4="%SystemRoot%\system32\psxss.exe" X3="Posix" X2="System\CurrentControlSet\Control\Session Manager\SubSystems" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\qagentRT.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\qagentRT.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\napagent\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\qmgr.dll" Type="REG" Is64="0" X4="%systemroot%\system32\qmgr.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Bits-Client" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\recovery.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\recovery.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Recovery" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\regsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\regsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\RemoteRegistry\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\rpcss.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\rpcss.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\DcomLaunch\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\rpcss.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\rpcss.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\RpcSs\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\schedsvc.dll" Type="REG" Is64="0" X4="%systemroot%\system32\schedsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\Schedule\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\schedsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\schedsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-TaskScheduler" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\sdclt.exe" Type="REG" Is64="0" X4="%SystemRoot%\system32\sdclt.exe" X3="" X2="SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\BackupPath" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\sdengin2.dll" Type="REG" Is64="0" X4="%systemroot%\system32\sdengin2.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Windows Backup" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\seclogon.dll" Type="REG" Is64="0" X4="%windir%\system32\seclogon.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\seclogon\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\sensrsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\sensrsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\SensrSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\services.exe" Type="REG" Is64="0" X4="%SystemRoot%\system32\services.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Service Control Manager" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\sppsvc.exe" Type="REG" Is64="0" X4="%windir%\system32\sppsvc.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Software Protection Platform Service" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\sppsvc.exe" Type="REG" Is64="0" X4="%windir%\system32\sppsvc.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Key Management Service\KmsRequests" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\sppuinotify.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\sppuinotify.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\sppuinotify\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\srcore.dll" Type="REG" Is64="0" X4="%systemroot%\system32\srcore.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\System Restore" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\srvsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\srvsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\sstpsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\sstpsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\SstpSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\sstpsvc.dll" Type="REG" Is64="0" X4="%systemroot%\system32\sstpsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\RasSstp" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\storsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\storsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\StorSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\sysmain.dll" Type="REG" Is64="0" X4="%systemroot%\system32\sysmain.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\SysMain\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\sysmain.dll" Type="REG" Is64="0" X4="%systemroot%\system32\sysmain.dll" X3="Library" X2="SYSTEM\CurrentControlSet\Services\rdyboost\Performance" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\tbssvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\tbssvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-TBS" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\termsrv.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\termsrv.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-TerminalServices-RemoteConnectionManager" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\termsrv.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\termsrv.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\TermService" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\themeservice.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\themeservice.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\Themes\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\umpnpmgr.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\umpnpmgr.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\PlugPlay\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\umpnpmgr.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\umpnpmgr.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-UserPnp" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\umpo.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\umpo.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\Power\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\w32time.dll" Type="REG" Is64="0" X4="%systemroot%\system32\w32time.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\W32Time\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\w32time.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\w32time.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Time-Service" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\w32time.dll" Type="REG" Is64="0" X4="%Systemroot%\system32\w32time.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\W32Time" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\w32time.dll" Type="REG" Is64="0" X4="%systemroot%\system32\w32time.dll" X3="DllName" X2="SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\w32time.dll" Type="REG" Is64="0" X4="%systemroot%\system32\w32time.dll" X3="DllName" X2="SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\wbem\WMIsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\wbem\WMIsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\Winmgmt\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\wecsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\wecsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\Wecsvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\wecsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\wecsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-EventCollector" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\wecsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\wecsvc.dll" X3="DisplayNameFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\HardwareEvents" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\wecsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\wecsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-EventCollector" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\winlogon.exe" Type="REG" Is64="0" X4="%SystemRoot%\system32\winlogon.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Winlogon" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\winsrv.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\winsrv.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-Winsrv" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\wlansvc.dll" Type="REG" Is64="0" X4="%windir%\system32\wlansvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-WLAN-AutoConfig" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\wpdbusenum.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\wpdbusenum.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\WPDBusEnum\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\wsepno.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\wsepno.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Windows Search Service Profile Notification" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\wuaueng.dll" Type="REG" Is64="0" X4="%systemroot%\system32\wuaueng.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\wuauserv\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="C:\Windows\system32\wuaueng.dll" Type="REG" Is64="0" X4="%systemroot%\system32\wuaueng.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-WindowsUpdateClient" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="C:\d8deeb25cfc8bc7553\DW\DW20.exe" Type="REG" Is64="0" X4="C:\d8deeb25cfc8bc7553\DW\DW20.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\VSSetup" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="Maker\DVDMaker.exe" Type="REG" Is64="0" X4="%ProgramFiles%\DVD Maker\DVDMaker.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Dvd Maker" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="\SystemRoot\System32\win32k.sys" Type="REG" Is64="0" X4="\SystemRoot\System32\win32k.sys" X3="Kmode" X2="System\CurrentControlSet\Control\Session Manager\SubSystems" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>
<ITEM CheckResult="-1" File="auditcse.dll" Type="REG" Is64="1" X4="auditcse.dll" X3="DLLName" X2="Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{f3ccc681-b74c-4060-9f26-cd84525dca2a}" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
<ITEM CheckResult="-1" File="igfxdev.dll" Type="REG" Is64="1" X4="igfxdev.dll" X3="DLLName" X2="Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>
</AUTORUN>
-<BHO>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="" Enabled="1" CLSID="{0C4CC089-D306-440D-9772-464E226F6539}" RegKey="HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions" BHOType="3"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="" Enabled="1" CLSID="{2670000A-7350-4f3c-8081-5663EE0C6C49}" RegKey="HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions" BHOType="3"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="" Enabled="1" CLSID="{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}" RegKey="HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions" BHOType="3"/>
</BHO>
-<ExplorerExt>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="" Enabled="1" CLSID="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" RegKey="SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved" ExtName="WebCheck" ExtType="1"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="" Enabled="1" CLSID="{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" RegKey="SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved" ExtName="Shell Extension for Malware scanning" ExtType="1"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="" Enabled="1" CLSID="{F9DB5320-233E-11D1-9F84-707F02C10627}" RegKey="SOFTWARE\Classes\Folder\shellex\ColumnHandlers" ExtName="ColumnHandler" ExtType="2"/>
</ExplorerExt>
-<PrintEXT>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="hpinkstsa211LM.dll" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="hpinkstsCC11LM.dll" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="HPDiscoPMCC11.dll" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="localspl.dll" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="FXSMON.DLL" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="tcpmon.dll" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="usbmon.dll" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="WSDMon.dll" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="inetpp.dll" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Providers"/>
</PrintEXT>
-<TaskScheduler>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File=" aitagent " Enabled="251281536" FullCmd=" aitagent " SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Application Experience\" Status="16777215" JobName="AitAgent"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="aepdu.dll" Enabled="251281536" FullCmd=" %windir%\system32\rundll32.exe aepdu.dll,AePduRunUpdate -nolegacy" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Application Experience\" Status="16777215" JobName="Microsoft Compatibility Appraiser"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="appraiser.dll" Enabled="251281536" FullCmd=" %windir%\system32\rundll32.exe appraiser.dll,DoScheduledTelemetryRun" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Application Experience\" Status="16777215" JobName="Microsoft Compatibility Appraiser"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="aepdu.dll" Enabled="251281536" FullCmd=" %windir%\system32\rundll32.exe aepdu.dll,AePduRunUpdate" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Application Experience\" Status="16777215" JobName="ProgramDataUpdater"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="invagent.dll" Enabled="251281536" FullCmd=" %windir%\system32\rundll32.exe invagent.dll,RunUpdate -noappraiser" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Application Experience\" Status="16777215" JobName="ProgramDataUpdater"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="acproxy.dll" Enabled="251281536" FullCmd=" %windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Autochk\" Status="16777215" JobName="Proxy"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="dfdts.dll" Enabled="251281536" FullCmd=" %windir%\system32\rundll32.exe dfdts.dll,DfdGetDefaultPolicyAndSMART" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\DiskDiagnostic\" Status="16777215" JobName="Microsoft-Windows-DiskDiagnosticDataCollector"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="C:\Windows\ehome\mcupdate" Enabled="251281536" FullCmd=" %SystemRoot%\ehome\mcupdate $(Arg0)" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Media Center\" Status="16777215" JobName="mcupdate"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="C:\Windows\ehome\ehrec" Enabled="251281536" FullCmd=" %SystemRoot%\ehome\ehrec /RestartRecording" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Media Center\" Status="16777215" JobName="RecordingRestart"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="C:\Windows\ehome\ehrec" Enabled="251281536" FullCmd=" %SystemRoot%\ehome\ehrec /StartRecording" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Media Center\" Status="16777215" JobName="StartRecording"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="srrstr.dll" Enabled="251281536" FullCmd=" %windir%\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\SystemRestore\" Status="16777215" JobName="SR"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="bfe.dll" Enabled="251281536" FullCmd=" %windir%\system32\rundll32.exe bfe.dll,BfeOnServiceStartTypeChange" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Windows Filtering Platform\" Status="16777215" JobName="BfeOnServiceStartTypeChange"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="C:\Program Files (x86)\Windows Media Player\wmpnscfg.exe" Enabled="251281536" FullCmd=" "%ProgramFiles%\Windows Media Player\wmpnscfg.exe" " SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Windows Media Sharing\" Status="16777215" JobName="UpdateLibrary"/>
</TaskScheduler>
-<SPI>
<ITEM IsPE="1" Ver="6.1.7601.18685" OFN="nlaapi.dll" Product="Microsoft® Windows® Operating System" Vendor="Microsoft Corporation" MD5="FE48346938C1CDDDF4E4097DB9B99764" ChangeDate="06.12.2014 05:50:19" CreateDate="19.01.2015 12:35:21" Attr="rsAh" Size="52224" LegalCopyright="© Microsoft Corporation. All rights reserved." Descr="Network Location Awareness 2" CheckResult="-1" File="C:\Windows\system32\NLAapi.dll" IsDLL="1" SPINaim="@%SystemRoot%\system32\nlasvc.dll,-1000" SPIType="1"/>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="napinsp.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="0B7E85364CB878E2AD531DB7B601A9E5" ChangeDate="14.07.2009 03:16:02" CreateDate="14.07.2009 01:54:55" Attr="rsAh" Size="52224" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="E-Mail-Namenshimanbieter" CheckResult="-1" File="C:\Windows\system32\napinsp.dll" IsDLL="1" SPINaim="@%SystemRoot%\system32\napinsp.dll,-1000" SPIType="1"/>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="pnrpnsp.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="5CF640EDDB1E40A5AB1BB743BCDEC610" ChangeDate="14.07.2009 03:16:12" CreateDate="14.07.2009 01:55:50" Attr="rsAh" Size="65024" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="PNRP-Namespaceanbieter" CheckResult="-1" File="C:\Windows\system32\pnrpnsp.dll" IsDLL="1" SPINaim="@%SystemRoot%\system32\pnrpnsp.dll,-1000" SPIType="1"/>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="pnrpnsp.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="5CF640EDDB1E40A5AB1BB743BCDEC610" ChangeDate="14.07.2009 03:16:12" CreateDate="14.07.2009 01:55:50" Attr="rsAh" Size="65024" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="PNRP-Namespaceanbieter" CheckResult="-1" File="C:\Windows\system32\pnrpnsp.dll" IsDLL="1" SPINaim="@%SystemRoot%\system32\pnrpnsp.dll,-1001" SPIType="1"/>
<ITEM IsPE="1" Ver="6.1.7601.18254" OFN="mswsock.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="E94C583CDE2348950155F2AF2876F34D" ChangeDate="08.09.2013 04:03:58" CreateDate="13.05.2014 20:58:34" Attr="rsAh" Size="231424" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="Microsoft Windows Sockets 2.0-Dienstanbieter" CheckResult="-1" File="C:\Windows\System32\mswsock.dll" IsDLL="1" SPINaim="@%SystemRoot%\system32\wshtcpip.dll,-60103" SPIType="1"/>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="winrnr" Product="Microsoft® Windows® Operating System" Vendor="Microsoft Corporation" MD5="5DF5D8CFD9B9573FA3B2C89D9061A240" ChangeDate="14.07.2009 03:16:19" CreateDate="14.07.2009 01:37:57" Attr="rsAh" Size="20992" LegalCopyright="© Microsoft Corporation. All rights reserved." Descr="LDAP RnR Provider DLL" CheckResult="-1" File="C:\Windows\System32\winrnr.dll" IsDLL="1" SPINaim="NTDS" SPIType="1"/>
<ITEM IsPE="1" Ver="6.1.7601.18254" OFN="mswsock.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="E94C583CDE2348950155F2AF2876F34D" ChangeDate="08.09.2013 04:03:58" CreateDate="13.05.2014 20:58:34" Attr="rsAh" Size="231424" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="Microsoft Windows Sockets 2.0-Dienstanbieter" CheckResult="-1" File="C:\Windows\system32\mswsock.dll" IsDLL="1" SPINaim="@%SystemRoot%\System32\wshtcpip.dll,-60100" SPIType="3"/>
<ITEM IsPE="1" Ver="6.1.7601.18254" OFN="mswsock.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="E94C583CDE2348950155F2AF2876F34D" ChangeDate="08.09.2013 04:03:58" CreateDate="13.05.2014 20:58:34" Attr="rsAh" Size="231424" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="Microsoft Windows Sockets 2.0-Dienstanbieter" CheckResult="-1" File="C:\Windows\system32\mswsock.dll" IsDLL="1" SPINaim="@%SystemRoot%\System32\wshtcpip.dll,-60101" SPIType="3"/>
<ITEM IsPE="1" Ver="6.1.7601.18254" OFN="mswsock.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="E94C583CDE2348950155F2AF2876F34D" ChangeDate="08.09.2013 04:03:58" CreateDate="13.05.2014 20:58:34" Attr="rsAh" Size="231424" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="Microsoft Windows Sockets 2.0-Dienstanbieter" CheckResult="-1" File="C:\Windows\system32\mswsock.dll" IsDLL="1" SPINaim="@%SystemRoot%\System32\wshtcpip.dll,-60102" SPIType="3"/>
<ITEM IsPE="1" Ver="6.1.7601.18254" OFN="mswsock.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="E94C583CDE2348950155F2AF2876F34D" ChangeDate="08.09.2013 04:03:58" CreateDate="13.05.2014 20:58:34" Attr="rsAh" Size="231424" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="Microsoft Windows Sockets 2.0-Dienstanbieter" CheckResult="-1" File="C:\Windows\system32\mswsock.dll" IsDLL="1" SPINaim="@%SystemRoot%\System32\wship6.dll,-60100" SPIType="3"/>
<ITEM IsPE="1" Ver="6.1.7601.18254" OFN="mswsock.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="E94C583CDE2348950155F2AF2876F34D" ChangeDate="08.09.2013 04:03:58" CreateDate="13.05.2014 20:58:34" Attr="rsAh" Size="231424" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="Microsoft Windows Sockets 2.0-Dienstanbieter" CheckResult="-1" File="C:\Windows\system32\mswsock.dll" IsDLL="1" SPINaim="@%SystemRoot%\System32\wship6.dll,-60101" SPIType="3"/>
<ITEM IsPE="1" Ver="6.1.7601.18254" OFN="mswsock.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="E94C583CDE2348950155F2AF2876F34D" ChangeDate="08.09.2013 04:03:58" CreateDate="13.05.2014 20:58:34" Attr="rsAh" Size="231424" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="Microsoft Windows Sockets 2.0-Dienstanbieter" CheckResult="-1" File="C:\Windows\system32\mswsock.dll" IsDLL="1" SPINaim="@%SystemRoot%\System32\wship6.dll,-60102" SPIType="3"/>
<ITEM IsPE="1" Ver="6.1.7601.18254" OFN="mswsock.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="E94C583CDE2348950155F2AF2876F34D" ChangeDate="08.09.2013 04:03:58" CreateDate="13.05.2014 20:58:34" Attr="rsAh" Size="231424" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="Microsoft Windows Sockets 2.0-Dienstanbieter" CheckResult="-1" File="C:\Windows\system32\mswsock.dll" IsDLL="1" SPINaim="@%SystemRoot%\System32\wshqos.dll,-100" SPIType="3"/>
<ITEM IsPE="1" Ver="6.1.7601.18254" OFN="mswsock.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="E94C583CDE2348950155F2AF2876F34D" ChangeDate="08.09.2013 04:03:58" CreateDate="13.05.2014 20:58:34" Attr="rsAh" Size="231424" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="Microsoft Windows Sockets 2.0-Dienstanbieter" CheckResult="-1" File="C:\Windows\system32\mswsock.dll" IsDLL="1" SPINaim="@%SystemRoot%\System32\wshqos.dll,-101" SPIType="3"/>
<ITEM IsPE="1" Ver="6.1.7601.18254" OFN="mswsock.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="E94C583CDE2348950155F2AF2876F34D" ChangeDate="08.09.2013 04:03:58" CreateDate="13.05.2014 20:58:34" Attr="rsAh" Size="231424" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="Microsoft Windows Sockets 2.0-Dienstanbieter" CheckResult="-1" File="C:\Windows\system32\mswsock.dll" IsDLL="1" SPINaim="@%SystemRoot%\System32\wshqos.dll,-102" SPIType="3"/>
<ITEM IsPE="1" Ver="6.1.7601.18254" OFN="mswsock.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="E94C583CDE2348950155F2AF2876F34D" ChangeDate="08.09.2013 04:03:58" CreateDate="13.05.2014 20:58:34" Attr="rsAh" Size="231424" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="Microsoft Windows Sockets 2.0-Dienstanbieter" CheckResult="-1" File="C:\Windows\system32\mswsock.dll" IsDLL="1" SPINaim="@%SystemRoot%\System32\wshqos.dll,-103" SPIType="3"/>
</SPI>
-<PORTS>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="135" PortType="1"/>
<ITEM CheckResult="-1" File="System.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="139" PortType="1"/>
<ITEM CheckResult="-1" File="System.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="445" PortType="1"/>
<ITEM CheckResult="-1" File="wmpnetwk.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="554" PortType="1"/>
<ITEM IsPE="1" Ver="15.0.0.463" OFN="avp.exe" Product="Kaspersky Anti-Virus" Vendor="Kaspersky Lab ZAO" MD5="058734C95991F6BEBF3D3075B8776234" ChangeDate="20.04.2014 16:15:58" CreateDate="20.04.2014 16:15:58" Attr="rsAh" Size="233552" CheckResult="0" File="c:\program files (x86)\kaspersky lab\kaspersky internet security 15.0.0\avp.exe" RemoteHost="127.0.0.1" RemotePort="50165" LocalPort="1110" PortType="1"/>
<ITEM IsPE="1" Ver="15.0.0.463" OFN="avp.exe" Product="Kaspersky Anti-Virus" Vendor="Kaspersky Lab ZAO" MD5="058734C95991F6BEBF3D3075B8776234" ChangeDate="20.04.2014 16:15:58" CreateDate="20.04.2014 16:15:58" Attr="rsAh" Size="233552" CheckResult="0" File="c:\program files (x86)\kaspersky lab\kaspersky internet security 15.0.0\avp.exe" RemoteHost="127.0.0.1" RemotePort="50181" LocalPort="1110" PortType="1"/>
<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="50185" LocalPort="1110" PortType="1"/>
<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="50188" LocalPort="1110" PortType="1"/>
<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="50189" LocalPort="1110" PortType="1"/>
<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="50190" LocalPort="1110" PortType="1"/>
<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="50191" LocalPort="1110" PortType="1"/>
<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="50192" LocalPort="1110" PortType="1"/>
<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="50207" LocalPort="1110" PortType="1"/>
<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="50208" LocalPort="1110" PortType="1"/>
<ITEM IsPE="1" Ver="15.0.0.463" OFN="avp.exe" Product="Kaspersky Anti-Virus" Vendor="Kaspersky Lab ZAO" MD5="058734C95991F6BEBF3D3075B8776234" ChangeDate="20.04.2014 16:15:58" CreateDate="20.04.2014 16:15:58" Attr="rsAh" Size="233552" CheckResult="0" File="c:\program files (x86)\kaspersky lab\kaspersky internet security 15.0.0\avp.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="1110" PortType="1"/>
<ITEM IsPE="1" Ver="15.0.0.463" OFN="avp.exe" Product="Kaspersky Anti-Virus" Vendor="Kaspersky Lab ZAO" MD5="058734C95991F6BEBF3D3075B8776234" ChangeDate="20.04.2014 16:15:58" CreateDate="20.04.2014 16:15:58" Attr="rsAh" Size="233552" CheckResult="0" File="c:\program files (x86)\kaspersky lab\kaspersky internet security 15.0.0\avp.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="1111" PortType="1"/>
<ITEM CheckResult="-1" File="System.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="2869" PortType="1"/>
<ITEM CheckResult="-1" File="System.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="5357" PortType="1"/>
<ITEM CheckResult="-1" File="System.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="8092" PortType="1"/>
<ITEM CheckResult="-1" File="System.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="10243" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="17500" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="17600" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="17603" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49176" LocalPort="19872" PortType="1"/>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="WinInit.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="B5C5DCAD3899512020D135600129D665" ChangeDate="14.07.2009 03:14:45" CreateDate="14.07.2009 01:36:49" Attr="rsAh" Size="96256" CheckResult="0" File="wininit.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="49152" PortType="1"/>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="49153" PortType="1"/>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="49154" PortType="1"/>
<ITEM CheckResult="-1" File="spoolsv.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="49155" PortType="1"/>
<ITEM CheckResult="-1" File="services.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="49156" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49159" LocalPort="49158" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49158" LocalPort="49159" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49161" LocalPort="49160" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49160" LocalPort="49161" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="108.160.172.204" RemotePort="443" LocalPort="49164" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49166" LocalPort="49165" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49165" LocalPort="49166" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49168" LocalPort="49167" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49167" LocalPort="49168" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49170" LocalPort="49169" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49169" LocalPort="49170" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49172" LocalPort="49171" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49171" LocalPort="49172" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49174" LocalPort="49173" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49173" LocalPort="49174" PortType="1"/>
<ITEM CheckResult="-1" File="lsass.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="49175" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="19872" LocalPort="49176" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="54.230.14.23" RemotePort="443" LocalPort="49177" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="54.230.14.23" RemotePort="443" LocalPort="49178" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="54.230.14.23" RemotePort="443" LocalPort="49179" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="108.160.172.193" RemotePort="443" LocalPort="49180" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49195" LocalPort="49194" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49194" LocalPort="49195" PortType="1"/>
<ITEM CheckResult="-1" File="HPNetworkCommunicatorCom.exe" RemoteHost="127.0.0.1" RemotePort="1110" LocalPort="50165" PortType="1"/>
<ITEM IsPE="1" Ver="15.0.0.463" OFN="avp.exe" Product="Kaspersky Anti-Virus" Vendor="Kaspersky Lab ZAO" MD5="058734C95991F6BEBF3D3075B8776234" ChangeDate="20.04.2014 16:15:58" CreateDate="20.04.2014 16:15:58" Attr="rsAh" Size="233552" CheckResult="0" File="c:\program files (x86)\kaspersky lab\kaspersky internet security 15.0.0\avp.exe" RemoteHost="192.168.1.116" RemotePort="8080" LocalPort="50166" PortType="1"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="1110" LocalPort="50181" PortType="1"/>
<ITEM IsPE="1" Ver="15.0.0.463" OFN="avp.exe" Product="Kaspersky Anti-Virus" Vendor="Kaspersky Lab ZAO" MD5="058734C95991F6BEBF3D3075B8776234" ChangeDate="20.04.2014 16:15:58" CreateDate="20.04.2014 16:15:58" Attr="rsAh" Size="233552" CheckResult="0" File="c:\program files (x86)\kaspersky lab\kaspersky internet security 15.0.0\avp.exe" RemoteHost="108.160.169.54" RemotePort="443" LocalPort="50182" PortType="1"/>
<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="1111" LocalPort="50252" PortType="1"/>
<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="1111" LocalPort="50253" PortType="1"/>
<ITEM CheckResult="-1" File="" RemoteHost="81.19.104.111" RemotePort="443" LocalPort="50254" PortType="1"/>
<ITEM CheckResult="-1" File="" RemoteHost="62.128.100.55" RemotePort="443" LocalPort="50255" PortType="1"/>
<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="1111" LocalPort="50256" PortType="1"/>
<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="1111" LocalPort="50257" PortType="1"/>
<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="1111" LocalPort="50258" PortType="1"/>
<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="1111" LocalPort="50259" PortType="1"/>
<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="1111" LocalPort="50260" PortType="1"/>
<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="1111" LocalPort="50261" PortType="1"/>
<ITEM IsPE="1" Ver="15.0.0.463" OFN="avp.exe" Product="Kaspersky Anti-Virus" Vendor="Kaspersky Lab ZAO" MD5="058734C95991F6BEBF3D3075B8776234" ChangeDate="20.04.2014 16:15:58" CreateDate="20.04.2014 16:15:58" Attr="rsAh" Size="233552" CheckResult="0" File="c:\program files (x86)\kaspersky lab\kaspersky internet security 15.0.0\avp.exe" RemoteHost="81.19.104.111" RemotePort="443" LocalPort="50262" PortType="1"/>
<ITEM IsPE="1" Ver="15.0.0.463" OFN="avp.exe" Product="Kaspersky Anti-Virus" Vendor="Kaspersky Lab ZAO" MD5="058734C95991F6BEBF3D3075B8776234" ChangeDate="20.04.2014 16:15:58" CreateDate="20.04.2014 16:15:58" Attr="rsAh" Size="233552" CheckResult="0" File="c:\program files (x86)\kaspersky lab\kaspersky internet security 15.0.0\avp.exe" RemoteHost="23.51.251.27" RemotePort="80" LocalPort="50263" PortType="1"/>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="68" PortType="2"/>
<ITEM CheckResult="-1" File="System.exe" RemoteHost="" RemotePort="0" LocalPort="137" PortType="2"/>
<ITEM CheckResult="-1" File="System.exe" RemoteHost="" RemotePort="0" LocalPort="138" PortType="2"/>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="500" PortType="2"/>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="1900" PortType="2"/>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="1900" PortType="2"/>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="3702" PortType="2"/>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="3702" PortType="2"/>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="3702" PortType="2"/>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="3702" PortType="2"/>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="4500" PortType="2"/>
<ITEM CheckResult="-1" File="wmpnetwk.exe" RemoteHost="" RemotePort="0" LocalPort="5004" PortType="2"/>
<ITEM CheckResult="-1" File="wmpnetwk.exe" RemoteHost="" RemotePort="0" LocalPort="5005" PortType="2"/>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="5355" PortType="2"/>
<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="" RemotePort="0" LocalPort="17500" PortType="2"/>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="49153" PortType="2"/>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="49154" PortType="2"/>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="60619" PortType="2"/>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="60620" PortType="2"/>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="63466" PortType="2"/>
<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="63544" PortType="2"/>
</PORTS>
<DPF> </DPF>
-<CPL>
<ITEM IsPE="1" Ver="17.0.0.134" OFN="FlashPlayerCPLApp.cpl" Product="Adobe Flash Player Control Panel Applet" Vendor="Adobe Systems Incorporated" MD5="D58D2CC2E405CF3A1D899C57AE15DB40" ChangeDate="11.04.2015 18:36:45" CreateDate="15.08.2014 22:15:14" Attr="rsAh" Size="142512" LegalCopyright="Copyright © 1996-2015 Adobe Systems Incorporated. All Rights Reserved. Adobe and Flash are either trademarks or registered trademarks in the United States and/or other countries." Descr="Adobe Flash Player Control Panel Applet" CheckResult="-1" File="C:\Windows\system32\FlashPlayerCPLApp.cpl" IsDLL="1" Enabled="1"/>
</CPL>
-<ActiveSetup>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="C:\Windows\System32\ie4uinit.exe" Enabled="1" CLSID="{7D715857-A67C-4C2F-A929-038448584D63}" RegKey="Software\Microsoft\Active Setup\Installed Components"/>
<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="C:\Windows\System32\ie4uinit.exe" Enabled="1" CLSID="{89820200-ECBD-11cf-8B85-00AA005B4383}" RegKey="Software\Microsoft\Active Setup\Installed Components"/>
</ActiveSetup>
<HOSTS> </HOSTS>
<ProtocolExt> </ProtocolExt>
-<NET_SHARE>
<ITEM Name="ADMIN$" Connections="0" Path="C:\Windows"/>
<ITEM Name="C$" Connections="0" Path="C:\"/>
<ITEM Name="HP ENVY 5640 series" Connections="0" Path="HP ENVY 5640 series,LocalsplOnly"/>
<ITEM Name="HP ENVY 5640 series (Netzwerk)" Connections="0" Path="HP ENVY 5640 series (Netzwerk),LocalsplOnly"/>
<ITEM Name="IPC$" Connections="0" Path=""/>
<ITEM Name="print$" Connections="0" Path="C:\Windows\system32\spool\drivers"/>
<ITEM Name="Users" Connections="0" Path="C:\Users"/>
</NET_SHARE>
-<SuspFiles>
<ITEM IsPE="1" Ver="6.1.7601.17567" OFN="EXPLORER.EXE.MUI" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="8B88EBBB05A0E56B7DCC708498C02B3E" ChangeDate="25.02.2011 07:30:54" CreateDate="13.05.2014 21:57:47" Attr="rsAh" Size="2616320" Descr=" Heuristische Analyse des Betriebssystems: Verdacht auf Datei mit verd?chtigem Namen (hohe Wahrscheinlichkeitsrate)" File="C:\Windows\system32\explorer.exe" VirType="3"/>
<ITEM IsPE="1" Ver="6.1.7601.18869" OFN="User.exe" Product="Microsoft® Windows® Operating System" Vendor="Microsoft Corporation" MD5="EC6E5AE2ECFE7A335B370865A1158EF8" ChangeDate="25.05.2015 18:50:36" CreateDate="14.06.2015 12:11:44" Attr="rsAh" Size="2048" Descr=" Heuristische Analyse des Betriebssystems: Verdacht auf Datei mit verd?chtigem Namen (CH) (hohe Wahrscheinlichkeitsrate)" File="C:\Windows\system32\user.exe" VirType="3"/>
</SuspFiles>
-<IPU>
<ITEM X2="@%SystemRoot%\System32\termsrv.dll,-268" X1="TermService" Code="1"/>
<ITEM X2="@%systemroot%\system32\ssdpsrv.dll,-100" X1="SSDPSRV" Code="1"/>
<ITEM X2="@%SystemRoot%\system32\schedsvc.dll,-100" X1="Schedule" Code="1"/>
<ITEM Code="3"/>
<ITEM Code="5"/>
<ITEM X1="-1" Code="8"/>
</IPU>
</AVZ>
|
|
09.08.2015, 17:49
| #10 |
| /// Malwareteam | Kaspersky 2015 meldet dauernd not-a-virus Hi, Schritt # 1: MBAM Downloade Dir bitte  Malwarebytes Anti-Malware
Schritt # 2: AdwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Schritt # 3: JRT Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Schritt # 4: FRST Bitte noch ein FRST-Log erstellen. Schritt # 5: Bitte Posten
|
|
11.08.2015, 12:45
| #11 |
| | Kaspersky 2015 meldet dauernd not-a-virus Hallo Miteinander Ich komme z.Z nicht dazu und bin ab heute an nem Open-Air  Ich poste die Resultate nächste Woche  Schöne Woche und danke das Ihr euch die Zeit nehmt |
|
11.08.2015, 13:10
| #12 |
| /// Malwareteam | Kaspersky 2015 meldet dauernd not-a-virus No Problemo |
|
17.08.2015, 12:44
| #13 |
| | Kaspersky 2015 meldet dauernd not-a-virus Hallöölle Mbam Teil 1 Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 17.08.2015 Suchlaufzeit: 13:16 Protokolldatei: mbam.txt Administrator: Ja Version: 2.1.8.1057 Malware-Datenbank: v2015.08.17.05 Rootkit-Datenbank: v2015.08.16.01 Lizenz: Kostenlose Version Malware-Schutz: Deaktiviert Schutz vor bösartigen Websites: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: admin Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 349975 Abgelaufene Zeit: 5 Min., 26 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 33 PUP.Optional.SearchProtect.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}, In Quarantäne, [2fba2adf98f30432ca282275818134cc], PUP.Optional.Lasaoren.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, In Quarantäne, [3dace425a2e967cfb3b91a84ed17c23e], PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [e00931d80c7f88aeb12b48d561a25da3], PUP.Optional.Delta.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\delta-homesSoftware, In Quarantäne, [93565aafc9c2f93d2cb8261f24df59a7], PUP.Optional.ExpressFind.A, HKLM\SOFTWARE\WOW6432NODE\ExpressFind, In Quarantäne, [b4353acf216a23133e05ef33a65d9868], PUP.Optional.FFPluginHp.A, HKLM\SOFTWARE\WOW6432NODE\FFPluginHp, In Quarantäne, [ab3e4bbed3b84ee8533e9c82b74c2cd4], PUP.Optional.IHProtect.A, HKLM\SOFTWARE\WOW6432NODE\IHProtect, In Quarantäne, [6881ea1f28631b1b669a0f208e754fb1], PUP.Optional.Picexa.A, HKLM\SOFTWARE\WOW6432NODE\Picexa, In Quarantäne, [c029c9403c4fea4c8e539313e91bdd23], PUP.Optional.Picexa.A, HKLM\SOFTWARE\WOW6432NODE\PicexaSvc, In Quarantäne, [ebfed83195f61b1bb32ffda951b3fb05], PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\webssearchesSoftware, In Quarantäne, [cc1dda2fdab10f27052e60fb8e756d93], PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [3dac61a84c3f2f0719c3809d5da6ce32], PUP.Optional.Iminent.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IMBoosterARP, In Quarantäne, [2abf64a57b104cea975930f87c87ae52], PUP.Optional.Iminent.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IminentToolbar, In Quarantäne, [e0090dfc2863ac8ae906cf590ff42ed2], PUP.Optional.Vosteran, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Vosteran.com, In Quarantäne, [2ebbe7227b1089ad4c0dde5843c003fd], PUP.Optional.Wajam.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WajIntEnhance, In Quarantäne, [569312f7c9c200360de1fe2a649fa65a], PUP.Optional.MiuiTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPDP, In Quarantäne, [fbee59b092f9181ee623b8f741c3f30d], PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB, In Quarantäne, [0bde52b77a1176c06359c879ab587c84], PUP.Optional.WindowsMangerProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\WindowsMangerProtect, In Quarantäne, [a5440efbcdbedf5727713dfb06fdfa06], PUP.Optional.Gameo.C, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\Gameo, In Quarantäne, [d712d23796f582b4d023bd61c73c8b75], PUP.Optional.InstallCore.C, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\InstallCore, In Quarantäne, [f8f17396d0bbc6705b6a4069ab598b75], PUP.Optional.TNT.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\TNT2, In Quarantäne, [edfc3ccdf09b06302a6af931f60d718f], PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, In Quarantäne, [d31641c81f6c87af0785de437192ac54], PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}, In Quarantäne, [e108f3166724092dbfcd051c659ed030], PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [ecfdf3160b8068ce206cde43b1522ed2], PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{A25AC313-DD19-4238-ACA2-401D6BEE4321}, In Quarantäne, [ebfe0009fc8f7fb7206cca57bc473ec2], PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{E733165D-CBCF-4FDA-883E-ADEF965B476C}, In Quarantäne, [5b8e15f4aae164d2fe8e3be69172d030], PUP.Optional.Iminent.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IMBoosterARP, In Quarantäne, [e2077891bad1a393eeaf59cc2ad90ff1], PUP.Optional.Iminent.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IminentToolbar, In Quarantäne, [42a738d175167eb86638ce57f01314ec], PUP.Optional.Linkey.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Linkey, In Quarantäne, [4e9b7b8efe8d4aec5847c95cb053fb05], PUP.Optional.SearchProtect.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\SearchProtect, In Quarantäne, [eefbd2374d3ee155eeb2643e659f8878], PUP.Optional.Vosteran.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Vosteran.com, In Quarantäne, [de0b21e8e0ab0e288f119b8a5ea508f8], PUP.Optional.Wajam.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WajIntEnhance, In Quarantäne, [12d768a12863ae88fba6cb5a3cc709f7], PUP.Optional.IStart.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MOZILLA\EXTENDS, In Quarantäne, [5594a4655f2ccd6969ae9a8c16ed51af], Registrierungswerte: 28 PUP.Optional.Lasaoren.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|URL, hxxp://Lasaoren.com/results.php?f=4&q={searchTerms}&a=lrn_secureddownload_14_45_ff&cd=2XzuyEtN2Y1L1QzuzzyEtA0AyE0BtDtBzy0E0B0DtCtByD0DtN0D0Tzu0StCtDyEyEtN1L2XzutAtFyCtFtCtFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyB0AyDtCyDtByD0AtGyBzy0C0AtGtDzyyByDtGtAyC0ByCtGtDyD0B0DtB0CyBzz0AyC0C0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0DyEtAtAtAyB0AtDtG0AyE0EyCtGyE0EyD0CtGzz0DyD0BtGtAyDyEtD0CzytByDyD0D0E0C2Q&cr=814032143&ir=, In Quarantäne, [3dace425a2e967cfb3b91a84ed17c23e] PUP.Optional.Lasaoren.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|TopResultURLFallback, hxxp://Lasaoren.com/results.php?f=4&q={searchTerms}&a=lrn_secureddownload_14_45_ff&cd=2XzuyEtN2Y1L1QzuzzyEtA0AyE0BtDtBzy0E0B0DtCtByD0DtN0D0Tzu0StCtDyEyEtN1L2XzutAtFyCtFtCtFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyB0AyDtCyDtByD0AtGyBzy0C0AtGtDzyyByDtGtAyC0ByCtGtDyD0B0DtB0CyBzz0AyC0C0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0DyEtAtAtAyB0AtDtG0AyE0EyCtGyE0EyD0CtGzz0DyD0BtGtAyDyEtD0CzytByDyD0D0E0C2Q&cr=814032143&ir=, In Quarantäne, [c52450b9cac158de4c207d2127dd38c8] PUP.Optional.Lasaoren.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|FaviconPath, C:\Program Files (x86)\WSE_Lasaoren\\FavIcon.ico, In Quarantäne, [a64361a8296295a19fcd3f5fbe466e92] PUP.Optional.Lasaoren.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}, Lasaoren, In Quarantäne, [e4053ecb6e1d72c44824c4da36cec739] PUP.Optional.Lasaoren.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|DisplayName, Lasaoren, In Quarantäne, [e009b9505e2d171f3c30742acb39b749] PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|URL, hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}, In Quarantäne, [e00931d80c7f88aeb12b48d561a25da3] PUP.Optional.Lasaoren.C, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY|AppPath, C:\Program Files (x86)\WSE_Lasaoren\\, In Quarantäne, [b732df2a701bf83ea48a53cc39ca639d] PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|URL, hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}, In Quarantäne, [3dac61a84c3f2f0719c3809d5da6ce32] PUP.Optional.FastStart.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|faststartff@gmail.com, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com, In Quarantäne, [3aaf31d805861a1c82b0a2ef4bb9da26] PUP.Optional.SearchEngine.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|searchengine@gmail.com, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\searchengine@gmail.com, In Quarantäne, [8465b356cdbeb680d43ff3a99f6518e8] PUP.Optional.IStart.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|istart_ffnt@gmail.com, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\istart_ffnt@gmail.com, In Quarantäne, [bb2e27e22d5e0b2bd3b2012460a3bb45] PUP.Optional.SweetSearch.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|sweetsearch@gmail.com, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com, In Quarantäne, [a44534d594f7f442e49b41de7e85f50b] PUP.Optional.MiuiTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPDP|dir, C:\Program Files (x86)\MiuiTab, In Quarantäne, [fbee59b092f9181ee623b8f741c3f30d] PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB|ptid, wpm040732, In Quarantäne, [0bde52b77a1176c06359c879ab587c84] PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}|URL, hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}, In Quarantäne, [a84167a2c1ca3ef86626c1607a89bf41] PUP.Optional.Conduit.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}|SuggestionsURL_JSON, hxxp://suggest.seccint.com/CSuggestJson.ashx?prefix={searchTerms}, In Quarantäne, [6c7de22723685cdaaa308a960ff435cb] PUP.Optional.Trovi.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}|DisplayName, Trovi search, In Quarantäne, [5d8cb455bfccd561d9c2dfbfc34139c7] PUP.Optional.Trovi.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}|TopResultURL, hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3322197&octid=EB_ORIGINAL_CTID&ISID=MD80C5FFC-C33E-47D9-AC4C-6548469089DB&SearchSource=58&CUI=&UM=6&UP=SP2E003C0D-CC8E-4543-BB51-AED908D7F6BE&q={searchTerms}&SSPV=, In Quarantäne, [b4350ffac0cb77bfc0db247ab054af51] PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|URL, hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}, In Quarantäne, [d31641c81f6c87af0785de437192ac54] PUP.Optional.Lasaoren.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|TopResultURLFallback, hxxp://Lasaoren.com/results.php?f=4&q={searchTerms}&a=lrn_secureddownload_14_45_ff&cd=2XzuyEtN2Y1L1QzuzzyEtA0AyE0BtDtBzy0E0B0DtCtByD0DtN0D0Tzu0StCtDyEyEtN1L2XzutAtFyCtFtCtFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyB0AyDtCyDtByD0AtGyBzy0C0AtGtDzyyByDtGtAyC0ByCtGtDyD0B0DtB0CyBzz0AyC0C0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0DyEtAtAtAyB0AtDtG0AyE0EyCtGyE0EyD0CtGzz0DyD0BtGtAyDyEtD0CzytByDyD0D0E0C2Q&cr=814032143&ir=, In Quarantäne, [2dbc010858338aac18532d71f50ffe02] PUP.Optional.Lasaoren.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}, Lasaoren, In Quarantäne, [2dbccc3d355685b1ef7c158906fea759] PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}|URL, hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}, In Quarantäne, [e108f3166724092dbfcd051c659ed030] PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}|FaviconURL, hxxp://www.delta-homes.com//favicon.ico, In Quarantäne, [16d34cbdfb90fa3c0f7d948d25de718f] PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|URL, hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}, In Quarantäne, [ecfdf3160b8068ce206cde43b1522ed2] PUP.Optional.WebsSearches.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|TopResultURL, hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}, In Quarantäne, [3eab2ddca3e8bf7715c6e33a758e0ff1] PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{A25AC313-DD19-4238-ACA2-401D6BEE4321}|URL, hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}, In Quarantäne, [ebfe0009fc8f7fb7206cca57bc473ec2] PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{E733165D-CBCF-4FDA-883E-ADEF965B476C}|URL, hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}, In Quarantäne, [5b8e15f4aae164d2fe8e3be69172d030] PUP.Optional.IStart.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MOZILLA\EXTENDS|appid, istart_ffnt@gmail.com, In Quarantäne, [5594a4655f2ccd6969ae9a8c16ed51af] Registrierungsdaten: 14 PUP.Optional.WebsSearches, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}),Ersetzt,[6188ef1aa1ea40f66812f94ec441cd33] PUP.Optional.Delta.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249, Gut: (www.google.com), Schlecht: (hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249),Ersetzt,[b4350cfd98f3e2543825c68de91c6c94] PUP.Optional.Delta.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249, Gut: (www.google.com), Schlecht: (hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249),Ersetzt,[6d7ca6639dee38feed700d46c73e758b] PUP.Optional.WebsSearches, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}),Ersetzt,[05e4b257f992ee48502a15323dc82cd4] PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[16d3dd2ce2a93ff7edbd7ad853b240c0] PUP.Optional.WebsSearches, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}),Ersetzt,[6386db2e06857eb897e3fe49ff06ce32] PUP.Optional.Delta.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249, Gut: (www.google.com), Schlecht: (hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249),Ersetzt,[10d937d23853d363b7a67ed5986d2ed2] PUP.Optional.Delta.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249, Gut: (www.google.com), Schlecht: (hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249),Ersetzt,[68814dbc9af1fc3a1d408bc8050060a0] PUP.Optional.WebsSearches, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}),Ersetzt,[9c4da564fe8d84b229518dbaea1b4fb1] PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[2fbaed1c315aab8be9c1bf93a85ddd23] PUP.Optional.WebsSearches, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://istart.webssearches.com/web/?type=dspp&ts=1417814128&from=cvs&uid=MTFDDAK256MAM&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=dspp&ts=1417814128&from=cvs&uid=MTFDDAK256MAM&q={searchTerms}),Ersetzt,[757458b1f8934ee8fd7ee364ef16758b] PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249, Gut: (www.google.com), Schlecht: (hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249),Ersetzt,[5198c9401e6dbc7a8fcfb89bfd084bb5] PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249, Gut: (www.google.com), Schlecht: (hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249),Ersetzt,[3eabf9100685979f3f1fc093a95c13ed] PUP.Optional.WebsSearches, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://istart.webssearches.com/web/?type=dspp&ts=1417814128&from=cvs&uid=MTFDDAK256MAM&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=dspp&ts=1417814128&from=cvs&uid=MTFDDAK256MAM&q={searchTerms}),Ersetzt,[6386b554e2a97bbb3c3f71d6db2a6e92] Ordner: 135 PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\index-dir, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\databases, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\IndexedDB, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Local Storage, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], PUP.Optional.Picexa.A, C:\Users\admin\AppData\Roaming\Picexa Viewer\log, In Quarantäne, [5594af5a612a60d624b963436e9620e0], PUP.Optional.Picexa.A, C:\Users\admin\AppData\Roaming\Picexa Viewer, In Quarantäne, [5594af5a612a60d624b963436e9620e0], PUP.Optional.Picexa.A, C:\Users\admin\AppData\Roaming\Picexa Viewer\update, In Quarantäne, [5594af5a612a60d624b963436e9620e0], PUP.Optional.Picexa.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picexa, In Quarantäne, [569335d45f2c3ef85c84efb7ab590bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\include, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\include\tools, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\lib, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\module, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\pack, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\en, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\en-US, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\es, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\es-419, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\fr, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\fr-BE, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\fr-CA, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\fr-CH, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\fr-LU, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\it, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\it-CH, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\pl, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\pt-BR, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\ru, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\ru-MO, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\tr, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\vi, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\zh-CN, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\zh-TW, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\skin, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\defaults, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\defaults\preferences, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\modules, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect, In Quarantäne, [8b5eda2f602bf5410f2efbfbb250718f], PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update, In Quarantäne, [8b5eda2f602bf5410f2efbfbb250718f], PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate, In Quarantäne, [9455c4457813cb6b66ca7e8c1fe41fe1], PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate\update, In Quarantäne, [9455c4457813cb6b66ca7e8c1fe41fe1], PUP.Optional.SearchEngine.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\searchengine@gmail.com, In Quarantäne, [559478911c6fe84e48622ce13cc715eb], PUP.Optional.SearchEngine.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\searchengine@gmail.com\chrome, In Quarantäne, [559478911c6fe84e48622ce13cc715eb], PUP.Optional.SearchEngine.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\searchengine@gmail.com\chrome\content, In Quarantäne, [559478911c6fe84e48622ce13cc715eb], PUP.Optional.SearchEngine.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\searchengine@gmail.com\chrome\skin, In Quarantäne, [559478911c6fe84e48622ce13cc715eb], PUP.Optional.ExpressFind.A, C:\ProgramData\77790361-426c-4fa2-8cf3-5994543d685d, In Quarantäne, [b237bf4ac5c6b77f00060f01aa59916f], PUP.Optional.ExpressFind.A, C:\ProgramData\77790361-426c-4fa2-8cf3-5994543d685d\plugincontainer, In Quarantäne, [b237bf4ac5c6b77f00060f01aa59916f], PUP.Optional.ExpressFind.A, C:\ProgramData\77790361-426c-4fa2-8cf3-5994543d685d\plugins, In Quarantäne, [b237bf4ac5c6b77f00060f01aa59916f], PUP.Optional.ExpressFind.A, C:\ProgramData\77790361-426c-4fa2-8cf3-5994543d685d\plugins\3, In Quarantäne, [b237bf4ac5c6b77f00060f01aa59916f], PUP.Optional.ExpressFind.A, C:\ProgramData\77790361-426c-4fa2-8cf3-5994543d685d\plugins\3bak, In Quarantäne, [b237bf4ac5c6b77f00060f01aa59916f], PUP.Optional.ExpressFind.A, C:\ProgramData\77790361-426c-4fa2-8cf3-5994543d685d\plugins\5, In Quarantäne, [b237bf4ac5c6b77f00060f01aa59916f], PUP.Optional.ExpressFind.A, C:\ProgramData\77790361-426c-4fa2-8cf3-5994543d685d\plugins\5bak, In Quarantäne, [b237bf4ac5c6b77f00060f01aa59916f], PUP.Optional.ExpressFind.A, C:\ProgramData\77790361-426c-4fa2-8cf3-5994543d685d\plugins\8, In Quarantäne, [b237bf4ac5c6b77f00060f01aa59916f], PUP.Optional.ExpressFind.A, C:\ProgramData\77790361-426c-4fa2-8cf3-5994543d685d\plugins\8bak, In Quarantäne, [b237bf4ac5c6b77f00060f01aa59916f], PUP.Optional.ExpressFind.A, C:\Program Files (x86)\Common Files\77790361-426c-4fa2-8cf3-5994543d685d, In Quarantäne, [8762ff0acac1b086907730e0ce356898], PUP.Optional.ExpressFind.A, C:\Program Files (x86)\Common Files\77790361-426c-4fa2-8cf3-5994543d685d\updater, In Quarantäne, [8762ff0acac1b086907730e0ce356898], PUP.Optional.ExpressFind.A, C:\Program Files (x86)\Express Find, In Quarantäne, [12d71dec177485b1061154bc818201ff], PUP.Optional.ExpressFind.A, C:\Program Files (x86)\Express Find\Extensions, In Quarantäne, [12d71dec177485b1061154bc818201ff], PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7], PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com\chrome, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7], PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com\chrome\content, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7], PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com\chrome\skin, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7], PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com\modules, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\include, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\include\tools, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\lib, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\module, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\pack, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\en, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\en-US, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\es, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\es-419, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\fr, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\fr-BE, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\fr-CA, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\fr-CH, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\fr-LU, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\it, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\it-CH, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\pl, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\pt-BR, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\ru, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\ru-MO, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\tr, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\vi, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\zh-CN, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\zh-TW, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\skin, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\defaults, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\defaults\preferences, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\modules, In Quarantäne, [ebfee227246753e359287b96aa59c040], PUP.Optional.SweetSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com, In Quarantäne, [5198df2a8a01e650671b58b9dc27b848], PUP.Optional.SweetSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com\chrome, In Quarantäne, [5198df2a8a01e650671b58b9dc27b848], PUP.Optional.SweetSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com\chrome\content, In Quarantäne, [5198df2a8a01e650671b58b9dc27b848], PUP.Optional.SweetSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com\chrome\skin, In Quarantäne, [5198df2a8a01e650671b58b9dc27b848], PUP.Optional.WebExtend.A, C:\Users\admin\AppData\Roaming\WebExtend, In Quarantäne, [1fca8c7de3a86fc74bd6120008fbbb45], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\image, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\img, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\en-US, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\es-419, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\es-ES, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-BE, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-CA, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-CH, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-FR, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-LU, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\it-CH, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\it-IT, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\pl, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\pt, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\pt-BR, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\ru, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\ru-MO, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\tr-TR, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\vi-VI, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\zh-CN, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\zh-TW, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], PUP.Optional.SupTab.A, C:\Users\admin\SupTab, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af], Code:
ATTFilter Dateien: 362
PUP.Optional.DownloadGuide, C:\Users\admin\Downloads\PhotoScape_V3.6.5.exe, In Quarantäne, [8f5ae3269dee8ea8e449f262f110c63a],
PUP.Optional.InstallCore, C:\Users\admin\Downloads\picasa_setup.exe, In Quarantäne, [61881fea404bfb3bec5e8afc8c7905fb],
PUP.Optional.DownloadGuide, C:\Users\admin\Downloads\PhotoScape_V3.6.5(1).exe, In Quarantäne, [a44517f2a8e3cc6a909df46012efcc34],
PUP.Optional.DownloadGuide.A, C:\Users\admin\Downloads\Dropbox_2.10.40_CB-DL-Manager.exe, In Quarantäne, [50992bde464540f6847bd3d605fc837d],
PUP.Optional.Lasaoren.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\searchplugins\Lasaoren.xml, In Quarantäne, [d81125e49cefab8bb677aa93699a659b],
PUP.Optional.Delta.ShrtCln, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\searchplugins\delta-homes.xml, In Quarantäne, [34b5d5342f5cd2644d2b0e3fce351be5],
PUP.Optional.WebsSearches.A, C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\webssearches.xml, In Quarantäne, [f0f940c91477eb4bca6ae675b350b050],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\QuotaManager-journal, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\cookies, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\cookies-journal, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\QuotaManager, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\website.ico, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\05ff7aa027ded9b9_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\06103210ae5eb92b_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\0898a7127ee82f8f_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\0965e8217a127c2c_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\1041015f9233625e_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\10d56a2bfd90d48a_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\133ad3275ce900a2_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\19d84e595d8acdd8_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\1dafb2ed7113577d_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\95ddd53adf512dbc_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\97b38689ccb7555d_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\97c34b7c9179ae2c_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\9873f2673c3d8526_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\994a5eb4097b9a48_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\9a892590ca2fc6be_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\9ae29e3aa2842aa4_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\9b2d4542638c8d16_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\9b4012bd1d2d1072_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\9b82ccf4af53b6a8_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\5f75a92bd2957b35_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\5ff63e69bbe8fa3c_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\63d4ee9a9d42bc8c_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\654f0e1ca4374c53_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\67b8233399ef3c0a_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\6a46777b47d8863e_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\724344affef6866f_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\73094d84fde79b10_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\75857d5ed588a153_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\d95d79cbff1d0c73_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\d9ba3aa2fec10a15_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\de3ec9ddc2b44a14_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\de8e43b7133518e3_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\e0ea107913adae0a_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\e5037607f77dc331_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\e685b2ebc644ef56_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\e8f138151634cdee_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\e96840897e658496_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\ea34829245485817_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\ecfb11388b7aa485_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\edb699e63c7ce924_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\ee368c55bdf4deb0_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\f28780c6599b94f9_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\f2d573680310966b_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\f764108990553099_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\index, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\36201cb039264766_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\38628010c0fdbeaf_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\4269bab2f2409c5f_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\47cff2ba15008159_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\47e8420271c119db_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\4b62fe917181ed62_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\4c7b043df68ee6e0_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\4fc1d6c2f5c967dd_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\5065f3c1667cc082_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\53967fa8ca013df7_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\53d404518cfdeeee_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\59f8199c46c0ac72_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\c05916caaca1a201_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\c302cd6a980ea412_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\c89f38f36e14b01c_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\c97e1c023a3691fd_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\caa7243563bf80ae_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\cac3335e62156f19_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\cbc9138bfd5a95d8_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\cc73100810e7a377_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\ce6fbf4de7522baf_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\d17464ed1518ad1d_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\d3c58d3a88f5618a_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\34c65f273f242ede_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\5b61b13f31538e6d_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\76dddbb58cb7031b_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\94bef38ab05056c4_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\9c7627e2abfdccd9_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\bdfbf69242bfe131_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\d70ff74b0debd45f_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\7c000d76bf1f0157_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\7cc07ed3c66ea2df_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\803985260cc54636_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\83b903905e8ed28c_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\86285c0e2a5ab7a8_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\8a2abd4eed83e9d6_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\8dff389a62f2bd7d_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\931588a85f8c2743_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\94615c9a6099d7d2_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\20d08ebe23d790a4_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\294ff6649b79679e_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\2d616aaad663dffd_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\2e7742d72fca4eb8_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\2e7b1d54211b33d1_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\2ed7a48cdf691d09_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\305fcbb0ccbceb0d_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\314b1462e990072c_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\315a39b606bc4359_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\327e2f346370c855_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\a2dfb1d022eadb33_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\a502325b53a0ae16_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\a67a7318862561a7_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\a682a844981d4e40_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\a8d39bd6a3465001_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\a90f0297d5bfc8b2_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\ad16b48903615445_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\aeb7ec1701dd5ba5_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\aec9c1de677d8508_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\b129387bb9742eda_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\index-dir\the-real-index, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\databases\Databases.db, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\databases\Databases.db-journal, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\000005.bak, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\000005.ldb, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\000006.log, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\CURRENT, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\LOCK, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\LOG, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\LOG.old, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\MANIFEST-000004, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Local Storage\file__0.localstorage, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Local Storage\file__0.localstorage-journal, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63],
PUP.Optional.Picexa.A, C:\Users\admin\AppData\Roaming\Picexa Viewer\log\install.log, In Quarantäne, [5594af5a612a60d624b963436e9620e0],
PUP.Optional.Picexa.A, C:\Users\admin\AppData\Roaming\Picexa Viewer\log\uninstall.log, In Quarantäne, [5594af5a612a60d624b963436e9620e0],
PUP.Optional.Picexa.A, C:\Users\admin\AppData\Roaming\Picexa Viewer\log\upgrade.log, In Quarantäne, [5594af5a612a60d624b963436e9620e0],
PUP.Optional.Picexa.A, C:\Users\admin\AppData\Roaming\Picexa Viewer\update\px_update_v2.1.21.exe, In Quarantäne, [5594af5a612a60d624b963436e9620e0],
PUP.Optional.Picexa.A, C:\Users\admin\AppData\Roaming\Picexa Viewer\update\px_update_v2.1.24.exe, In Quarantäne, [5594af5a612a60d624b963436e9620e0],
PUP.Optional.Picexa.A, C:\Users\admin\AppData\Roaming\Picexa Viewer\update\px_update_v2.1.42.exe, In Quarantäne, [5594af5a612a60d624b963436e9620e0],
PUP.Optional.Picexa.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picexa\Picexa.lnk, In Quarantäne, [569335d45f2c3ef85c84efb7ab590bf5],
PUP.Optional.Picexa.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picexa\uninstall.lnk, In Quarantäne, [569335d45f2c3ef85c84efb7ab590bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome.manifest, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\install.rdf, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\index.html, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\quick_start.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\quick_start.xul, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\include\speed_dial.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\include\tools\about_blank_hook.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\include\tools\misc.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\include\tools\popup_image_helper.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\include\tools\urlrequestor.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\js.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\lib\doT.min.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\lib\jquery-2.1.0.min.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\lib\jquery.autocomplete.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\module\hotSearch.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\module\mostgrid.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\module\search.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\module\stat.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\pack\common.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\pack\ga.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\pack\xagainit.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\en\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\en-US\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\es\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\es-419\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\fr\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\fr-BE\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\fr-CA\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\fr-CH\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\fr-LU\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\it\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\it-CH\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\pl\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\pt-BR\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\ru\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\ru-MO\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\tr\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\vi\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\zh-CN\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\zh-TW\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\skin\default_logo.png, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\skin\googlelogo.png, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\skin\google_trends.png, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\skin\icon.png, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\skin\loading.gif, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\skin\logo.png, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\skin\newtab.ico, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\skin\simple.css, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\skin\style.css, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\defaults\preferences\fvd.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\defaults\preferences\preferences.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\modules\addonmanager.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\modules\aes.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\modules\config.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\modules\dialogs.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\modules\last_tab.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\modules\misc.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\modules\properties.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\modules\remoterequest.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\modules\restoreprefs.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\modules\settings.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5],
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update\conf, In Quarantäne, [8b5eda2f602bf5410f2efbfbb250718f],
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update\update.exe, In Quarantäne, [8b5eda2f602bf5410f2efbfbb250718f],
PUP.Optional.SearchEngine.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\searchengine@gmail.com\chrome.manifest, In Quarantäne, [559478911c6fe84e48622ce13cc715eb],
PUP.Optional.SearchEngine.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\searchengine@gmail.com\install.rdf, In Quarantäne, [559478911c6fe84e48622ce13cc715eb],
PUP.Optional.SearchEngine.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\searchengine@gmail.com\chrome\content\toolbar.js, In Quarantäne, [559478911c6fe84e48622ce13cc715eb],
PUP.Optional.SearchEngine.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\searchengine@gmail.com\chrome\content\toolbar.xul, In Quarantäne, [559478911c6fe84e48622ce13cc715eb],
PUP.Optional.SearchEngine.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\searchengine@gmail.com\chrome\skin\icon.png, In Quarantäne, [559478911c6fe84e48622ce13cc715eb],
PUP.Optional.ExpressFind.A, C:\ProgramData\77790361-426c-4fa2-8cf3-5994543d685d\temp, In Quarantäne, [b237bf4ac5c6b77f00060f01aa59916f],
PUP.Optional.ExpressFind.A, C:\Program Files (x86)\Express Find\7za.exe, In Quarantäne, [12d71dec177485b1061154bc818201ff],
PUP.Optional.ExpressFind.A, C:\Program Files (x86)\Express Find\Extensions\{7ab3cbb3-34f1-440b-b048-404cfae819c0}.xpi, In Quarantäne, [12d71dec177485b1061154bc818201ff],
PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com\chrome.manifest, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7],
PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com\install.rdf, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7],
PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com\chrome\content\main.js, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7],
PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com\chrome\content\main.xul, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7],
PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com\chrome\content\vgValidator.js, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7],
PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com\chrome\skin\icon.png, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7],
PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com\modules\XCipher.js, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome.manifest, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\install.rdf, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\awesome.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\awesome.xul, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\index.html, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\quick_start.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\quick_start.xul, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\include\speed_dial.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\include\tools\about_blank_hook.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\include\tools\misc.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\include\tools\popup_image_helper.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\include\tools\urlrequestor.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\js.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\lib\doT.min.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\lib\jquery-2.1.0.min.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\lib\jquery.autocomplete.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\module\hotSearch.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\module\mostgrid.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\module\search.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\module\stat.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\pack\common.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\pack\ga.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\pack\xagainit.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\en\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\en-US\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\es\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\es-419\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\fr\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\fr-BE\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\fr-CA\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\fr-CH\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\fr-LU\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\it\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\it-CH\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\pl\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\pt-BR\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\ru\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\ru-MO\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\tr\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\vi\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\zh-CN\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\zh-TW\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\skin\default_logo.png, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\skin\googlelogo.png, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\skin\google_trends.png, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\skin\icon.png, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\skin\loading.gif, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\skin\logo.png, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\skin\luck.png, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\skin\newtab.ico, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\skin\simple.css, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\skin\style.css, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\defaults\preferences\fvd.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\defaults\preferences\preferences.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\modules\addonmanager.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\modules\aes.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\modules\config.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\modules\dialogs.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\modules\last_tab.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\modules\misc.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\modules\properties.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\modules\remoterequest.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\modules\restoreprefs.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\modules\settings.js, In Quarantäne, [ebfee227246753e359287b96aa59c040],
PUP.Optional.SweetSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com\chrome.manifest, In Quarantäne, [5198df2a8a01e650671b58b9dc27b848],
PUP.Optional.SweetSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com\install.rdf, In Quarantäne, [5198df2a8a01e650671b58b9dc27b848],
PUP.Optional.SweetSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com\chrome\content\toolbar.js, In Quarantäne, [5198df2a8a01e650671b58b9dc27b848],
PUP.Optional.SweetSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com\chrome\content\toolbar.xul, In Quarantäne, [5198df2a8a01e650671b58b9dc27b848],
PUP.Optional.SweetSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com\chrome\skin\icon.png, In Quarantäne, [5198df2a8a01e650671b58b9dc27b848],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\conf, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\ffsearch_toolbar!1.0.0.1031.xpi, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\install.data, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\msvcp110.dll, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\msvcr110.dll, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\searchProvider.xml, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\uninstall.exe, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\about.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\about_bk.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\btn.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\btn_apply.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\close.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\conf.xml, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\conf_back.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\input_bk.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\logo.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\main.xml, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\radio_1.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\radio_2.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\rigth_arrow.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\settings.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\data.html, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\indexIE.html, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\indexIE8.html, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\main.css, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\img\google_trends.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\img\icon128.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\img\icon16.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\img\icon48.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\img\loading.gif, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\img\logo32.ico, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\common.js, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\ga.js, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\jquery-1.11.0.min.js, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\jquery.autocomplete.js, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\jquery.xdomainrequest.min.js, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\js.js, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\library.js, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\xagainit-ie8.js, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\xagainit2.0.js, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\xdomain.min.js, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\en-US\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\es-419\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\es-ES\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-BE\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-CA\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-CH\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-FR\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-LU\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\it-CH\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\it-IT\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\pl\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\pt\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\pt-BR\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\ru\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\ru-MO\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\tr-TR\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\vi-VI\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\zh-CN\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\zh-TW\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2],
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\domain, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af],
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\expirationDate, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af],
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\hotsearch, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af],
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\hotsearch_uptime, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af],
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\name, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af],
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\path, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af],
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\set_country, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af],
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\set_z, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af],
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\TABts, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af],
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\uid, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af],
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\updateTime, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af],
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\url, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af],
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\_ver, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af],
PUP.Optional.Delta.ShrtCln, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://www.delta-homes.com/newtab/?type=nt&ts=1434713643&z=24f644d9902c60e32aeef35g1z3c4z7m0g7caqdzbz&from=ient06192&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249");), Ersetzt,[18d16b9e187393a3f3c6c2cae124c937]
PUP.Optional.Delta.ShrtCln, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js, Gut: (browser.startup.homepage", "https://www.malwarebytes.org/restorebrowser/), Schlecht: (browser.startup.homepage", "hxxp://www.delta-homes.com), Ersetzt,[36b368a1404b999d541fa9e60005f808]
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js, Gut: (), Schlecht: (faststartff@gmail.com), Ersetzt,[b4359a6fe3a80f278ac08f012dd8e020]
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js, Gut: (), Schlecht: (quick_searchff@gmail.com), Ersetzt,[cf1a9673810a0036212b5a3619ecbe42]
PUP.Optional.SearchEngine.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js, Gut: (), Schlecht: (searchengine@gmail.com), Ersetzt,[88611feabad140f686c8aee2e81dba46]
Physische Sektoren: 0
(keine bösartigen Elemente erkannt)
(end)
Code:
ATTFilter # AdwCleaner v5.000 - Logfile created 17/08/2015 at 13:30:07
# Updated 14/08/2015 by Xplode
# Database : 2015-08-16.2 [Server]
# Operating system : Windows 7 Professional Service Pack 1 (x64)
# Username : admin - PHOENIX
# Running from : C:\Users\admin\Downloads\AdwCleaner_5.000.exe
# Option : Cleaning
***** [ Services ] *****
***** [ Folders ] *****
[-] Folder Deleted : C:\Program Files (x86)\PC Speed Maximizer
[-] Folder Deleted : C:\Program Files (x86)\STab
[-] Folder Deleted : C:\Program Files (x86)\Picexa
[-] Folder Deleted : C:\Users\admin\AppData\Roaming\RHEng
***** [ Files ] *****
[-] File Deleted : C:\END
[-] File Deleted : C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Picexa.lnk
[-] File Deleted : C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Play Games Online.url
[-] File Deleted : C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\user.js
[-] File Deleted : C:\Windows\Sysnative\log\iSafeKrnlCall.log
***** [ Shortcuts ] *****
***** [ Scheduled tasks ] *****
***** [ Registry ] *****
[-] Key Deleted : HKLM\SOFTWARE\Classes\PicexaViewer.bmp
[-] Key Deleted : HKLM\SOFTWARE\Classes\PicexaViewer.gif
[-] Key Deleted : HKLM\SOFTWARE\Classes\PicexaViewer.ico
[-] Key Deleted : HKLM\SOFTWARE\Classes\PicexaViewer.jpeg
[-] Key Deleted : HKLM\SOFTWARE\Classes\PicexaViewer.jpg
[-] Key Deleted : HKLM\SOFTWARE\Classes\PicexaViewer.png
[-] Key Deleted : HKLM\SOFTWARE\Classes\PicexaViewer.tif
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B853E835-9F24-4F4B-B55C-E554D15CCCD2}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{B002FFEB-D622-4EC8-A061-549681AAA56E}
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F}]
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A25AC313-DD19-4238-ACA2-401D6BEE4321}
[-] Key Deleted : HKCU\Software\SecuredDownload
[-] Key Deleted : HKCU\Software\simplytech
[-] Key Deleted : HKCU\Software\V9
[-] Key Deleted : HKLM\SOFTWARE\hdcode
[-] Key Deleted : HKLM\SOFTWARE\SiteSee
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Linkey
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Picexa
[!] Key Not Deleted : [x64] HKCU\Software\SecuredDownload
[!] Key Not Deleted : [x64] HKCU\Software\simplytech
[!] Key Not Deleted : [x64] HKCU\Software\V9
***** [ Web browsers ] *****
[-] [C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js] [Preference] Deleted : user_pref("browser.search.searchengine.iconURL", "hxxp://search.delta-homes.com/favicon.ico");
[-] [C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js] [Preference] Deleted : user_pref("browser.search.searchengine.url", "hxxp://search.delta-homes.com/web/?type=ds&ts=1434713643&z=24f644d9902c60e32aeef35g1z3c4z7m0g7caqdzbz&from=ient06192&uid=MTFDDAK256MAM-1K12_1246091C424909[...]
[-] [C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js] [Preference] Deleted : user_pref("extensions.quick_start.enable_search1", false);
[-] [C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js] [Preference] Deleted : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);
[-] [C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js] [Preference] Deleted : user_pref("extensions.srchlsrn.hmpgUrl", "hxxp://Lasaoren.com/?f=1&a=lrn_secureddownload_14_45_ff&cd=2XzuyEtN2Y1L1QzuzzyEtA0AyE0BtDtBzy0E0B0DtCtByD0DtN0D0Tzu0StCtDyEyEtN1L2XzutAtFyCtFtCtFtDtN1L1CzutCy[...]
[-] [C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js] [Preference] Deleted : user_pref("extensions.srchlsrn.newTabUrl", "hxxp://Lasaoren.com/?f=2&a=lrn_secureddownload_14_45_ff&cd=2XzuyEtN2Y1L1QzuzzyEtA0AyE0BtDtBzy0E0B0DtCtByD0DtN0D0Tzu0StCtDyEyEtN1L2XzutAtFyCtFtCtFtDtN1L1Czut[...]
[-] [C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js] [Preference] Deleted : user_pref("extensions.srchlsrn.prtnrId", "WSE_Lasaoren");
[-] [C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js] [Preference] Deleted : user_pref("extensions.srchlsrn.srchPrvdr", "Lasaoren");
[-] [C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js] [Preference] Deleted : user_pref("extensions.srchlsrn.tlbrSrchUrl", "hxxp://Lasaoren.com/?f=3&a=lrn_secureddownload_14_45_ff&cd=2XzuyEtN2Y1L1QzuzzyEtA0AyE0BtDtBzy0E0B0DtCtByD0DtN0D0Tzu0StCtDyEyEtN1L2XzutAtFyCtFtCtFtDtN1L1Cz[...]
*************************
:: Proxy settings cleared
:: Winsock settings cleared
!! Unable to delete Internet Explorer policies
!! Unable to delete Chrome policies
*************************
C:\AdwCleaner[C1].txt - [5216 octets] - [17/08/2015 13:30:07]
C:\AdwCleaner[S1].txt - [4924 octets] - [17/08/2015 13:28:21]
C:\AdwCleaner[S2].txt - [4987 octets] - [17/08/2015 13:29:20]
########## EOF - C:\AdwCleaner[C1].txt - [5405 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.5.6 (08.10.2015:1)
OS: Windows 7 Professional x64
Ran by admin on 17.08.2015 at 13:33:00.12
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
~~~ Registry Values
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{FE6BE06B-7324-4D38-AD78-79507F307D7D}
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{FE6BE06B-7324-4D38-AD78-79507F307D7D}
~~~ Files
~~~ Folders
Successfully deleted: [Folder] C:\Users\admin\AppData\Roaming\goldengate
~~~ FireFox
Successfully deleted the following from C:\Users\admin\AppData\Roaming\mozilla\firefox\profiles\8u5y4rmx.default\prefs.js
user_pref(browser.search.defaultenginename, delta-homes);
user_pref(browser.search.searchengine.alias, delta-homes);
user_pref(browser.search.searchengine.desc, this is my first firefox searchEngine);
user_pref(browser.search.searchengine.name, delta-homes);
user_pref(browser.search.searchengine.ptid, ient06192);
user_pref(browser.search.searchengine.uid, MTFDDAK256MAM-1K12_1246091C4249091C4249);
user_pref(browser.search.selectedEngine, delta-homes);
Emptied folder: C:\Users\admin\AppData\Roaming\mozilla\firefox\profiles\8u5y4rmx.default\minidumps [2 files]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 17.08.2015 at 13:35:01.43
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
17.08.2015, 12:47
| #14 |
| | Kaspersky 2015 meldet dauernd not-a-virus FRST Teil 1 Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:16-08-2015
durchgeführt von admin (Administrator) auf PHOENIX (17-08-2015 13:38:02)
Gestartet von C:\Users\admin\Downloads
Geladene Profile: admin (Verfügbare Profile: admin)
Platform: Windows 7 Professional Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Opera)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera_crashreporter.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Farbar) C:\Users\admin\Downloads\FRST64 (1).exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1664000 2012-11-12] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2812656 2014-01-24] (Synaptics Incorporated)
HKLM-x32\...\Run: [QLBController] => C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe [336672 2014-02-10] (Hewlett-Packard Company)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-29] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292088 2013-02-22] (Intel Corporation)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7063832 2014-11-21] (Piriform Ltd)
HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\...\Run: [HP ENVY 5640 series (NET)] => C:\Program Files\HP\HP ENVY 5640 series\Bin\ScanToPCActivationApp.exe [3483656 2014-08-22] (Hewlett-Packard Development Company, LP)
HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\...\Run: [Dropbox Update] => C:\Users\admin\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-19] (Dropbox, Inc.)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-05-13] (Microsoft Corporation)
Startup: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2014-08-17]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-10-10]
ShortcutTarget: Dropbox.lnk -> C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk [2015-07-04]
ShortcutTarget: phase-6 Reminder.lnk -> C:\Users\admin\AppData\Local\phase-6\phase-6-compendio\reminder\reminder.exe (phase-6)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-06] (Dropbox, Inc.)
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-06-09] (Microsoft Corporation)
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-25] (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-06-09] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-06-16] (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-25] (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-07-04] (Oracle Corporation)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-06-09] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-07-04] (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
Toolbar: HKLM - Perfect PDF 8 - {FE6BE06B-7324-4D38-AD78-79507F307D7D} - C:\Program Files (x86)\soft Xpansion\Perfect PDF 8\ieagent64.dll [2014-12-14] (soft Xpansion)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{AE055004-6C80-4B3B-9C81-902050B152BE}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{F059243C-D0C1-44EE-AE24-7E9B8859776A}: [DhcpNameServer] 192.168.1.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
FireFox:
========
FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default
FF Homepage: https://www.malwarebytes.org/restorebrowser//?type=hp&ts=1434713643&z=24f644d9902c60e32aeef35g1z3c4z7m0g7caqdzbz&from=ient06192&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-10] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-01-31] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-10] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-07-04] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-07-04] (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-10-25] ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-10-25] ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-10-25] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-08-16] (Microsoft Corporation)
FF Plugin-x32: @soft-xpansion/npsxpdf -> C:\Program Files (x86)\Common Files\soft Xpansion\np-sxpdf.dll [2014-12-14] (soft-Xpansion)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1824315975-2186341827-1397389162-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2015-08-08] ()
FF Extension: Elegant Advisor - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\{20fec063-c59d-0c63-9ae8-03180eee7f1e} [2015-06-07]
FF Extension: My Swisscom Assistant - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\{} [2015-02-10]
FF Extension: Express Find - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\{7ab3cbb3-34f1-440b-b048-404cfae819c0}.xpi [2015-04-11]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions: [{067A541B-C896-42F1-92EA-79C69EF90ED5}] - C:\ProgramData\soft Xpansion\Perfect PDF 8\Data\fftb
FF Extension: Perfect PDF 8 - C:\ProgramData\soft Xpansion\Perfect PDF 8\Data\fftb [2014-12-14]
FF HKLM-x32\...\Thunderbird\Extensions: [{067A541B-C896-42F1-92EA-79C69EF90ED5}] - C:\ProgramData\soft Xpansion\Perfect PDF 8\Data\fftb
FF Extension: Kein Name - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com [nicht gefunden]
FF Extension: Kein Name - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com [nicht gefunden]
FF Extension: Kein Name - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com [nicht gefunden]
FF Extension: Kein Name - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com [nicht gefunden]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2015-08-02] (BitRaider, LLC)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2753720 2015-07-01] (Microsoft Corporation)
S2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe [683296 2014-02-10] (Hewlett-Packard Company)
S3 hpqwmiex; C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe [1006424 2013-01-23] (Hewlett-Packard Company) [Datei ist nicht signiert]
S2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89840 2015-03-28] (Hewlett-Packard Company)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2013-10-11] ()
S2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [327680 2012-11-12] (IDT, Inc.) [Datei ist nicht signiert]
S3 SXDS10; C:\Program Files (x86)\Common Files\soft Xpansion\sxds10.exe [234096 2014-12-14] (soft Xpansion)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3671792 2013-10-11] (Intel® Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [141320 2014-10-25] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [793800 2014-10-25] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1866080 2012-11-28] ()
S3 BRDriver64_1_3_3_E02B25FC; \??\C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-08-17 13:38 - 2015-08-17 13:38 - 00021176 _____ C:\Users\admin\Downloads\FRST.txt
2015-08-17 13:37 - 2015-08-17 13:37 - 02173440 _____ (Farbar) C:\Users\admin\Downloads\FRST64 (1).exe
2015-08-17 13:35 - 2015-08-17 13:35 - 00001660 _____ C:\Users\admin\Desktop\JRT.txt
2015-08-17 13:32 - 2015-08-17 13:32 - 01791580 _____ (Malwarebytes Corporation) C:\Users\admin\Downloads\JRT.exe
2015-08-17 13:30 - 2015-08-17 13:30 - 00005490 _____ C:\Users\admin\Desktop\AdwCleaner[C1].txt
2015-08-17 13:29 - 2015-08-17 13:29 - 00004987 _____ C:\Users\admin\Desktop\AdwCleaner[S2].txt
2015-08-17 13:28 - 2015-08-17 13:30 - 00000000 ____D C:\AdwCleaner
2015-08-17 13:28 - 2015-08-17 13:28 - 00004924 _____ C:\Users\admin\Desktop\AdwCleaner[S1].txt
2015-08-17 13:27 - 2015-08-17 13:27 - 01563648 _____ C:\Users\admin\Downloads\AdwCleaner_5.000.exe
2015-08-17 13:24 - 2015-08-17 13:24 - 00106146 _____ C:\Users\admin\Desktop\mbam.txt
2015-08-17 13:22 - 2015-08-17 13:30 - 00158348 _____ C:\Windows\PFRO.log
2015-08-17 13:22 - 2015-08-17 13:30 - 00000112 _____ C:\Windows\setupact.log
2015-08-17 13:22 - 2015-08-17 13:22 - 00000000 _____ C:\Windows\setuperr.log
2015-08-17 13:14 - 2015-08-17 13:14 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-08-17 13:12 - 2015-08-17 13:13 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\admin\Downloads\mbam-setup-2.1.8.1057 (1).exe
2015-08-17 11:19 - 2015-08-17 11:19 - 00000000 ____D C:\Users\admin\Documents\Benutzerdefinierte Office-Vorlagen
2015-08-16 04:14 - 2015-07-30 15:13 - 00124624 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-08-16 04:14 - 2015-07-30 15:13 - 00103120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-08-16 00:02 - 2015-07-28 22:09 - 00017344 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-08-16 00:02 - 2015-07-28 22:05 - 01116672 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-08-16 00:02 - 2015-07-28 22:05 - 00774656 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-08-16 00:02 - 2015-07-28 22:05 - 00743424 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-08-16 00:02 - 2015-07-28 22:05 - 00437760 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-08-16 00:02 - 2015-07-28 22:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-08-16 00:02 - 2015-07-28 22:05 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-08-16 00:02 - 2015-07-28 21:55 - 01148416 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-08-16 00:01 - 2015-07-16 21:12 - 06131200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-08-16 00:01 - 2015-07-16 21:12 - 00856064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2015-08-16 00:01 - 2015-07-16 21:12 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2015-08-16 00:01 - 2015-07-16 21:11 - 07077376 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-08-16 00:01 - 2015-07-16 21:11 - 01057792 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2015-08-16 00:01 - 2015-07-16 21:11 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2015-08-16 00:01 - 2015-07-15 20:15 - 05568960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-08-16 00:01 - 2015-07-15 20:15 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-08-16 00:01 - 2015-07-15 20:15 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-08-16 00:01 - 2015-07-15 20:15 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-08-16 00:01 - 2015-07-15 20:12 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-08-16 00:01 - 2015-07-15 20:11 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-08-16 00:01 - 2015-07-15 20:11 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-08-16 00:01 - 2015-07-15 20:11 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-08-16 00:01 - 2015-07-15 20:11 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-08-16 00:01 - 2015-07-15 20:11 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 01743360 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-08-16 00:01 - 2015-07-15 20:10 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-08-16 00:01 - 2015-07-15 20:10 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-08-16 00:01 - 2015-07-15 20:10 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-08-16 00:01 - 2015-07-15 20:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-08-16 00:01 - 2015-07-15 20:09 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-08-16 00:01 - 2015-07-15 20:05 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-08-16 00:01 - 2015-07-15 20:05 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:59 - 03989952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-08-16 00:01 - 2015-07-15 19:59 - 03934656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-08-16 00:01 - 2015-07-15 19:56 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-08-16 00:01 - 2015-07-15 19:55 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-08-16 00:01 - 2015-07-15 19:55 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-08-16 00:01 - 2015-07-15 19:55 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-08-16 00:01 - 2015-07-15 19:55 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-08-16 00:01 - 2015-07-15 19:55 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-08-16 00:01 - 2015-07-15 19:54 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-08-16 00:01 - 2015-07-15 19:54 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-08-16 00:01 - 2015-07-15 19:54 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-08-16 00:01 - 2015-07-15 19:54 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-08-16 00:01 - 2015-07-15 19:54 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-08-16 00:01 - 2015-07-15 19:54 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-08-16 00:01 - 2015-07-15 19:54 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-08-16 00:01 - 2015-07-15 19:53 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-08-16 00:01 - 2015-07-15 19:53 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-08-16 00:01 - 2015-07-15 19:53 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-08-16 00:01 - 2015-07-15 19:53 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-08-16 00:01 - 2015-07-15 19:53 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-08-16 00:01 - 2015-07-15 19:53 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-08-16 00:01 - 2015-07-15 19:49 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-08-16 00:01 - 2015-07-15 19:48 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 18:46 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-08-16 00:01 - 2015-07-15 18:46 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-08-16 00:01 - 2015-07-15 18:46 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-08-16 00:01 - 2015-07-15 18:37 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-08-16 00:01 - 2015-07-15 18:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-08-16 00:01 - 2015-07-15 18:34 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 18:34 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 18:34 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 18:34 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-08-16 00:01 - 2015-07-11 15:15 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2015-08-16 00:00 - 2015-07-15 05:19 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\basesrv.dll
2015-08-15 23:59 - 2015-07-21 02:39 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-08-15 23:59 - 2015-07-21 02:12 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-08-15 23:59 - 2015-07-16 23:14 - 25192448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-08-15 23:59 - 2015-07-16 22:54 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-08-15 23:59 - 2015-07-16 22:54 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-08-15 23:59 - 2015-07-16 22:37 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-08-15 23:59 - 2015-07-16 22:36 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-08-15 23:59 - 2015-07-16 22:36 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-08-15 23:59 - 2015-07-16 22:36 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-08-15 23:59 - 2015-07-16 22:35 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-08-15 23:59 - 2015-07-16 22:35 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-08-15 23:59 - 2015-07-16 22:27 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-08-15 23:59 - 2015-07-16 22:26 - 05923328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-08-15 23:59 - 2015-07-16 22:26 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-08-15 23:59 - 2015-07-16 22:23 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-08-15 23:59 - 2015-07-16 22:21 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-08-15 23:59 - 2015-07-16 22:21 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-08-15 23:59 - 2015-07-16 22:21 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-08-15 23:59 - 2015-07-16 22:21 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-08-15 23:59 - 2015-07-16 22:20 - 19870208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-08-15 23:59 - 2015-07-16 22:12 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-08-15 23:59 - 2015-07-16 22:08 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-08-15 23:59 - 2015-07-16 22:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-08-15 23:59 - 2015-07-16 22:00 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-08-15 23:59 - 2015-07-16 21:55 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-08-15 23:59 - 2015-07-16 21:54 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-08-15 23:59 - 2015-07-16 21:51 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-08-15 23:59 - 2015-07-16 21:51 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-08-15 23:59 - 2015-07-16 21:51 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-08-15 23:59 - 2015-07-16 21:50 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-08-15 23:59 - 2015-07-16 21:50 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-08-15 23:59 - 2015-07-16 21:49 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-08-15 23:59 - 2015-07-16 21:45 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-08-15 23:59 - 2015-07-16 21:43 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-08-15 23:59 - 2015-07-16 21:43 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-08-15 23:59 - 2015-07-16 21:41 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-08-15 23:59 - 2015-07-16 21:39 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-08-15 23:59 - 2015-07-16 21:39 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-08-15 23:59 - 2015-07-16 21:38 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-08-15 23:59 - 2015-07-16 21:36 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-08-15 23:59 - 2015-07-16 21:35 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-08-15 23:59 - 2015-07-16 21:34 - 14451200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-08-15 23:59 - 2015-07-16 21:33 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-08-15 23:59 - 2015-07-16 21:32 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-08-15 23:59 - 2015-07-16 21:29 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-08-15 23:59 - 2015-07-16 21:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-08-15 23:59 - 2015-07-16 21:20 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-08-15 23:59 - 2015-07-16 21:19 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-08-15 23:59 - 2015-07-16 21:17 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-08-15 23:59 - 2015-07-16 21:12 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-08-15 23:59 - 2015-07-16 21:12 - 02427904 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-08-15 23:59 - 2015-07-16 21:10 - 12856832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-08-15 23:59 - 2015-07-16 21:06 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-08-15 23:59 - 2015-07-16 21:06 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-08-15 23:59 - 2015-07-16 21:05 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-08-15 23:59 - 2015-07-16 21:01 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-08-15 23:59 - 2015-07-16 20:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-08-15 23:59 - 2015-07-16 20:42 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-08-15 23:59 - 2015-07-16 20:38 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-08-15 23:59 - 2015-07-16 20:37 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-08-15 23:58 - 2015-07-01 22:49 - 00260096 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2015-08-15 23:58 - 2015-07-01 22:48 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2015-08-15 23:58 - 2015-07-01 22:30 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2015-08-15 23:58 - 2015-07-01 22:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2015-08-15 23:57 - 2015-07-30 20:06 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2015-08-15 23:57 - 2015-07-30 20:06 - 01648128 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-08-15 23:57 - 2015-07-30 20:06 - 01180160 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-08-15 23:57 - 2015-07-30 20:06 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-08-15 23:57 - 2015-07-30 20:06 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-08-15 23:57 - 2015-07-30 20:06 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-08-15 23:57 - 2015-07-30 20:06 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-08-15 23:57 - 2015-07-30 19:57 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2015-08-15 23:57 - 2015-07-30 19:57 - 01251328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-08-15 23:57 - 2015-07-30 19:57 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-08-15 23:57 - 2015-07-30 19:57 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-08-15 23:57 - 2015-07-30 19:57 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-08-15 23:57 - 2015-07-30 19:55 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-08-15 23:57 - 2015-07-30 18:56 - 03208192 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-08-15 23:57 - 2015-07-30 18:52 - 00372736 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-08-15 23:57 - 2015-07-30 18:49 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-08-15 23:57 - 2015-07-15 05:19 - 02004992 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2015-08-15 23:57 - 2015-07-15 05:19 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-08-15 23:57 - 2015-07-15 05:14 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2015-08-15 23:57 - 2015-07-15 05:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-08-15 23:57 - 2015-07-15 04:55 - 01390592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2015-08-15 23:57 - 2015-07-15 04:55 - 01241088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-08-15 23:57 - 2015-07-15 04:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2015-08-15 23:57 - 2015-07-15 04:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-08-15 23:56 - 2015-07-20 20:12 - 03154944 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-08-15 23:56 - 2015-07-20 20:12 - 02606080 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-08-15 23:56 - 2015-07-20 20:12 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-08-15 23:56 - 2015-07-20 20:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-08-15 23:56 - 2015-07-20 20:12 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-08-15 23:56 - 2015-07-20 20:12 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-08-15 23:56 - 2015-07-20 20:12 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-08-15 23:56 - 2015-07-20 20:12 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-08-15 23:56 - 2015-07-20 20:12 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-08-15 23:56 - 2015-07-20 20:12 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-08-15 23:56 - 2015-07-20 20:12 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-08-15 23:56 - 2015-07-20 19:56 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-08-15 23:56 - 2015-07-20 19:56 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-08-15 23:56 - 2015-07-20 19:56 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-08-15 23:56 - 2015-07-20 19:56 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-08-15 23:56 - 2015-07-20 19:56 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-08-15 23:56 - 2015-07-10 19:51 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-08-15 23:56 - 2015-07-10 19:34 - 12875776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-08-15 23:56 - 2015-07-09 19:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\notepad.exe
2015-08-15 23:56 - 2015-07-09 19:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\notepad.exe
2015-08-15 23:56 - 2015-07-09 19:42 - 00179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
2015-08-15 23:44 - 2015-08-15 23:44 - 00000000 ____D C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-08-11 13:44 - 2015-08-11 13:44 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\admin\Downloads\mbam-setup-2.1.8.1057.exe
2015-08-10 17:42 - 2015-08-10 17:42 - 00000000 ____D C:\Windows\System32\Tasks\Leader Technologies
2015-08-10 17:42 - 2015-08-10 17:42 - 00000000 ____D C:\Users\admin\AppData\Roaming\Leadertech
2015-08-08 21:24 - 2015-08-08 21:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ubisoft
2015-08-08 12:55 - 2015-08-08 12:55 - 00380416 _____ C:\Users\admin\Downloads\Gmer-19357.exe
2015-08-08 12:51 - 2015-08-17 13:38 - 00000000 ____D C:\FRST
2015-08-08 12:50 - 2015-08-08 12:51 - 02169856 _____ (Farbar) C:\Users\admin\Downloads\FRST64.exe
2015-08-08 12:49 - 2015-08-08 12:49 - 00000000 _____ C:\Users\admin\defogger_reenable
2015-08-08 12:48 - 2015-08-08 12:48 - 00050477 _____ C:\Users\admin\Downloads\Defogger.exe
2015-08-08 01:11 - 2015-08-08 01:11 - 00000000 ____D C:\Users\admin\AppData\Local\Ubisoft Game Launcher
2015-08-08 00:52 - 2015-08-08 00:52 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2015-08-08 00:52 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2015-08-08 00:52 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2015-08-08 00:52 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2015-08-08 00:52 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2015-08-08 00:52 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2015-08-08 00:52 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll
2015-08-08 00:52 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2015-08-08 00:52 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2015-08-08 00:52 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2015-08-08 00:52 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2015-08-08 00:52 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2015-08-08 00:52 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2015-08-02 19:45 - 2015-08-02 19:45 - 00000000 ____D C:\Users\Public\Documents\BitRaider
2015-08-02 19:45 - 2015-08-02 19:45 - 00000000 ____D C:\ProgramData\BitRaider
2015-08-02 19:44 - 2015-08-02 19:44 - 00000000 ____D C:\Users\admin\AppData\Local\SWTORPerf
2015-08-02 19:40 - 2015-08-02 19:40 - 00000000 ____D C:\Program Files (x86)\Electronic Arts
2015-08-02 19:36 - 2015-08-02 19:37 - 29720272 _____ C:\Users\admin\Downloads\SWTOR_setup.exe
2015-08-01 02:21 - 2015-08-08 01:10 - 00000000 ____D C:\ProgramData\Solidshield
Code:
ATTFilter 2015-07-31 18:34 - 2009-03-16 14:18 - 00521560 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll
2015-07-31 18:34 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2015-07-31 18:34 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2015-07-31 18:34 - 2009-03-16 14:18 - 00174936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll
2015-07-31 18:34 - 2009-03-16 14:18 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll
2015-07-31 18:34 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 05425496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 02430312 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_41.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 01846632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_41.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 00520544 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_41.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2015-07-31 18:34 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2015-07-31 18:34 - 2008-07-10 11:00 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2015-07-31 18:34 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2015-07-31 18:34 - 2008-07-10 11:00 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2015-07-31 18:34 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2015-07-31 18:34 - 2008-07-10 11:00 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2015-07-31 18:34 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll
2015-07-31 18:34 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2015-07-31 18:34 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2015-07-31 18:34 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll
2015-07-31 18:34 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll
2015-07-31 18:34 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2015-07-31 18:34 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2015-07-31 18:34 - 2008-05-30 14:16 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 04991496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 01941528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2015-07-31 18:34 - 2008-03-05 16:04 - 00489480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll
2015-07-31 18:34 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll
2015-07-31 18:34 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2015-07-31 18:34 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll
2015-07-31 18:34 - 2008-03-05 16:00 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll
2015-07-31 18:34 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll
2015-07-31 18:34 - 2008-03-05 15:56 - 04910088 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll
2015-07-31 18:34 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2015-07-31 18:34 - 2008-03-05 15:56 - 01860120 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll
2015-07-31 18:34 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll
2015-07-31 18:34 - 2008-02-05 23:07 - 00529424 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll
2015-07-31 18:34 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll
2015-07-31 18:34 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll
2015-07-31 18:34 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2015-07-31 18:34 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll
2015-07-31 18:34 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
2015-07-31 18:34 - 2007-10-12 15:14 - 05081608 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_36.dll
2015-07-31 18:34 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
2015-07-31 18:34 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll
2015-07-31 18:34 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
2015-07-31 18:34 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll
2015-07-31 18:34 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
2015-07-31 18:34 - 2007-07-20 00:57 - 00411496 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_9.dll
2015-07-31 18:34 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 01985904 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_35.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_35.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2015-07-31 18:34 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2015-07-31 18:34 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2015-07-31 18:34 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2015-07-31 18:34 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2015-07-31 18:34 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2015-07-31 18:34 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2015-07-31 18:34 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll
2015-07-31 18:34 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2015-07-31 18:34 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2015-07-31 18:34 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2015-07-31 18:34 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll
2015-07-31 18:34 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2015-07-31 18:34 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2015-07-31 18:34 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2015-07-31 18:34 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2015-07-31 18:34 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2015-07-31 18:34 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2015-07-31 18:34 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2015-07-31 18:34 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2015-07-31 18:34 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2015-07-31 18:34 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll
2015-07-31 18:34 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2015-07-31 18:34 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2015-07-31 18:34 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2015-07-31 18:34 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2015-07-31 18:34 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
2015-07-31 18:34 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2015-07-31 18:34 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2015-07-31 18:34 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2015-07-31 18:34 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2015-07-31 18:34 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2015-07-31 18:34 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2015-07-31 18:34 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2015-07-31 18:34 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
2015-07-31 18:34 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2015-07-31 18:34 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2015-07-31 18:34 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2015-07-31 18:34 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2015-07-31 18:34 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2015-07-31 18:34 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2015-07-31 18:34 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2015-07-31 18:34 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2015-07-31 18:34 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2015-07-31 18:34 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2015-07-31 18:34 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2015-07-31 18:34 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2015-07-31 18:34 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2015-07-31 18:34 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2015-07-31 18:34 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2015-07-31 18:34 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2015-07-31 18:34 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2015-07-31 18:34 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2015-07-31 18:34 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2015-07-31 18:34 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2015-07-26 13:39 - 2015-05-09 20:26 - 00493504 _____ (Microsoft Corporation) C:\Windows\system32\mcupdate_GenuineIntel.dll
2015-07-26 13:39 - 2015-03-14 05:21 - 01632768 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-07-26 13:39 - 2015-03-14 05:21 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2015-07-26 13:39 - 2015-03-14 05:04 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-07-26 13:39 - 2015-03-14 05:04 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2015-07-24 18:53 - 2015-07-24 18:53 - 05439072 _____ (TeamViewer) C:\Users\admin\Downloads\TeamViewerQS_de.exe
2015-07-24 18:53 - 2015-07-24 18:53 - 00000000 ____D C:\Users\admin\AppData\Roaming\TeamViewer
2015-07-23 23:41 - 2015-06-02 02:07 - 00254976 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll
2015-07-23 23:41 - 2015-06-02 01:47 - 00210432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cewmdm.dll
2015-07-23 23:39 - 2015-06-09 20:03 - 03180544 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-07-23 23:39 - 2015-06-09 20:03 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-07-23 23:38 - 2015-06-17 19:47 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-23 23:38 - 2015-06-17 19:37 - 00312320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-07-23 23:32 - 2015-07-04 20:07 - 02087424 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-23 23:32 - 2015-07-04 19:48 - 01414656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-07-23 23:32 - 2015-04-27 21:23 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-07-23 23:32 - 2015-04-27 21:23 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-07-23 23:32 - 2015-04-27 21:23 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-07-23 23:32 - 2015-04-27 21:23 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-07-23 23:32 - 2015-04-27 21:05 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-07-23 23:32 - 2015-04-27 21:04 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-07-23 23:32 - 2015-04-27 21:04 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-07-23 23:32 - 2015-04-27 21:04 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-07-23 23:31 - 2015-06-15 23:50 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-07-23 23:31 - 2015-06-15 23:45 - 03242496 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-23 23:31 - 2015-06-15 23:45 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-07-23 23:31 - 2015-06-15 23:45 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2015-07-23 23:31 - 2015-06-15 23:45 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-07-23 23:31 - 2015-06-15 23:44 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-23 23:31 - 2015-06-15 23:43 - 02364416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-07-23 23:31 - 2015-06-15 23:43 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-07-23 23:31 - 2015-06-15 23:43 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2015-07-23 23:31 - 2015-06-15 23:42 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-07-23 23:31 - 2015-06-15 23:42 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2015-07-23 23:31 - 2015-06-15 23:37 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-08-17 13:37 - 2014-10-25 17:14 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2015-08-17 13:35 - 2009-07-14 19:58 - 00699342 _____ C:\Windows\system32\perfh007.dat
2015-08-17 13:35 - 2009-07-14 19:58 - 00149450 _____ C:\Windows\system32\perfc007.dat
2015-08-17 13:35 - 2009-07-14 07:13 - 01619284 _____ C:\Windows\system32\PerfStringBackup.INI
2015-08-17 13:33 - 2015-01-14 20:35 - 01386561 _____ C:\Windows\WindowsUpdate.log
2015-08-17 13:33 - 2009-07-14 06:45 - 00026528 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-08-17 13:33 - 2009-07-14 06:45 - 00026528 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-08-17 13:30 - 2015-05-14 13:17 - 00000000 ____D C:\Windows\system32\log
2015-08-17 13:30 - 2014-10-10 15:37 - 00000000 ___RD C:\Users\admin\Dropbox
2015-08-17 13:30 - 2014-10-10 15:35 - 00000000 ____D C:\Users\admin\AppData\Roaming\Dropbox
2015-08-17 13:30 - 2014-08-14 14:20 - 00000435 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2015-08-17 13:30 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-08-17 13:21 - 2015-02-14 22:56 - 00001115 _____ C:\Users\Public\Desktop\Opera.lnk
2015-08-17 13:21 - 2013-12-05 22:18 - 00000000 ____D C:\Users\admin
2015-08-17 13:21 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\Performance
2015-08-17 13:13 - 2015-06-19 22:52 - 00001224 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000UA.job
2015-08-17 13:00 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-08-17 10:53 - 2015-06-19 22:52 - 00001172 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000Core.job
2015-08-16 22:22 - 2014-12-13 23:33 - 00000000 ____D C:\Users\admin\Documents\Briefvorlagen
2015-08-16 22:18 - 2015-05-12 14:56 - 00000000 ____D C:\Users\admin\Documents\TAMY
2015-08-16 12:28 - 2009-07-14 06:45 - 00499752 _____ C:\Windows\system32\FNTCACHE.DAT
2015-08-16 04:15 - 2014-12-11 13:59 - 00000000 ____D C:\Windows\system32\appraiser
2015-08-16 04:15 - 2014-05-13 21:48 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-08-16 04:12 - 2014-05-13 19:48 - 00000000 ____D C:\Windows\system32\MRT
2015-08-16 04:10 - 2014-05-13 19:48 - 132483416 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-08-08 21:26 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-08-08 12:32 - 2015-06-19 13:34 - 00000000 ____D C:\Users\admin\AppData\Everything
2015-08-08 01:16 - 2014-05-13 19:21 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-08-08 00:35 - 2015-02-14 22:56 - 00003850 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1423947365
2015-08-08 00:35 - 2015-02-14 22:55 - 00000000 ____D C:\Program Files (x86)\Opera
2015-08-01 15:53 - 2015-07-04 13:46 - 00000000 ____D C:\Users\admin\.phase-6
2015-07-31 15:13 - 2015-04-13 12:37 - 00000000 ___SD C:\Windows\system32\GWX
2015-07-29 11:39 - 2015-07-10 19:29 - 00000000 ___HD C:\$Windows.~BT
2015-07-29 11:30 - 2013-12-05 22:07 - 00000000 ____D C:\Windows\Panther
2015-07-29 11:00 - 2015-04-13 12:37 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-07-27 07:25 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-07-26 13:44 - 2014-05-13 21:39 - 01593564 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2015-07-25 13:25 - 2014-08-16 21:49 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-07-25 13:22 - 2015-01-19 12:32 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-07-23 23:08 - 2015-06-19 22:52 - 00004194 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000UA
2015-07-23 23:08 - 2015-06-19 22:52 - 00003798 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000Core
2015-07-23 23:06 - 2014-08-16 21:14 - 00000000 ____D C:\Program Files\Microsoft Office 15
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2015-04-24 12:11 - 2015-04-24 12:11 - 0001099 _____ () C:\Users\admin\AppData\Roaming\ShiftN.ini
2015-02-13 17:54 - 2015-02-13 17:54 - 0000057 _____ () C:\ProgramData\Ament.ini
Einige Dateien in TEMP:
====================
C:\Users\admin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpndjxlh.dll
C:\Users\admin\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2015-08-17 12:53
==================== Ende von Ergebnis ============================
|
|
17.08.2015, 16:31
| #15 |
| /// Malwareteam | Kaspersky 2015 meldet dauernd not-a-virus Hi, Schritt # 1: FRST-Fix Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter CloseProcesses:
HKLM-x32\...\Run: [] => [X]
SearchScopes: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL =
FF Extension: Express Find - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\{7ab3cbb3-34f1-440b-b048-404cfae819c0}.xpi [2015-04-11]
FF Extension: Kein Name - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com [nicht gefunden]
FF Extension: Kein Name - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com [nicht gefunden]
FF Extension: Kein Name - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com [nicht gefunden]
FF Extension: Kein Name - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com [nicht gefunden]
EmtyTemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt # 2: ESET ESET Online Scanner
Schritt # 3: SecurityCheck Downloade Dir bitte  SecurityCheck und:
Schritt # 4: FRST Noch ein frisches FRST-Log bitte. Schritt # 5: Frage Noch Probleme? Schritt # 6: Bitte Posten
|
|
| Themen zu Kaspersky 2015 meldet dauernd not-a-virus |
| code, confused, dateien, dauernd, desinfizieren, einfügen, erstell, kaspersky, lange, lösch, löscht, melde, meldet, not-a-virus, poste, posten, quara, quarantäne |
Linear-Darstellung
