|
Plagegeister aller Art und deren Bekämpfung: Easycalender lässt sich nicht entfernenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
05.11.2015, 12:34 | #1 |
| Easycalender lässt sich nicht entfernen Hallo zusammen, ich habe seit gestern ein Problem: Und zwar habe ich mir scheinbar gestern beim runterladen eine Freeware noch paar Malwares o.ä. hinzugezogen. Ich habe sofort über die Systemsteuerung alles was neu dazu kam deinstalliert allerdings bin ich mir nun nicht sicher ob auch alles weg ist. Denn im Google Chrome Browser befindet sich immer noch das EasyCalender AddOn welches sich nicht löschen lässt da es "Durch Unternehmensrichtlinie installiert" wurde.... Nun plage ich mich auf Chrome durch dutzende Werbebanner rum die meine Surfqualität ziemlich beeinträchtigen. Über eure Hilfe würde ich mich sehr freuen! Mit freundlichen Grüßen, Martin P.S.: Das Problem habe ich bereits mit CCleaner und AdwCleaner versucht zu bekämpfen, aber scheinbar ohne Erfolg.. |
05.11.2015, 12:57 | #2 |
/// TB-Ausbilder | Easycalender lässt sich nicht entfernenMein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen. Bitte beachte folgende Hinweise:
Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags: So funktioniert es: Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Danke für deine Mitarbeit! Zur ersten Analyse bitte FRST und TDSS-Killer ausführen: Schritt 1 Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
Schritt 2 Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop
Bitte poste mit deiner nächsten Antwort
|
05.11.2015, 14:48 | #3 |
| Easycalender lässt sich nicht entfernen Hallo Matthias,
__________________vielen Dank erstmal, dass du mir hilfst! Anbei der: FRST.txt: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:04-11-2015 durchgeführt von Admin (Administrator) auf PC (05-11-2015 14:32:34) Gestartet von C:\Users\Admin\Desktop Geladene Profile: Admin (Verfügbare Profile: Admin) Platform: Windows 10 Pro (X64) Sprache: Deutsch (Deutschland) Internet Explorer Version 11 (Standard-Browser: Edge) Start-Modus: Normal Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Prozesse (Nicht auf der Ausnahmeliste) ================= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.) (AMD) C:\Windows\System32\atiesrxx.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe () C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe (@ByELDI) C:\Program Files\KMSpico\Service_KMS.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe (Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe (Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe (cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\spd.exe (AMD) C:\Windows\System32\atieclxx.exe (Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe (Microsoft Corporation) C:\Windows\System32\browser_broker.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\cfosspeed.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (FNet Co., Ltd.) C:\Program Files (x86)\XFastUSB\XFastUsb.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Kone Pure Mouse\KonePureMonitor.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe (Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe () C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe (Valve Corporation) C:\Program Files (x86)\Steam\GameOverlayUI.exe (Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe (Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe (Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe ==================== Registry (Nicht auf der Ausnahmeliste) =========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13636824 2013-07-26] (Realtek Semiconductor) HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation) HKLM\...\Run: [XFast LAN] => C:\Program Files\ASRock\XFast LAN\cFosSpeed.exe [2009952 2013-05-31] (cFos Software GmbH) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169744 2015-09-12] (Apple Inc.) HKLM-x32\...\Run: [XFastUSB] => C:\Program Files (x86)\XFastUSB\XFastUsb.exe [6311104 2014-12-15] (FNet Co., Ltd.) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-21] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [RoccatKonePure] => C:\Program Files (x86)\ROCCAT\Kone Pure Mouse\KonePureMonitor.EXE [561152 2014-01-20] (ROCCAT GmbH) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [GoogleChromeAutoLaunch_A5B343D047FD8BD2F268B0EA0F8DBD7C] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [811848 2015-10-20] (Google Inc.) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Spotify Web Helper] => C:\Users\Admin\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2021944 2015-06-17] (Spotify Ltd) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Spotify] => C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe [7323192 2015-06-17] (Spotify Ltd) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8551848 2015-10-19] (Piriform Ltd) HKU\S-1-5-18\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [43816 2015-04-26] (Apple Inc.) Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2015-02-06] ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation) GroupPolicy: Beschränkung - Chrome <======= ACHTUNG CHR HKLM\SOFTWARE\Policies\Google: Beschränkung <======= ACHTUNG ==================== Internet (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{947ba08f-6d7e-4686-b9ff-2806db41b1ff}: [DhcpNameServer] 192.168.0.1 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-09-29] (Microsoft Corporation) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-25] (Google Inc.) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-15] (Microsoft Corporation) BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-09-29] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-21] (Oracle Corporation) BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-25] (Google Inc.) BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-15] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-21] (Oracle Corporation) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-25] (Google Inc.) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-25] (Google Inc.) Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-10-14] (Microsoft Corporation) FireFox: ======== FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation) FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-09-04] () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-03] (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-03] (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-21] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-21] (Oracle Corporation) FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-03-31] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-19] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-19] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-09-27] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-03-31] (Microsoft Corporation) Chrome: ======= CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-05] CHR Extension: (Google Drive) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-23] CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24] CHR Extension: (Google-Suche) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-28] CHR Extension: (LoungeDestroyer) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghahcnmfjfckcedfajbhekgknjdplfcl [2015-10-07] CHR Extension: (Google Text & Tabellen Offline) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-03] CHR Extension: (EasyCalendar) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcgcoifbkbphhjnekfkmohklfaimhikk [2015-11-05] CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-25] CHR Extension: (Google Mail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-29] ==================== Dienste (Nicht auf der Ausnahmeliste) ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-09-02] (Apple Inc.) R2 ASRockIOMon; C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe [454656 2013-05-28] () [Datei ist nicht signiert] R2 cFosSpeedS; C:\Program Files\ASRock\XFast LAN\spd.exe [652640 2013-05-31] (cFos Software GmbH) S3 Futuremark SystemInfo Service; C:\Program Files (x86)\Futuremark\SystemInfo\FMSISvc.exe [614624 2014-12-10] (Futuremark) R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation) R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [Datei ist nicht signiert] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation) R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-03] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-03] (Intel Corporation) R2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [966336 2014-10-10] (@ByELDI) [Datei ist nicht signiert] R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation) ===================== Treiber (Nicht auf der Ausnahmeliste) ========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.) S3 AsrDrv101; C:\Windows\SysWOW64\Drivers\AsrDrv101.sys [22280 2014-12-16] (ASRock Incorporation) R0 AsrRamDisk; C:\Windows\System32\drivers\AsrRamDisk.sys [40200 2013-05-09] (ASRock Inc.) R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [102912 2015-07-15] (Advanced Micro Devices) S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider) S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider) R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [16648 2014-12-15] (FNet Co., Ltd.) R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-03] (Intel Corporation) R3 sthid; C:\Windows\System32\drivers\sthid.sys [21216 2014-08-06] (Splashtop Inc.) S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] () S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-07-10] (Microsoft Corporation) R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [291680 2015-07-10] (Microsoft Corporation) R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation) S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X] ==================== NetSvcs (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) ==================== Ein Monat: Erstellte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-11-05 14:32 - 2015-11-05 14:32 - 00016825 _____ C:\Users\Admin\Desktop\FRST.txt 2015-11-05 14:31 - 2015-11-05 14:31 - 04404952 _____ (Kaspersky Lab ZAO) C:\Users\Admin\Desktop\tdsskiller.exe 2015-11-05 14:30 - 2015-11-05 14:32 - 00000000 ____D C:\FRST 2015-11-05 14:30 - 2015-11-05 14:30 - 02198016 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe 2015-11-05 14:13 - 2015-11-05 14:13 - 04944608 _____ (Advanced Micro Devices, Inc.) C:\Users\Admin\Downloads\autodetectutility.exe 2015-11-05 14:07 - 2015-11-05 14:07 - 00016148 _____ C:\WINDOWS\system32\PC_Admin_HistoryPrediction.bin 2015-11-05 14:00 - 2015-11-05 14:00 - 00000000 ___HD C:\OneDriveTemp 2015-11-05 12:12 - 2015-11-05 12:12 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (3).exe 2015-11-05 12:12 - 2015-11-05 12:12 - 01708032 _____ C:\Users\Admin\Desktop\adwcleaner_5.017.exe 2015-11-04 17:15 - 2015-11-04 17:15 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (2).exe 2015-11-04 17:08 - 2015-11-05 12:13 - 00000000 ____D C:\AdwCleaner 2015-11-04 17:08 - 2015-11-04 17:08 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (1).exe 2015-11-04 16:49 - 2015-11-05 14:07 - 00000275 _____ C:\WINDOWS\WindowsUpdate.log 2015-11-04 16:49 - 2015-11-04 16:49 - 00000000 ____D C:\$SysReset 2015-11-04 16:34 - 2015-11-04 16:34 - 00002844 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC 2015-11-04 16:34 - 2015-11-04 16:34 - 00000863 _____ C:\Users\Public\Desktop\CCleaner.lnk 2015-11-04 16:34 - 2015-11-04 16:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2015-11-04 16:34 - 2015-11-04 16:34 - 00000000 ____D C:\Program Files\CCleaner 2015-11-04 16:33 - 2015-11-04 16:34 - 05524624 _____ (Piriform Ltd) C:\Users\Admin\Downloads\ccsetup511_slim.exe 2015-11-04 16:14 - 2015-11-04 16:23 - 00000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job 2015-11-04 16:13 - 2015-11-04 16:13 - 00000000 ____D C:\WINDOWS\pss 2015-11-04 16:07 - 2015-11-04 16:07 - 00003380 _____ C:\WINDOWS\System32\Tasks\{6761BBC9-893A-456B-822C-C0DF98AE0062} 2015-11-04 15:46 - 2015-11-04 15:46 - 00000608 __RSH C:\ProgramData\ntuser.pol 2015-11-04 15:21 - 2015-11-05 14:08 - 00001004 _____ C:\WINDOWS\Tasks\28Arly8BQ3IUn.job 2015-11-04 15:21 - 2015-11-04 15:21 - 00004136 _____ C:\WINDOWS\System32\Tasks\28Arly8BQ3IUn 2015-11-04 15:21 - 2015-11-04 15:21 - 00002022 _____ C:\WINDOWS\Tasks\temp_813a5cd0-04f6-4ddb-a269-e350a08d2cae-10_user.job 2015-11-04 15:19 - 2015-11-05 14:08 - 00001014 _____ C:\WINDOWS\Tasks\bSUwmicbiyVJJ5rnrs.job 2015-11-04 15:19 - 2015-11-04 15:19 - 00004156 _____ C:\WINDOWS\System32\Tasks\bSUwmicbiyVJJ5rnrs 2015-11-04 15:17 - 2015-11-04 16:00 - 00000004 _____ C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7 2015-11-04 15:17 - 2013-08-22 14:25 - 00000824 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak 2015-11-04 15:16 - 2015-11-04 15:21 - 00000000 ____D C:\Program Files (x86)\mbot_de_014010136 2015-11-04 15:16 - 2015-11-04 15:16 - 00003144 _____ C:\WINDOWS\System32\Tasks\uhy3013 2015-11-04 15:16 - 2015-11-04 15:16 - 00000000 ____D C:\Users\Public\Documents\Guid 2015-11-04 15:16 - 2015-11-04 15:16 - 00000000 ____D C:\Users\Public\Documents\Baidu 2015-11-04 15:15 - 2015-11-04 15:39 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Opera Software 2015-11-04 15:15 - 2015-11-04 15:39 - 00000000 ____D C:\Users\Admin\AppData\Local\Opera Software 2015-11-04 15:12 - 2015-11-04 15:39 - 00000000 ____D C:\Program Files (x86)\Opera 2015-10-30 17:15 - 2015-10-30 17:15 - 00000000 ____D C:\ProgramData\ROCCAT 2015-10-30 17:15 - 2015-10-30 17:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ROCCAT 2015-10-30 17:14 - 2015-10-30 17:14 - 24907859 _____ C:\Users\Admin\Downloads\ROCCAT_Kone_Pure_DRV1.14_FW1.21.zip 2015-10-30 17:14 - 2015-10-30 17:14 - 00000000 ____D C:\Program Files (x86)\ROCCAT 2015-10-30 17:14 - 2014-01-20 10:53 - 73113600 _____ (ROCCAT GmbH) C:\Users\Admin\Desktop\KonePureOption.exe 2015-10-30 17:13 - 2015-10-28 00:38 - 21871616 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll 2015-10-30 17:13 - 2015-10-28 00:16 - 18801664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll 2015-10-30 17:13 - 2015-10-21 13:45 - 00541024 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcupdate_GenuineIntel.dll 2015-10-30 17:13 - 2015-10-21 13:44 - 00459104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys 2015-10-30 17:13 - 2015-10-21 13:43 - 01392480 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll 2015-10-30 17:13 - 2015-10-21 13:39 - 03621248 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2015-10-30 17:13 - 2015-10-21 13:00 - 24595968 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2015-10-30 17:13 - 2015-10-21 13:00 - 03248128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll 2015-10-30 17:13 - 2015-10-21 12:59 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll 2015-10-30 17:13 - 2015-10-21 12:57 - 02418688 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll 2015-10-30 17:13 - 2015-10-21 12:52 - 02987520 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll 2015-10-30 17:13 - 2015-10-21 12:50 - 00333312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll 2015-10-30 17:13 - 2015-10-21 12:48 - 01068032 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll 2015-10-30 17:13 - 2015-10-21 12:47 - 00453120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Usb.dll 2015-10-30 17:13 - 2015-10-21 12:46 - 02179584 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll 2015-10-30 17:13 - 2015-10-21 12:46 - 01602560 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2015-10-30 17:13 - 2015-10-21 12:44 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll 2015-10-30 17:13 - 2015-10-21 12:44 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe 2015-10-30 17:13 - 2015-10-21 12:43 - 02675200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll 2015-10-30 17:13 - 2015-10-21 12:42 - 00627712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll 2015-10-30 17:13 - 2015-10-21 12:41 - 01795072 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll 2015-10-30 17:13 - 2015-10-21 12:40 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll 2015-10-30 17:13 - 2015-10-21 12:38 - 00502272 _____ (Microsoft Corporation) C:\WINDOWS\system32\dlnashext.dll 2015-10-30 17:13 - 2015-10-21 06:53 - 00961376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll 2015-10-30 17:13 - 2015-10-21 06:49 - 02878512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2015-10-30 17:13 - 2015-10-21 06:13 - 19326464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2015-10-30 17:13 - 2015-10-21 06:11 - 02647040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll 2015-10-30 17:13 - 2015-10-21 06:08 - 01918976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll 2015-10-30 17:13 - 2015-10-21 06:05 - 02639872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll 2015-10-30 17:13 - 2015-10-21 06:03 - 01380864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2015-10-30 17:13 - 2015-10-21 06:03 - 00311296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Usb.dll 2015-10-30 17:13 - 2015-10-21 05:58 - 02049536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepository.dll 2015-10-30 17:13 - 2015-10-21 05:58 - 00464896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll 2015-10-30 17:13 - 2015-10-21 05:55 - 00441344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dlnashext.dll 2015-10-26 19:45 - 2015-10-26 19:45 - 00014336 _____ C:\Users\Admin\Downloads\wenn-2.xls 2015-10-26 19:38 - 2015-10-26 19:38 - 03135063 _____ C:\Users\Admin\Downloads\Pruefung_1_Jugendarbeitsschutzgesetz_.zip 2015-10-17 13:48 - 2015-10-10 08:12 - 00078528 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll 2015-10-17 13:48 - 2015-10-06 04:03 - 16708608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll 2015-10-17 13:48 - 2015-10-06 03:46 - 13027840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll 2015-10-17 13:48 - 2015-10-01 05:01 - 01294352 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2015-10-17 13:48 - 2015-10-01 05:01 - 01123400 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2015-10-17 13:48 - 2015-10-01 05:01 - 01018568 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi 2015-10-17 13:48 - 2015-10-01 05:01 - 00858408 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe 2015-10-17 13:48 - 2015-10-01 05:00 - 08020320 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2015-10-17 13:48 - 2015-10-01 04:03 - 00757760 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll 2015-10-17 13:48 - 2015-09-25 05:01 - 02573768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll 2015-10-17 13:48 - 2015-09-25 05:01 - 00498016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys 2015-10-17 13:48 - 2015-09-25 04:56 - 22322624 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2015-10-17 13:48 - 2015-09-25 04:52 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi 2015-10-17 13:48 - 2015-09-25 04:33 - 01997336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll 2015-10-17 13:48 - 2015-09-25 04:26 - 20858360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2015-10-17 13:48 - 2015-09-25 04:11 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataAccountApis.dll 2015-10-17 13:48 - 2015-09-25 04:11 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneCallHistoryApis.dll 2015-10-17 13:48 - 2015-09-25 04:09 - 12504064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2015-10-17 13:48 - 2015-09-25 04:07 - 01276416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll 2015-10-17 13:48 - 2015-09-25 04:04 - 00826880 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll 2015-10-17 13:48 - 2015-09-25 04:04 - 00771072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll 2015-10-17 13:48 - 2015-09-25 04:03 - 00796160 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll 2015-10-17 13:48 - 2015-09-25 04:03 - 00576000 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll 2015-10-17 13:48 - 2015-09-25 04:02 - 07523840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll 2015-10-17 13:48 - 2015-09-25 04:02 - 00949248 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll 2015-10-17 13:48 - 2015-09-25 04:02 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll 2015-10-17 13:48 - 2015-09-25 04:01 - 04792320 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2015-10-17 13:48 - 2015-09-25 04:01 - 03586560 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys 2015-10-17 13:48 - 2015-09-25 04:00 - 01423872 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll 2015-10-17 13:48 - 2015-09-25 04:00 - 01382400 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys 2015-10-17 13:48 - 2015-09-25 04:00 - 00856576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContactApis.dll 2015-10-17 13:48 - 2015-09-25 04:00 - 00752640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChatApis.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 01205248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\EmailApis.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 00685568 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppointmentApis.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\MessagingDataModel2.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 00288256 _____ (Microsoft Corporation) C:\WINDOWS\system32\PimIndexMaintenance.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\CallHistoryClient.dll 2015-10-17 13:48 - 2015-09-25 03:58 - 01871360 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll 2015-10-17 13:48 - 2015-09-25 03:47 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll 2015-10-17 13:48 - 2015-09-25 03:47 - 00172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhoneCallHistoryApis.dll 2015-10-17 13:48 - 2015-09-25 03:38 - 03580416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2015-10-17 13:48 - 2015-09-25 03:38 - 00650240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll 2015-10-17 13:48 - 2015-09-25 03:38 - 00574464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll 2015-10-17 13:48 - 2015-09-25 03:38 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll 2015-10-17 13:48 - 2015-09-25 03:37 - 00766976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll 2015-10-17 13:48 - 2015-09-25 03:37 - 00613376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll 2015-10-17 13:48 - 2015-09-25 03:37 - 00480256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll 2015-10-17 13:48 - 2015-09-25 03:36 - 11262976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2015-10-17 13:48 - 2015-09-25 03:36 - 05454848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll 2015-10-17 13:48 - 2015-09-25 03:34 - 00928256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll 2015-10-17 13:48 - 2015-09-25 03:34 - 00625152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContactApis.dll 2015-10-17 13:48 - 2015-09-25 03:34 - 00579584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentApis.dll 2015-10-17 13:48 - 2015-09-25 03:34 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ChatApis.dll 2015-10-17 13:48 - 2015-09-25 03:34 - 00525312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EmailApis.dll 2015-10-17 13:48 - 2015-09-25 03:33 - 00131072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CallHistoryClient.dll 2015-10-17 13:48 - 2015-09-25 03:32 - 01594368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll 2015-10-17 13:48 - 2015-09-25 03:32 - 00466432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MessagingDataModel2.dll 2015-10-17 13:39 - 2015-11-04 16:28 - 00000000 ____D C:\Users\Admin\Desktop\Felgen 2015-10-17 13:36 - 2015-10-17 13:36 - 00001822 _____ C:\Users\Public\Desktop\iTunes.lnk 2015-10-17 13:36 - 2015-10-17 13:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2015-10-17 13:35 - 2015-10-17 13:36 - 00000000 ____D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7 2015-10-17 13:35 - 2015-10-17 13:36 - 00000000 ____D C:\Program Files\iTunes 2015-10-17 13:35 - 2015-10-17 13:35 - 00002535 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\WINDOWS\System32\Tasks\Apple 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files\iPod 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files\Bonjour 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\iTunes 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\Bonjour 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\Apple Software Update 2015-10-17 13:30 - 2015-10-17 13:34 - 152447768 _____ (Apple Inc.) C:\Users\Admin\Downloads\iTunes6464Setup (1).exe 2015-10-12 18:13 - 2015-10-12 18:15 - 167601944 _____ (Apple Inc.) C:\Users\Admin\Downloads\iTunes6464Setup.exe 2015-10-12 17:20 - 2015-10-12 17:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud 2015-10-12 17:09 - 2015-10-12 17:19 - 71807792 _____ (Apple Inc.) C:\Users\Admin\Downloads\iCloudSetup.exe 2015-10-12 17:03 - 2015-10-12 17:24 - 1971067436 _____ C:\Users\Admin\Downloads\iPhone7,2_8.4.1_12H321_Restore.ipsw 2015-10-09 15:13 - 2015-10-09 15:13 - 00000000 ____D C:\Users\Admin\AppData\LocalLow\Hyper Hippo Productions Ltd_ 2015-10-09 15:12 - 2015-10-09 15:12 - 00000222 _____ C:\Users\Admin\Desktop\AdVenture Capitalist.url 2015-10-08 16:47 - 2015-10-08 16:47 - 00000000 ____D C:\ProgramData\ATI 2015-10-07 18:54 - 2015-10-07 18:54 - 00062253 _____ C:\WINDOWS\SysWOW64\CCCInstall_201510071954276182.log 2015-10-07 18:54 - 2015-10-07 18:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center 2015-10-07 18:54 - 2015-10-07 18:54 - 00000000 ____D C:\Program Files\ATI Technologies 2015-10-07 18:53 - 2015-10-07 18:54 - 00000000 ____D C:\Program Files (x86)\ATI Technologies 2015-10-07 18:53 - 2015-10-07 18:53 - 00052907 _____ C:\WINDOWS\SysWOW64\CCCInstall_201510071953453509.log 2015-10-07 18:52 - 2015-10-07 18:52 - 47794160 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\amdocl64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 39721456 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\amdocl.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 30776304 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atio6axx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 27544560 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\amdocl12cl64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 25320432 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atioglxx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 22327280 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\amdocl12cl.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 15725552 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticaldd64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 14310896 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticaldd.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 09355016 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdxc64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 08009360 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiumdva.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 07683096 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdxc32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 07482560 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiumdag.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 06686192 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdmantle64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 05216240 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdmantle32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 03471376 _____ C:\WINDOWS\SysWOW64\atiumdva.cap 2015-10-07 18:52 - 2015-10-07 18:52 - 03437632 _____ C:\WINDOWS\system32\atiumd6a.cap 2015-10-07 18:52 - 2015-10-07 18:52 - 01196032 _____ C:\WINDOWS\system32\amdocl_as64.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 01070592 _____ C:\WINDOWS\system32\amdocl_ld64.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 01004032 _____ C:\WINDOWS\SysWOW64\amdocl_as32.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00935408 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atiadlxy.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00935408 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atiadlxx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00833800 _____ C:\WINDOWS\system32\amdicdxx.dat 2015-10-07 18:52 - 2015-10-07 18:52 - 00807424 _____ C:\WINDOWS\SysWOW64\amdocl_ld32.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00662392 _____ C:\WINDOWS\SysWOW64\atiapfxx.blb 2015-10-07 18:52 - 2015-10-07 18:52 - 00662392 _____ C:\WINDOWS\system32\atiapfxx.blb 2015-10-07 18:52 - 2015-10-07 18:52 - 00631280 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\amdlvr64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00524272 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\amdlvr32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00471320 _____ C:\WINDOWS\system32\amdmiracast.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00375792 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atiapfxx.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00341488 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\ATIODE.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00243696 _____ C:\WINDOWS\system32\clinfo.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00213488 _____ C:\WINDOWS\system32\amdgfxinfo64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00199664 _____ (AMD) C:\WINDOWS\system32\atitmm64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00198640 _____ C:\WINDOWS\SysWOW64\amdgfxinfo32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00177344 _____ C:\WINDOWS\system32\ativce03.dat 2015-10-07 18:52 - 2015-10-07 18:52 - 00175648 _____ C:\WINDOWS\system32\amde31a.dat 2015-10-07 18:52 - 2015-10-07 18:52 - 00168944 _____ C:\WINDOWS\system32\atieah64.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00165360 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atig6txx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00152560 _____ C:\WINDOWS\SysWOW64\atieah32.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00151936 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\amdhcp64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00150512 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atigktxx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00143344 _____ C:\WINDOWS\system32\amdhdl64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00138384 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\amdhcp32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00136176 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\mantle64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00132080 _____ C:\WINDOWS\SysWOW64\amdhdl32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00122352 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\mantle32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00117608 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdave64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00112368 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiu9pag.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00111600 _____ C:\WINDOWS\system32\hsa-thunk64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00111088 _____ C:\WINDOWS\SysWOW64\hsa-thunk.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00110320 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdave32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00103408 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\mantleaxl64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00100816 _____ C:\WINDOWS\system32\ativce02.dat 2015-10-07 18:52 - 2015-10-07 18:52 - 00097776 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atisamu64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00096752 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\mantleaxl32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00089584 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atisamu32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00088000 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atimpc64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00088000 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdpcom64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00083952 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atig6pxx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00081168 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atimpc32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00081160 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdpcom32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00078320 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiglpxx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00078320 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiglpxx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00073712 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00071152 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticalrt64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00068080 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00064496 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticalcl64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00060912 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticalrt.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00059888 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\ATIODCLI.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00059376 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdmmcl6.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00057840 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticalcl.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00052208 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\ati2erec.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00048112 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdmmcl.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00047664 _____ C:\WINDOWS\system32\kapp_ci.sbin 2015-10-07 18:52 - 2015-10-07 18:52 - 00043536 _____ C:\WINDOWS\system32\kapp_si.sbin 2015-10-07 18:52 - 2015-10-07 18:52 - 00038384 _____ (AMD) C:\WINDOWS\system32\atimuixx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00012784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\detoured.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00012784 _____ (Microsoft Corporation) C:\WINDOWS\system32\detoured.dll ==================== Ein Monat: Geänderte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-11-05 14:23 - 2014-12-31 19:28 - 00000000 ____D C:\Program Files (x86)\Steam 2015-11-05 14:19 - 2014-12-15 23:33 - 00001124 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2015-11-05 14:13 - 2015-08-05 21:51 - 01793546 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2015-11-05 14:13 - 2015-07-10 17:34 - 00772138 _____ C:\WINDOWS\system32\perfh007.dat 2015-11-05 14:13 - 2015-07-10 17:34 - 00154500 _____ C:\WINDOWS\system32\perfc007.dat 2015-11-05 14:08 - 2014-12-15 23:33 - 00001120 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2015-11-05 14:07 - 2015-07-10 13:21 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT 2015-11-05 14:05 - 2015-08-05 22:01 - 00000000 ___RD C:\Users\Admin\OneDrive 2015-11-05 14:04 - 2015-08-05 21:41 - 00000000 ____D C:\Users\Admin 2015-11-05 13:15 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\sru 2015-11-05 12:14 - 2015-07-10 10:05 - 00262144 ___SH C:\WINDOWS\system32\config\BBI 2015-11-05 12:13 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\AppReadiness 2015-11-04 17:09 - 2015-08-05 21:41 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2015-11-04 17:09 - 2014-12-15 23:33 - 00001327 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2015-11-04 17:09 - 2014-12-15 23:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2015-11-04 16:43 - 2015-01-06 20:23 - 00000000 ____D C:\Users\Admin\AppData\Roaming\TS3Client 2015-11-04 16:42 - 2015-08-05 22:33 - 00000000 ___DC C:\WINDOWS\Panther 2015-11-04 16:42 - 2014-12-30 23:19 - 00000000 ____D C:\Users\Admin\AppData\Local\CrashDumps 2015-11-04 16:09 - 2014-12-18 21:20 - 00000000 ____D C:\Program Files (x86)\Adobe 2015-11-04 16:08 - 2014-12-15 22:53 - 00000000 ____D C:\Program Files\KMSpico 2015-11-04 15:46 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy 2015-11-04 15:46 - 2013-08-22 16:36 - 00000000 ___HD C:\WINDOWS\system32\GroupPolicy 2015-11-04 15:39 - 2015-01-21 20:03 - 00000000 __SHD C:\Users\Admin\AppData\Local\EmieUserList 2015-11-04 15:39 - 2015-01-21 20:03 - 00000000 __SHD C:\Users\Admin\AppData\Local\EmieSiteList 2015-11-04 15:26 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\appraiser 2015-11-03 10:51 - 2015-08-05 22:01 - 00002358 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk 2015-11-02 14:26 - 2015-07-10 11:55 - 00000000 ____D C:\WINDOWS\CbsTemp 2015-11-01 00:33 - 2015-01-05 18:20 - 00003972 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task 2015-10-30 17:14 - 2014-12-15 23:42 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2015-10-27 19:48 - 2014-12-31 18:33 - 00000000 ____D C:\Users\Admin\AppData\Local\Spotify 2015-10-27 19:48 - 2014-12-31 18:32 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Spotify 2015-10-26 20:55 - 2015-04-12 21:14 - 00000000 ____D C:\Users\Admin\Desktop\Mailin 2015-10-26 20:17 - 2014-12-30 19:00 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013 2015-10-26 20:17 - 2014-12-30 15:46 - 00000000 ____D C:\ProgramData\Microsoft Help 2015-10-26 20:15 - 2013-08-22 14:25 - 00000167 _____ C:\WINDOWS\win.ini 2015-10-26 19:47 - 2014-12-15 22:56 - 00000000 ____D C:\Users\Admin\AppData\Local\Packages 2015-10-17 13:35 - 2015-04-10 06:25 - 00000000 ____D C:\Program Files\Common Files\Apple 2015-10-17 13:34 - 2015-04-10 06:25 - 00000000 ____D C:\ProgramData\Apple 2015-10-16 11:13 - 2014-12-18 21:21 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2015-10-16 04:10 - 2015-07-10 12:06 - 00810488 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2015-10-16 04:10 - 2015-07-10 12:06 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2015-10-12 18:13 - 2015-09-08 19:52 - 00000000 ____D C:\WINDOWS\system32\appmgmt 2015-10-12 18:11 - 2014-12-30 17:39 - 00000000 ____D C:\Users\Admin\AppData\Local\Akamai 2015-10-12 17:47 - 2015-07-10 13:20 - 00348328 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2015-10-12 17:45 - 2015-07-10 17:44 - 00000000 ____D C:\Program Files\Windows Journal 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___SD C:\WINDOWS\system32\F12 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___RD C:\WINDOWS\PurchaseDialog 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\Provisioning 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\L2Schemas 2015-10-09 15:12 - 2015-01-06 13:55 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam 2015-10-07 18:53 - 2015-07-30 15:44 - 00000000 ____D C:\Program Files (x86)\AMD 2015-10-07 18:53 - 2014-12-15 22:57 - 00000000 ____D C:\AMD 2015-10-07 18:52 - 2015-07-16 01:12 - 00162240 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiuxp64.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 12088008 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atidxx64.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 10211016 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atidxx32.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 08982440 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiumd6a.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 08864928 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiumd64.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 01479808 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\aticfx64.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 01223552 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\aticfx32.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 00143056 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiuxpag.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 00130072 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiu9p64.dll 2015-10-07 18:52 - 2015-07-16 01:06 - 21648880 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\atikmdag.sys 2015-10-07 18:52 - 2015-07-16 00:17 - 00683504 _____ (AMD) C:\WINDOWS\system32\atieclxx.exe 2015-10-07 18:52 - 2015-07-16 00:17 - 00451056 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atidemgy.dll 2015-10-07 18:52 - 2015-07-16 00:17 - 00255472 _____ (AMD) C:\WINDOWS\system32\atiesrxx.exe 2015-10-07 18:52 - 2015-07-16 00:13 - 01256432 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atiadlxx.dll 2015-10-07 18:52 - 2015-07-16 00:13 - 00674288 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\atikmpag.sys 2015-10-07 18:52 - 2015-07-16 00:12 - 00874480 _____ (AMD) C:\WINDOWS\system32\coinst_15.20.dll ==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ======= 2015-04-19 13:20 - 2015-04-19 13:20 - 0005872 _____ () C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn 2015-04-20 15:05 - 2015-04-20 15:05 - 1579520 _____ () C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe 2015-04-19 13:20 - 2015-04-19 13:20 - 0005872 _____ () C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs 2015-04-20 15:05 - 2015-04-20 15:05 - 1579520 _____ () C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe 2015-09-08 19:37 - 2015-09-08 19:37 - 0003225 _____ () C:\Users\Admin\AppData\Local\recently-used.xbel Einige Dateien in TEMP: ==================== C:\Users\Admin\AppData\Local\Temp\225.exe C:\Users\Admin\AppData\Local\Temp\4156.exe C:\Users\Admin\AppData\Local\Temp\8548.exe C:\Users\Admin\AppData\Local\Temp\9768.exe C:\Users\Admin\AppData\Local\Temp\avgD177.exe C:\Users\Admin\AppData\Local\Temp\HarryPotterAndTheOrderOfThePhoenixGame__11652_il54233.exe C:\Users\Admin\AppData\Local\Temp\InstallHelper.exe C:\Users\Admin\AppData\Local\Temp\mytmpinstaller.exe C:\Users\Admin\AppData\Local\Temp\Opera_NI_stable.exe C:\Users\Admin\AppData\Local\Temp\sqlite3.dll C:\Users\Admin\AppData\Local\Temp\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\UninstallModule.exe C:\Users\Admin\AppData\Local\Temp\VLX_Player.exe ==================== Bamital & volsnap ================= (Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.) C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert C:\WINDOWS\explorer.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert C:\WINDOWS\system32\services.exe => Datei ist digital signiert C:\WINDOWS\system32\User32.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert LastRegBack: 2015-11-02 14:19 ==================== Ende von FRST.txt ============================ Die Addition.txt: Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:04-11-2015 durchgeführt von Admin (2015-11-05 14:33:15) Gestartet von C:\Users\Admin\Desktop Windows 10 Pro (X64) (2015-08-05 20:58:30) Start-Modus: Normal ========================================================== ==================== Konten: ============================= Admin (S-1-5-21-3896126499-3315573620-1378135710-1001 - Administrator - Enabled) => C:\Users\Admin Administrator (S-1-5-21-3896126499-3315573620-1378135710-500 - Administrator - Disabled) DefaultAccount (S-1-5-21-3896126499-3315573620-1378135710-503 - Limited - Disabled) Gast (S-1-5-21-3896126499-3315573620-1378135710-501 - Limited - Disabled) ==================== Sicherheits-Center ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.) AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installierte Programme ====================== (Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.) 3DMark (HKLM-x32\...\{7330098c-3669-4f39-9e82-4221d489db39}) (Version: 1.4.828.0 - Futuremark) 3DMark (Version: 1.4.828.0 - Futuremark) Hidden Adobe Reader XI (11.0.13) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.13 - Adobe Systems Incorporated) AdVenture Capitalist (HKLM-x32\...\Steam App 346900) (Version: - Hyper Hippo Games) Akamai NetSession Interface (HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Akamai) (Version: - Akamai Technologies, Inc) AMD Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD) AMD Catalyst Install Manager (HKLM\...\{572C982F-95F5-0562-AE8F-8A9D7D024A88}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.) APP Shop v1.0.13 (HKLM-x32\...\{90242E9B-BC60-46E3-8EE7-8E953F702280}_is1) (Version: 1.0.13 - ASRock Inc.) Apple Application Support (32-Bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.) Apple Application Support (64-Bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{FD244E19-6EFE-4A2D-948A-0D45D4C168BE}) (Version: 9.0.0.26 - Apple Inc.) Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.) ASRock App Charger v1.0.6 (HKLM\...\ASRock App Charger_is1) (Version: 1.0.6 - ASRock Inc.) ASRock Restart to UEFI v1.0.3 (HKLM-x32\...\ASRock Restart to UEFI_is1) (Version: - ) ASRock XFast RAM v3.0.2 (HKLM\...\ASRock XFast RAM_is1) (Version: - ASRock Inc.) A-Tuning v2.0.51.1 (HKLM-x32\...\A-Tuning_is1) (Version: 2.0.51.1 - ) Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.) CCleaner (HKLM\...\CCleaner) (Version: 5.11 - Piriform) Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve) Futuremark SystemInfo (HKLM-x32\...\{2FE4C157-30AD-47F3-9D93-D9A2AFF25D3F}) (Version: 4.33.485.0 - Futuremark) GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 46.0.2490.80 - Google Inc.) Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6904.2028 - Google Inc.) Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden iCloud (HKLM\...\{709A2D23-C25E-47B5-9268-CB6FEE648504}) (Version: 4.1.1.53 - Apple Inc.) Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation) Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{0EC7F9CC-4741-45AE-9F55-6E9343F726F5}) (Version: 1.1.0.36960 - Intel Corporation) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation) Intel(R) Network Connections 18.5.54.0 (HKLM\...\PROSetDX) (Version: 18.5.54.0 - Intel) Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation) iTunes (HKLM\...\{CEC7613B-E286-4A31-BEE3-3F7798488D9F}) (Version: 12.1.3.6 - Apple Inc.) Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation) KMSpico (HKLM\...\{8B29D47F-92E2-4C20-9EE0-F710991F5D7C}_is1) (Version: - ) Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation) Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation) MyDriveConnect 4.0.2.2123 (HKLM-x32\...\MyDriveConnect) (Version: 4.0.2.2123 - TomTom) Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.) ROCCAT Kone Pure Mouse Driver (HKLM-x32\...\{4905245D-56E7-4176-BE68-962728B803D6}) (Version: - Roccat GmbH) Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version: - Microsoft) Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version: - Microsoft) Hidden Splashtop Software Updater (HKLM-x32\...\Splashtop Software Updater) (Version: 1.5.6.15 - Splashtop Inc.) Splashtop Streamer (HKLM-x32\...\{B7C5EA94-B96A-41F5-BE95-25D78B486678}) (Version: 2.6.2.4 - Splashtop Inc.) Spotify (HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Spotify) (Version: 1.0.6.80.g2a801a53 - Spotify AB) Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation) TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH) Update for Skype for Business 2015 (KB2889853) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{CBCC2FD8-7DFE-4752-95B5-2E447C226F45}) (Version: - Microsoft) Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version: - Microsoft) Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version: - Microsoft) Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version: - Microsoft) VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.) VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN) WinRAR 5.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH) XFast LAN v9.05 (HKLM\...\XFast LAN) (Version: 9.05 - cFos Software GmbH, Bonn) XFastUSB (HKLM-x32\...\XFastUSB) (Version: 3.02.38 - ASRock Inc.) ==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) CustomCLSID: HKU\S-1-5-21-3896126499-3315573620-1378135710-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Admin\AppData\Local\Microsoft\OneDrive\17.3.6201.1019\FileCoAuth.exe (Microsoft Corporation) ==================== Wiederherstellungspunkte ========================= 07-10-2015 18:51:41 Windows Update 12-10-2015 17:19:18 Installed iCloud 17-10-2015 13:21:53 Removed iTunes 26-10-2015 19:59:23 Windows Update 02-11-2015 14:19:58 Windows Update 04-11-2015 15:33:50 Wiederherstellungsvorgang ==================== Hosts Inhalt: =============================== (Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.) 2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts ==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) ============= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) Task: {0641E672-CA84-4606-B6D2-9F2BABE58BF5} - System32\Tasks\28Arly8BQ3IUn => C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe [2015-04-20] () <==== ACHTUNG Task: {07181339-8E57-4CB5-BBFE-76170783B9DB} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG Task: {12FB6D15-B5C0-4B66-BF0C-21D82690E855} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation) Task: {1780DAB3-4584-4FBD-92C9-8857F3886BA3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.) Task: {18B3B3A2-AFFF-476E-BA62-AB75BE1E7871} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG Task: {314E7782-948E-4C4F-B24E-BC0CC4B34F09} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG Task: {35EB728D-F128-4075-B375-D45BF71FE8B2} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\BrowserChoice\browserchoice.exe Task: {39F87631-C2F8-4269-952F-841E84773CAD} - System32\Tasks\temp_813a5cd0-04f6-4ddb-a269-e350a08d2cae-10_user => C:\Program Files (x86)\MyBrowser 1.0.2V04.11\813a5cd0-04f6-4ddb-a269-e350a08d2cae-10.exe <==== ACHTUNG Task: {3A4FD38E-5C92-414E-9586-8C3CAA34B95C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.) Task: {3E9757E4-DB07-4418-A44D-2721FDE15694} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG Task: {4D0FE605-48D7-41B3-AD75-AD266C4238D5} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG Task: {5769C702-F476-4F1D-8161-7F0B757132B2} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation) Task: {6B883A1A-4B18-410C-B686-CE03876036BA} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG Task: {706560C9-EAA0-41D3-833A-15525024E0B5} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-26] (Apple Inc.) Task: {80A4DADB-BA50-49B2-AA96-134B855D9DA2} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation) Task: {829CE483-8082-49CD-A513-92A43A02E5FB} - System32\Tasks\{6761BBC9-893A-456B-822C-C0DF98AE0062} => pcalua.exe -a "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\Installer\setup.exe" -c --uninstall --system-level Task: {91B7D1C5-C4A2-47A1-8301-8BB576FF708E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated) Task: {A0AE8DD5-A88B-4716-868D-7DE54D6A193B} - \AutoKMS -> Keine Datei <==== ACHTUNG Task: {ABDBD144-AC98-4BFB-A605-068E267D2877} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation) Task: {AF2AD4F7-61F8-4A4D-80A1-EC7534DACF61} - System32\Tasks\bSUwmicbiyVJJ5rnrs => C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe [2015-04-20] () <==== ACHTUNG Task: {B5D52175-0BF8-41EC-8DE9-7EA06BDD727D} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG Task: {C094DE92-8467-4C1A-BDA4-A77A51B90A69} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG Task: {CBA55D8E-91C9-42CD-83D1-CCEA95CCAD58} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG Task: {D9512478-B671-48F5-AB7D-4DFDF9C1B3D9} - \AutoPico Daily Restart -> Keine Datei <==== ACHTUNG Task: {DA46E218-00C4-4B54-B5E0-5243E443B1D5} - System32\Tasks\uhy3013 => C:\PROGRA~2\FAST-S~1\uhy3013.exe <==== ACHTUNG Task: {ECA37C1B-4E7F-4781-B87B-E8B93639BBCB} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG Task: {F2497E2D-9818-4923-A176-F89FB32151E5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-10-19] (Piriform Ltd) Task: {F5E604C0-8A2B-485C-9605-9EC1FD317421} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG Task: {F69C0FCA-220E-4675-A1E1-DD67E0976A15} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation) (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.) Task: C:\WINDOWS\Tasks\28Arly8BQ3IUn.job => C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\bSUwmicbiyVJJ5rnrs.job => C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\WINDOWS\Tasks\temp_813a5cd0-04f6-4ddb-a269-e350a08d2cae-10_user.job => C:\Program Files (x86)\MyBrowser 1.0.2V04.11\813a5cd0-04f6-4ddb-a269-e350a08d2cae-10.exe <==== ACHTUNG ==================== Geladene Module (Nicht auf der Ausnahmeliste) ============== 2015-07-10 12:00 - 2015-07-10 12:00 - 00028160 _____ () C:\WINDOWS\SYSTEM32\efsext.dll 2015-08-05 22:30 - 2015-08-05 22:30 - 00032768 _____ () C:\WINDOWS\SYSTEM32\licensemanagerapi.dll 2015-08-23 21:30 - 2015-08-11 10:14 - 00404480 _____ () C:\WINDOWS\System32\diagtrack_wininternal.dll 2015-03-20 17:12 - 2015-03-20 17:12 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2015-03-20 17:12 - 2015-03-20 17:12 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2014-12-15 23:54 - 2013-05-28 17:58 - 00454656 _____ () C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe 2015-10-01 09:14 - 2015-09-17 07:48 - 02494712 _____ () C:\WINDOWS\System32\CoreUIComponents.dll 2015-10-01 09:14 - 2015-09-17 06:43 - 02028544 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RulesService.dll 2015-10-01 09:14 - 2015-09-17 06:42 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll 2015-10-01 09:14 - 2015-09-17 06:42 - 00619008 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SignalsManager.dll 2015-10-01 09:14 - 2015-09-17 06:43 - 00928768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RulesBackgroundTasks.dll 2015-10-01 09:14 - 2015-09-17 06:48 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll 2015-10-01 09:14 - 2015-09-17 07:48 - 02494712 _____ () C:\WINDOWS\system32\CoreUIComponents.dll 2015-07-10 11:59 - 2015-07-10 11:59 - 00143360 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\XamlTileRendering.dll 2015-10-01 09:14 - 2015-09-17 06:44 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll 2015-10-01 09:14 - 2015-09-17 06:49 - 00884736 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll 2015-10-01 09:14 - 2015-09-17 06:42 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll 2015-10-01 09:14 - 2015-09-17 06:43 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll 2015-07-10 12:00 - 2015-07-10 17:43 - 00210432 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.ProxyStub.dll 2015-10-19 21:00 - 2015-10-19 21:00 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll 2015-01-06 13:56 - 2015-08-15 13:15 - 00103424 _____ () C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe 2015-10-23 15:20 - 2015-10-20 15:08 - 01532744 _____ () C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.80\libglesv2.dll 2015-10-23 15:20 - 2015-10-20 15:08 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.80\libegl.dll 2015-10-30 17:15 - 2012-06-23 14:54 - 00061440 _____ () C:\Program Files (x86)\ROCCAT\Kone Pure Mouse\hiddriver.dll 2014-12-15 23:45 - 2013-09-03 16:52 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll 2014-12-31 19:33 - 2015-10-05 17:18 - 00778752 _____ () C:\Program Files (x86)\Steam\SDL2.dll 2015-01-20 22:01 - 2015-07-03 17:12 - 04962816 _____ () C:\Program Files (x86)\Steam\v8.dll 2014-12-31 19:33 - 2015-10-14 21:56 - 02423376 _____ () C:\Program Files (x86)\Steam\video.dll 2015-01-20 22:01 - 2015-07-03 17:12 - 01556992 _____ () C:\Program Files (x86)\Steam\icui18n.dll 2015-01-20 22:01 - 2015-07-03 17:12 - 01187840 _____ () C:\Program Files (x86)\Steam\icuuc.dll 2014-12-31 19:32 - 2015-09-24 01:33 - 02549248 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll 2014-12-31 19:32 - 2015-09-24 01:33 - 00491008 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll 2014-12-31 19:32 - 2015-09-24 01:33 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll 2014-12-31 19:32 - 2015-09-24 01:33 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll 2014-12-31 19:32 - 2015-09-24 01:33 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll 2014-12-31 19:33 - 2015-10-14 21:56 - 00705104 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL 2015-07-22 17:27 - 2015-10-09 19:13 - 00193024 _____ () C:\Program Files (x86)\Steam\bin\openvr_api.dll 2015-11-05 14:22 - 2015-11-05 14:22 - 00155232 ___HT () C:\Users\Admin\AppData\Local\Temp\~D0EA.tmp 2014-12-31 19:33 - 2015-10-08 23:20 - 45010208 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll 2015-01-20 22:01 - 2015-09-25 00:56 - 00119208 _____ () C:\Program Files (x86)\Steam\winh264.dll 2015-01-06 13:55 - 2015-09-17 19:42 - 00198144 _____ () C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\bin\launcher.dll 2015-01-06 13:55 - 2015-09-17 19:42 - 00317440 _____ () C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\bin\tier0.dll 2015-01-06 13:56 - 2015-09-17 19:41 - 00203776 _____ () C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\bin\vstdlib.dll 2015-01-06 13:55 - 2015-09-17 19:41 - 00389120 _____ () C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\bin\filesystem_stdio.dll 2015-01-06 13:55 - 2015-10-30 17:13 - 06696448 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\engine.dll 2015-01-06 13:55 - 2015-09-17 19:42 - 00156160 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\inputsystem.dll 2015-01-06 13:55 - 2015-09-17 19:42 - 01174016 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\vphysics.dll 2015-01-06 13:55 - 2015-10-21 18:49 - 01240064 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\materialsystem.dll 2015-01-06 13:55 - 2015-09-17 19:41 - 00351744 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\datacache.dll 2015-01-06 13:55 - 2015-09-17 19:41 - 00607744 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\studiorender.dll 2015-01-06 13:55 - 2015-09-17 19:42 - 00164864 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\soundemittersystem.dll 2015-01-06 13:55 - 2015-09-17 19:42 - 00708096 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\vscript.dll 2015-01-06 13:56 - 2015-09-17 19:41 - 00134656 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\valve_avi.dll 2015-01-06 13:55 - 2015-09-17 19:42 - 01336320 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\vguimatsurface.dll 2015-01-06 13:55 - 2015-09-17 19:41 - 00394752 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\vgui2.dll 2015-01-06 13:55 - 2015-10-21 18:49 - 03192320 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\scaleformui.dll 2015-01-06 13:55 - 2015-10-09 14:17 - 01763328 _____ () C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\bin\shaderapidx9.dll 2015-01-06 13:56 - 2015-09-17 19:41 - 00143360 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\localize.dll 2015-01-06 13:55 - 2015-09-17 19:42 - 00230912 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\stdshader_dbg.dll 2015-01-06 13:55 - 2015-09-17 19:41 - 00996864 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\stdshader_dx9.dll 2015-01-06 13:55 - 2015-10-21 18:49 - 00582144 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo\bin\matchmaking.dll 2015-01-06 13:55 - 2015-11-01 00:22 - 12490752 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo\bin\client.dll 2015-01-06 13:55 - 2015-10-30 17:15 - 10011136 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo\bin\server.dll 2015-01-06 13:55 - 2015-09-17 19:41 - 00094208 _____ () C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\bin\scenefilecache.dll 2015-01-06 13:55 - 2015-10-02 08:17 - 00084992 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\vaudio_miles.dll 2015-01-06 13:55 - 2015-01-06 13:55 - 00071680 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\mssmp3.asi 2015-01-06 13:55 - 2015-01-06 13:55 - 00012800 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\mssds3d.flt 2015-01-06 13:56 - 2015-01-06 13:56 - 00055808 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\msseax.flt 2015-01-06 13:55 - 2015-10-21 18:49 - 00972800 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\serverbrowser.dll 2015-01-06 13:56 - 2015-09-17 19:41 - 00173568 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\vaudio_celt.dll ==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) ========= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.) ==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.) ==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.) ==================== Internet Explorer Vertrauenswürdig/Eingeschränkt =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.) ==================== Andere Bereiche ============================ (Aktuell gibt es keinen automatisierten Fix für diesen Bereich.) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppBackground\{8f613224-081d-4870-95b1-d3401a9c063b}.jpg DNS Servers: 192.168.0.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Windows Firewall ist aktiviert. ==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge == (Aktuell gibt es keinen automatisierten Fix für diesen Bereich.) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Akamai NetSession Interface" HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Spotify" HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Spotify Web Helper" ==================== Firewall Regeln (Nicht auf der Ausnahmeliste) =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139 FirewallRules: [{AA2759FA-EDA9-49D9-8F1E-31DBB008545D}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe FirewallRules: [{21668B50-B857-45A9-B645-E11ECDD0BA49}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe FirewallRules: [{6CB59014-5555-42F1-8B13-C849BCCFE2D5}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe FirewallRules: [{A3131C8E-696E-4F51-ACFD-B2AB59280978}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe FirewallRules: [{FEE6B3AF-FAFD-4C1B-B25C-3D7B4B195124}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{B443DA33-A6A7-4033-956B-A93AC3CBC433}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{E6CBFDB1-E319-4DB8-AFE5-A4934C2C92BB}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{6A8E79CC-2575-4BAE-8F1C-D7A7E2F46E1E}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{8E7D9FDF-1879-4244-A2C6-EBC14CC669E7}] => (Allow) %USERPROFILE%\jagexcache\jagexlauncher\bin\JagexLauncher.exe FirewallRules: [{35A1C72A-BDD3-483A-89A4-27F37D6F2DF0}] => (Allow) %USERPROFILE%\jagexcache\jagexlauncher\bin\JagexLauncher.exe FirewallRules: [{B6240254-8695-4136-8688-496A32476A12}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe FirewallRules: [{E7AD38FE-F37D-44CA-9649-1701BCC99048}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe FirewallRules: [{B0CB35E9-5E30-4F33-B965-F50096A6FF89}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe FirewallRules: [{D97329F3-5344-4F9A-ABBF-5E569CF1D363}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe FirewallRules: [{CAEEFC92-F0A2-4DE5-A2E7-FFCAFF3B70D4}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe FirewallRules: [{DA773FEA-CDF4-4FFB-818E-B255D4ABA4EF}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe FirewallRules: [{22A49953-B3ED-4BC6-8832-A1E30DE6E35D}] => (Block) C:\users\admin\appdata\roaming\spotify\spotify.exe FirewallRules: [{C130419E-ACEF-4A16-B5CD-F7064DA07399}] => (Block) C:\users\admin\appdata\roaming\spotify\spotify.exe FirewallRules: [UDP Query User{8F3963CA-4443-496D-B9E4-2A16E020A73E}C:\users\admin\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\admin\appdata\roaming\spotify\spotify.exe FirewallRules: [TCP Query User{C9892719-B171-4AE8-B087-57F263271C60}C:\users\admin\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\admin\appdata\roaming\spotify\spotify.exe FirewallRules: [{52E0F1D2-FD56-4E24-A22C-DE206D1494F7}] => (Allow) C:\Windows\AutoKMS\AutoKMS.exe FirewallRules: [{7039608C-3BAF-4175-B1D5-9DB53104CE60}] => (Allow) C:\Windows\AutoKMS\AutoKMS.exe FirewallRules: [{A6677B6E-9570-4D98-87FE-84B9780B452C}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{CD221F27-BA09-4A4E-BC94-50541EBCB868}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{85BC76F4-96B4-4164-A507-B85036C799E4}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe FirewallRules: [{05E12DE1-3BF9-4600-BD77-0809E7D8C280}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe FirewallRules: [UDP Query User{6B3064D8-144A-4C73-834F-582573F693E1}C:\users\admin\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\admin\appdata\local\akamai\netsession_win.exe FirewallRules: [TCP Query User{4F97824E-B35A-4B0C-97A6-D3BAFD6E693B}C:\users\admin\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\admin\appdata\local\akamai\netsession_win.exe FirewallRules: [{ACFE8A12-C5A4-41FC-90A6-7D110C49FAEE}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe FirewallRules: [{55CAAA0F-FBB7-462F-8A31-FCCBE685917A}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe FirewallRules: [{046FF7F9-A214-4106-ADBB-6B8AD4D530E1}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe FirewallRules: [{B26C67AD-595F-4798-8BA9-48A408D1A66A}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe FirewallRules: [{0812631C-DFED-4D26-BAD8-38EC0D43A5F9}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe FirewallRules: [{DD625CA9-74CC-4EF5-8787-672253D8102B}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe FirewallRules: [{92F406C8-75D5-4ABC-B10E-2BCB8528AAD5}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{2E1B87E5-B37C-4C66-97F9-A7331EB138D4}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{20E5CF9D-CD2B-48EC-8529-99B170102939}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\AdVenture Capitalist\adventure-capitalist.exe FirewallRules: [{C1EF0CA2-2081-43FE-8B04-16DE223F8C15}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\AdVenture Capitalist\adventure-capitalist.exe FirewallRules: [{C20F43D5-69D4-45A1-AD1B-C744E89D4511}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{7E097365-0904-432E-929B-8F1CD4D41E51}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{1E925C46-62CE-4FA6-82B0-ABDF754998C5}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{F8DCB71C-268A-4DB2-8339-FDB932450A7D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{DD491145-F36D-48BC-A4CF-458D412FE1DE}] => (Allow) C:\Program Files\iTunes\iTunes.exe FirewallRules: [{9E2BD5A0-E113-4596-8766-27355FE2915D}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe FirewallRules: [{E745B22D-7912-4168-B501-8A08C1F3C580}] => (Allow) C:\Program Files (x86)\Max Driver Updater\maxdu.exe FirewallRules: [{B3E55AD0-D1A7-43AB-921D-E6DDA30B0AA7}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe FirewallRules: [{E14732EA-52F0-4432-89E4-260E59AA402D}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe FirewallRules: [{AA9EBF75-40EA-45B3-8E32-6D07EA9B53A9}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\DataProxy.exe ==================== Fehlerhafte Geräte im Gerätemanager ============= ==================== Fehlereinträge in der Ereignisanzeige: ========================= Applikationsfehler: ================== Error: (11/05/2015 01:57:18 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC) Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2147024865. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“. Error: (11/05/2015 01:57:18 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC) Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2147024865. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“. Error: (11/05/2015 01:57:18 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC) Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“. Error: (11/04/2015 05:09:31 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: MicrosoftEdge.exe, Version: 11.0.10240.16566, Zeitstempel: 0x56277dbe Name des fehlerhaften Moduls: CoreUIComponents.dll, Version: 0.0.0.0, Zeitstempel: 0x55fa4b76 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000000000060f73 ID des fehlerhaften Prozesses: 0x1f70 Startzeit der fehlerhaften Anwendung: 0xMicrosoftEdge.exe0 Pfad der fehlerhaften Anwendung: MicrosoftEdge.exe1 Pfad des fehlerhaften Moduls: MicrosoftEdge.exe2 Berichtskennung: MicrosoftEdge.exe3 Vollständiger Name des fehlerhaften Pakets: MicrosoftEdge.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: MicrosoftEdge.exe5 Error: (11/04/2015 04:53:58 PM) (Source: System Restore) (EventID: 8210) (User: ) Description: Unbekannter Fehler bei der Systemwiederherstellung: (Windows Update). Zusätzliche Informationen: 0x80070571. Error: (11/04/2015 04:23:32 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC) Description: Bei der Aktivierung der App „Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe:MicrosoftEdge.AppX9zvsr9qeth9e9a03yr0g7rpdrcrwgn5r.mca“ ist folgender Fehler aufgetreten: -2144927149. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“. Error: (11/04/2015 04:14:43 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC) Description: Bei der Aktivierung der App „Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe:MicrosoftEdge.AppX9zvsr9qeth9e9a03yr0g7rpdrcrwgn5r.mca“ ist folgender Fehler aufgetreten: -2144927149. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“. Error: (11/04/2015 03:37:41 PM) (Source: System Restore) (EventID: 8210) (User: ) Description: Unbekannter Fehler bei der Systemwiederherstellung: (Windows Update). Zusätzliche Informationen: 0x81000204. Error: (11/04/2015 03:34:50 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC) Description: Bei der Aktivierung der App „Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe!Microsoft.MicrosoftOfficeHub“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“. Error: (11/04/2015 03:34:04 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: ) Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer". Details: AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll. System Error: Zugriff verweigert . Systemfehler: ============= Error: (11/05/2015 02:10:52 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT) Description: {784E29F4-5EBE-4279-9948-1E8FE941646D} Error: (11/05/2015 02:07:02 PM) (Source: EventLog) (EventID: 6008) (User: ) Description: Das System wurde zuvor am 05.11.2015 um 14:04:09 unerwartet heruntergefahren. Error: (11/05/2015 02:04:09 PM) (Source: EventLog) (EventID: 6008) (User: ) Description: Das System wurde zuvor am 05.11.2015 um 13:59:08 unerwartet heruntergefahren. Error: (11/05/2015 02:03:01 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT) Description: {784E29F4-5EBE-4279-9948-1E8FE941646D} Error: (11/05/2015 01:59:08 PM) (Source: EventLog) (EventID: 6008) (User: ) Description: Das System wurde zuvor am 05.11.2015 um 13:34:28 unerwartet heruntergefahren. Error: (11/05/2015 01:57:18 PM) (Source: DCOM) (EventID: 10001) (User: PC) Description: "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca31CortanaUI.AppXjxtspbn4351hrtx8tc95e89kaz3h2f1f.mcaNicht verfügbarNicht verfügbar Error: (11/05/2015 01:57:18 PM) (Source: DCOM) (EventID: 10001) (User: PC) Description: "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca31CortanaUI.AppXd4tad4d57t4wtdbnnmb8v2xtzym8c1n8.mcaNicht verfügbarNicht verfügbar Error: (11/05/2015 01:57:18 PM) (Source: DCOM) (EventID: 10010) (User: PC) Description: CortanaUI.AppXtpp90jhw9p0njjb85kvhxpppgrqfp117.mca Error: (11/05/2015 01:57:15 PM) (Source: DCOM) (EventID: 10010) (User: PC) Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474} Error: (11/05/2015 01:57:15 PM) (Source: DCOM) (EventID: 10010) (User: PC) Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474} CodeIntegrity: =================================== Date: 2015-11-05 12:39:36.174 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-10-26 20:03:56.406 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-09-28 17:52:15.924 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-09-24 22:29:45.054 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-09-15 19:40:31.474 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-08-29 12:12:37.860 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-08-05 23:10:52.350 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. ==================== Speicherinformationen =========================== Prozessor: Intel(R) Pentium(R) CPU G3420 @ 3.20GHz Prozentuale Nutzung des RAM: 41% Installierter physikalischer RAM: 8111.13 MB Verfügbarer physikalischer RAM: 4772.97 MB Summe virtueller Speicher: 9391.13 MB Verfügbarer virtueller Speicher: 5462.03 MB ==================== Laufwerke ================================ Drive c: () (Fixed) (Total:243.36 GB) (Free:163.33 GB) NTFS Drive d: (Volume) (Fixed) (Total:687.37 GB) (Free:687.19 GB) NTFS ==================== MBR & Partitionstabelle ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: C390FBE7) Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=243.4 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=450 MB) - (Type=27) Partition 4: (Not Active) - (Size=687.4 GB) - (Type=07 NTFS) ==================== Ende von Addition.txt ============================ |
05.11.2015, 14:50 | #4 |
| Easycalender lässt sich nicht entfernen Und zu guter letzt die TDSSKiller Datei: (die Datei ist zu groß ich teile die mal auf 2 logs auf, falls ich es anders posten soll, lass es mich bitte wissen!) Code:
ATTFilter 14:35:25.0799 0x1958 TDSS rootkit removing tool 3.1.0.5 Jul 24 2015 12:29:57 14:35:51.0779 0x1958 ============================================================ 14:35:51.0779 0x1958 Current date / time: 2015/11/05 14:35:51.0779 14:35:51.0779 0x1958 SystemInfo: 14:35:51.0779 0x1958 14:35:51.0779 0x1958 OS Version: 10.0.10240 ServicePack: 0.0 14:35:51.0779 0x1958 Product type: Workstation 14:35:51.0779 0x1958 ComputerName: PC 14:35:51.0779 0x1958 UserName: Admin 14:35:51.0779 0x1958 Windows directory: C:\WINDOWS 14:35:51.0779 0x1958 System windows directory: C:\WINDOWS 14:35:51.0779 0x1958 Running under WOW64 14:35:51.0779 0x1958 Processor architecture: Intel x64 14:35:51.0779 0x1958 Number of processors: 2 14:35:51.0779 0x1958 Page size: 0x1000 14:35:51.0779 0x1958 Boot type: Normal boot 14:35:51.0779 0x1958 ============================================================ 14:35:52.0221 0x1958 KLMD registered as C:\WINDOWS\system32\drivers\23134186.sys 14:35:52.0896 0x1958 System UUID: {D3571052-8531-8C7F-52F0-7A69597B5193} 14:35:53.0322 0x1958 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 14:35:53.0331 0x1958 ============================================================ 14:35:53.0331 0x1958 \Device\Harddisk0\DR0: 14:35:53.0331 0x1958 MBR partitions: 14:35:53.0332 0x1958 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0xAF000 14:35:53.0332 0x1958 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0xAF800, BlocksNum 0x1E6B7800 14:35:53.0332 0x1958 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x1E848000, BlocksNum 0x55EBD800 14:35:53.0332 0x1958 ============================================================ 14:35:53.0364 0x1958 C: <-> \Device\Harddisk0\DR0\Partition2 14:35:53.0388 0x1958 D: <-> \Device\Harddisk0\DR0\Partition3 14:35:53.0388 0x1958 ============================================================ 14:35:53.0388 0x1958 Initialize success 14:35:53.0388 0x1958 ============================================================ 14:36:29.0255 0x1be8 ============================================================ 14:36:29.0255 0x1be8 Scan started 14:36:29.0255 0x1be8 Mode: Manual; SigCheck; TDLFS; 14:36:29.0255 0x1be8 ============================================================ 14:36:29.0255 0x1be8 KSN ping started 14:36:31.0571 0x1be8 KSN ping finished: true 14:36:34.0166 0x1be8 ================ Scan system memory ======================== 14:36:34.0166 0x1be8 System memory - ok 14:36:34.0166 0x1be8 ================ Scan services ============================= 14:36:34.0269 0x1be8 [ 22CE801AD25C51E2553F41A076BB0CB2, 0520216417F1619FB642734EC937C59D5E79A24306C1E9B793C82FAE077851E6 ] 1394ohci C:\WINDOWS\System32\drivers\1394ohci.sys 14:36:34.0302 0x1be8 1394ohci - ok 14:36:34.0317 0x1be8 [ 2C49A2441EBB24C6ACFB524C1459115F, 0ABACB6F21C41C0297994E61F1BFABB3905AF6B569D0446FE8E174EB9225B8EF ] 3ware C:\WINDOWS\system32\drivers\3ware.sys 14:36:34.0326 0x1be8 3ware - ok 14:36:34.0358 0x1be8 [ B87D3D07FE6F15328C6860D542F0E2BD, 46CF069EDD7DBFB4DB800BABA3081DAB363DD2CFD724AFF5916D3419F62A3574 ] ACPI C:\WINDOWS\system32\drivers\ACPI.sys 14:36:34.0375 0x1be8 ACPI - ok 14:36:34.0386 0x1be8 [ 1E3C4EDBB7F3F668B7205E351010BB79, A3CA12F72836C4F77B671264828B370B9EBA9CD71110E2C0514994760B6B12FF ] acpiex C:\WINDOWS\system32\Drivers\acpiex.sys 14:36:34.0395 0x1be8 acpiex - ok 14:36:34.0417 0x1be8 [ 13B1C26AEDCB40082CDD97506F968129, 883442206B4C60AA493E84CC3037B6C1568441E1F43D2B1FCBFD8D87D135D511 ] acpipagr C:\WINDOWS\System32\drivers\acpipagr.sys 14:36:34.0425 0x1be8 acpipagr - ok 14:36:34.0446 0x1be8 [ B3D64FF927D611721DA73A61BF3A18B3, 96B51AFDC3078B5088AAF66F0CF3E07D2FCBBC84A19D309A25DF0A5C6CECB958 ] AcpiPmi C:\WINDOWS\System32\drivers\acpipmi.sys 14:36:34.0453 0x1be8 AcpiPmi - ok 14:36:34.0460 0x1be8 [ 19F793B2203D94AC1F8AEDB08B494E2E, DC98CCF9935E1F1C32FA88575A9A678B74916EFF48E39A64CF1FF92232F64A52 ] acpitime C:\WINDOWS\System32\drivers\acpitime.sys 14:36:34.0468 0x1be8 acpitime - ok 14:36:34.0551 0x1be8 [ 5DB2C6B908C50767E2EDAA294A7566B5, 13AE4879D679BB0C6B2A5A5B13910359815A9D2E569BC1DE740B5A387A78CF33 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe 14:36:34.0557 0x1be8 AdobeARMservice - ok 14:36:34.0602 0x1be8 [ 2A24E10C1A1DE0E0035E353EED494A1C, CBBFA86578BE74CAADDCA923D65E3BFFC57BC17B887936ADE5C6952530546A22 ] ADP80XX C:\WINDOWS\system32\drivers\ADP80XX.SYS 14:36:34.0629 0x1be8 ADP80XX - ok 14:36:34.0662 0x1be8 [ 6C12C7E01A4F64E0AA9C88AF66955CC9, 81A413702909341F8694823EC83FBA0089523D7EC927B80E55E0779BB83AD263 ] AFD C:\WINDOWS\system32\drivers\afd.sys 14:36:34.0679 0x1be8 AFD - ok 14:36:34.0702 0x1be8 [ EF09D07626820F7F89519514C17FE768, C3EC1DC163CD5946270ED876CD414889BBF2C586A8AF5DC7825FA5D77001E827 ] agp440 C:\WINDOWS\system32\drivers\agp440.sys 14:36:34.0709 0x1be8 agp440 - ok 14:36:34.0733 0x1be8 [ 8A289EF0721F95267BF2404BABEE146D, E263D258F03DF3BB405D49AE7230C37E7EB8F392FDEE48059C7C1E3709520D35 ] ahcache C:\WINDOWS\system32\DRIVERS\ahcache.sys 14:36:34.0747 0x1be8 ahcache - ok 14:36:34.0769 0x1be8 [ C301499987AF909258774AE9DC5778BB, 3ED539C999847116AE9DB9C8C5A34AB09703BAE3018E1EAF6DBC779BB6736F32 ] AJRouter C:\WINDOWS\System32\AJRouter.dll 14:36:34.0777 0x1be8 AJRouter - ok 14:36:34.0799 0x1be8 [ DD69535D379F9E40AD0D6002887AAA99, 579DD18CE2B264B4058C6069B8AEE6FD9FE6A882B7DA19E300DFE40B37A4E5BE ] ALG C:\WINDOWS\System32\alg.exe 14:36:34.0809 0x1be8 ALG - ok 14:36:34.0834 0x1be8 [ 6DD5B6F43B389A058FA92C2C955F1296, 66575E05E91D88B1ED9BD2817A667DA91279B480106B6F97A82BB1DD7B731052 ] AMD External Events Utility C:\WINDOWS\system32\atiesrxx.exe 14:36:34.0845 0x1be8 AMD External Events Utility - ok 14:36:34.0869 0x1be8 [ 6763084E8322A4876D1613854640F914, 89EEEB47517A9964FA799821E5E45BDD6009EBDC628D6DADE6A7F03DE7CDA6CD ] AmdK8 C:\WINDOWS\System32\drivers\amdk8.sys 14:36:34.0880 0x1be8 AmdK8 - ok 14:36:34.0904 0x1be8 [ F2FF8C1B41B3784EDBD5C6D5397F403C, 104873700D2BDF4812DC48200B4609F46A63E7A50594A0599100EF1438863708 ] amdkmafd C:\WINDOWS\system32\drivers\amdkmafd.sys 14:36:34.0912 0x1be8 amdkmafd - ok 14:36:34.0915 0x1be8 amdkmdag - ok 14:36:34.0940 0x1be8 [ 8653B22467365AC4853566B2E20C36DE, AB2896370C6EBFDAE4195E3A25F40E440B709280A472ACCB4F8912E59D4C5DC6 ] amdkmdap C:\WINDOWS\system32\DRIVERS\atikmpag.sys 14:36:34.0959 0x1be8 amdkmdap - ok 14:36:34.0974 0x1be8 [ DE29D8AB57AD67D4940CAB4A48B3E230, 4E92AFCD9107573DAB8E65AC6318E4B8851DCCBE17E135DFF8CF5733210B52E6 ] AmdPPM C:\WINDOWS\System32\drivers\amdppm.sys 14:36:34.0984 0x1be8 AmdPPM - ok 14:36:35.0020 0x1be8 [ 4C1F9BBAF5CCD76D4642F3B92B97B454, 514CCAA8B586B1019658BE101046386EB727AD48D7913AEF9A168763E91F0DE5 ] amdsata C:\WINDOWS\system32\drivers\amdsata.sys 14:36:35.0028 0x1be8 amdsata - ok 14:36:35.0040 0x1be8 [ F8195C1A15955180DD663E7FF4C2F6DD, F3C0C6B38FB9478217EE25EBDBDF7A18F01B97655BC38373E70E71171705D5E9 ] amdsbs C:\WINDOWS\system32\drivers\amdsbs.sys 14:36:35.0051 0x1be8 amdsbs - ok 14:36:35.0059 0x1be8 [ DD2F5BBCFAC4D8E48DB1A95A7EEBFF08, 619E3106072C6F785144D785C4AFB4C607CAF7ED29AAA4A1411BE262E62B7ADE ] amdxata C:\WINDOWS\system32\drivers\amdxata.sys 14:36:35.0066 0x1be8 amdxata - ok 14:36:35.0077 0x1be8 [ 46AAF119090573A80D603745582229ED, 8D7C4AED66DD32A104965DC23D17C0815CD1BE2E3D52375C1A63863664EE174F ] AppID C:\WINDOWS\system32\drivers\appid.sys 14:36:35.0086 0x1be8 AppID - ok 14:36:35.0090 0x1be8 [ 24315B385F515D6D5476757EAFD62633, CE645397BF43CC54B864A0E4FCB86F76C10B9C2D2482E85DBBE15EF7BF045F17 ] AppIDSvc C:\WINDOWS\System32\appidsvc.dll 14:36:35.0116 0x1be8 AppIDSvc - ok 14:36:35.0125 0x1be8 [ 2CE396457D5C18F034D243EC7E159010, DDF588A568DF5EAE058DF315535BD746760363E2242EF8C705F8DCBA2D5DA4A7 ] Appinfo C:\WINDOWS\System32\appinfo.dll 14:36:35.0137 0x1be8 Appinfo - ok 14:36:35.0213 0x1be8 [ 3E7C6639E424FD28952C29D66B7E5277, B10AD3FA5CB36328C5DF33AF58F76770E2B54CFBCB70BD84934F925B8E19FA1F ] Apple Mobile Device Service C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 14:36:35.0218 0x1be8 Apple Mobile Device Service - ok 14:36:35.0234 0x1be8 [ 68AF553066C4DAE7D8698322526BDA86, 806A5228D204B18B3B9F88AB87B5918046BE96D1B3AEFEC9331CA7A483547486 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll 14:36:35.0246 0x1be8 AppMgmt - ok 14:36:35.0265 0x1be8 [ A8AC0B8ED134888731D1A1BCEF930FA1, 917D2C99CB28C5F20BA386148B6A93541AEF900A9A99D310D732B501322945E5 ] AppReadiness C:\WINDOWS\system32\AppReadiness.dll 14:36:35.0288 0x1be8 AppReadiness - ok 14:36:35.0355 0x1be8 [ 2E71E6B389976FD78609A1AB44F7EEB1, 24F7A6D7B4C3DFFE128AFE70F37FFA6258928DF7CCFF3AB2490A41F595529299 ] AppXSvc C:\WINDOWS\system32\appxdeploymentserver.dll 14:36:35.0416 0x1be8 AppXSvc - ok 14:36:35.0432 0x1be8 [ 0756EECAC010BE449D07502DF27E7701, 6A895CA80050D021DB5E130102F626027339A22673B7C15C51A375C0401F03D2 ] arcsas C:\WINDOWS\system32\drivers\arcsas.sys 14:36:35.0441 0x1be8 arcsas - ok 14:36:35.0460 0x1be8 [ E1AFEE1584C74050DE0DD16DE2A54BF3, 77C8D98159D8BCDC7917B04977949823D50C49D0D13587310E060A4B8893AE42 ] AsrAppCharger C:\WINDOWS\system32\DRIVERS\AsrAppCharger.sys 14:36:35.0464 0x1be8 AsrAppCharger - ok 14:36:35.0516 0x1be8 [ 1A234F4643F5658BAB07BFA611282267, F40435488389B4FB3B945CA21A8325A51E1B5F80F045AB019748D0EC66056A8B ] AsrDrv101 C:\Windows\SysWOW64\Drivers\AsrDrv101.sys 14:36:35.0520 0x1be8 AsrDrv101 - ok 14:36:35.0573 0x1be8 [ D208B82330EB0CA9E1285520630183F1, 1122E08493BFDF639ECB80A7F3BD640971FF3639154F4130434F98E1831E004A ] ASRockIOMon C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe 14:36:35.0586 0x1be8 ASRockIOMon - detected UnsignedFile.Multi.Generic ( 1 ) 14:36:37.0903 0x1be8 Detect skipped due to KSN trusted 14:36:37.0903 0x1be8 ASRockIOMon - ok 14:36:37.0927 0x1be8 [ A149C93231945A5118C63AEACA6D1E72, 60B28184585B389751FCF71651A139D74018DE04AEBF4A497835AF727B64BD53 ] AsrRamDisk C:\WINDOWS\system32\drivers\AsrRamDisk.sys 14:36:37.0931 0x1be8 AsrRamDisk - ok 14:36:37.0959 0x1be8 [ A5792F971EFE86B7F56EE7299ED1082B, 82DCD15E2C9D8A3EA663941C9CE73020FEEF2F91354D0BB51E8A142AA1E30217 ] AsyncMac C:\WINDOWS\System32\drivers\asyncmac.sys 14:36:37.0969 0x1be8 AsyncMac - ok 14:36:37.0976 0x1be8 [ 8921DF6060DB5C7700AA48CB12E9EA08, 8F18841B454CDE4926C50B23F818D00ECE0AE884DB198E396445CB44CB39B2C4 ] atapi C:\WINDOWS\system32\drivers\atapi.sys 14:36:37.0982 0x1be8 atapi - ok 14:36:37.0996 0x1be8 [ AF6DD5993D46AF2492C19E1FF6D9A04C, 720F27791FF5D486AD07A447A4BC44D137AA245B91CE1D624E40B1DA78B6CACF ] AtiHDAudioService C:\WINDOWS\system32\drivers\AtihdWB6.sys 14:36:38.0006 0x1be8 AtiHDAudioService - ok 14:36:38.0040 0x1be8 [ 240FF83DD79546B26F187FAB20F83864, C4DC0159016B4A4630357131E614814C068D07BEA94AAF6393E882A78C9FCA1E ] AudioEndpointBuilder C:\WINDOWS\System32\AudioEndpointBuilder.dll 14:36:38.0056 0x1be8 AudioEndpointBuilder - ok 14:36:38.0081 0x1be8 [ 4C86961C71396D2BA39DAD9783437546, C36A428701D6C0E2FFDF0ECB8917FB6ED48E8014F7C3DD911387DE6E161D7EAD ] Audiosrv C:\WINDOWS\System32\Audiosrv.dll 14:36:38.0114 0x1be8 Audiosrv - ok 14:36:38.0139 0x1be8 [ 2F7F80543129210CA75995D0DCA488E8, 353E598FF26FA363C02A2B44BA8D7D1ED97B8AC8C69F1B5C5D521BD0D5D5AB94 ] AxInstSV C:\WINDOWS\System32\AxInstSV.dll 14:36:38.0152 0x1be8 AxInstSV - ok 14:36:38.0170 0x1be8 [ 00D64E82900E4EC9062805ED87C2D75A, 577110F9A7C6C2C4CF86FFF4F60E23F61623ED325FC950033900A5102754A677 ] b06bdrv C:\WINDOWS\system32\drivers\bxvbda.sys 14:36:38.0187 0x1be8 b06bdrv - ok 14:36:38.0208 0x1be8 [ 5164A66EC1565711A7B4CF2F143B4979, DA29F0FB63F3EB2BF92D51FEB4BB7D2B964553D2F634556325953927464CB3A5 ] BasicDisplay C:\WINDOWS\System32\drivers\BasicDisplay.sys 14:36:38.0217 0x1be8 BasicDisplay - ok 14:36:38.0225 0x1be8 [ F4C58BBF2972BD84C73F6A14CA35AC4E, B7A226EB861B63ACF4BF9B5A331ACA6FFC9B787DCCAA7697EEFC4F634508A6D5 ] BasicRender C:\WINDOWS\System32\drivers\BasicRender.sys 14:36:38.0233 0x1be8 BasicRender - ok 14:36:38.0254 0x1be8 [ 25349D0B334E528667980948ED107D89, 70EF9D3B8DCAC6E9720C6F3EBC77392FADC182A6925F9024FE30A21321E0137F ] bcmfn2 C:\WINDOWS\System32\drivers\bcmfn2.sys 14:36:38.0258 0x1be8 bcmfn2 - ok 14:36:38.0284 0x1be8 [ DF78B56EEE6004DEE8CE57763128075E, 5758CAF4B0182F3F2E2508B3BB58B0271F2689808D09675B2753FE373D1D77D2 ] BDESVC C:\WINDOWS\System32\bdesvc.dll 14:36:38.0300 0x1be8 BDESVC - ok 14:36:38.0328 0x1be8 [ 1E8A9267F8886803AAE02982FC1B5BC4, 655DF84E037BD6E582A6BA89737A4388956219171AF7253D126E54A23F16BE59 ] Beep C:\WINDOWS\system32\drivers\Beep.sys 14:36:38.0345 0x1be8 Beep - ok 14:36:38.0375 0x1be8 [ 7FAFFFC4C59F5010D6E7CEA152076B92, 945FD6C04E109D4E5A4164BAA9A8120EC85AB809555AAD83E61B9F179F976FD7 ] BFE C:\WINDOWS\System32\bfe.dll 14:36:38.0402 0x1be8 BFE - ok 14:36:38.0445 0x1be8 [ BD60F5633F6BD617D9ECCA3FFDC0D37E, 2F0DECAEB7096CD628387263381E123C883F483BD87F7F2BA6DEFBB5A184BAA3 ] BITS C:\WINDOWS\System32\qmgr.dll 14:36:38.0482 0x1be8 BITS - ok 14:36:38.0511 0x1be8 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD, 17BFFC5DF609CE3B2F0CAB4BD6C118608C66A3AD86116A47E90B2BB7D8954122 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe 14:36:38.0521 0x1be8 Bonjour Service - ok 14:36:38.0532 0x1be8 [ C9FD65687EF89715999C582D3E568812, 42BA59A78A47C510CB2AFDC6C6080B33F9F611F84FEE5262DFF16D7633C50EB1 ] bowser C:\WINDOWS\system32\DRIVERS\bowser.sys 14:36:38.0542 0x1be8 bowser - ok 14:36:38.0574 0x1be8 [ 3A4A543F135DE9A06ABA9DF982D79DD7, ABA165435C27BE15D7EBD3E7D023E295CB7AE2A099DF9E253C78EC45EADD75EA ] BrokerInfrastructure C:\WINDOWS\System32\bisrv.dll 14:36:38.0595 0x1be8 BrokerInfrastructure - ok 14:36:38.0604 0x1be8 [ 2AAD720B32904B97EDD8C3211344F79E, 41B1AEA5FAA48033B2581E18D68EFC986C3D65B383847E250C054CE3133A893C ] Browser C:\WINDOWS\System32\browser.dll 14:36:38.0614 0x1be8 Browser - ok 14:36:38.0626 0x1be8 [ F8DD3B0EAC1EF1D087AE47E5819540AC, 866C951B52E3202AC89552AEA72A45123367199335578F03815E2ED55DA2FDAE ] BthAvrcpTg C:\WINDOWS\System32\drivers\BthAvrcpTg.sys 14:36:38.0635 0x1be8 BthAvrcpTg - ok 14:36:38.0656 0x1be8 [ 647E2A425AD43637EAA01096A58B7089, 8F76D024FEBCBA1AC54363133DE1E0DD5B9D696E5E688EFEBC3B79F7F1B9C568 ] BthHFEnum C:\WINDOWS\System32\drivers\bthhfenum.sys 14:36:38.0666 0x1be8 BthHFEnum - ok 14:36:38.0675 0x1be8 [ B95040CAD3434D9EE003065363A0FAFF, D441E0676EA1AE1ABC305732024311CA59715E6763B3D7ADB728DEEFC403E182 ] bthhfhid C:\WINDOWS\System32\drivers\BthHFHid.sys 14:36:38.0684 0x1be8 bthhfhid - ok 14:36:38.0711 0x1be8 [ F334BF7B0737CEB3B6822631EAD55A87, 4E5AEB1F8E109BA01A5D1CDE2E3C677FF07F2AFE8B195CB5F82AA28816D2060E ] BthHFSrv C:\WINDOWS\System32\BthHFSrv.dll 14:36:38.0727 0x1be8 BthHFSrv - ok 14:36:38.0737 0x1be8 [ 29AEE352AED4FCD2191436D263D75347, 3D21262EA26BF423BFA4A9146E53F8B036B2A1157DBE91A11C5603AF7A670B6F ] BTHMODEM C:\WINDOWS\System32\drivers\bthmodem.sys 14:36:38.0747 0x1be8 BTHMODEM - ok 14:36:38.0761 0x1be8 [ 26DD0127A05B333E36316E6EA9A6AAE2, A2DC4483FF5639EE8DD315AB2989865CA6A6992C578FD7F7D31698A015355941 ] bthserv C:\WINDOWS\system32\bthserv.dll 14:36:38.0771 0x1be8 bthserv - ok 14:36:38.0786 0x1be8 [ 854AF190F55E6D70EC65A85798F896E2, 6D39F9131BE93F934502BA1DB109E7AD35D3987B636F7B32F9C34823DF25746B ] buttonconverter C:\WINDOWS\System32\drivers\buttonconverter.sys 14:36:38.0795 0x1be8 buttonconverter - ok 14:36:38.0807 0x1be8 [ A10A1E05A943B10ECE5D57D131B7404D, 71BB816B6841001A4305DF1814926B639265E91895CA5D06284B0970E40CE386 ] CapImg C:\WINDOWS\System32\drivers\capimg.sys 14:36:38.0818 0x1be8 CapImg - ok 14:36:38.0831 0x1be8 [ F2829DC6D292DCAC5029893BB2E9FEE3, AF2A25722D3BE37BABD1F6668786AAF39E9D6CA18CE8E845E63266E218C64526 ] cdfs C:\WINDOWS\system32\DRIVERS\cdfs.sys 14:36:38.0841 0x1be8 cdfs - ok 14:36:38.0866 0x1be8 [ F3A9E38AE23AD4015764AF89E4AE3519, 57ED6AC834177E128720FEC5B5793F35C7C36474E2D787F182B6730933222CC9 ] CDPSvc C:\WINDOWS\System32\CDPSvc.dll 14:36:38.0884 0x1be8 CDPSvc - ok 14:36:38.0914 0x1be8 [ CA160E02F35A61C6F5C681FB4669C519, E6BC66156EE226F16804C4FDC8A60EB15CE6212EAFB9FB841FAC899979E140E2 ] cdrom C:\WINDOWS\System32\drivers\cdrom.sys 14:36:38.0925 0x1be8 cdrom - ok 14:36:38.0934 0x1be8 [ 320E7A02D81A468E8C1FEEFDB856AFAE, E65127D3D6B628F9D19EA509FEBD9E4DC1BF20D0C62C3C9E1D7087DF972B2AA7 ] CertPropSvc C:\WINDOWS\System32\certprop.dll 14:36:38.0949 0x1be8 CertPropSvc - ok 14:36:39.0002 0x1be8 [ 1BF0745142C07A6967C6DB7DEBFF6B16, 50C60F59CC1FE6EFF4E79A0A2545B14FF4851881C9262D6CFA6EE0ECF027D1D6 ] cFosSpeed C:\WINDOWS\system32\DRIVERS\cfosspeed6.sys 14:36:39.0035 0x1be8 cFosSpeed - ok 14:36:39.0105 0x1be8 [ 49C58338E9572E2570E2C636A3CDAA42, 9E2271B008EABD1263507A4185FE0CFDE84C65A659DF350EF000325FA0340B66 ] cFosSpeedS C:\Program Files\ASRock\XFast LAN\spd.exe 14:36:39.0119 0x1be8 cFosSpeedS - ok 14:36:39.0138 0x1be8 [ 60D7D304DF75DFF6A46CF633F583B592, 4141D8D1C6FE829C02053DA91AC6B0628BDEB3322CAAD4AD958190F9D173340E ] circlass C:\WINDOWS\System32\drivers\circlass.sys 14:36:39.0147 0x1be8 circlass - ok 14:36:39.0166 0x1be8 [ FF9D4BCE19E5D36CB3A845A3286DA6C3, A0E2C38D629359EEC6F8EEC6F92A3E571AEF018BAF259F395DC497ED4827460B ] CLFS C:\WINDOWS\system32\drivers\CLFS.sys 14:36:39.0179 0x1be8 CLFS - ok 14:36:39.0211 0x1be8 [ 5C4648673693724C8D4A1A92E1AA06E6, 5D548241715687BFA52E40B867EF73CB45D01B7F9A9B7F00B92BF2B4C97BE1D0 ] ClipSVC C:\WINDOWS\System32\ClipSVC.dll 14:36:39.0230 0x1be8 ClipSVC - ok 14:36:39.0254 0x1be8 [ 8EBA63416EC166EBA6EF6D34A505D8C8, 5EB0236ABEA2277B71D9F009DA71934C618606B20BBEC07B8595195E40C12A2B ] CmBatt C:\WINDOWS\System32\drivers\CmBatt.sys 14:36:39.0263 0x1be8 CmBatt - ok 14:36:39.0290 0x1be8 [ 3B64DA873CEA5BEC42570BFF1054A014, 3649B25855CB9BE5BA3B3FEE4221575381FB2D488B8B050B5DD0088386AA0F7B ] CNG C:\WINDOWS\system32\Drivers\cng.sys 14:36:39.0307 0x1be8 CNG - ok 14:36:39.0314 0x1be8 [ 5EEA0856000F81B3D709BC81B3AA1EF2, C04E4E31D3FC38102BA410D312F58AF848920EE37004A5C306D79229C9B6079A ] cnghwassist C:\WINDOWS\system32\DRIVERS\cnghwassist.sys 14:36:39.0321 0x1be8 cnghwassist - ok 14:36:39.0371 0x1be8 [ 74CD3BF688E2B408227FE012A2F2D8ED, CC01AC79CEB9DC94FA5675D66F048928C9968B8944E34F5482A73C14B70EE8A8 ] CompositeBus C:\WINDOWS\System32\DriverStore\FileRepository\compositebus.inf_amd64_98334ba6e76853ba\CompositeBus.sys 14:36:39.0379 0x1be8 CompositeBus - ok 14:36:39.0382 0x1be8 COMSysApp - ok 14:36:39.0394 0x1be8 [ D38774D1D383A2CDB9A4F64B7206913B, 6CDDC46D1D431342F00CA537FC327B23B8AA4D513CEEEE61F3E19C77975DF9C8 ] condrv C:\WINDOWS\system32\drivers\condrv.sys 14:36:39.0402 0x1be8 condrv - ok 14:36:39.0439 0x1be8 [ 8AFDD74F2DC5BAD9B2215FB19DB65240, A2BDDA4C77C63D3D8E9F1D397D7B41EC1BF093A6399C14D311D4D230B5F1E093 ] CoreMessagingRegistrar C:\WINDOWS\system32\coremessaging.dll 14:36:39.0461 0x1be8 CoreMessagingRegistrar - ok 14:36:39.0490 0x1be8 [ 35DB06AACD8AD5999161DA71FF0E16F0, 22AD27811AAD14666ACEF4115447B0CFAA70D1E73923059FB2A9B4C3CBE500A6 ] CryptSvc C:\WINDOWS\system32\cryptsvc.dll 14:36:39.0500 0x1be8 CryptSvc - ok 14:36:39.0515 0x1be8 [ 838755238B2BAE5A4802B038443B8A22, 1A89E413C6E5C3E8C2B64F8A1D41271D3FA39BC67291331FEC8DCFD4F8CCE994 ] CSC C:\WINDOWS\system32\drivers\csc.sys 14:36:39.0536 0x1be8 CSC - ok 14:36:39.0570 0x1be8 [ 7D64B14DAFEBBC19A87EC9D5B862F6AA, BE7510E618566FEA013E2E77CE4C7C160BADE105C493424595A15D0A7F1615CF ] CscService C:\WINDOWS\System32\cscsvc.dll 14:36:39.0596 0x1be8 CscService - ok 14:36:39.0621 0x1be8 [ F038EAF73AAB72A4A89185A5A7B9FD75, 8213A60B3BEAFC1C554C5D049DFE3C6E44CEFE639EDD6A335AC18A9DAEDA2D4B ] dam C:\WINDOWS\system32\drivers\dam.sys 14:36:39.0629 0x1be8 dam - ok 14:36:39.0664 0x1be8 [ 5E57B9FBB4E9C43EE5B69BEE01A1819F, A1F8D1E52AF446CEA2EB50064E3A24B713B19197D61C3EAECB81B3CCD80558E7 ] DcomLaunch C:\WINDOWS\system32\rpcss.dll 14:36:39.0693 0x1be8 DcomLaunch - ok 14:36:39.0702 0x1be8 [ 0605AB12BF1856DF21AB708F28EA91CF, 3A6A7F8F84044DC1EA490A007E6DBC52203BA237ECF1B845961D9BB95E9BF8C8 ] DcpSvc C:\WINDOWS\system32\dcpsvc.dll 14:36:39.0718 0x1be8 DcpSvc - ok 14:36:39.0733 0x1be8 [ BABB7BB5AD3CECFF466E6080F43CFC58, 1B8FF66557EC4C749156ED6DACC4D61D5DC4E25DD58F6DB3713C356214B80FDA ] defragsvc C:\WINDOWS\System32\defragsvc.dll 14:36:39.0756 0x1be8 defragsvc - ok 14:36:39.0774 0x1be8 [ 63C9464B165D31ACC46B6B089AB36B41, DE38DE4E6331D07630B63224F8014C27368C29791EDB58CC5DAE7CBACD37160A ] DeviceAssociationService C:\WINDOWS\system32\das.dll 14:36:39.0795 0x1be8 DeviceAssociationService - ok 14:36:39.0806 0x1be8 [ 7B3DA16FAA498838BB457E0B7E380EDF, B73DCFFA60886F10765E4B76A58CFF18C08CAFEE620700361FC8FEC7E80B5958 ] DeviceInstall C:\WINDOWS\system32\umpnpmgr.dll 14:36:39.0820 0x1be8 DeviceInstall - ok 14:36:39.0828 0x1be8 [ CF3895DD260ADE05BC91D8FBE0A82907, D7D8A29E873BE5C3832C9264F0165F6CD50D42ED0E04B0FCF07F054793092334 ] DevQueryBroker C:\WINDOWS\system32\DevQueryBroker.dll 14:36:39.0837 0x1be8 DevQueryBroker - ok 14:36:39.0857 0x1be8 [ 25435407D97419627F4B10653433BF2B, 5429B0DB7C5302E9A6AF92C046637183D4147D4A206963ABEA3A611214D6AB04 ] Dfsc C:\WINDOWS\system32\Drivers\dfsc.sys 14:36:39.0868 0x1be8 Dfsc - ok 14:36:39.0891 0x1be8 [ 73BDD44A6088916964945886F9025409, 8E2ECC9AAEF3C6EBA2E61D25F657FDFCC72AB517CC4FD5FFF992E1F9EB942662 ] dg_ssudbus C:\WINDOWS\system32\DRIVERS\ssudbus.sys 14:36:39.0897 0x1be8 dg_ssudbus - ok 14:36:39.0905 0x1be8 [ E59C209F1F633C1AEAF151B2CA46BBAA, 6A4DA927418B56A228CC8D9DFA3351B2B53A9328F5C56C10F0C7B19974B2ED89 ] Dhcp C:\WINDOWS\system32\dhcpcore.dll 14:36:39.0929 0x1be8 Dhcp - ok 14:36:39.0976 0x1be8 [ 95AA7877FD4161BFBC8493F9279B1901, F6B7DF75D763A89901BD12454BEF92D161B392F721B8568505073929D9F419BD ] diagnosticshub.standardcollector.service C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 14:36:39.0984 0x1be8 diagnosticshub.standardcollector.service - ok 14:36:40.0027 0x1be8 [ 58395E37ED838B93A56F1D089C2F53CF, 57D167B58DF5B33F7E2A98E1B8B33C8F076D34CA032D22F050AE6F83A48DC8E6 ] DiagTrack C:\WINDOWS\system32\diagtrack.dll 14:36:40.0064 0x1be8 DiagTrack - ok 14:36:40.0076 0x1be8 [ FDCD449AE9E75D7690593D16ADAF4DB4, 3366C4BDB031EB525F85850E903C46802A2AC762C0772C6F6E543DDA4AF1E9D5 ] disk C:\WINDOWS\system32\drivers\disk.sys 14:36:40.0084 0x1be8 disk - ok 14:36:40.0111 0x1be8 [ 43A1B8B43CA4E213E0FD920F2FD6BCBA, 839C6047FD6EA951538209C30C9D8AE68F9B47A58DA151D071C03408250B0ECD ] DmEnrollmentSvc C:\WINDOWS\system32\Windows.Internal.Management.dll 14:36:40.0126 0x1be8 DmEnrollmentSvc - ok 14:36:40.0144 0x1be8 [ F10A8F6D036CEDD14A5471782C52F041, E0DA3C4F76DBBEAED549375E57819F8825B33A118F7674D417D294054863F648 ] dmvsc C:\WINDOWS\System32\drivers\dmvsc.sys 14:36:40.0152 0x1be8 dmvsc - ok 14:36:40.0183 0x1be8 [ 7228733177F673B4D51BD1AA082D47C1, DBE155CDCFAA7C32407A207F637F252FA0CE30F1DE7E7DBEC42DB37FADB5BFA7 ] dmwappushservice C:\WINDOWS\system32\dmwappushsvc.dll 14:36:40.0210 0x1be8 dmwappushservice - ok 14:36:40.0234 0x1be8 [ 592E41B3C11CA12203D3708AD8FC3D37, 6C69D5D603FBF038C069EDDCE29F7C6A60CAAE58B985AB218E1497F2BA934D42 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll 14:36:40.0248 0x1be8 Dnscache - ok 14:36:40.0267 0x1be8 [ 6184C7A2F12625C108AEFD3A43429967, 689153F319BB1013FF60F71317E8380A6945EEE8141EDBDD6B185A966E23BB93 ] dot3svc C:\WINDOWS\System32\dot3svc.dll 14:36:40.0282 0x1be8 dot3svc - ok 14:36:40.0304 0x1be8 [ 27069CFFF29B7F04F4B1BB10154BE52B, 6869626F9A1D3F64224883C5E661638CEE893A3E29651C7B9302A03E52180415 ] dot4 C:\WINDOWS\system32\DRIVERS\Dot4.sys 14:36:40.0310 0x1be8 dot4 - ok 14:36:40.0323 0x1be8 [ 0BD906A79F9CE3013F7D9D0AC45F9F9D, 2F7D5082E7E226D5EBEA164A8ACEE0A447C96EB1829224A6EFA3E7B4EFEE1D14 ] Dot4Print C:\WINDOWS\System32\drivers\Dot4Prt.sys 14:36:40.0327 0x1be8 Dot4Print - ok 14:36:40.0339 0x1be8 [ B7D595F2F464F7B628AD53F06547792C, F5D06A91EF54FBF56305FCC882B854350B266B2A005D80CC77AEBC2929440729 ] dot4usb C:\WINDOWS\system32\DRIVERS\dot4usb.sys 14:36:40.0343 0x1be8 dot4usb - ok 14:36:40.0362 0x1be8 [ A616D8297C1BEA690BBC796736A7A78D, 9365470F4609606410AD79D98E1E77D815DC7C5AA924FB639FCF713EE8EDEA76 ] DPS C:\WINDOWS\system32\dps.dll 14:36:40.0373 0x1be8 DPS - ok 14:36:40.0394 0x1be8 [ 45771610FF181434073B5A0A00F20F8D, 6A17DB09AA6D021F000F7315317235E1FCF41FD58EA7DF81A7C9F5A6DE999984 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys 14:36:40.0400 0x1be8 drmkaud - ok 14:36:40.0428 0x1be8 [ 00D9A948FB7344C62CEBED88E50EE39A, EF33FE7FB34DE571F3956C1F7AC8EFAA25BFD9F3AFA3ECD25DD34C5890873245 ] DsmSvc C:\WINDOWS\System32\DeviceSetupManager.dll 14:36:40.0441 0x1be8 DsmSvc - ok 14:36:40.0465 0x1be8 [ EA354224BAD970CF0F438E6567F26A49, 900F2454F085BC6D2C2149A96452F3375111C601C4464066B6DA1DD7B795021A ] DsSvc C:\WINDOWS\System32\DsSvc.dll 14:36:40.0478 0x1be8 DsSvc - ok 14:36:40.0536 0x1be8 [ 89C9C3745F270EF93988DA57BC6AA62B, 947886F3121919427BDCB123C6FC28E29CA73D427E92025E1BEAA743D27306D3 ] DXGKrnl C:\WINDOWS\System32\drivers\dxgkrnl.sys 14:36:40.0579 0x1be8 DXGKrnl - ok 14:36:40.0607 0x1be8 [ C413D1219AFF3005E1318CC8EA38DB4F, 2DBED36CA9B9BCC443C0D8FD41BAED5FFD38F5531FF9BE5B7A9DAD22087C5707 ] e1iexpress C:\WINDOWS\System32\drivers\e1i63x64.sys 14:36:40.0650 0x1be8 e1iexpress - ok 14:36:40.0675 0x1be8 [ 6E36BDBB46DF7F865D0DD30663AE3891, 98967B01EA450AD4D5FE8085F710359C022D783B839A51BD4A266718156B01EB ] Eaphost C:\WINDOWS\System32\eapsvc.dll 14:36:40.0692 0x1be8 Eaphost - ok 14:36:40.0764 0x1be8 [ 3070013B01EDA42C7EB67D731340C396, C083CA05650750876E70CB6AB51D5C047C06098C2ED86B083A74C97830247BFC ] ebdrv C:\WINDOWS\system32\drivers\evbda.sys 14:36:40.0835 0x1be8 ebdrv - ok 14:36:40.0859 0x1be8 [ 9A83FA0EC9B0DCED2CBC49DD05901920, 14D2F241235E2693C68BCCF05D83F2A1C9A7BE185C83E7C6C63EF0F654892F95 ] EFS C:\WINDOWS\System32\lsass.exe 14:36:40.0868 0x1be8 EFS - ok 14:36:40.0872 0x1be8 [ 59EE187E333EE9914DD9BEA5F4E0D85D, E34BB8075E38FC6AEC056323C6E3B5B4E7041EE6F4D51699B706DEEA18BDB911 ] EhStorClass C:\WINDOWS\system32\drivers\EhStorClass.sys 14:36:40.0881 0x1be8 EhStorClass - ok 14:36:40.0904 0x1be8 [ 9297F1CC486F24BDFD2874156AC5430F, 1AF8689ADE4E658FC9418F7886B6C19F7D005EAB2AEF9B0E14FC81C61A74CECF ] EhStorTcgDrv C:\WINDOWS\system32\drivers\EhStorTcgDrv.sys 14:36:40.0913 0x1be8 EhStorTcgDrv - ok 14:36:40.0937 0x1be8 [ 9E8FF6B95FD420FA9E40BE548E5C8D92, 8825B81418335D03CFAADB792C1466023C459BE489ACACBD6686FFB544F22D30 ] embeddedmode C:\WINDOWS\System32\embeddedmodesvc.dll 14:36:40.0962 0x1be8 embeddedmode - ok 14:36:40.0972 0x1be8 [ DC2F91EAE9A28FA8C6610A9B7701B70D, 480DB509BF944AAC3617594F1245B4603069DE39186BC1FA7EDB8E0536B05E79 ] EntAppSvc C:\WINDOWS\system32\EnterpriseAppMgmtSvc.dll 14:36:40.0986 0x1be8 EntAppSvc - ok 14:36:41.0007 0x1be8 [ F7FCCA6300485EF60CEA6D991D6C8C78, 24080D80CF1FD678DF4C9CAE70F65F8D9232F5F6A6F2B73A77B5E3C91E6505F3 ] ErrDev C:\WINDOWS\System32\drivers\errdev.sys 14:36:41.0015 0x1be8 ErrDev - ok 14:36:41.0042 0x1be8 [ 2093F65AA84478E28C8E9D05BC413845, 086D4E0D4B993F4041AA8A9DCBEEDB53BD05B88E2BEFB218837FB10FACDF4233 ] EventSystem C:\WINDOWS\system32\es.dll 14:36:41.0078 0x1be8 EventSystem - ok 14:36:41.0111 0x1be8 [ DCCDC3F35F0618692117DF90800A4284, B636B2A39AE89A9C2CDE17EC52DA669DA8AA9E2B04CA5CA19926DA8009655244 ] exfat C:\WINDOWS\system32\drivers\exfat.sys 14:36:41.0127 0x1be8 exfat - ok 14:36:41.0152 0x1be8 [ 5A1C6AFFF6946C5C21A27AE05084C0D1, 558CB87E596E85182F6976F215EE0E35F57BF901409A2805E6A3C29D8984B048 ] fastfat C:\WINDOWS\system32\drivers\fastfat.sys 14:36:41.0166 0x1be8 fastfat - ok 14:36:41.0204 0x1be8 [ 046FC9CF53A91E2FBA498CA7B0C3B028, BCFB06DF53065706DD6287E8C47BF5047F8A1E33981E1881E6ED7510337F5BC8 ] Fax C:\WINDOWS\system32\fxssvc.exe 14:36:41.0228 0x1be8 Fax - ok 14:36:41.0260 0x1be8 [ 4E4B7D935DBF522B2F23D3573596181D, 9D0EC9F65920EE0FFFB2D49C58E4D5151C8CEEB7AA82543D226E4B84EEE4B3F0 ] fcvsc C:\WINDOWS\System32\drivers\fcvsc.sys 14:36:41.0268 0x1be8 fcvsc - ok 14:36:41.0279 0x1be8 [ 583EB1C7690E361213BBD0472155128B, 5F5871490A6DAC4A824F4428941AC86FBFA9AA349B99B5D9544E5D62EB459FA8 ] fdc C:\WINDOWS\System32\drivers\fdc.sys 14:36:41.0287 0x1be8 fdc - ok 14:36:41.0298 0x1be8 [ 94B1A46EDD335F0C54C7BDAFC43348E6, 58073D58D0BE7389C2A4736AFE108835E5AE9C9950FF630644F585C99B964043 ] fdPHost C:\WINDOWS\system32\fdPHost.dll 14:36:41.0309 0x1be8 fdPHost - ok 14:36:41.0318 0x1be8 [ BC855BB7DFE06F27F78E0EB2A8CCB70D, D16C3DAB99C16B077BA5DA5E9E0646B0B9237B00ABAE867D9F81A2D072D583B1 ] FDResPub C:\WINDOWS\system32\fdrespub.dll 14:36:41.0330 0x1be8 FDResPub - ok 14:36:41.0337 0x1be8 [ F1125F20D56F28DDCD1A6F3E81EB4F5F, A6620ECCB15FAA70E4A43ADA4CE82CF97D708B6FA07F3FAED276359E7F92FD0F ] fhsvc C:\WINDOWS\system32\fhsvc.dll 14:36:41.0351 0x1be8 fhsvc - ok 14:36:41.0355 0x1be8 [ CDFD81CACE0E11596A3BB61EC4CF6467, 569FA86A215B054131AA9AFEECFEE7FD7143DCFFE275B84196004AEA538B2476 ] FileCrypt C:\WINDOWS\system32\drivers\filecrypt.sys 14:36:41.0365 0x1be8 FileCrypt - ok 14:36:41.0378 0x1be8 [ 3F02FEDAE894CBF4BAADDF8C8E1D53A8, DA32ABB1CDA867B8456C46F8581FA7F3A8D8B89D9F6E7422F51941D5FFA15B13 ] FileInfo C:\WINDOWS\system32\drivers\fileinfo.sys 14:36:41.0386 0x1be8 FileInfo - ok 14:36:41.0396 0x1be8 [ 2824933386E30DE5BA089DF539CE19A3, 7B33E514576C68B444AE99CBA1360EBFAE8A46EEE5C01F4EE4CF471A712AB148 ] Filetrace C:\WINDOWS\system32\drivers\filetrace.sys 14:36:41.0407 0x1be8 Filetrace - ok 14:36:41.0424 0x1be8 [ 6A598249640F8BEDD79EC73917E1664F, A675238EA19E6632CDEB4EEFF7CF509EAAEF76AD8DFD247664E5607555D9CEE1 ] flpydisk C:\WINDOWS\System32\drivers\flpydisk.sys 14:36:41.0433 0x1be8 flpydisk - ok 14:36:41.0459 0x1be8 [ 44B6A6832134DF651E887E941478CA35, FCF4EB726D00F5A17DD66C81CFDA49427281C94CF9CA2008397D591AEA61AE05 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys 14:36:41.0473 0x1be8 FltMgr - ok 14:36:41.0494 0x1be8 [ E341178C116DAC6A3A764587E68DFA7B, 91B4C79057908A622666FF069CF1C7ECA42952A6587432F5E99E33E8B19D29AF ] FNETURPX C:\WINDOWS\system32\drivers\FNETURPX.SYS 14:36:41.0499 0x1be8 FNETURPX - ok 14:36:41.0556 0x1be8 [ C197284A9D565A38497733AF2BDFA111, C6615AF0D366C2DD6D431B073901EED02D49AA3F252230735DBB52A90BCFA833 ] FontCache C:\WINDOWS\system32\FntCache.dll 14:36:41.0605 0x1be8 FontCache - ok 14:36:41.0678 0x1be8 [ 109AACC7FB0170535F71491F673AFD38, 212B6761ABBAC29993DA0A47C3DDE8074EA9E5A8FFA8FF6EAB95AC69D8FDD5A0 ] FontCache3.0.0.0 C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 14:36:41.0685 0x1be8 FontCache3.0.0.0 - ok 14:36:41.0692 0x1be8 [ 3F3B9E8CECD5604BC7746EF3A852EB67, 51AF62A9563379266C0C873E82F55427900032DFD7AC3EBDCDF77F8F8DE91A5D ] FsDepends C:\WINDOWS\system32\drivers\FsDepends.sys 14:36:41.0700 0x1be8 FsDepends - ok 14:36:41.0708 0x1be8 [ A60583221C7BB7CEC35C63285A297BE1, 3C842FBEAD1FA2BD8D37B2B0E8EDF77F4F50508C56FB25DFA81DE9679090D51D ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys 14:36:41.0715 0x1be8 Fs_Rec - ok 14:36:41.0808 0x1be8 [ 145F65521C983CBB68D994B4C2339AB4, 1AB4330B8F0A01B27F4D0A2900A5660B89FE22F2884A709890FE1297E35C40A1 ] Futuremark SystemInfo Service C:\Program Files (x86)\Futuremark\SystemInfo\FMSISvc.exe 14:36:41.0854 0x1be8 Futuremark SystemInfo Service - ok 14:36:41.0918 0x1be8 [ 58013A50225174EEF1410E37795D7908, F8E557CA4110ABB203192DEAF59D91A5FEF2A5EA394637276DAB7F4D2E7BFA39 ] fvevol C:\WINDOWS\system32\DRIVERS\fvevol.sys 14:36:41.0937 0x1be8 fvevol - ok 14:36:41.0959 0x1be8 [ 0DAAE3EFCE00133AB3E383A36C47CDAF, 9145665F4F0575F951803AAFAA1A7DC0FAA35430CAE7D90E902074D60D6F4C62 ] gagp30kx C:\WINDOWS\system32\drivers\gagp30kx.sys 14:36:41.0967 0x1be8 gagp30kx - ok 14:36:41.0983 0x1be8 [ 8E98D21EE06192492A5671A6144D092F, B8F656B34D361EA5AFB47F3A67AB2221580DADA59C8CD0CB83181E4AD8B562B4 ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 14:36:41.0987 0x1be8 GEARAspiWDM - ok 14:36:42.0006 0x1be8 [ F59155B95D01C08F9ED774B626B504A1, EF0FCF35AD9CD5E5D695F0C064244D2B327E7FB10FD7CBB0586253EC75562918 ] gencounter C:\WINDOWS\System32\drivers\vmgencounter.sys 14:36:42.0014 0x1be8 gencounter - ok 14:36:42.0023 0x1be8 [ AE24452F55C6F1784CBD7489D0CDDB02, 4E13C51CBF30A8662B1180AC74E968CFC428B6EA7931F09357E7D120063D4823 ] genericusbfn C:\WINDOWS\System32\drivers\genericusbfn.sys 14:36:42.0032 0x1be8 genericusbfn - ok 14:36:42.0046 0x1be8 [ 96F0D3A583A91B634EE2AC2507356EDC, 43D2575F33D28F61C13D2DCF358BFA9DCEAE276C83152DBE7AE2020A66929CD9 ] GPIOClx0101 C:\WINDOWS\system32\Drivers\msgpioclx.sys 14:36:42.0055 0x1be8 GPIOClx0101 - ok 14:36:42.0095 0x1be8 [ E50CE978F571B900D9A7E2F1C5BCC070, EA14873A5F1B700D7CDBE55B9D214DC457262866A90D80B3E8325A8EB7932CE7 ] gpsvc C:\WINDOWS\System32\gpsvc.dll 14:36:42.0138 0x1be8 gpsvc - ok 14:36:42.0145 0x1be8 [ BA2455D93BD57989A04FE4094AA6F941, B579FB367C063EA30C034381148410D49D38E183A5A4D51D2334A81DAEE95CEC ] GpuEnergyDrv C:\WINDOWS\system32\drivers\gpuenergydrv.sys 14:36:42.0156 0x1be8 GpuEnergyDrv - ok 14:36:42.0208 0x1be8 [ DD7423ABBE2913E70D50E9318AD57EE4, 74BC123808F3FA60ADDC51C1383F8250608D3DBA3A8DC175B3418A1CF0BC53E9 ] gupdate C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 14:36:42.0214 0x1be8 gupdate - ok 14:36:42.0218 0x1be8 [ DD7423ABBE2913E70D50E9318AD57EE4, 74BC123808F3FA60ADDC51C1383F8250608D3DBA3A8DC175B3418A1CF0BC53E9 ] gupdatem C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 14:36:42.0224 0x1be8 gupdatem - ok 14:36:42.0247 0x1be8 [ 5D4BC124FAAE6730AC002CDB67BF1A1C, 00294F4DC7D17F6DD2A22B9C3299BED40146BA45C972367154D20DB502472551 ] gusvc C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe 14:36:42.0254 0x1be8 gusvc - ok 14:36:42.0261 0x1be8 [ C277A49F8A8295840DEBC9240B75A282, 8B2BA0E6A8300323765D95ECD843105B0FC4B80B85EE2220E677C4E9A760C9D8 ] HDAudBus C:\WINDOWS\System32\drivers\HDAudBus.sys 14:36:42.0270 0x1be8 HDAudBus - ok 14:36:42.0290 0x1be8 [ D5A57EF4822A0388352FFF9F5CD53495, 509F365386859157E9078821FAA56D2A3C0BA296CA129E0D42453428A14687A5 ] HidBatt C:\WINDOWS\System32\drivers\HidBatt.sys 14:36:42.0298 0x1be8 HidBatt - ok 14:36:42.0313 0x1be8 [ 39575B53EB80C77FF2A3F1449D00B7F5, 37E66B38BACE00AFEF7093F990A234399D8451A9D2C2C8CBECAB69C664E63EA6 ] HidBth C:\WINDOWS\System32\drivers\hidbth.sys 14:36:42.0322 0x1be8 HidBth - ok 14:36:42.0331 0x1be8 [ 35C3B602664116E737FF729F9A7156AD, 7A3C5CAD716E819CC53405971F3ACD135BCF023EC2228C1095E2116BCC384E62 ] hidi2c C:\WINDOWS\System32\drivers\hidi2c.sys 14:36:42.0340 0x1be8 hidi2c - ok 14:36:42.0349 0x1be8 [ C4ABE526BBF2A18E8AF70177FBAD9C6E, 4DA06B563A08AC15D949F4599F73F172B3BFCB5D23B34240D1E2114438A11929 ] hidinterrupt C:\WINDOWS\System32\drivers\hidinterrupt.sys 14:36:42.0356 0x1be8 hidinterrupt - ok 14:36:42.0363 0x1be8 [ 348416C7D7EB05BC3099FE2F2B27985C, F30E8682E9DD731A1AD7328FB8A48A2BB7D6E52780AE1FDE839D26E84B4FA7B5 ] HidIr C:\WINDOWS\System32\drivers\hidir.sys 14:36:42.0372 0x1be8 HidIr - ok 14:36:42.0379 0x1be8 [ 5576DF399CF2D3B63608F7F282151249, 04939E79B8B8035547CE6FFE9001252CA810BAD46D8DB75FF5C13EB10EEB5C57 ] hidserv C:\WINDOWS\system32\hidserv.dll 14:36:42.0387 0x1be8 hidserv - ok 14:36:42.0396 0x1be8 [ 01F732724AF6EFE69886DA95A4E51820, E048A480F9396418BDE9659596E7EDA5FF97D3CE029D186048609B47575BEAE1 ] HidUsb C:\WINDOWS\System32\drivers\hidusb.sys 14:36:42.0404 0x1be8 HidUsb - ok 14:36:42.0427 0x1be8 [ 7433A8D28EE11A661C7A45AF28BA7987, 8A73DB423924E84CD3629BF6C7298CD093D2437B73B3F4520D39330923DDA2D6 ] HomeGroupListener C:\WINDOWS\system32\ListSvc.dll 14:36:42.0441 0x1be8 HomeGroupListener - ok 14:36:42.0473 0x1be8 [ 3FDBFBE5AE639996EB8D482C16BA7EA9, 7E48304818AABB4C5B0CB7FD32D96D6F90F4180AB0F668A2FE653A7097A40673 ] HomeGroupProvider C:\WINDOWS\system32\provsvc.dll 14:36:42.0492 0x1be8 HomeGroupProvider - ok 14:36:42.0516 0x1be8 [ 3844CE7DD23530CAD59D8CABA57CCB05, A44BB60686A0E98FF370D9DED5B32C3F34F0352ACFA3B3052BA4023922B53DB7 ] HpSAMD C:\WINDOWS\system32\drivers\HpSAMD.sys 14:36:42.0523 0x1be8 HpSAMD - ok 14:36:42.0560 0x1be8 [ CA6EADBB8731CA27BDA4037BF290AC14, 31EC9397D55D4EEC416AD722134E2D6B5D14E46D2150CB94889C4BFDAACBF421 ] HTTP C:\WINDOWS\system32\drivers\HTTP.sys 14:36:42.0585 0x1be8 HTTP - ok 14:36:42.0591 0x1be8 [ 8841D927EB1F7FFC8B1805BC0CF190ED, B063E686380EEF582CF736E33751812F0041C593C7F30EE97D13DEDC9B246AB5 ] hwpolicy C:\WINDOWS\system32\drivers\hwpolicy.sys 14:36:42.0598 0x1be8 hwpolicy - ok 14:36:42.0615 0x1be8 [ 53436C3835E80F4421652A67F44D6313, 8731091945A839713348DF3060A4C96033874E2B3DC7E099BEEC8C65B07F98CF ] hyperkbd C:\WINDOWS\System32\drivers\hyperkbd.sys 14:36:42.0622 0x1be8 hyperkbd - ok 14:36:42.0632 0x1be8 [ B2DC6C2F313EBB967B556B4E73A75451, B1816A0AE15705F0325F167EA76166779607D6086EC36A4A960E3BA47B4EBC4B ] HyperVideo C:\WINDOWS\system32\DRIVERS\HyperVideo.sys 14:36:42.0639 0x1be8 HyperVideo - ok 14:36:42.0662 0x1be8 [ D4CDEE4A62BDFFF6E8558A9552148EA7, 55306786CB45082AE374937EBA256FF9CD640BB2E8C19DC6C704489D4743F5CC ] i8042prt C:\WINDOWS\System32\drivers\i8042prt.sys 14:36:42.0672 0x1be8 i8042prt - ok 14:36:42.0679 0x1be8 [ 16A10CCEDCF5AC4CAAE43DC9FC40392F, F77696AE55B992154A3B35F7660BD73E0AB35A6ECEEC1931C0D35748CFA605C0 ] iaLPSSi_GPIO C:\WINDOWS\System32\drivers\iaLPSSi_GPIO.sys 14:36:42.0685 0x1be8 iaLPSSi_GPIO - ok 14:36:42.0693 0x1be8 [ F1DF87463AC308047B089E9F0456B4C8, DFFF3C63D3124C2B879B888104042406FE326D4E7C8C1881A269BD4287B9CD33 ] iaLPSSi_I2C C:\WINDOWS\System32\drivers\iaLPSSi_I2C.sys 14:36:42.0699 0x1be8 iaLPSSi_I2C - ok 14:36:42.0735 0x1be8 [ 57CD95DEB3529181BCC931DD2DFB2341, 03ACF906E4C3CF954F503900F42C7A60FCD5624772B90A956F032484146E42B7 ] iaStorA C:\WINDOWS\system32\drivers\iaStorA.sys 14:36:42.0750 0x1be8 iaStorA - ok 14:36:42.0781 0x1be8 [ 9FDD4763A115D04F565C38183DE4646F, A8B0653E7C5F5B3CB2A1B642F502269FB1BB1E35DBB1CBABDBDADF92C9815727 ] iaStorAV C:\WINDOWS\system32\drivers\iaStorAV.sys 14:36:42.0801 0x1be8 iaStorAV - ok 14:36:42.0856 0x1be8 [ 20E83F4632E15A5E9E716FF2E8AC7FAE, 7CA1A4924F432AD30ED7FA6247C6513DA173EE31132AE115E85C0ED7E5971029 ] IAStorDataMgrSvc C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe 14:36:42.0861 0x1be8 IAStorDataMgrSvc - ok 14:36:42.0889 0x1be8 [ 4E69EE8F8E5DA036535D433C544AF9E2, 2ADE9B97CE1C19FF984D8BB99CF31415872C2D9628864BD78C0E44D21CC94EE3 ] iaStorV C:\WINDOWS\system32\drivers\iaStorV.sys 14:36:42.0904 0x1be8 iaStorV - ok 14:36:42.0923 0x1be8 [ 15C59DF20F74A0C2C764B991FED7F4A5, 6E9804775E815F32A4D73C346E627D64A3096525E78FAE3B6E43CFECAE270428 ] ibbus C:\WINDOWS\System32\drivers\ibbus.sys 14:36:42.0938 0x1be8 ibbus - ok 14:36:43.0015 0x1be8 [ E199288F016C354255C39A84378A48F6, 881B41D64D73F7A3A1680EDD68201E14AC5C60B848374EEAE44CCDDE46010E81 ] ICCS C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe 14:36:43.0021 0x1be8 ICCS - ok 14:36:43.0041 0x1be8 [ 88E6A429944544346EC3AE1FD7D24BCC, B6B8D51E5491C91D2FCDC77C1D82A5168B0C860252208E1B4612D8D5C19401AD ] icssvc C:\WINDOWS\System32\tetheringservice.dll 14:36:43.0055 0x1be8 icssvc - ok 14:36:43.0057 0x1be8 IEEtwCollectorService - ok 14:36:43.0096 0x1be8 [ 6F9C31435DD3E3D3BC247212EA144EBF, 05C4A0BD4BABD27783CEFEE6108C1A05911A212189233F09AF1A56BDC60F60F8 ] IKEEXT C:\WINDOWS\System32\ikeext.dll 14:36:43.0127 0x1be8 IKEEXT - ok 14:36:43.0204 0x1be8 [ E9740A3BC0AE6EA035FF7ECE3A1B27B6, 4CA3E094B0057E143955DE5D41C3344688B6D2C4FFC0417235FF46312B600F99 ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RTKVHD64.sys 14:36:43.0264 0x1be8 IntcAzAudAddService - ok 14:36:43.0309 0x1be8 [ 0DB1E3F6189C628675F855C0EB510419, 989F539E82105019D2D81255369B96DC65826CD2A421DA09809155B26F69C555 ] Intel(R) Capability Licensing Service Interface C:\Program Files\Intel\iCLS Client\HeciServer.exe 14:36:43.0330 0x1be8 Intel(R) Capability Licensing Service Interface - detected UnsignedFile.Multi.Generic ( 1 ) 14:36:45.0661 0x1be8 Detect skipped due to KSN trusted 14:36:45.0661 0x1be8 Intel(R) Capability Licensing Service Interface - ok 14:36:45.0699 0x1be8 [ 492AAF2FF66F437F0E796574B116EFC3, 6BF21C61ED05705DD58203952A750D1AB4D4B62F3A2B640BBBD9B85D1ECC3E5C ] Intel(R) Capability Licensing Service TCP IP Interface C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe 14:36:45.0717 0x1be8 Intel(R) Capability Licensing Service TCP IP Interface - ok 14:36:45.0748 0x1be8 [ 57739E742ABC085C2A4340D4404B4A8B, B4B85C35AC96D11F5940AFCB15A2B2A41D70E3C392E1D4D9353899FA140FF281 ] Intel(R) ME Service C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe 14:36:45.0753 0x1be8 Intel(R) ME Service - ok 14:36:45.0783 0x1be8 [ CBF7341E55A8348C7AB01A9870C7D948, A5084DF3C6321788C88A9E6B5F43FE5BCFDBB579BDE3A4D5F55558C6D13035A5 ] Intel(R) PROSet Monitoring Service C:\Windows\system32\IProsetMonitor.exe 14:36:45.0791 0x1be8 Intel(R) PROSet Monitoring Service - ok 14:36:45.0813 0x1be8 [ 498759139F71142888CF7EFA1ABE18C8, 9CD0CD748B143F947B4DEDE39344A8C284717CC8AC97E25827EB73CF10831419 ] intelide C:\WINDOWS\system32\drivers\intelide.sys 14:36:45.0819 0x1be8 intelide - ok 14:36:45.0827 0x1be8 [ DC270DDCDDC2EF65D484A65CC5166222, A88BEAD819ABEFE28B6F9A10586ADCB0EE2A5ED9273F176E9313750609C7892F ] intelpep C:\WINDOWS\system32\drivers\intelpep.sys 14:36:45.0834 0x1be8 intelpep - ok 14:36:45.0850 0x1be8 [ B4D9C777762B1F7356958B9C0AA93BEB, F11B07FE939A107AB4EED4857854DF269C2D86A80C8507C8B1E95F7805975EDB ] intelppm C:\WINDOWS\System32\drivers\intelppm.sys 14:36:45.0861 0x1be8 intelppm - ok 14:36:45.0869 0x1be8 [ 22BD83268B80A8C89AAC0BDF46E4EB5D, E7DC0C2E4104B51EA545BA8D0CFF11FD6A15BFD8EE16E546E8FC220853402CB3 ] IoQos C:\WINDOWS\system32\drivers\ioqos.sys 14:36:45.0877 0x1be8 IoQos - ok 14:36:45.0888 0x1be8 [ A49E47A6E1429123F46A7CA9C05AEFC1, FFD68CA46DFAA4954FD76145808E2C74BDC34FFD6979BB3FB6A3EE4DC33CDC78 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 14:36:45.0899 0x1be8 IpFilterDriver - ok 14:36:45.0939 0x1be8 [ 8FBA61B7CB44F136226BE3B346FC6D19, 2190A523AC948B18C2C7B6DC96ABB654DAB471AD5E5E13F79899416E91777AED ] iphlpsvc C:\WINDOWS\System32\iphlpsvc.dll 14:36:45.0971 0x1be8 iphlpsvc - ok 14:36:45.0980 0x1be8 [ E0C276985AF968CE295B8E09C121321F, 07B54165E80D4254C29A6CF00CC634E70F190EF0EB8EEF73EC14F38B841087A5 ] IPMIDRV C:\WINDOWS\System32\drivers\IPMIDrv.sys 14:36:45.0989 0x1be8 IPMIDRV - ok 14:36:46.0011 0x1be8 [ 5D3744E6FDEC1A6FB3FA9B1DD4AF0694, 209BE9FC25C8BF8CE058B7E993B6A902B881380DADC69F5208733077DA7F4382 ] IPNAT C:\WINDOWS\system32\drivers\ipnat.sys 14:36:46.0022 0x1be8 IPNAT - ok 14:36:46.0050 0x1be8 [ 0BE777523E5CB0E4F2CA2135DB4C60C8, 979BBAC7EAD3F5C913155BC12BB1B87D1EFD39D92293195D50805D657ABECC6D ] iPod Service C:\Program Files\iPod\bin\iPodService.exe 14:36:46.0065 0x1be8 iPod Service - ok 14:36:46.0072 0x1be8 [ B18202D72C0EF4B53CEC6F59E3E1B955, 6DA244E6485372C16CF0B38838DC90B48079A85F5D22B0F2F197C8DA37F0A293 ] IRENUM C:\WINDOWS\system32\drivers\irenum.sys 14:36:46.0082 0x1be8 IRENUM - ok 14:36:46.0104 0x1be8 [ CD04CBCCCB4C0E4BB06B98E0F45C888A, 106B3E823C188BD14328F2BEA28559D2F637C270064B2FD214522FAC4E616F4C ] isapnp C:\WINDOWS\system32\drivers\isapnp.sys 14:36:46.0111 0x1be8 isapnp - ok 14:36:46.0123 0x1be8 [ 5D90E942C94B20E0F321015C0ABF3EEA, 4110551B172D4A5524DD857D7CB65FAF2594310BE7883D5641BC0DF5EF49C82C ] iScsiPrt C:\WINDOWS\System32\drivers\msiscsi.sys 14:36:46.0134 0x1be8 iScsiPrt - ok 14:36:46.0159 0x1be8 [ 52069AEB42D3D0F97CBCA1085EBF55E6, ADB2EFFF563B3FE113FCD156FD1E469BC24FC1D68AFEDCA21306F76592C9FF88 ] jhi_service C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe 14:36:46.0166 0x1be8 jhi_service - ok 14:36:46.0175 0x1be8 [ 4192DFE6CA143C0AD8AF42C51A82BECA, 31FB3A261D0D5241CC87EF7DFF8BFC1A1EACE8CEC42138918EC5958DAEE100CD ] kbdclass C:\WINDOWS\System32\drivers\kbdclass.sys 14:36:46.0183 0x1be8 kbdclass - ok 14:36:46.0191 0x1be8 [ B63C0DB341DCB46CF7AA259333A737DD, F1B43BA68707F3F99CD31AB2035F5E86CD967AE4E5393928C69861785E960872 ] kbdhid C:\WINDOWS\System32\drivers\kbdhid.sys 14:36:46.0199 0x1be8 kbdhid - ok 14:36:46.0206 0x1be8 [ 53C79A7FABDAAFD11EAB31963FB2CED7, 357418645DDCEFA5546AE78EDCAE86D50928710CA7A3F65F01CF721AADA36623 ] kdnic C:\WINDOWS\System32\drivers\kdnic.sys 14:36:46.0214 0x1be8 kdnic - ok 14:36:46.0227 0x1be8 [ 9A83FA0EC9B0DCED2CBC49DD05901920, 14D2F241235E2693C68BCCF05D83F2A1C9A7BE185C83E7C6C63EF0F654892F95 ] KeyIso C:\WINDOWS\system32\lsass.exe 14:36:46.0235 0x1be8 KeyIso - ok 14:36:46.0246 0x1be8 [ 1E99B26BDB9B9C9BC775ED4543558560, 890870A6737B4910735D1B23F714AA73FCCD1C131D135FACBA6909F06D31B3FF ] KSecDD C:\WINDOWS\system32\Drivers\ksecdd.sys 14:36:46.0255 0x1be8 KSecDD - ok 14:36:46.0269 0x1be8 [ 6198A79011C67497B324798B3D4272CE, C587F7D86837550D07918F6AACF26BF65EBAF7FF57475DC9196B4D011E83AE47 ] KSecPkg C:\WINDOWS\system32\Drivers\ksecpkg.sys 14:36:46.0279 0x1be8 KSecPkg - ok 14:36:46.0287 0x1be8 [ 503597D9B72DBD9998F722F12A51ACFC, 9B3585282191163AA70243BAD921ED8725A98454E0D3879E0F671E0E4F56AB4F ] ksthunk C:\WINDOWS\system32\drivers\ksthunk.sys 14:36:46.0296 0x1be8 ksthunk - ok 14:36:46.0331 0x1be8 [ ED5AE20C27F27F293C6C61AEC9881054, 4D5BE394D129BD559B0A9D237F3F59CB3D24C15ABDD97AE2E64931D6B9D14FF1 ] KtmRm C:\WINDOWS\system32\msdtckrm.dll 14:36:46.0348 0x1be8 KtmRm - ok 14:36:46.0370 0x1be8 [ C529DA0AD5A21878E318801B024AF8E7, A14E8ADCA33C37B1D256CB4926A19F56D2D19B94EDF314A4ED34A8B5AB62CA5A ] LanmanServer C:\WINDOWS\system32\srvsvc.dll 14:36:46.0386 0x1be8 LanmanServer - ok 14:36:46.0420 0x1be8 [ D6D9F4CAFD3F1A7E30AD02E508552CD2, F0D225E5951CFE1D8349F634CC91BDD5B3F9DCF6233CCB965E99BFEAFE642265 ] LanmanWorkstation C:\WINDOWS\System32\wkssvc.dll 14:36:46.0436 0x1be8 LanmanWorkstation - ok 14:36:46.0461 0x1be8 [ 24881F16D2829764681F5FAE7B86D7D3, 290348CFAF3165847E4B53965D22E9D417EE20FFD23293B5C1855C57E6328599 ] lfsvc C:\WINDOWS\System32\lfsvc.dll 14:36:46.0470 0x1be8 lfsvc - ok 14:36:46.0479 0x1be8 [ 6ED675774BDC3735AB6DA12D29F825CF, 4317C7CF491F4E806975E7A973CFF11CFEE9E94730DDABCC67C3D693691DDDE5 ] LicenseManager C:\WINDOWS\system32\LicenseManagerSvc.dll 14:36:46.0487 0x1be8 LicenseManager - ok 14:36:46.0500 0x1be8 [ DB789F57CE94C827FBFF709CA5ABD29E, 4CA4DD079A63649C36F76A31C4081F11F5CF6574AC573B63EF930DB19B1D1C95 ] lltdio C:\WINDOWS\system32\drivers\lltdio.sys 14:36:46.0511 0x1be8 lltdio - ok 14:36:46.0530 0x1be8 [ FECBC6C4981772E5D0F517B34A5496EE, 15DB097BFB221B91E580E5CD1DD6B34A9A2C78A1A6FCE4162A855BB4AFE673E9 ] lltdsvc C:\WINDOWS\System32\lltdsvc.dll 14:36:46.0546 0x1be8 lltdsvc - ok 14:36:46.0568 0x1be8 [ 24C87BDC66AB192FEB273BEE5FD5AA38, BFAAE1F2450DEBD1A14877C046C6EBA91014DB0B5D0FB95EC14CB714B773B3C0 ] lmhosts C:\WINDOWS\System32\lmhsvc.dll 14:36:46.0576 0x1be8 lmhosts - ok 14:36:46.0624 0x1be8 [ 90C864827E1722F5BB6EEA8896A4E8EF, 6F9D96B7A65BD79ED5A384025393F36A5DEAC4EE01CA173874906B54F57150EF ] LMS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe 14:36:46.0634 0x1be8 LMS - ok 14:36:46.0662 0x1be8 [ 3BB39166E446D456C277C17DFEA3DAC6, 1A08E1D017BBCE91E508D876835FA7AD2DA0859A8CFE8F8F31B4F12B48E2573D ] LSI_SAS C:\WINDOWS\system32\drivers\lsi_sas.sys 14:36:46.0671 0x1be8 LSI_SAS - ok 14:36:46.0681 0x1be8 [ 25CF625E46307A5D6674C8DFA1A289AA, 1D00EB70B6B0157013A7C15EF194F51B8596612066EF31B337D8134D6BD0BBBE ] LSI_SAS2i C:\WINDOWS\system32\drivers\lsi_sas2i.sys 14:36:46.0690 0x1be8 LSI_SAS2i - ok 14:36:46.0700 0x1be8 [ 722C52B12EA4C198D56994934C9DDAB6, 5F4AB818251C770821BAF41C19B1C483A31CCC28EB96F2084D4092E33EAF906B ] LSI_SAS3i C:\WINDOWS\system32\drivers\lsi_sas3i.sys 14:36:46.0709 0x1be8 LSI_SAS3i - ok 14:36:46.0721 0x1be8 [ 3371FF1D5D745C3306C6A2C4E99C25A9, DD6F0099001501BAEDDF8411FBCD930BD6472662D209199249203CB2FDAA23FB ] LSI_SSS C:\WINDOWS\system32\drivers\lsi_sss.sys 14:36:46.0730 0x1be8 LSI_SSS - ok 14:36:46.0757 0x1be8 [ E2EEF074F5260378F9AAFBCD592319A3, DC56674A08FA03FA7AF7DD8B3CC55D8324D1CB51546092A990A935FF9AB48A3C ] LSM C:\WINDOWS\System32\lsm.dll 14:36:46.0783 0x1be8 LSM - ok 14:36:46.0813 0x1be8 [ C692B9C0352315417CF49FFA664957A3, C2D4F9A936B809889F7C51FE48214A1923175913A6C5D0B72D3BA469214B5174 ] luafv C:\WINDOWS\system32\drivers\luafv.sys 14:36:46.0826 0x1be8 luafv - ok 14:36:46.0859 0x1be8 [ 6A4C75FD28F60062FEA3DF3B15D956C0, 4FC58F3320D33BDACCF759A50C623A3E58E4320749E6691B397DF0C8EAAA8A6F ] MapsBroker C:\WINDOWS\System32\moshost.dll 14:36:46.0868 0x1be8 MapsBroker - ok 14:36:46.0887 0x1be8 [ B2ED9A7A5587A128A0EFD0DBE7662E95, 63070AAFD44E3CD2A4B262DF27222B103455A4D8C2E45914502BFA03D84D32C9 ] megasas C:\WINDOWS\system32\drivers\megasas.sys 14:36:46.0895 0x1be8 megasas - ok 14:36:46.0915 0x1be8 [ 083F71488E6780A67290273180256EA5, 5F43CE66F5A48850BABB70F4D219FDD002F9BC2B2F0E58E66FE2C492AA335E50 ] megasr C:\WINDOWS\system32\drivers\megasr.sys 14:36:46.0933 0x1be8 megasr - ok 14:36:46.0964 0x1be8 [ 926C135CFB0C75B32FB714B5C0C58FAA, AF627CD125794B69D450D298D5608D357F2C91FB89EBFAA0DA2A0F07C6A304A8 ] MEIx64 C:\WINDOWS\system32\DRIVERS\TeeDriverx64.sys 14:36:46.0969 0x1be8 MEIx64 - ok 14:36:47.0003 0x1be8 [ 5907A10D46747A2B6DBFD6A198254DC2, 6C283E9DC75C7ABFD270D6FABBF4F54628A1786E7CE2F603BF664CBB9E4FE583 ] mlx4_bus C:\WINDOWS\System32\drivers\mlx4_bus.sys 14:36:47.0023 0x1be8 mlx4_bus - ok 14:36:47.0042 0x1be8 [ 91ED6F0EDF4158D63C52194F17D4F42E, ACF543978E253650C167C6C370699AEA7340EBCECF7CAB904CBDD334D1BD6928 ] MMCSS C:\WINDOWS\system32\drivers\mmcss.sys 14:36:47.0050 0x1be8 MMCSS - ok 14:36:47.0070 0x1be8 [ 2C4CC9F6ADBED5A6D131FDB97A78FF68, 04DC76E3F0959C0A9B00DF2133B075194FB7DCBD76832B9D25B0E37223D300DC ] Modem C:\WINDOWS\system32\drivers\modem.sys 14:36:47.0080 0x1be8 Modem - ok 14:36:47.0097 0x1be8 [ D8DB13529C8AD6FBAF8E2F382024374F, 13025035C479E2EF76EDCB90D83BE65B4ADD9F7000AD31FEAD628D5DDFE69158 ] monitor C:\WINDOWS\System32\drivers\monitor.sys 14:36:47.0104 0x1be8 monitor - ok 14:36:47.0117 0x1be8 [ 2DAAF1EE1C30F2FCF59851A64ADA0422, 08CD801E63E2862DE058CD732C3DB3D87B1A2898732365440E3F8919932E96FC ] mouclass C:\WINDOWS\System32\drivers\mouclass.sys 14:36:47.0125 0x1be8 mouclass - ok 14:36:47.0136 0x1be8 [ D30FE074503283829ED194BCAE6239C3, A3A127381ECC798417D01F6B8A1894EED7D71989047BC4D1D74D0E7C8394AD65 ] mouhid C:\WINDOWS\System32\drivers\mouhid.sys 14:36:47.0144 0x1be8 mouhid - ok 14:36:47.0170 0x1be8 [ D5EC9413527B286CFEEB0294C53ABB95, B094C611F5A7E33D2F8667B2A4D6260E1D57BD135867F984EE5B674C7EE72B95 ] mountmgr C:\WINDOWS\system32\drivers\mountmgr.sys 14:36:47.0179 0x1be8 mountmgr - ok 14:36:47.0189 0x1be8 [ 989A1BBD9C49B107B4A47D06E6827A69, 62D90B22AE13AC84324DFD5FEBA595813AD07469B7FEC41380CE223D93020CCA ] mpsdrv C:\WINDOWS\system32\drivers\mpsdrv.sys 14:36:47.0198 0x1be8 mpsdrv - ok 14:36:47.0235 0x1be8 [ A0DBB9386BEA8DA1A159C2A2E07081A3, 9D3F26005A76A72F9512F040D45C16124D17F8C8DA45C51FFAF74F066357D0A4 ] MpsSvc C:\WINDOWS\system32\mpssvc.dll 14:36:47.0264 0x1be8 MpsSvc - ok 14:36:47.0281 0x1be8 [ C1E74DD1D84861D8F12FF8BC0BA11975, 5912A0455C840F5C8AD6383823C9C7DE6FF8B5CAF1B72EA181864999891EAF30 ] MRxDAV C:\WINDOWS\system32\drivers\mrxdav.sys 14:36:47.0295 0x1be8 MRxDAV - ok 14:36:47.0316 0x1be8 [ 1DF2C5FD2710A13B07E663A12F0E0EEA, 8EBCA9269F52A5CF602F5DE2B0C2AB2BFD82F415465DBB74C73D43F321D9FD46 ] mrxsmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 14:36:47.0333 0x1be8 mrxsmb - ok 14:36:47.0364 0x1be8 [ 185932B1149BD707F8A13174CDAB365B, BC26CB10DD6E81A94477564444E91F76D47E685E897BD77B9C1393F0D31AB718 ] mrxsmb10 C:\WINDOWS\system32\DRIVERS\mrxsmb10.sys 14:36:47.0377 0x1be8 mrxsmb10 - ok 14:36:47.0383 0x1be8 [ 99E24D4DBACBC569833B9A67710D65E7, 93BC765E7B6E19E83AFF783DE8080A80A1D69A406B496F1E36C47AE6E86AFB76 ] mrxsmb20 C:\WINDOWS\system32\DRIVERS\mrxsmb20.sys 14:36:47.0396 0x1be8 mrxsmb20 - ok 14:36:47.0412 0x1be8 [ 6F8BE4FB6262012E61BBADB5444628DC, E87489207AA48106C08E4BADDD8D66D14BC9DD6AD2A4CDD880BA655932CDDE60 ] MsBridge C:\WINDOWS\system32\drivers\bridge.sys 14:36:47.0424 0x1be8 MsBridge - ok 14:36:47.0447 0x1be8 [ 283BDF3602F442336DAF242BDD07FB98, 185F046B6AA24FFD1567F00AA70357C82002FF627E329CEF9B926645A6DDB172 ] MSDTC C:\WINDOWS\System32\msdtc.exe 14:36:47.0458 0x1be8 MSDTC - ok 14:36:47.0473 0x1be8 [ 7C55F1751CAC199680D4489D1EE46544, 967EC8137D321F6139C3382D19A338FD97A3023EB654747AC57C2008BE4AF677 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys 14:36:47.0482 0x1be8 Msfs - ok 14:36:47.0507 0x1be8 [ 988588C16A53C2581488C15FF18934BF, F021FD31163CB5C7012CF96EF642C5E551708C835039075268F4CBED002D441D ] msgpiowin32 C:\WINDOWS\System32\drivers\msgpiowin32.sys 14:36:47.0514 0x1be8 msgpiowin32 - ok 14:36:47.0517 0x1be8 [ 09622DBC24D0178F15DB8461BB6970DF, C0B3F9B2219AAF87E417EE9FF54C64B8AD9944E101EA79B5DC81D99E8C2ECF30 ] mshidkmdf C:\WINDOWS\System32\drivers\mshidkmdf.sys 14:36:47.0525 0x1be8 mshidkmdf - ok 14:36:47.0534 0x1be8 [ 34BB07495C0159BE4189841E16F3BC2F, 264B5735D9A68C85BEDE363D4C0AE1FCC381B39EA884B4BAEE185EB8A873184A ] mshidumdf C:\WINDOWS\System32\drivers\mshidumdf.sys 14:36:47.0542 0x1be8 mshidumdf - ok 14:36:47.0548 0x1be8 [ 7BF3F0DA362C053918F5F2EC43CE39E2, AA773FA3F83C0C572160D3D0286A697DC628FF4F3655EF21D01C6D1B7BE5DF1C ] msisadrv C:\WINDOWS\system32\drivers\msisadrv.sys 14:36:47.0555 0x1be8 msisadrv - ok 14:36:47.0576 0x1be8 [ 669DA2006C0B9D882D2014617E1E88F5, 090F558818806CAEF6C81D369F8BFFE4A8240295EF37CAA7102A18F4CD20D868 ] MSiSCSI C:\WINDOWS\system32\iscsiexe.dll 14:36:47.0587 0x1be8 MSiSCSI - ok 14:36:47.0589 0x1be8 msiserver - ok 14:36:47.0598 0x1be8 [ B2D0FD21FE67D6434769CC6F7A7883CA, B2368BD72952C6EE6DAF1AA006DF575A3019E4721BEFB108D3DF1B9E07B2BC5D ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys 14:36:47.0606 0x1be8 MSKSSRV - ok 14:36:47.0618 0x1be8 [ FB3801F176376286A3F8F20FFB8CDC53, EEF89081665B9BBA93AE9F5912C40C1698E8BA8DBBCCC3BBE0BAB5A86B7E05D4 ] MsLldp C:\WINDOWS\system32\drivers\mslldp.sys 14:36:47.0630 0x1be8 MsLldp - ok 14:36:47.0649 0x1be8 [ 8CBDF0E7A6CD824352F37A682A33DF7E, 4567FF4C73648FF26EA68EAE2B524B767099789086C158875C97768C77B81359 ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys 14:36:47.0656 0x1be8 MSPCLOCK - ok 14:36:47.0674 0x1be8 [ 33E5B6261D69ACD4948A5C64B9D8F29F, 1D32340640312372E52E59AFB5DB872E6F9DFE3AC16B56F9D928AE230DA02B8A ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys 14:36:47.0682 0x1be8 MSPQM - ok 14:36:47.0694 0x1be8 [ 557DF8C0DBBBF518AC395C6EB1B179AE, B294B5A7882C0C60D91FB853FC87505B6E7638D25E360FDAE002AEBB714ED471 ] MsRPC C:\WINDOWS\system32\drivers\MsRPC.sys 14:36:47.0708 0x1be8 MsRPC - ok 14:36:47.0720 0x1be8 [ 0A29AFA668F5DD50482A98ECE70C77A7, 4C1F23B062361D97B1C8D864AB227E5F398F774A99B5E60A1149A4F78D5BEC20 ] mssmbios C:\WINDOWS\System32\drivers\mssmbios.sys 14:36:47.0727 0x1be8 mssmbios - ok 14:36:47.0743 0x1be8 [ 30CE30877FD5BFADE74FA27D7829BF89, B5EA1F8C91E75722DB1E3E2172C8607FEDBF35BDC4141258A3E6D29D8B0E193B ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys 14:36:47.0750 0x1be8 MSTEE - ok 14:36:47.0756 0x1be8 [ 13D88C0B8A2FA001CD72D454955A6974, 19DD5C8BBD07B64F355737436BF702FFC209D84A8855D2224D3377E233D4BB34 ] MTConfig C:\WINDOWS\System32\drivers\MTConfig.sys 14:36:47.0764 0x1be8 MTConfig - ok 14:36:47.0786 0x1be8 [ 00C7F0F06A0A48B9CDB6B3AC3BE288F0, BF469A2DDF495ACB9FEE9063C6680C95BCC8686682C9EDAE6D1893D4058E8AA6 ] Mup C:\WINDOWS\system32\Drivers\mup.sys 14:36:47.0794 0x1be8 Mup - ok 14:36:47.0812 0x1be8 [ 8E237527CA260C71D39ED4081BDF3419, CA52DD174C756A404B1FAD3F2A70E50085C2820BF12369259F61DA649101A179 ] mvumis |
05.11.2015, 14:51 | #5 |
| Easycalender lässt sich nicht entfernenCode:
ATTFilter C:\WINDOWS\system32\drivers\mvumis.sys 14:36:47.0820 0x1be8 mvumis - ok 14:36:47.0842 0x1be8 [ 48D0587A8302FD3302CFE6F59F7345B0, 26D48AF3F7FF4867E179347CD635055DEA9A751C6C61CE2C391A7F74FC0DC1DE ] NativeWifiP C:\WINDOWS\system32\DRIVERS\nwifi.sys 14:36:47.0862 0x1be8 NativeWifiP - ok 14:36:47.0886 0x1be8 [ 11BE8117653C542D264788A700AC5BFE, 87EAAC2DF62BB26619DA72950F5EE41DCA1DBDF93F098647F9D200D588F14003 ] NcaSvc C:\WINDOWS\System32\ncasvc.dll 14:36:47.0898 0x1be8 NcaSvc - ok 14:36:47.0911 0x1be8 [ 286C6276B2BA86F29A0F687D05466277, AC8551536F37717A0ACE4A260F5696D1276F7AC62F669E8F12AA158DD86F71A5 ] NcbService C:\WINDOWS\System32\ncbservice.dll 14:36:47.0927 0x1be8 NcbService - ok 14:36:47.0934 0x1be8 [ C55DA734ED2A831E0BACAAFA01CEB7FF, 9D989B03D07BBAD287B317D238691664B0694331D6A69B7A1AA3D8AB7D1323FC ] NcdAutoSetup C:\WINDOWS\System32\NcdAutoSetup.dll 14:36:47.0960 0x1be8 NcdAutoSetup - ok 14:36:47.0967 0x1be8 [ CF8296427834CF8BBB3EE1444C17362D, 6EFBE1F015DFFA0704C66DF5C88089DD5771E1542018E4AE98389CFF3D0B2309 ] ndfltr C:\WINDOWS\System32\drivers\ndfltr.sys 14:36:47.0975 0x1be8 ndfltr - ok 14:36:48.0015 0x1be8 [ 616F40B897DA651221F86A1741E9609B, 22D66029726313D92FC8E074BCC51C1E1560CB5FE36DCB735E7E063EA53E299A ] NDIS C:\WINDOWS\system32\drivers\ndis.sys 14:36:48.0044 0x1be8 NDIS - ok 14:36:48.0055 0x1be8 [ A0719D1EBA971DFC5DF5F7CC010385F8, A982487D3A74E66F3C29AAA5B46CE9A0969F07F267DDEFE58C58573573AB0024 ] NdisCap C:\WINDOWS\system32\drivers\ndiscap.sys 14:36:48.0063 0x1be8 NdisCap - ok 14:36:48.0079 0x1be8 [ 0C557932CCCC65AEB37326DD36504527, C0AF3066DEE4BCC32DB30CCC16B7A91442A8383BB36C7C4E3CC0A5EFE0FAAA9B ] NdisImPlatform C:\WINDOWS\system32\drivers\NdisImPlatform.sys 14:36:48.0091 0x1be8 NdisImPlatform - ok 14:36:48.0102 0x1be8 [ 56F9345D1945826135FBAB7589592B1F, 6BC2A5900076B917823C7392C582A2648D0C8000F2F65D309D5B48E36D4FB4D6 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys 14:36:48.0111 0x1be8 NdisTapi - ok 14:36:48.0130 0x1be8 [ AADFC340939D99E5D756E713E1D452EB, EFEFDBB2188DE82C2C5E67929861B269FD4C127D34D1DE6D0596ABC33E2C2B51 ] Ndisuio C:\WINDOWS\system32\drivers\ndisuio.sys 14:36:48.0139 0x1be8 Ndisuio - ok 14:36:48.0147 0x1be8 [ 312DFD787D99D3BF1427B0388BC04F71, C082CA1F332AD57FF2100748518D3D7B3D0F1B042F69BD7401C44B77AFE97462 ] NdisVirtualBus C:\WINDOWS\System32\drivers\NdisVirtualBus.sys 14:36:48.0156 0x1be8 NdisVirtualBus - ok 14:36:48.0179 0x1be8 [ 2103F43E0A1ECFB14B7E1B889F5F24D7, 6A86E854C89E132DBC9183DE2B9464DC592E7492BE267BA02FE4DAFE6FA87528 ] NdisWan C:\WINDOWS\System32\drivers\ndiswan.sys 14:36:48.0193 0x1be8 NdisWan - ok 14:36:48.0199 0x1be8 [ 2103F43E0A1ECFB14B7E1B889F5F24D7, 6A86E854C89E132DBC9183DE2B9464DC592E7492BE267BA02FE4DAFE6FA87528 ] ndiswanlegacy C:\WINDOWS\system32\DRIVERS\ndiswan.sys 14:36:48.0213 0x1be8 ndiswanlegacy - ok 14:36:48.0225 0x1be8 [ 6E98F16983C4AE8703FF9F90AB4B31DD, BB8BD5DB4B5FB31F3A257747C27CBEFA4B7837EC5C0CF3D4F408E626E4003F4C ] ndproxy C:\WINDOWS\system32\DRIVERS\NDProxy.sys 14:36:48.0236 0x1be8 ndproxy - ok 14:36:48.0245 0x1be8 [ F1B7CC77F412C8D45B2DDCF76EDA4F9D, 25F2AA76E675D9BCC0B1FD47AFEC6DF2D0B47E7B1C8AF6FB27C1ED2FB902961A ] Ndu C:\WINDOWS\system32\drivers\Ndu.sys 14:36:48.0255 0x1be8 Ndu - ok 14:36:48.0264 0x1be8 [ 824FDC990A3F79069BE468A132EB6888, D09F7A9EC04E37DA504CE54EEC25C312B407B6A8B214CBB074BEB50DE420F52A ] NetBIOS C:\WINDOWS\system32\drivers\netbios.sys 14:36:48.0272 0x1be8 NetBIOS - ok 14:36:48.0288 0x1be8 [ F0D791348AD254360CC3C3E501CCB745, E4CAB4D3C2CD3169731283B00DEBFE26438BB66A3F0D78BDB68E876A14FC7070 ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys 14:36:48.0302 0x1be8 NetBT - ok 14:36:48.0311 0x1be8 [ 9A83FA0EC9B0DCED2CBC49DD05901920, 14D2F241235E2693C68BCCF05D83F2A1C9A7BE185C83E7C6C63EF0F654892F95 ] Netlogon C:\WINDOWS\system32\lsass.exe 14:36:48.0319 0x1be8 Netlogon - ok 14:36:48.0345 0x1be8 [ 7C8A7380CBE45DFD3DF118D8601499A7, C137280B7696F8CF4258BDC8B241C66BB3AA5708C5410D85255E46C7E8284826 ] Netman C:\WINDOWS\System32\netman.dll 14:36:48.0361 0x1be8 Netman - ok 14:36:48.0392 0x1be8 [ BBE9D72EFC7BD66B28309C3607683DBA, FC372EFBC650CE0BDB117858D840A1FB361947B1C67D1DD16BABA95D0286856A ] netprofm C:\WINDOWS\System32\netprofmsvc.dll 14:36:48.0415 0x1be8 netprofm - ok 14:36:48.0433 0x1be8 [ 5D046D71B18BEFB2E4D164C3DEEDD672, 536834D020889973854830919B23DF22CC1B27236AFAEDEBDF42D432CE48FCDE ] NetSetupSvc C:\WINDOWS\System32\NetSetupSvc.dll 14:36:48.0447 0x1be8 NetSetupSvc - ok 14:36:48.0472 0x1be8 [ FBF2ACE9B10DDE0B4108930D78370E86, 2A4910F071747B786EA49A638B3AAB698DCD0AD7FE702078BA83F85C533A227E ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 14:36:48.0480 0x1be8 NetTcpPortSharing - ok 14:36:48.0496 0x1be8 [ 46E862DA2CF8F351375EF537276B69B5, AC0FE0977E56380849DCE668AC0F5AF183AAB115ED84ADD964E390CC0BEDF6D3 ] netvsc C:\WINDOWS\System32\drivers\netvsc.sys 14:36:48.0505 0x1be8 netvsc - ok 14:36:48.0527 0x1be8 [ 88CE4AC85F36B6347C1D820FA373B998, E10B5DF8883928A2062FC6180DE4CF0DE33C68622C2E3E4E1AFC56A0682F8E75 ] NgcCtnrSvc C:\WINDOWS\System32\NgcCtnrSvc.dll 14:36:48.0541 0x1be8 NgcCtnrSvc - ok 14:36:48.0545 0x1be8 [ 9A83FA0EC9B0DCED2CBC49DD05901920, 14D2F241235E2693C68BCCF05D83F2A1C9A7BE185C83E7C6C63EF0F654892F95 ] NgcSvc C:\WINDOWS\system32\lsass.exe 14:36:48.0553 0x1be8 NgcSvc - ok 14:36:48.0594 0x1be8 [ EA1C2DAB8A63712B94897A58557B086C, 98DD7E5C84F3CDF2DAA89484892D6B439F5D14297B5243436925BEEAA0C02EE1 ] NlaSvc C:\WINDOWS\System32\nlasvc.dll 14:36:48.0611 0x1be8 NlaSvc - ok 14:36:48.0622 0x1be8 [ 41557BE174E9EC6AC703A8A4ADBC6650, 8CF6DF3FDC3C7C44B32851538A67BF86A54AB6444A424D7A20B7A9A94B4158D8 ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys 14:36:48.0632 0x1be8 Npfs - ok 14:36:48.0639 0x1be8 [ AC3F70FCFBCE97AA2F12BA43EE13B86E, D0AC50FB022C0F3031531CEE210D47FC3244C6FB55FAAD4AAB04081F0A21DAE4 ] npsvctrig C:\WINDOWS\System32\drivers\npsvctrig.sys 14:36:48.0647 0x1be8 npsvctrig - ok 14:36:48.0657 0x1be8 [ 0AF4872D3D6FD3A030E836DAC2B3EF2D, 03EE7B6FAFC0BB5C26793BC5FF8BD1019AC96B3104688009C1E062C3F4F34D6D ] nsi C:\WINDOWS\system32\nsisvc.dll 14:36:48.0666 0x1be8 nsi - ok 14:36:48.0671 0x1be8 [ 66A98C407085B8920DF1E6D722F1ADB8, 3FE307E4A9E41B08E0453507E50D6D0C67FA6F4245A863D90181463C749C83B5 ] nsiproxy C:\WINDOWS\system32\drivers\nsiproxy.sys 14:36:48.0680 0x1be8 nsiproxy - ok 14:36:48.0738 0x1be8 [ 466EC5659C02ED53DBD47DC1BC2B8086, 1F35DE75386F7D029C01D67B09D5E5157141C6892858885C11972CE73D6078AC ] NTFS C:\WINDOWS\system32\drivers\NTFS.sys 14:36:48.0788 0x1be8 NTFS - ok 14:36:48.0805 0x1be8 [ 383E546EF4982262A0EF6CC2B6E9D525, 3C6C90B62E8EB094E6928C388E5081A3F73DF87B0F34F716B72EA7B6EF71FBB7 ] Null C:\WINDOWS\system32\drivers\Null.sys 14:36:48.0813 0x1be8 Null - ok 14:36:48.0823 0x1be8 [ 466F875F1D4C6ABB46AF28007009237C, 26F5A5579737A7CF2267F79DDE5A551149C682D5FD24663B53FCEC5AA6B448CE ] nvraid C:\WINDOWS\system32\drivers\nvraid.sys 14:36:48.0834 0x1be8 nvraid - ok 14:36:48.0846 0x1be8 [ 76F19EAE7A52CBAF7B8EC428BE6E0DA0, CF1E55D92FA32744A20AB75D466A3E05E6FACF4694F9265C41F5C27C1E7243DC ] nvstor C:\WINDOWS\system32\drivers\nvstor.sys 14:36:48.0855 0x1be8 nvstor - ok 14:36:48.0868 0x1be8 [ 0D0CB77D74B38E0EC62341C19E469D8D, A05D3CC67FEEB2FD219BFAA34BF98CB3F3718042124AF28F0E9FDFB9F132DD76 ] nv_agp C:\WINDOWS\system32\drivers\nv_agp.sys 14:36:48.0877 0x1be8 nv_agp - ok 14:36:48.0899 0x1be8 [ EA3FFE8617B9FCA1620AD9876E92F4F1, 68D5143CA71D10A2BB44E29B3C76580596669D0624076BCF6CCBA7AF3140538E ] OneSyncSvc C:\WINDOWS\System32\APHostService.dll 14:36:48.0917 0x1be8 OneSyncSvc - ok 14:36:49.0009 0x1be8 [ 11E0B35479C895888BA3D7F619DCFFF3, 6ED82C19898101EC00BD64A9F90595C3D20AD2D2902AA8765B740FB3B9312DDF ] ose64 C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 14:36:49.0017 0x1be8 ose64 - ok 14:36:49.0046 0x1be8 [ CAFB5A95883158A0579DED2ED5CB0627, B23F7D19142DD3544F96ADB36F152F4EA7F6C524A1281EC26A2B95D7D044822C ] p2pimsvc C:\WINDOWS\system32\pnrpsvc.dll 14:36:49.0062 0x1be8 p2pimsvc - ok 14:36:49.0093 0x1be8 [ 3612CE3432E0A2BE0081E6B488ACF84C, F1A641735FD374CA293FB98FADA2C41E2033B17FECCA3B6D225D0E591AFFF413 ] p2psvc C:\WINDOWS\system32\p2psvc.dll 14:36:49.0112 0x1be8 p2psvc - ok 14:36:49.0136 0x1be8 [ 38F1AE32339731F6E5A7281AE8042545, 308954518C45D29FC199525F0CC7FE4EA805322EC0B871DDDCBEEC15355514C8 ] Parport C:\WINDOWS\System32\drivers\parport.sys 14:36:49.0146 0x1be8 Parport - ok 14:36:49.0170 0x1be8 [ 707889D2F95AAE8C9DD254D8767AD908, BE7BD94728D7629F8B7567523FFB42B8979941CEA2EA03E11BFCD51CF119FC27 ] partmgr C:\WINDOWS\system32\drivers\partmgr.sys 14:36:49.0178 0x1be8 partmgr - ok 14:36:49.0198 0x1be8 [ A09B0D8F9F0FC17EBCE6481AC9FD5CDF, 8E8D68992D98CF3DBC4B70C7902B3EC28A1E2DA8D4DB38F0AD9D52B1A5A1D40F ] PcaSvc C:\WINDOWS\System32\pcasvc.dll 14:36:49.0215 0x1be8 PcaSvc - ok 14:36:49.0264 0x1be8 [ 2834089EA4E550FF3B96E61FB4AA34ED, D25DAB47F9778675E984E0738D2014024C2758D52D7E071167A12FF466B7898E ] pci C:\WINDOWS\system32\drivers\pci.sys 14:36:49.0276 0x1be8 pci - ok 14:36:49.0306 0x1be8 [ 3D587E4295B11B8480F7ACB09A89D718, 8C3BD62B3451E1B2E7197EDAE381785406DF86C03BEEC486602C642FDD37DBC1 ] pciide C:\WINDOWS\system32\drivers\pciide.sys 14:36:49.0313 0x1be8 pciide - ok 14:36:49.0322 0x1be8 [ B8F07002B5F1DA23CFF979C2806B09F3, AD5C589A02BB8185AA070420BF30E78BC8BE3C6F9B0F66319A8CA05B70A5ED32 ] pcmcia C:\WINDOWS\system32\drivers\pcmcia.sys 14:36:49.0331 0x1be8 pcmcia - ok 14:36:49.0340 0x1be8 [ FF588077D0C6AC2EA3FCBF1903CE08D0, 64BE1646FB6D8CC902B6F386255F7C0420E3C334E14DECD527DD541B43A1DCD6 ] pcw C:\WINDOWS\system32\drivers\pcw.sys 14:36:49.0348 0x1be8 pcw - ok 14:36:49.0360 0x1be8 [ 70469C8AC4AD367295E70CFDD81B754C, 3EC6FD742C7C60363939E5343477810D751D91D32A2F24285976C08A7C4477AB ] pdc C:\WINDOWS\system32\drivers\pdc.sys 14:36:49.0369 0x1be8 pdc - ok 14:36:49.0408 0x1be8 [ 688F47C342E1BBC87A48AB71D316233E, CE99AB67C7E7A11AC69C2F4513AEBDACA385BA7F8CC49BE6313CE04ED404A0E7 ] PEAUTH C:\WINDOWS\system32\drivers\peauth.sys 14:36:49.0436 0x1be8 PEAUTH - ok 14:36:49.0481 0x1be8 [ 303D2C90139ABFC1D12E279F0F101710, CE02E335A72011004395DC635EB819B3ED8D00041B9C59024DE246366AF00559 ] PeerDistSvc C:\WINDOWS\system32\peerdistsvc.dll 14:36:49.0537 0x1be8 PeerDistSvc - ok 14:36:49.0551 0x1be8 [ 189265498945593D5256CFF7FEBB9665, 9CB88CC3C726BFE6EDCE8D9E4544306AACD3FB9E969E3A438D9FD533F25C1281 ] percsas2i C:\WINDOWS\system32\drivers\percsas2i.sys 14:36:49.0558 0x1be8 percsas2i - ok 14:36:49.0571 0x1be8 [ 9B86965114F6831A5130EFE6657B17D9, 4C5B657DB9A9F96BFD3EAFA756ED60D911EB58857C439F5FA6E495A473ED1145 ] percsas3i C:\WINDOWS\system32\drivers\percsas3i.sys 14:36:49.0579 0x1be8 percsas3i - ok 14:36:49.0633 0x1be8 [ 8A5A52C855FB5BFEF019AE9938AEA8AE, 77CB8A09B209DB5895319BA9D073A67148926E22C47836343050DFC178AFAEEE ] PerfHost C:\WINDOWS\SysWow64\perfhost.exe 14:36:49.0642 0x1be8 PerfHost - ok 14:36:49.0676 0x1be8 [ 839BD56425530973FF3F6F7C0057CD22, 9BADF39BC4628409CFCD5F1300C6040C49B2ED72D0FA389C6BB042E5B17E1A40 ] PimIndexMaintenanceSvc C:\WINDOWS\System32\PimIndexMaintenance.dll 14:36:49.0692 0x1be8 PimIndexMaintenanceSvc - ok 14:36:49.0738 0x1be8 [ 82FDEC2A262728F62F2111A84CC04B16, A1FCE38D4F55F10BB9B3BFB7D9E3EF7C27D499D9C8882218C8A9A73487798188 ] pla C:\WINDOWS\system32\pla.dll 14:36:49.0786 0x1be8 pla - ok 14:36:49.0815 0x1be8 [ 7B3DA16FAA498838BB457E0B7E380EDF, B73DCFFA60886F10765E4B76A58CFF18C08CAFEE620700361FC8FEC7E80B5958 ] PlugPlay C:\WINDOWS\system32\umpnpmgr.dll 14:36:49.0830 0x1be8 PlugPlay - ok 14:36:49.0835 0x1be8 [ F1E9C35A8DFD4D64382CFB9019A950F9, 24E0381C6909F9876D6DC4697DC6405FE18DF91531891B2CCA6DB0191B9C6DF4 ] PNRPAutoReg C:\WINDOWS\system32\pnrpauto.dll 14:36:49.0844 0x1be8 PNRPAutoReg - ok 14:36:49.0863 0x1be8 [ CAFB5A95883158A0579DED2ED5CB0627, B23F7D19142DD3544F96ADB36F152F4EA7F6C524A1281EC26A2B95D7D044822C ] PNRPsvc C:\WINDOWS\system32\pnrpsvc.dll 14:36:49.0880 0x1be8 PNRPsvc - ok 14:36:49.0908 0x1be8 [ 62C0BD179961132EF2C5B952210C11F5, 2473FBB3619D0DDA229D4BEC30CEFE7497C27ED3844A5B7655F6F2D328FEAF61 ] PolicyAgent C:\WINDOWS\System32\ipsecsvc.dll 14:36:49.0927 0x1be8 PolicyAgent - ok 14:36:49.0938 0x1be8 [ 6390391EDFC43DD11CE9E6AADCAC20EA, C8BC222FFBB9E47489D16BB5248E0E2E594011C46CFF71F5DBCC4D5CC6788098 ] Power C:\WINDOWS\system32\umpo.dll 14:36:49.0949 0x1be8 Power - ok 14:36:49.0970 0x1be8 [ 1433EB7908E5E1E20FFD50E4126C3484, 34D81680C8F2F2C5892FC0E0A6DFCBB241AFF493267A1FE182ED28AE9F712456 ] PptpMiniport C:\WINDOWS\System32\drivers\raspptp.sys 14:36:49.0981 0x1be8 PptpMiniport - ok 14:36:50.0083 0x1be8 [ E3514CE7CB4AF80ECCA383F065BC77C0, 1EA06D358A07EB9DFB703CEFC4EB834B947B899E0ACFE1C494E2DAED63F1D4B5 ] PrintNotify C:\WINDOWS\system32\spool\drivers\x64\3\PrintConfig.dll 14:36:50.0162 0x1be8 PrintNotify - ok 14:36:50.0178 0x1be8 [ 22DE54C3974E4FD98F61D095C22C59B7, 64E78D6DEC4A28ABB0A23F2CF078459D81796EC79235AE45976ABB4F72B1D1E6 ] Processor C:\WINDOWS\System32\drivers\processr.sys 14:36:50.0188 0x1be8 Processor - ok 14:36:50.0216 0x1be8 [ 27D0B024BB356C6BEB1214B61E47DE02, 8CBDD62E243CC652F2197AE83DEDD21D91D2792558A6D7D1CC680B37607DEF4B ] ProfSvc C:\WINDOWS\system32\profsvc.dll 14:36:50.0233 0x1be8 ProfSvc - ok 14:36:50.0241 0x1be8 [ EDD52C352CBAAAD13FD7BD5DCEA309B3, EC7D294B23FD5C309E5C4C455896937B85DC615E1B36C9F8F3BDC90E75EBF9CF ] Psched C:\WINDOWS\system32\drivers\pacer.sys 14:36:50.0250 0x1be8 Psched - ok 14:36:50.0278 0x1be8 [ DD3FF2053356D11C785999BBC633F3E0, E9A5B7C657F4523E5DEF7AEE7ECFCC94E911FC65F1D491BEF01239F357B8D8E0 ] QWAVE C:\WINDOWS\system32\qwave.dll 14:36:50.0294 0x1be8 QWAVE - ok 14:36:50.0320 0x1be8 [ 51590F442C6E5D43244BA30DDB0CE79D, 9C7FD0A19753C13FD4A27EBFD60703A2414D5A2F6F451F0B32769C8D7C953980 ] QWAVEdrv C:\WINDOWS\system32\drivers\qwavedrv.sys 14:36:50.0328 0x1be8 QWAVEdrv - ok 14:36:50.0346 0x1be8 [ E951E70019865B06126AF850BCCA2026, C590DE38C7603149AFA0271D57EEBAF956F18F50584FCF04BC2C8D8CEC5C5932 ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys 14:36:50.0355 0x1be8 RasAcd - ok 14:36:50.0374 0x1be8 [ 0BF8607133AE264BC3C41A5BAA5FFB7B, 9A4F6AC6013AB5C2A99BCFC2CCF161DD225DE8D85D61579655ADBF04A4383A61 ] RasAgileVpn C:\WINDOWS\System32\drivers\AgileVpn.sys 14:36:50.0386 0x1be8 RasAgileVpn - ok 14:36:50.0397 0x1be8 [ FE0976379F9E7DB6F7945FCEB88C7E29, BA331CE55C02E86478714DA87FAC547B50D53BC7D02BCA5A64D484DED44BFAA5 ] RasAuto C:\WINDOWS\System32\rasauto.dll 14:36:50.0410 0x1be8 RasAuto - ok 14:36:50.0428 0x1be8 [ CA60F6C03611AF1710BC903ED9F566FB, B5C9E8BAC631738761E11168AB68EB1ECC5EC96BF9A8248B9127DCF744CA4691 ] Rasl2tp C:\WINDOWS\System32\drivers\rasl2tp.sys 14:36:50.0440 0x1be8 Rasl2tp - ok 14:36:50.0472 0x1be8 [ 586A17C10D417D889F1FF7D8636E2F34, EEDA4EE8D2BC5C8C7756AB79F1F19AF8B1C4057996748FAE4E3F37844DB0EB33 ] RasMan C:\WINDOWS\System32\rasmans.dll 14:36:50.0499 0x1be8 RasMan - ok 14:36:50.0530 0x1be8 [ E5FA41160F5A3D78D8F7765E5C5F6BB0, 31BA423FFFC3206717DC34B482149421EE28B27A4A3BA2DC78C3B3A9EE0C1365 ] RasPppoe C:\WINDOWS\System32\drivers\raspppoe.sys 14:36:50.0541 0x1be8 RasPppoe - ok 14:36:50.0553 0x1be8 [ DF0834AE921E633E05D1FDC55C318957, 851A00961224DACBEF9DA427122F6B4B73BB99849D5ECB55DBBD311B2EA84C33 ] RasSstp C:\WINDOWS\System32\drivers\rassstp.sys 14:36:50.0564 0x1be8 RasSstp - ok 14:36:50.0580 0x1be8 [ FC9B7AC6E2B837EF7CD6C64F7068D41D, 9B0DD842033E82BC7EE80416A62B084BF5200923EB7A6C80415BB28004E9B5E3 ] rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys 14:36:50.0597 0x1be8 rdbss - ok 14:36:50.0604 0x1be8 [ FB7375657F8A5932C35EAA45E9B4B416, 99594708BFD6DC9F8CECBF092058D4D0D4F1BC3204E86F9FDAD5207ED5ECF194 ] rdpbus C:\WINDOWS\System32\drivers\rdpbus.sys 14:36:50.0612 0x1be8 rdpbus - ok 14:36:50.0621 0x1be8 [ A32AED8C644734B283A7C9D08D76064D, A12F67C57E43B6A2FE6449EA3822B1108FE70C66AF9911798777F85D760E384C ] RDPDR C:\WINDOWS\system32\drivers\rdpdr.sys 14:36:50.0632 0x1be8 RDPDR - ok 14:36:50.0654 0x1be8 [ 37CC7E41243EFBB4FBC0510E5CA32A02, 634E2F81D61F937F30E5ECE01FB581E090C6DA073EF7B1A3F6083ECAF363CB46 ] RdpVideoMiniport C:\WINDOWS\system32\drivers\rdpvideominiport.sys 14:36:50.0662 0x1be8 RdpVideoMiniport - ok 14:36:50.0692 0x1be8 [ DAF957B25A35757E9D814611FAE8FE3B, 5244A427B2DEB5349B9F336A4A39A6834A6E8118A8EDA00738C6CE09F2452C24 ] rdyboost C:\WINDOWS\system32\drivers\rdyboost.sys 14:36:50.0702 0x1be8 rdyboost - ok 14:36:50.0746 0x1be8 [ 2C72E029C153D25325CA182A669E4ADE, 5CE0E04A6B53A1F11E8159DFD1E59F2AE6631E3B5BD27BAAEC4A35BC02A55722 ] ReFSv1 C:\WINDOWS\system32\drivers\ReFSv1.sys 14:36:50.0772 0x1be8 ReFSv1 - ok 14:36:50.0817 0x1be8 [ BABEE4A896D005BD0D205F1C932DA25E, 269FDF65BE3A226FA2A5CA25085366E32ADAD30A020484FE844962E8C61CB1D2 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll 14:36:50.0838 0x1be8 RemoteAccess - ok 14:36:50.0864 0x1be8 [ 066062967A77867BDCF665960EFDAD32, 68143DBDFA7C68786C22F5CC4E80200255C663A844069C080E7816F423ABB1F4 ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll 14:36:50.0879 0x1be8 RemoteRegistry - ok 14:36:50.0924 0x1be8 [ 891C83BE8BA62B7547B9A6576A360C71, B808FE4B5A93B8C971C2AF6CC7F0BAE7154A43A87D6CE0826277D1D7D7948E24 ] RetailDemo C:\WINDOWS\system32\RDXService.dll 14:36:50.0957 0x1be8 RetailDemo - ok 14:36:50.0976 0x1be8 [ 6451FE42C35FDE3862D99579444F4A8F, BD56A1120AACF6143E6EB739E12BEE86DF142F1159865608BDF1BBE54B66AFCE ] RpcEptMapper C:\WINDOWS\System32\RpcEpMap.dll 14:36:50.0986 0x1be8 RpcEptMapper - ok 14:36:51.0003 0x1be8 [ F24131EAD1D0B73463052BB042A37B6C, 43B5772310B200DF1914C8E4D10401A0BCE9082BDEAC34736AFB2920B39D7956 ] RpcLocator C:\WINDOWS\system32\locator.exe 14:36:51.0011 0x1be8 RpcLocator - ok 14:36:51.0028 0x1be8 [ 5E57B9FBB4E9C43EE5B69BEE01A1819F, A1F8D1E52AF446CEA2EB50064E3A24B713B19197D61C3EAECB81B3CCD80558E7 ] RpcSs C:\WINDOWS\system32\rpcss.dll 14:36:51.0057 0x1be8 RpcSs - ok 14:36:51.0079 0x1be8 [ DC66C1D262D64E30A30B68E9F21AC74B, A5ED3D31BCD68DBC00A956787517ACA167C86F5FFDAF7C9A85505FA2B705C6CB ] rspndr C:\WINDOWS\system32\drivers\rspndr.sys 14:36:51.0090 0x1be8 rspndr - ok 14:36:51.0111 0x1be8 [ 88F7703F2A4677C828124AE2110D3EBC, 529F6A5815806F2EA2235802BD28AF8D7A40E7799356BD3EC337C9E71B6B53E6 ] s3cap C:\WINDOWS\System32\drivers\vms3cap.sys 14:36:51.0133 0x1be8 s3cap - ok 14:36:51.0177 0x1be8 [ 9A83FA0EC9B0DCED2CBC49DD05901920, 14D2F241235E2693C68BCCF05D83F2A1C9A7BE185C83E7C6C63EF0F654892F95 ] SamSs C:\WINDOWS\system32\lsass.exe 14:36:51.0185 0x1be8 SamSs - ok 14:36:51.0210 0x1be8 [ B467E932FE4E16E201DC7E56870CB559, 6FCE9A2DFC5D222BBEA4AA271A17B830FCF8EAE44B07BEE5FF34AE50CABCBB6A ] sbp2port C:\WINDOWS\system32\drivers\sbp2port.sys 14:36:51.0218 0x1be8 sbp2port - ok 14:36:51.0234 0x1be8 [ 3E115C63649402D321D396F8D606C9B0, F4BA7FE0E89D563A57B6865E4CF1334998987D11A0D70FF7491726A507B40DF4 ] SCardSvr C:\WINDOWS\System32\SCardSvr.dll 14:36:51.0251 0x1be8 SCardSvr - ok 14:36:51.0279 0x1be8 [ 67EFFD3D1BB6D2B67DF7F8FDCB1A51FC, DE41539FAC730F5CFF6C8754ECFF1253AFDC1C86743AE71B61D716B7A84E85FD ] ScDeviceEnum C:\WINDOWS\System32\ScDeviceEnum.dll 14:36:51.0294 0x1be8 ScDeviceEnum - ok 14:36:51.0300 0x1be8 [ 31DDA0716EC265CA57DAF9D2295FD76F, E6F39C1B3CF81918277DB8C6E3DF9A82812E1C9063DEB1FB85FE433DC9A16CBA ] scfilter C:\WINDOWS\system32\DRIVERS\scfilter.sys 14:36:51.0312 0x1be8 scfilter - ok 14:36:51.0353 0x1be8 [ 1BFAC03B6422E878EFCDA934BF4C4823, 0BA537A4B9E8020E6B709A44F1382DB3B41CEF631B847201F812152FEB303CD3 ] Schedule C:\WINDOWS\system32\schedsvc.dll 14:36:51.0386 0x1be8 Schedule - ok 14:36:51.0412 0x1be8 [ 320E7A02D81A468E8C1FEEFDB856AFAE, E65127D3D6B628F9D19EA509FEBD9E4DC1BF20D0C62C3C9E1D7087DF972B2AA7 ] SCPolicySvc C:\WINDOWS\System32\certprop.dll 14:36:51.0426 0x1be8 SCPolicySvc - ok 14:36:51.0451 0x1be8 [ 004C66464D8FE76D5DA78BE6777D61AF, 58B5C436798EEBBE7081D54B55B70DEB15331856802CD45E3FF8BDE794F06A27 ] sdbus C:\WINDOWS\System32\drivers\sdbus.sys 14:36:51.0463 0x1be8 sdbus - ok 14:36:51.0487 0x1be8 [ A906C527B838A4922611C63EBD250F91, 6BB0054A9C2408138BDF49D834FF99B5B9764E7747ABC15016F54FBA1D28394F ] SDRSVC C:\WINDOWS\System32\SDRSVC.dll 14:36:51.0498 0x1be8 SDRSVC - ok 14:36:51.0509 0x1be8 [ F4BF50A7D16A97A887BFA0F193693C42, EEBF5AAC149C72F490BAC954B25BB6882B10FC38F93CA4F4829A06702B1ECEF9 ] sdstor C:\WINDOWS\System32\drivers\sdstor.sys 14:36:51.0517 0x1be8 sdstor - ok 14:36:51.0526 0x1be8 [ 648A299839E8F48A946C41DE270D28F5, EEC9A5FCBE3FF78FB5E0452FF1932A8B0C7399688041E22555703CB1977A4428 ] seclogon C:\WINDOWS\system32\seclogon.dll 14:36:51.0535 0x1be8 seclogon - ok 14:36:51.0549 0x1be8 [ 29452A9DA3E3482F0C2963312F979053, E1782D36C336C4B4C261AD665C1E9051905AA86020E08FC94069972AF4C4DB4B ] SENS C:\WINDOWS\System32\sens.dll 14:36:51.0562 0x1be8 SENS - ok 14:36:51.0594 0x1be8 [ 919BA7E3054E4F1D61A3524ADCE6A970, 3C382673DF5AF2F38A5AE4A268F5856B0CC9E65D52213DE6D2C06E252753B73C ] SensorDataService C:\WINDOWS\System32\SensorDataService.exe 14:36:51.0627 0x1be8 SensorDataService - ok 14:36:51.0653 0x1be8 [ 01C2EEA7870FE26A4A6CCBA5421CC7E5, 9E643AB6BCBECE4F2A5FD4C96547A4E3F2BDFEFC5FE24B802467718EC69929F8 ] SensorService C:\WINDOWS\system32\SensorService.dll 14:36:51.0667 0x1be8 SensorService - ok 14:36:51.0678 0x1be8 [ D2FEE824B4AA0BE377F1353E5F915BF4, 00D754C62F3482BBD0EA72C896139C39D15192B2D9FCC7B755D1FB9DF9FCFD9B ] SensrSvc C:\WINDOWS\system32\sensrsvc.dll 14:36:51.0691 0x1be8 SensrSvc - ok 14:36:51.0703 0x1be8 [ 9DB0BBE3ABE1F49651AE51EC5BCABE58, 0B46C1F231F41766AB73EE7E9834D3CDACA602D12E702D9277E28B47417D9CA4 ] SerCx C:\WINDOWS\system32\drivers\SerCx.sys 14:36:51.0711 0x1be8 SerCx - ok 14:36:51.0737 0x1be8 [ C4AF79C37334D995D95C22C14FDBF7FD, 4D4985921261909F2123467A22EDB102B490710F60AB935624435E5BB808A0E9 ] SerCx2 C:\WINDOWS\system32\drivers\SerCx2.sys 14:36:51.0747 0x1be8 SerCx2 - ok 14:36:51.0755 0x1be8 [ FC541A272F47BE03E67A9FCB87FA8C3E, 730A3616FD67E9F2832442144B2655A8EF78B9AFCB204113E73E257256491354 ] Serenum C:\WINDOWS\System32\drivers\serenum.sys 14:36:51.0763 0x1be8 Serenum - ok 14:36:51.0772 0x1be8 [ 2A5F5F95FCA123DCBF53B5F603B64789, DE5C9E1D88B2C180B137DA7839F3EF6C936A171ABA49F89C10EE9C73A2226F3F ] Serial C:\WINDOWS\System32\drivers\serial.sys 14:36:51.0782 0x1be8 Serial - ok 14:36:51.0801 0x1be8 [ C8738887228B7BFA3B1A906816A8BB12, 328283569201791891D5E9FB3028DB5B9FD93A7BEFC00C7DEBC2CC5731DE64D5 ] sermouse C:\WINDOWS\System32\drivers\sermouse.sys 14:36:51.0809 0x1be8 sermouse - ok 14:36:51.0850 0x1be8 [ 0CBE2081CAC41BD0093AF69E167B6559, D446B1B31B823875E0536CA8A2F784093B0DA77A875FB0F2D5EABB6DE711CFFC ] Service KMSELDI C:\Program Files\KMSpico\Service_KMS.exe 14:36:51.0885 0x1be8 Service KMSELDI - detected UnsignedFile.Multi.Generic ( 1 ) 14:36:54.0263 0x1be8 Service KMSELDI ( UnsignedFile.Multi.Generic ) - warning 14:36:56.0639 0x1be8 [ B1CB58853153397DFFA2D13A81451D09, CC9B3B064711E9B5CB38DC1C84DC410033939848BD31BB0D12F990E8154F357E ] SessionEnv C:\WINDOWS\system32\sessenv.dll 14:36:56.0658 0x1be8 SessionEnv - ok 14:36:56.0670 0x1be8 [ 67832B68752CDF7FDE56949E4A2E70BF, A72320EA8575A751DF86A1EE7969AD9D548D6185F2520197262E11B79FF8222B ] sfloppy C:\WINDOWS\System32\drivers\sfloppy.sys 14:36:56.0678 0x1be8 sfloppy - ok 14:36:56.0710 0x1be8 [ F10E5536E1C753E01CF19FA4F466CE90, C9897F22B176D84CA233F864078895E3DAD4DAD090FACBB01BD6E59EE337B47C ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll 14:36:56.0731 0x1be8 SharedAccess - ok 14:36:56.0759 0x1be8 [ 4AC12D495B3CB4275F74C68A7A017561, DC53EBD606ECCD8BCF6D618C0EB58B03F5C20F09E0F0AEDE9B8082D6B208B19A ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll 14:36:56.0790 0x1be8 ShellHWDetection - ok 14:36:56.0798 0x1be8 [ ED058030296CF9B79C8D48BF43724323, 01DC7C2590DF48116CD1A126F207FE5DE439A53286BAE3736E22EE3D1CA80BE3 ] SiSRaid2 C:\WINDOWS\system32\drivers\SiSRaid2.sys 14:36:56.0805 0x1be8 SiSRaid2 - ok 14:36:56.0813 0x1be8 [ 633D3D1581E9DCCD5A2D8F039104C9A5, C44B5097016C2AEC8B41F77425FE44413562F9DCF0C0C11CA69D8178970B4706 ] SiSRaid4 C:\WINDOWS\system32\drivers\sisraid4.sys 14:36:56.0821 0x1be8 SiSRaid4 - ok 14:36:56.0849 0x1be8 [ 35B8FC714C2E7F07F7DC7C64452153F8, 6D45EB01B5F972ED0E5520E771F007FFEE892054FABDB3DD00D3E9915D3A0A31 ] smphost C:\WINDOWS\System32\smphost.dll 14:36:56.0861 0x1be8 smphost - ok 14:36:56.0890 0x1be8 [ DE3A5C27EC842A113F68A2705FF63B00, B134EF63708A892B673B539F544F7980FF72838D822E8E4CCDDB359B22CB8805 ] SmsRouter C:\WINDOWS\system32\SmsRouterSvc.dll 14:36:56.0915 0x1be8 SmsRouter - ok 14:36:56.0940 0x1be8 [ CD1056818A6FCEF4D32BD1D6E34070D5, F5BFB61ACB220A73B0DC4487B049F52E9F9FA2D4188C001E7A5838D47CEA6343 ] SNMPTRAP C:\WINDOWS\System32\snmptrap.exe 14:36:56.0950 0x1be8 SNMPTRAP - ok 14:36:56.0968 0x1be8 [ 187B4AD4446C59F8FCC4A10F473EE3D1, 0AAD961B3D7B3484DC89CB86F3EC96CEBFABB7224A5BFB48083DE8F1805EA7B4 ] spaceport C:\WINDOWS\system32\drivers\spaceport.sys 14:36:56.0983 0x1be8 spaceport - ok 14:36:56.0996 0x1be8 [ 2799FCA215919FDC9A87C5FCAB530828, BDE968BF26693AA4D70AB669896BCA49C6F533EA226386B35B0EA589A55227B5 ] SpbCx C:\WINDOWS\system32\drivers\SpbCx.sys 14:36:57.0004 0x1be8 SpbCx - ok 14:36:57.0087 0x1be8 [ 788BA30B95BEFA1F0142723CD0070940, B3E0AC94AD7D59D8FF0985B353AE40DF6EB7C7788984F3FD835430272326E69B ] SplashtopRemoteService C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe 14:36:57.0105 0x1be8 SplashtopRemoteService - ok 14:36:57.0125 0x1be8 [ 58C17D92AD61EC7A98B05F4FAD0D205A, B881134A1BD9194145A9D18BDB34D57E2C167F06C2A9368459D0C33E6E0D6501 ] Spooler C:\WINDOWS\System32\spoolsv.exe 14:36:57.0153 0x1be8 Spooler - ok 14:36:57.0273 0x1be8 [ 5C31E109943E67CFC801810C00AB63EE, 9A80D7CDA1135EBCE10E753986A59CFA3D8D49F9B0BE38FDF99880B1DD88C41D ] sppsvc C:\WINDOWS\system32\sppsvc.exe 14:36:57.0402 0x1be8 sppsvc - ok 14:36:57.0416 0x1be8 [ AA1F23501511EFE9CF9771F6B20E8D45, E786852D9877CCFD35444F8FC694467132F868D87A8C344FD1016FFDE74695A5 ] srv C:\WINDOWS\system32\DRIVERS\srv.sys 14:36:57.0433 0x1be8 srv - ok 14:36:57.0447 0x1be8 [ F5B169EDF9D5E3C7200D89D30E065D13, 12BAF3A3CB76F0900FA53681C9AD16F40308F493BA22C0F60E1E268D0D6AF825 ] srv2 C:\WINDOWS\system32\DRIVERS\srv2.sys 14:36:57.0470 0x1be8 srv2 - ok 14:36:57.0477 0x1be8 [ 2E142E027F0AA698BA4DCE49CBDB43CD, A21027BBBC75A55A8B302D028113A0683016E4C72790A8C561DDB1AE7FDB4289 ] srvnet C:\WINDOWS\system32\DRIVERS\srvnet.sys 14:36:57.0490 0x1be8 srvnet - ok 14:36:57.0501 0x1be8 [ BF71B3FB5B7557CB740CDB09C5FB50D9, D6F9E65FDC9C4ADAFE82D94F71A1F5960DB3BEEBF4FE5B2D087515C4FAA5F287 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll 14:36:57.0517 0x1be8 SSDPSRV - ok 14:36:57.0538 0x1be8 [ EF1BC04215C201ADA3F7F5A2F034EA21, E1A7A0FA2032B9E7D3951100E74C04D93CD848C88D23D57FBA0BFA2816B29C61 ] SstpSvc C:\WINDOWS\system32\sstpsvc.dll 14:36:57.0553 0x1be8 SstpSvc - ok 14:36:57.0581 0x1be8 [ 5252D7BC56E5E0ED715AEA8FE173A455, 1408B3E98B35A449434718777EE70595F0D306197A428279C6281D2F1953F259 ] ssudmdm C:\WINDOWS\system32\DRIVERS\ssudmdm.sys 14:36:57.0589 0x1be8 ssudmdm - ok 14:36:57.0612 0x1be8 [ 504C33FE3B4E2AF11FE5875DDCA8EBEA, 7A3A5B5B23422A58F597DDE5FC0593EDE8EF31A7FB9CB77DB3A6AAFCCA369F3D ] SSUService C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe 14:36:57.0626 0x1be8 SSUService - ok 14:36:57.0706 0x1be8 [ 0FC4FA53C3F666CD7AFB138A978D3CB8, F65D88324D6007CE4AAB9486B6D00EE6352CA0F3B1A2D0616811AF1279799501 ] StateRepository C:\WINDOWS\system32\windows.staterepository.dll 14:36:57.0779 0x1be8 StateRepository - ok 14:36:57.0835 0x1be8 [ D31201BD8782752BD69DBE1E5DDF9AC5, 98B72690B4E6CC1B694C655DD31CB1FB56B76B62A32CFB748AF78F4C072D9740 ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe 14:36:57.0852 0x1be8 Steam Client Service - ok 14:36:57.0875 0x1be8 [ DDE064A4298FD1FBF804D3ED691E7EDB, B0D117B1FC0DA2CB76F5F63699E2F108930B6C6721AC443111D48215ED624278 ] stexstor C:\WINDOWS\system32\drivers\stexstor.sys 14:36:57.0882 0x1be8 stexstor - ok 14:36:57.0900 0x1be8 [ A10A6FC3F643F82777345ADDC182799A, 8D09A7643A0095A0077710423E7D8D7134F9197B6F73DA427333790BA3774A61 ] sthid C:\WINDOWS\System32\drivers\sthid.sys 14:36:57.0903 0x1be8 sthid - ok 14:36:57.0937 0x1be8 [ 60F04DF1AB55D6D4BDA02052DD20537E, 52996EDF2C06968DADC9BDF24E4039929B81643493C7193B8CC4A6BD1A3AE761 ] stisvc C:\WINDOWS\System32\wiaservc.dll 14:36:57.0962 0x1be8 stisvc - ok 14:36:57.0989 0x1be8 [ 32C95F44108C3E7DB58F773346E3C9D0, F852D8ECA06080EA6DE1A90509071965A750D9CFC9627F0D4DB8ECC57133B0B5 ] storahci C:\WINDOWS\system32\drivers\storahci.sys 14:36:57.0999 0x1be8 storahci - ok 14:36:58.0011 0x1be8 [ 8883C8CE4942A99B84E1CC6EFA19738E, 60C1CDA4382F8EE70D810DBB1BCAF5F389433563FF23EEB84859612F396D8CE6 ] storflt C:\WINDOWS\system32\drivers\vmstorfl.sys 14:36:58.0018 0x1be8 storflt - ok 14:36:58.0039 0x1be8 [ AE7B7E1E95BFB9340B1956C98CA52C81, 3E0214A0C486C1CD05D9BC57E58A998A3CEADDC1D24AE2A75098F56B37069160 ] stornvme C:\WINDOWS\system32\drivers\stornvme.sys 14:36:58.0048 0x1be8 stornvme - ok 14:36:58.0061 0x1be8 [ 63513EF3121689B3A59BD217618A2E42, DE9B89732801DEC60BD116D58CFB427F7E37F093BE8A9F6E0CAC729B5346B314 ] storqosflt C:\WINDOWS\system32\drivers\storqosflt.sys 14:36:58.0070 0x1be8 storqosflt - ok 14:36:58.0101 0x1be8 [ CC96FF061C772340F2ED89ABBA567ADC, 028CD44405B7FAFC7BF331DD729E44E0594A63386F48CF39D7725A58B3DE22D6 ] StorSvc C:\WINDOWS\system32\storsvc.dll 14:36:58.0118 0x1be8 StorSvc - ok 14:36:58.0136 0x1be8 [ 000F5CFCEF0F06DC8FD1D2F568E48AE4, C1FE485E57A1B912CE79556E0EFF03CC11362E7966D250E3AA4962DCCB8F8EE6 ] storufs C:\WINDOWS\system32\drivers\storufs.sys 14:36:58.0143 0x1be8 storufs - ok 14:36:58.0157 0x1be8 [ 7415087F9006D6818F85F3CBD79B1A50, C768EBB2263375D285D689FEEF546147D42D7376977424A4D6FD655CC78EA7CD ] storvsc C:\WINDOWS\system32\drivers\storvsc.sys 14:36:58.0164 0x1be8 storvsc - ok 14:36:58.0189 0x1be8 [ E49858EA5865A015EB78B7F7C1C07DE2, 1ADBBAC2D2E2E3C40AB0BDDE068001E76A8DAB79C54F06479F7A4567DAD7A7A8 ] svsvc C:\WINDOWS\system32\svsvc.dll 14:36:58.0201 0x1be8 svsvc - ok 14:36:58.0264 0x1be8 [ 802278EE4ACCE9EA1F1481DF20EB1667, E78F0DA2CA0B2C2DF3B7E3B2A22C03380FE649813EE6EB31067C5FB6727DB7BD ] swenum C:\WINDOWS\System32\DriverStore\FileRepository\swenum.inf_amd64_2a699e44676b7781\swenum.sys 14:36:58.0271 0x1be8 swenum - ok 14:36:58.0285 0x1be8 [ 313D2C0DBA0B23A8302254FD317D2EC8, 20B98D6F33FEC7ACBCEED9757A3FEAD837FA7BA378BA25575A33EA45E076FC6B ] swprv C:\WINDOWS\System32\swprv.dll 14:36:58.0308 0x1be8 swprv - ok 14:36:58.0332 0x1be8 [ 12D0CB1DCAE6725B6CA54CC2038C4C8C, 7D224298E440B8C5FDD99A52485A6245DE5109C9A02E65AD38F1EC6DBF4AEEF2 ] Synth3dVsc C:\WINDOWS\System32\drivers\Synth3dVsc.sys 14:36:58.0340 0x1be8 Synth3dVsc - ok 14:36:58.0365 0x1be8 [ D5B31B2F14848015C211F1D674A82F3A, 58C18254C817693DB727090D1CC518032B3A67C5B3FC7F2F8CE4613A33790CFA ] SysMain C:\WINDOWS\system32\sysmain.dll 14:36:58.0402 0x1be8 SysMain - ok 14:36:58.0431 0x1be8 [ D5AAA188C70146977CFEE8D128599F3F, 9ABC30982E552EAF41FE84397EEEE5A3187444062C662D7CF35A03E3B274AFB8 ] SystemEventsBroker C:\WINDOWS\System32\SystemEventsBrokerServer.dll 14:36:58.0450 0x1be8 SystemEventsBroker - ok 14:36:58.0473 0x1be8 [ 95875059929EF91B55EA612D7967DD3D, 5F734209C8C9725376F7C146ED84999CC6D019C4C10B1795F53E72BE8853E2DD ] TabletInputService C:\WINDOWS\System32\TabSvc.dll 14:36:58.0485 0x1be8 TabletInputService - ok 14:36:58.0513 0x1be8 [ 3C32FF010F869BC184DF71290477384E, 55CFCEC7F026C6E2E96A2FBE846AB513BB12BB0348735274FE1B71AF019C837B ] tap0901 C:\WINDOWS\System32\drivers\tap0901.sys 14:36:58.0518 0x1be8 tap0901 - ok 14:36:58.0546 0x1be8 [ FE33F417DFD9847CB571D3C7EE5FA7E3, B3C7BE7998B9B093DD969A2588EE8CEBD9771331A63D4B1D86A188317B5EE71C ] TapiSrv C:\WINDOWS\System32\tapisrv.dll 14:36:58.0562 0x1be8 TapiSrv - ok 14:36:58.0611 0x1be8 [ 7EBD20284AC9BF9F0A020B86769BB074, 26D8CC9C1EE069BB617973BA7CBCFC36BAF1EABF975F395077547F930197A56A ] Tcpip C:\WINDOWS\system32\drivers\tcpip.sys 14:36:58.0662 0x1be8 Tcpip - ok 14:36:58.0711 0x1be8 [ 7EBD20284AC9BF9F0A020B86769BB074, 26D8CC9C1EE069BB617973BA7CBCFC36BAF1EABF975F395077547F930197A56A ] Tcpip6 C:\WINDOWS\system32\drivers\tcpip.sys 14:36:58.0762 0x1be8 Tcpip6 - ok 14:36:58.0777 0x1be8 [ D378A1AF58AFA84BB6AC753F2C1BE9F4, 8BBA623193D51E6A8DD0627FA08C93B918EF1BA2EEBA46CDBB86FE6A1007FDEE ] tcpipreg C:\WINDOWS\system32\drivers\tcpipreg.sys 14:36:58.0787 0x1be8 tcpipreg - ok 14:36:58.0818 0x1be8 [ 28E1E63A1AC65E17B3194238FA2CF3BF, 9A52D6DD14BEBB7B407B2703A111D1B302F1B84AA40A14D21FCA554F395E935D ] tdx C:\WINDOWS\system32\DRIVERS\tdx.sys 14:36:58.0826 0x1be8 tdx - ok 14:36:58.0843 0x1be8 [ CCDBD2817C10A4F631280CBB3AE44FFB, A022DEF4D3CF75F41FA26275347F4BA38A513AD32FF18385C2E756DECB61D404 ] terminpt C:\WINDOWS\System32\drivers\terminpt.sys 14:36:58.0849 0x1be8 terminpt - ok 14:36:58.0883 0x1be8 [ A0608264209A836821D6AB8C67B108AB, 7912C75F72BCAB7426A2E00C597C8D94C185B5DD31BD6C4BE5D56FECD5B0D9EA ] TermService C:\WINDOWS\System32\termsrv.dll 14:36:58.0917 0x1be8 TermService - ok 14:36:58.0926 0x1be8 [ 261830B1E3650E4471E1F98850B929B7, D281B8A93315E64C7AF5002E5BFBE6AFF8B35FD6AA747AE07D7AA96F4AFAA613 ] Themes C:\WINDOWS\system32\themeservice.dll 14:36:58.0941 0x1be8 Themes - ok 14:36:58.0978 0x1be8 [ 8D23F0819A00C547814409B734DD3747, 0E1B25A53C84486F8A57F309F3C016114F90F5AF5E576889BD230931F38594A5 ] tiledatamodelsvc C:\WINDOWS\system32\tileobjserver.dll 14:36:58.0999 0x1be8 tiledatamodelsvc - ok 14:36:59.0040 0x1be8 [ 354DAA630928CD4DA2BC84A0DA4ADA9D, AFAE4948EA4F899267DC52DF9A06450FC3E77083B563E541581DA90685C7E98C ] TimeBroker C:\WINDOWS\System32\TimeBrokerServer.dll 14:36:59.0053 0x1be8 TimeBroker - ok 14:36:59.0076 0x1be8 [ F4AEDABC8F3A9D632F8206D0C7F8CA09, 6E76749CD4B857B4D930267E3CF448AF4D14FAC851873C5E71572E62CAD2FA36 ] TPM C:\WINDOWS\system32\drivers\tpm.sys 14:36:59.0086 0x1be8 TPM - ok 14:36:59.0105 0x1be8 [ 2D0338A3009075FCCB119CB7F3280F82, F42F3B8DA0F8B2C99892E66CDEF471A1CD30A30CF437ADFF464A2C786A6B87A6 ] TrkWks C:\WINDOWS\System32\trkwks.dll 14:36:59.0117 0x1be8 TrkWks - ok 14:36:59.0172 0x1be8 [ 62D6A900C5DFF2ECF131384E5A5C85AB, 1AF1FB868C59DFF452E3351EE5070B2C746DE606B9E2F1834CE2256F41ABE7A9 ] TrustedInstaller C:\WINDOWS\servicing\TrustedInstaller.exe 14:36:59.0182 0x1be8 TrustedInstaller - ok 14:36:59.0188 0x1be8 [ 676C801CAA61AADD0C918CC536A74B78, DB5DEC9445272E46D32DC2A9A99A9AE45729E424E61C679ECFD973AA88457BE6 ] TsUsbFlt C:\WINDOWS\system32\drivers\TsUsbFlt.sys 14:36:59.0197 0x1be8 TsUsbFlt - ok 14:36:59.0220 0x1be8 [ 2BB6CC0DD1CEE86330743B56FA9FE91F, EE71E3DEECA7599947AB09E8967FE8066348D82B4C17D8CBE800FCDE9CF4989D ] TsUsbGD C:\WINDOWS\System32\drivers\TsUsbGD.sys 14:36:59.0228 0x1be8 TsUsbGD - ok 14:36:59.0258 0x1be8 [ 14B46248612DF1B1A695040FFFBCFAFC, 8C373A3C416FC9AB3872A187E64AC7A6E69FF605BD8784E8F2B1C28C293A0495 ] tunnel C:\WINDOWS\System32\drivers\tunnel.sys 14:36:59.0269 0x1be8 tunnel - ok 14:36:59.0288 0x1be8 [ D0BE5EA1652D55029C9A898FB8ACFCE0, 80C4BC30B967C79B3457F43EB9B530CA2571C6158958879AC55E5A81F71CFF15 ] uagp35 C:\WINDOWS\system32\drivers\uagp35.sys 14:36:59.0295 0x1be8 uagp35 - ok 14:36:59.0307 0x1be8 [ 13C15E4B238895FE4731DB1D612EEB5F, 211E4B05AA09F7FBE2487C3241A98D1F970FEE5B9B1BAED2788B57233BFC4104 ] UASPStor C:\WINDOWS\System32\drivers\uaspstor.sys 14:36:59.0315 0x1be8 UASPStor - ok 14:36:59.0327 0x1be8 [ BEBB8B55C5F99B69EEE39A9D7BADB21E, 08A094EA38AB58CC70108A3BDFDD3251897DC4B13FDDAD54C1B063137836EF34 ] UcmCx0101 C:\WINDOWS\system32\Drivers\UcmCx.sys 14:36:59.0336 0x1be8 UcmCx0101 - ok 14:36:59.0357 0x1be8 [ DE3EDAF609D00EA2E54986E6459796A6, 61A9AB51869F38300CC5CC5D302B962FB966F54CBB2E393954F36372B3A479FE ] UcmUcsi C:\WINDOWS\System32\drivers\UcmUcsi.sys 14:36:59.0367 0x1be8 UcmUcsi - ok 14:36:59.0383 0x1be8 [ FB1C1D8B96A482F3581338D6752E1D6C, 0FFAEE3E088614B3483C459513BB9D78EB76B574696FD877A3CDF6A11378F46C ] Ucx01000 C:\WINDOWS\system32\drivers\ucx01000.sys 14:36:59.0394 0x1be8 Ucx01000 - ok 14:36:59.0408 0x1be8 [ 4E1543ACE2F6E2846713E5123D9D4159, 1A6AFC525A80D1F19B14CDAD38790DF7293911C4D0E8301161D92201B934C3D4 ] UdeCx C:\WINDOWS\system32\drivers\udecx.sys 14:36:59.0417 0x1be8 UdeCx - ok 14:36:59.0431 0x1be8 [ CDCA9CC1D8293E75218D8FF85F2337A4, 173086C08DDC7625E026E425F1E2B5D6C795771BEAE9BFF6093E3592FBEBD323 ] udfs C:\WINDOWS\system32\DRIVERS\udfs.sys 14:36:59.0451 0x1be8 udfs - ok 14:36:59.0475 0x1be8 [ BC683E19307C533C7161DB7A58051347, 5553BE3421986FDD9992EBFD883CDA151F7166C01BBFA3E9183A3C93E41D79B6 ] UEFI C:\WINDOWS\System32\drivers\UEFI.sys 14:36:59.0483 0x1be8 UEFI - ok 14:36:59.0496 0x1be8 [ D14B42C26DE402F316D49667D15446F0, 61CC9FF03EF78631C800EFD8D587975CB94D53DB80E6F60BD13BA52EC5690D3D ] Ufx01000 C:\WINDOWS\system32\drivers\ufx01000.sys 14:36:59.0507 0x1be8 Ufx01000 - ok 14:36:59.0517 0x1be8 [ 192470BE4321791FBB25F379D0141D6F, AD120F8F98BD99014471CE60630B5FEE7555AB261C98B7D9819FE23C386655F7 ] UfxChipidea C:\WINDOWS\System32\drivers\UfxChipidea.sys 14:36:59.0525 0x1be8 UfxChipidea - ok 14:36:59.0536 0x1be8 [ F7BD838E84E6B286DBCE068EFB8C0800, A55188C8F8BDC739A7ED7D29CDCB2A17468BBB158E13D804963B31ED73449520 ] ufxsynopsys C:\WINDOWS\System32\drivers\ufxsynopsys.sys 14:36:59.0546 0x1be8 ufxsynopsys - ok 14:36:59.0568 0x1be8 [ C844E39B900FFA46CA8DD2BBA670A077, 0CB6232BCE47C59821DF25D6ED33E85C3E32DDAB101AA8A2C22B5401E73F5D5B ] UI0Detect C:\WINDOWS\system32\UI0Detect.exe 14:36:59.0581 0x1be8 UI0Detect - ok 14:36:59.0603 0x1be8 [ A25842AC180F0E8B02380ECB8ADA1AF5, AF22E7559C5EF8DC22A2B9E27FFFFF075B1D1B68A8307266BD9473E0FAF36BEF ] uliagpkx C:\WINDOWS\system32\drivers\uliagpkx.sys 14:36:59.0611 0x1be8 uliagpkx - ok 14:36:59.0620 0x1be8 [ 21088F43172525C7E02D335A3327F46C, B04AD471A7DFE83AB557DB4540616B7DF4A1904F8BDDCB920D449FCEE6F36FD5 ] umbus C:\WINDOWS\System32\drivers\umbus.sys 14:36:59.0630 0x1be8 umbus - ok 14:36:59.0646 0x1be8 [ 294A291B5D48FE8F38DD94B7272442C5, 66C9139636760C92C1E04FCF440C432FF6C5A94E1577CAFE1D61FCF2D30472ED ] UmPass C:\WINDOWS\System32\drivers\umpass.sys 14:36:59.0653 0x1be8 UmPass - ok 14:36:59.0674 0x1be8 [ 3427889AECC3B6912A0A01D095E32B98, 322AE14B74295ACFC124719BBEF8809201150A184E262EC55E26D2B45787BF9D ] UmRdpService C:\WINDOWS\System32\umrdp.dll 14:36:59.0690 0x1be8 UmRdpService - ok 14:36:59.0728 0x1be8 [ 0D5C9E27E93AAEA3E30A1E59A7AC3DFF, 31A203DA03877E6B887930990C5BB53402F0DFFB22A6F8FC5A34EF0B99CD8A7E ] UnistoreSvc C:\WINDOWS\System32\unistore.dll 14:36:59.0768 0x1be8 UnistoreSvc - ok 14:36:59.0788 0x1be8 [ BD693208673F40BA21AA70B69F1D439C, E324947C2DD34386A83B09E73668F1CCED127AC91194B8BF7EC4C8E36CF8203E ] upnphost C:\WINDOWS\System32\upnphost.dll 14:36:59.0810 0x1be8 upnphost - ok 14:36:59.0826 0x1be8 [ A7A52EDDC3FAF183D6AC4774690ADF13, 630A0331F2EFA2DC7EFDACD08D8DF5C85BFDA30FF1525050FF54E069AFA45F6C ] UrsChipidea C:\WINDOWS\System32\drivers\urschipidea.sys 14:36:59.0833 0x1be8 UrsChipidea - ok 14:36:59.0847 0x1be8 [ 2EEA0897DD9E30E958B508D557F0B5E4, BE051A3AA5DFF56310FAB67AD19AC0443A3580542886EF3554EBE18F1323596F ] UrsCx01000 C:\WINDOWS\system32\drivers\urscx01000.sys 14:36:59.0854 0x1be8 UrsCx01000 - ok 14:36:59.0860 0x1be8 [ DC54D775A3A61E4CDE871B4E38A1459A, CC996A9D293201BBD285E7B629B12EE88574702B8AC7BB4149439D6A25A07F7E ] UrsSynopsys C:\WINDOWS\System32\drivers\urssynopsys.sys 14:36:59.0867 0x1be8 UrsSynopsys - ok 14:36:59.0893 0x1be8 [ F957092C63CD71D85903CA0D8370F473, 4DEC2FC20329F248135DA24CB6694FD972DCCE8B1BBEA8D872FDE41939E96AAF ] USBAAPL64 C:\WINDOWS\System32\Drivers\usbaapl64.sys 14:36:59.0902 0x1be8 USBAAPL64 - ok 14:36:59.0924 0x1be8 [ 18B63A0980F4AA1E6D7879B253980E37, 05F96DBE0A3DE2A685DEEBA8B6838A47AEB7CE2EBE8EB6BAD67B36DCF7E73589 ] usbccgp C:\WINDOWS\System32\drivers\usbccgp.sys 14:36:59.0934 0x1be8 usbccgp - ok 14:36:59.0961 0x1be8 [ 1C60A1A3C8E1E819E16F12BAEB1C83F8, E255BD173DBF091C5EA07381862E23C1FD761489EC396E312974FBC124E1F33A ] usbcir C:\WINDOWS\System32\drivers\usbcir.sys 14:36:59.0972 0x1be8 usbcir - ok 14:37:00.0002 0x1be8 [ 9A3E39F85DC6E3B9F792F1095ACFF788, 66B8E137A5232E9F717907CFD49FE624AE101F4DE14E2960849DABF7A877E87A ] usbehci C:\WINDOWS\System32\drivers\usbehci.sys 14:37:00.0010 0x1be8 usbehci - ok 14:37:00.0046 0x1be8 [ 0A368247A900656CC0678117DFC3A87C, 9BEAD14DA067439D913F609955E95CFA0B88ED4F1BC60B473E00F9D9CBC01B9C ] usbhub C:\WINDOWS\System32\drivers\usbhub.sys 14:37:00.0063 0x1be8 usbhub - ok 14:37:00.0100 0x1be8 [ C08449092043601887A1743350888635, 5CD916649D2CD8823B89C9E7459AD76AA8E54D70B6D9F40AD4A41144E22ACBE0 ] USBHUB3 C:\WINDOWS\System32\drivers\UsbHub3.sys 14:37:00.0117 0x1be8 USBHUB3 - ok 14:37:00.0138 0x1be8 [ 72EA850B59F40C25A4FEDDA5FE84EFEB, FB4801AA1FB72FC1C41024916368823E88D53E338640E3BEA865B0F0E7B8EE91 ] usbohci C:\WINDOWS\System32\drivers\usbohci.sys 14:37:00.0148 0x1be8 usbohci - ok 14:37:00.0154 0x1be8 [ 47B2B2DE152E25546944049CA1170BB1, DDA0A806D3108B2475AB13F584EA8CE6F0932C5E394C2C3FA691DFAB8A2BCAC0 ] usbprint C:\WINDOWS\System32\drivers\usbprint.sys 14:37:00.0164 0x1be8 usbprint - ok 14:37:00.0189 0x1be8 [ 923CA145CD0A9DFBA4CBBA60AB684C2C, EFAA1E730802490E9A53718D70484832A38345FE0A670937FC546FD245DF2CC9 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys 14:37:00.0199 0x1be8 usbscan - ok 14:37:00.0228 0x1be8 [ 1F72E1A7E1858B7B3FF81522FCEBDE95, 4FAD243DA73C45CD5CA5E50F824F30EF0DC777D83957FD21FF43D8C89EC15AAC ] usbser C:\WINDOWS\System32\drivers\usbser.sys 14:37:00.0239 0x1be8 usbser - ok 14:37:00.0252 0x1be8 [ CD35467670DF1E6FBF36DA308F0C872B, E1F4F9B1EBD476394CBD0C934842AEE2502B030D97351B0A1E751FF23B011B57 ] USBSTOR C:\WINDOWS\System32\drivers\USBSTOR.SYS 14:37:00.0261 0x1be8 USBSTOR - ok 14:37:00.0270 0x1be8 [ DFA92EA105DD1073B43FB210EEB03DD4, D940432458F0A04F5013B48197CEA0412C8A909C50605AA21DD08271C90E2FE3 ] usbuhci C:\WINDOWS\System32\drivers\usbuhci.sys 14:37:00.0280 0x1be8 usbuhci - ok 14:37:00.0313 0x1be8 [ C67A03F54A1EA683F4880A481EE5FF6C, 346185B378577FF14EFAD01ECB7DFC9AFC0D50F16DF081C3BA99AEFF710A0EE9 ] USBXHCI C:\WINDOWS\System32\drivers\USBXHCI.SYS 14:37:00.0328 0x1be8 USBXHCI - ok 14:37:00.0361 0x1be8 [ 32212C0FE0556915E763C29DEB6D267E, C5BC9DA3AB0C41604E8F3D01AFC2C25351FF5D3967E766DD0CDB4C0239ED6312 ] UserDataSvc C:\WINDOWS\System32\userdataservice.dll 14:37:00.0407 0x1be8 UserDataSvc - ok 14:37:00.0448 0x1be8 [ D76A6C338A81C3B14AD37B22AA422B4B, 39489B44068CAA86232B513FF7A5DA56F5AAAB595D8DBC0CCDDD4ED4A1318E07 ] UserManager C:\WINDOWS\System32\usermgr.dll 14:37:00.0474 0x1be8 UserManager - ok 14:37:00.0508 0x1be8 [ 0CFEA30C0217EE74FF853B2B0CC0BE6D, 1F0856D2D94F46D7B24B7EE18ED868C9EFAE972039D35D1FAA9058A12CF40493 ] UsoSvc C:\WINDOWS\system32\usocore.dll 14:37:00.0525 0x1be8 UsoSvc - ok 14:37:00.0538 0x1be8 [ 9A83FA0EC9B0DCED2CBC49DD05901920, 14D2F241235E2693C68BCCF05D83F2A1C9A7BE185C83E7C6C63EF0F654892F95 ] VaultSvc C:\WINDOWS\system32\lsass.exe 14:37:00.0546 0x1be8 VaultSvc - ok 14:37:00.0558 0x1be8 [ 26223003DDFB347B5CF3EC0B56DB066B, 78848BE1334C05F28FA431B08225EAE8345B2C66E7D677F9936892FC941EA961 ] vdrvroot C:\WINDOWS\system32\drivers\vdrvroot.sys 14:37:00.0565 0x1be8 vdrvroot - ok 14:37:00.0601 0x1be8 [ 0C3F4E7684C1D72E85A98689E65A98A1, F7928D3EFC1A83125887ADA5F8E008022B58F0DBA8A711B4D60975D8CE82B595 ] vds C:\WINDOWS\System32\vds.exe 14:37:00.0629 0x1be8 vds - ok 14:37:00.0655 0x1be8 [ A417284BC6B5C2EEF63F2C5154473530, 55146660CDDD829630C216038E6500CFAC906E67C82881047B665BFEEB286D10 ] VerifierExt C:\WINDOWS\system32\drivers\VerifierExt.sys 14:37:00.0666 0x1be8 VerifierExt - ok 14:37:00.0684 0x1be8 [ 4C39C05A72EB14C0567501C7E087E564, D3DC122B7E4A5BD345517FE3A9E9E58CD3C78887F9F327AB782BADCAD0F8F2EB ] vhdmp C:\WINDOWS\System32\drivers\vhdmp.sys 14:37:00.0703 0x1be8 vhdmp - ok 14:37:00.0725 0x1be8 [ C42206A15078596FDE8E89BB629DE342, B95F9EC2413ADE658A7CE4A9BB57A0E125C29205C24BBB120153DACAF4CF9482 ] vhf C:\WINDOWS\System32\drivers\vhf.sys 14:37:00.0732 0x1be8 vhf - ok 14:37:00.0756 0x1be8 [ 248D9F911A5C94CF8477125DD0C3A291, 418C7285184BCC9DE4E56175960585867A5DB21FEF761C49FF6F1AF1C07D8088 ] vmbus C:\WINDOWS\system32\drivers\vmbus.sys 14:37:00.0765 0x1be8 vmbus - ok 14:37:00.0774 0x1be8 [ 3E98DD4E0CBD6B4F9CBD0E9E0EDF541E, 2B5CF364F4D1D3359FBEA8BB2E72A1FCE1277E8D893977B751D9AC10A27DF018 ] VMBusHID C:\WINDOWS\System32\drivers\VMBusHID.sys 14:37:00.0782 0x1be8 VMBusHID - ok 14:37:00.0811 0x1be8 [ 977603C51C997435D59ECFE7E24E0653, 32AB9BBFFEB73F5282848748B46584238BD1B812A1435F7759180D36B33FE806 ] vmicguestinterface C:\WINDOWS\System32\ICSvc.dll 14:37:00.0831 0x1be8 vmicguestinterface - ok 14:37:00.0840 0x1be8 [ 977603C51C997435D59ECFE7E24E0653, 32AB9BBFFEB73F5282848748B46584238BD1B812A1435F7759180D36B33FE806 ] vmicheartbeat C:\WINDOWS\System32\ICSvc.dll 14:37:00.0861 0x1be8 vmicheartbeat - ok 14:37:00.0870 0x1be8 [ 977603C51C997435D59ECFE7E24E0653, 32AB9BBFFEB73F5282848748B46584238BD1B812A1435F7759180D36B33FE806 ] vmickvpexchange C:\WINDOWS\System32\ICSvc.dll 14:37:00.0890 0x1be8 vmickvpexchange - ok 14:37:00.0899 0x1be8 [ 977603C51C997435D59ECFE7E24E0653, 32AB9BBFFEB73F5282848748B46584238BD1B812A1435F7759180D36B33FE806 ] vmicrdv C:\WINDOWS\System32\ICSvc.dll 14:37:00.0919 0x1be8 vmicrdv - ok 14:37:00.0928 0x1be8 [ 977603C51C997435D59ECFE7E24E0653, 32AB9BBFFEB73F5282848748B46584238BD1B812A1435F7759180D36B33FE806 ] vmicshutdown C:\WINDOWS\System32\ICSvc.dll 14:37:00.0948 0x1be8 vmicshutdown - ok 14:37:00.0957 0x1be8 [ 977603C51C997435D59ECFE7E24E0653, 32AB9BBFFEB73F5282848748B46584238BD1B812A1435F7759180D36B33FE806 ] vmictimesync C:\WINDOWS\System32\ICSvc.dll 14:37:00.0977 0x1be8 vmictimesync - ok 14:37:00.0986 0x1be8 [ 977603C51C997435D59ECFE7E24E0653, 32AB9BBFFEB73F5282848748B46584238BD1B812A1435F7759180D36B33FE806 ] vmicvmsession C:\WINDOWS\System32\ICSvc.dll 14:37:01.0006 0x1be8 vmicvmsession - ok 14:37:01.0015 0x1be8 [ 977603C51C997435D59ECFE7E24E0653, 32AB9BBFFEB73F5282848748B46584238BD1B812A1435F7759180D36B33FE806 ] vmicvss C:\WINDOWS\System32\ICSvc.dll 14:37:01.0035 0x1be8 vmicvss - ok 14:37:01.0047 0x1be8 [ 91F165C5D71D9DCB18D4661CF10D1084, 1D55C1FF0F5D860E6DB60EEFE303C0797C98BB0B053ECC255F9B316872288818 ] volmgr C:\WINDOWS\system32\drivers\volmgr.sys 14:37:01.0055 0x1be8 volmgr - ok 14:37:01.0064 0x1be8 [ 17042748AC05862A0283D32575220080, A85B480CB969CB7678545D2A9EE99CBD2ADFF210FA016A43E092D0711FBB633D ] volmgrx C:\WINDOWS\system32\drivers\volmgrx.sys 14:37:01.0077 0x1be8 volmgrx - ok 14:37:01.0085 0x1be8 [ 823A237D871CD652C6BFD47BECB6810A, 99310521451CB54C29A5DEA54C3A666F95E2A1FF0979D5F9792885A161E90C65 ] volsnap C:\WINDOWS\system32\drivers\volsnap.sys 14:37:01.0100 0x1be8 volsnap - ok 14:37:01.0109 0x1be8 [ 78727FA284C2095EED660D71CD3C9AEF, 323F0BD5A624DF77973F28C7CF31EC6B3A525496EBF063666623A62B1DB0EA65 ] vpci C:\WINDOWS\System32\drivers\vpci.sys 14:37:01.0116 0x1be8 vpci - ok 14:37:01.0132 0x1be8 [ 2415961D561E02F5E46B7C1C687A6788, 68A54B9595A0D15D410D5F1656B6EBE3B913A4BA5F71C658C9B99420E6ED327A ] vsmraid C:\WINDOWS\system32\drivers\vsmraid.sys 14:37:01.0141 0x1be8 vsmraid - ok 14:37:01.0177 0x1be8 [ 16419CBDB04DB9FF298169AA93413822, 743AD26F08AF5EFF5DD353E75C3D659B10C3FEC2FEDABB76387B87721B5B98F8 ] VSS C:\WINDOWS\system32\vssvc.exe 14:37:01.0221 0x1be8 VSS - ok 14:37:01.0236 0x1be8 [ 6AE9A843AE979F2DCCA5A25C07C7A5F8, 3CEC26DE2EEC97929A0FBBD87FF75F8DC387C0988B2047074C8F069ACBEF2587 ] VSTXRAID C:\WINDOWS\system32\drivers\vstxraid.sys 14:37:01.0248 0x1be8 VSTXRAID - ok 14:37:01.0268 0x1be8 [ BD232C761C59FA8D8EF626CA630E2D2E, E494EFDCE8F6343F49F33F1F03DCD5DEC9CB6F349B1AD302B4D3333B5F6BD8E5 ] vwifibus C:\WINDOWS\System32\drivers\vwifibus.sys 14:37:01.0275 0x1be8 vwifibus - ok 14:37:01.0306 0x1be8 [ 3039687AB65CEE26CF478C1F42FFCD7D, 40E140C6F94B6203767A1493DF8CAE6BA1FB67FBD0C13789444F72410D0E6FF1 ] vwififlt C:\WINDOWS\system32\drivers\vwififlt.sys 14:37:01.0317 0x1be8 vwififlt - ok 14:37:01.0355 0x1be8 [ EC9B6544C569E8D7FAB91772BD7D23F2, 06CC5F21E9A9DD35099CB3E44C3E2BF2F944CE5B71284E6A85E1B681F12BD31B ] W32Time C:\WINDOWS\system32\w32time.dll 14:37:01.0379 0x1be8 W32Time - ok 14:37:01.0402 0x1be8 [ FC40A7527D39F06D032A6553D22E4BF6, F572FCB5EB3DE16FD6222A5B6A43C81E3A1F838890667D9F0453F82FFCA772FF ] WacomPen C:\WINDOWS\System32\drivers\wacompen.sys 14:37:01.0411 0x1be8 WacomPen - ok 14:37:01.0438 0x1be8 [ 2CFE8CBE358CC4D5715E010E3B13559F, 54E9BFCE202FA123EB261C226094054950429AAFA304AA714F461B003E070BD9 ] WalletService C:\WINDOWS\system32\WalletService.dll 14:37:01.0458 0x1be8 WalletService - ok 14:37:01.0469 0x1be8 [ E9E22E116F810DAC98C5EC207F24C916, C518DC57CECA5174E7695F5632555FA08571D5F3A7D6B0C295BA4221AEA67C04 ] wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys 14:37:01.0480 0x1be8 wanarp - ok 14:37:01.0484 0x1be8 [ E9E22E116F810DAC98C5EC207F24C916, C518DC57CECA5174E7695F5632555FA08571D5F3A7D6B0C295BA4221AEA67C04 ] wanarpv6 C:\WINDOWS\system32\DRIVERS\wanarp.sys 14:37:01.0496 0x1be8 wanarpv6 - ok 14:37:01.0527 0x1be8 [ CF9EF65FA66B0F4982FD1FACAB3009B6, 681C1CD5DCAF87EF436B907534E98B0AB4F66BD62E46B8977A7880B854766A27 ] wbengine C:\WINDOWS\system32\wbengine.exe 14:37:01.0573 0x1be8 wbengine - ok 14:37:01.0603 0x1be8 [ 8F2B0ED6FCA72B34BEEA37E32D0EE106, A86C641A13FDF056B7BA13641551582199DDB08E9490003C74D999518B097C00 ] WbioSrvc C:\WINDOWS\System32\wbiosrvc.dll 14:37:01.0627 0x1be8 WbioSrvc - ok 14:37:01.0660 0x1be8 [ A40484AC27EE08DBE7F8DA5E1F6651ED, E3259694450C4F1DEC5E0EA5E23BF3A51F1819374DF47FECF70282AFD46114A1 ] Wcmsvc C:\WINDOWS\System32\wcmsvc.dll 14:37:01.0685 0x1be8 Wcmsvc - ok 14:37:01.0705 0x1be8 [ 8E7FD07D2C82ACBCA52C4100C20F6542, FB2CD88557ABB5EBE6555CD4E41BF4BDC6FE6BCF26288338F2FB034B966FCBD3 ] wcncsvc C:\WINDOWS\System32\wcncsvc.dll 14:37:01.0725 0x1be8 wcncsvc - ok 14:37:01.0734 0x1be8 [ 9C776ED423CD03F8ABD54C2557E34416, 282C1208977070EC0280D5ABA0E03A847AEAEE31F35CDAA3C7A02D8477614EB1 ] WcsPlugInService C:\WINDOWS\System32\WcsPlugInService.dll 14:37:01.0743 0x1be8 WcsPlugInService - ok 14:37:01.0829 0x1be8 [ C8BA574B3BA6AE88741AC86B1FE3C1DC, B2422CDE3A6A27B52D270D24298FF69D91D389C68456EC1805BA30AA59BAB839 ] WdBoot C:\WINDOWS\system32\drivers\WdBoot.sys 14:37:01.0836 0x1be8 WdBoot - ok 14:37:01.0860 0x1be8 [ 927AD29D7F91B9A0C5294932374DA15E, ABB2722EF4153771D15683B5CE603D2B7D8A585357F64A3DC26114F37BE2906E ] Wdf01000 C:\WINDOWS\system32\drivers\Wdf01000.sys 14:37:01.0880 0x1be8 Wdf01000 - ok 14:37:01.0894 0x1be8 [ C5BB7C612B4C852836BEA39593BA5F46, 1E2B123F34500C2A8E983AAAF7F14E409B88DC396A655F19F3E7F15D0C51A762 ] WdFilter C:\WINDOWS\system32\drivers\WdFilter.sys 14:37:01.0905 0x1be8 WdFilter - ok 14:37:01.0917 0x1be8 [ 9E0442D3880438D006D95C6F63C27274, DB1ED2BCF9986495EFA8A0B3B0156119F2E4F77AE9BDC6377ADF3A6B53C658F6 ] WdiServiceHost C:\WINDOWS\system32\wdi.dll 14:37:01.0931 0x1be8 WdiServiceHost - ok 14:37:01.0935 0x1be8 [ 9E0442D3880438D006D95C6F63C27274, DB1ED2BCF9986495EFA8A0B3B0156119F2E4F77AE9BDC6377ADF3A6B53C658F6 ] WdiSystemHost C:\WINDOWS\system32\wdi.dll 14:37:01.0949 0x1be8 WdiSystemHost - ok 14:37:01.0967 0x1be8 [ 9B2039C5673EEBF1D4E34ABC0AFB88C7, BBC85546BD86B9027426DAF148194CFE992B80FF89311B28BE0BD82C88630E8C ] wdiwifi C:\WINDOWS\system32\DRIVERS\wdiwifi.sys 14:37:01.0992 0x1be8 wdiwifi - ok 14:37:02.0004 0x1be8 [ BD193A7BD34B2E829FAF56306FEE3B09, ADD746D198E21242CEFA01840952B792074EFC473113CD3E7F1ABBA6A4E26AF6 ] WdNisDrv C:\WINDOWS\system32\Drivers\WdNisDrv.sys 14:37:02.0013 0x1be8 WdNisDrv - ok 14:37:02.0030 0x1be8 WdNisSvc - ok 14:37:02.0118 0x1be8 [ 6A3B5013D5C7840E8CABD63DD021C112, 371CCEEAC7816CFE79ACA8A218CDA16469D9567CB63CC9D18C55FF047011EF25 ] WebClient C:\WINDOWS\System32\webclnt.dll 14:37:02.0136 0x1be8 WebClient - ok 14:37:02.0150 0x1be8 [ EED4043BC3C2D00067411730EE118354, 5E268DA4DB78C06D8F181E9408B4769F8A12C38DA52C1E986EE0CEE1101E9485 ] Wecsvc C:\WINDOWS\system32\wecsvc.dll 14:37:02.0166 0x1be8 Wecsvc - ok 14:37:02.0171 0x1be8 [ 6ECD7A49AFC6533821BEEA1876CEB21D, 2E972245F56F589EF1AB9DABB9214B9DE6E290878735476323A3357D8CDFC71F ] WEPHOSTSVC C:\WINDOWS\system32\wephostsvc.dll 14:37:02.0183 0x1be8 WEPHOSTSVC - ok 14:37:02.0193 0x1be8 [ 09B434867028AF4895A87959EA668686, 26A7DB82E42DCBF3A77092D58AC6392754FD7C538B9EAAEFA88E9AF81DFE8E96 ] wercplsupport C:\WINDOWS\System32\wercplsupport.dll 14:37:02.0226 0x1be8 wercplsupport - ok 14:37:02.0246 0x1be8 [ DE4E417B867841EE55114E588098B8D5, 878708C93FC1D919E2B9E1C5F94A0EAFC5F28BDAA58D3F29DEEDC8EC3F72D9ED ] WerSvc C:\WINDOWS\System32\WerSvc.dll 14:37:02.0261 0x1be8 WerSvc - ok 14:37:02.0263 0x1be8 wfpcapture - ok 14:37:02.0269 0x1be8 [ DBF5255B759212E5217A2748567A0B5C, 5E81A9289EC39702179038B686A35FADF9974651E74222F3354B4CBE919887B0 ] WFPLWFS C:\WINDOWS\system32\drivers\wfplwfs.sys 14:37:02.0278 0x1be8 WFPLWFS - ok 14:37:02.0290 0x1be8 [ 4CD8826BB8320741842A9E53E48AF2BC, 97B22D9DCD0FD31D3A801946173369B0E70B1850576682C8A8180874A61CAD1A ] WiaRpc C:\WINDOWS\System32\wiarpc.dll 14:37:02.0300 0x1be8 WiaRpc - ok 14:37:02.0320 0x1be8 [ 4375BCBA419D19695CF566082CEF27D3, 6F86FA14B41A03F2BA51B8702F3D59B85FD488405601FA177495E4B7C576850D ] WIMMount C:\WINDOWS\system32\drivers\wimmount.sys 14:37:02.0327 0x1be8 WIMMount - ok 14:37:02.0329 0x1be8 WinDefend - ok 14:37:02.0336 0x1be8 [ 037BC6DE5F58D4A74A5BB0C12DCECDCA, 92921A2615A41C434BADEB33594DABC166FC9418FBD311A3B2022410B14BFDAC ] WindowsTrustedRT C:\WINDOWS\system32\drivers\WindowsTrustedRT.sys 14:37:02.0345 0x1be8 WindowsTrustedRT - ok 14:37:02.0358 0x1be8 [ 70BCD70BD53F2FE660ED94B025A043EB, B23B96DCAB30C62CB1651B3A2292155AEE8217CE3120574F5158D5E7DA09DE56 ] WindowsTrustedRTProxy C:\WINDOWS\system32\drivers\WindowsTrustedRTProxy.sys 14:37:02.0365 0x1be8 WindowsTrustedRTProxy - ok 14:37:02.0404 0x1be8 [ 8921ECEC2C7D1B1333D77325C60D3AEA, 67C6B6A92B34D99165B5591D0730322C31E967E599BA44924249BF5AD505C132 ] WinHttpAutoProxySvc C:\WINDOWS\system32\winhttp.dll 14:37:02.0434 0x1be8 WinHttpAutoProxySvc - ok 14:37:02.0457 0x1be8 [ 7792AE5403BF8975B6460DFC3428D129, D88F77E973D58C2CA629CC9249877A34ABF31CA1DC2A570666921A8A0DC8DEC7 ] WinMad C:\WINDOWS\System32\drivers\winmad.sys 14:37:02.0464 0x1be8 WinMad - ok 14:37:02.0514 0x1be8 [ 73B5230F03DC7002A70F11EA1B0BAA37, DFE8BBE52B58589686E402ACED51021E298A491F907EBA5689DF9DAFC3002BA5 ] Winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll 14:37:02.0527 0x1be8 Winmgmt - ok 14:37:02.0599 0x1be8 [ 2FE85D6AFF90F56A78743CC93B9CA684, B515765C4EE64E7EC16BD6AF037C084CCA6E81180AEF59E18F260406ABE6DF58 ] WinRM C:\WINDOWS\system32\WsmSvc.dll 14:37:02.0672 0x1be8 WinRM - ok 14:37:02.0688 0x1be8 [ 811F30EB6EE8318C4171CB95AE30B9BD, 765F6BEA3D35D523B5D7ED7356EC0C97A48066A5C4D77C1E6EDAC6F220153385 ] WINUSB C:\WINDOWS\System32\drivers\WinUSB.SYS 14:37:02.0698 0x1be8 WINUSB - ok 14:37:02.0712 0x1be8 [ DF00381AB8665D48DE3FF794BC6760AB, 749AC7048601061A34BFF507B574AF028FC662C0A98692E7331E667D105EC09D ] WinVerbs C:\WINDOWS\System32\drivers\winverbs.sys 14:37:02.0720 0x1be8 WinVerbs - ok 14:37:02.0767 0x1be8 [ 3C096082A9232B7CEE4653B9C9031769, CFD4C7D0874097ED70735FD99206F21C12749B7956C4B5D4287F160EC6A21DCC ] WlanSvc C:\WINDOWS\System32\wlansvc.dll 14:37:02.0830 0x1be8 WlanSvc - ok 14:37:02.0885 0x1be8 [ 0968D575D9108497A6DC37749D4A6C4F, 8BFEDBE642DA0FD8AC1E60180C192527F3D36E43089090A7BB6D8B27AB6E4F7F ] wlidsvc C:\WINDOWS\system32\wlidsvc.dll 14:37:02.0946 0x1be8 wlidsvc - ok 14:37:02.0965 0x1be8 [ 623ED8E10DFEEAB7AE2CD11A0451DB79, 7DDE15F22FD24556D4765F6CFD0F8E2F27370A89A962919646DE2613B33D43D6 ] WmiAcpi C:\WINDOWS\System32\drivers\wmiacpi.sys 14:37:02.0973 0x1be8 WmiAcpi - ok 14:37:03.0006 0x1be8 [ B2BB87531C4127ED4120E9BF5566827F, 1DDC0F00F215D77D3698F81B56D4488F384E9D017267840EDFA4846742B99B6A ] wmiApSrv C:\WINDOWS\system32\wbem\WmiApSrv.exe 14:37:03.0019 0x1be8 wmiApSrv - ok 14:37:03.0039 0x1be8 WMPNetworkSvc - ok 14:37:03.0068 0x1be8 [ 78CA1FF6FE37EEFAFF99DD1C956AF60A, 883C7890C83BAB3B846A0C969D7B67031BD2EF65FA58A0620DD0CD1655C5B2C5 ] Wof C:\WINDOWS\system32\drivers\Wof.sys 14:37:03.0079 0x1be8 Wof - ok 14:37:03.0140 0x1be8 [ C7503A49364DB2AF7A7DE177B233081F, 85DC6D8B5631E51FCF395A884F58571A96C8C55C38CA9ABEBD9C75BABAD21E38 ] workfolderssvc C:\WINDOWS\system32\workfolderssvc.dll 14:37:03.0193 0x1be8 workfolderssvc - ok 14:37:03.0215 0x1be8 [ 388F2A3C771B8BEE76FD1AAF9614D08E, C064EC6136CC20C4EE19C86E91CA071974933BB52C9EF8521DF4AFD060FED4A2 ] wpcfltr C:\WINDOWS\system32\DRIVERS\wpcfltr.sys 14:37:03.0223 0x1be8 wpcfltr - ok 14:37:03.0246 0x1be8 [ A6FCFE1F691B4A4D266F5D487FADB9FE, 2135D0C13C1295A2F76885E380CD72CB71CEB8E0D9F1C183A35935B27737D423 ] WPDBusEnum C:\WINDOWS\system32\wpdbusenum.dll 14:37:03.0256 0x1be8 WPDBusEnum - ok 14:37:03.0276 0x1be8 [ 37DCE976B3935380F2F6E39ABB6BF40D, B14E875F6D6503DF0DB6D9D2363316073AEEF394D830EA2270A0DCDA56E1CEC4 ] WpdUpFltr C:\WINDOWS\system32\drivers\WpdUpFltr.sys 14:37:03.0283 0x1be8 WpdUpFltr - ok 14:37:03.0295 0x1be8 [ 80F0154FD4293E562D54E97811E03499, EDE920F7F95EFBE542FE3CE066B6F7CDE3B9A37DDF3411DC86EACE9EEF294C1D ] WpnService C:\WINDOWS\system32\WpnService.dll 14:37:03.0304 0x1be8 WpnService - ok 14:37:03.0333 0x1be8 [ 3CD22DD5A790CF7C24D65455E565EA83, 49DB06DF6F38940E7F8691C16586A78BB20E702FD48A34E50987C06B08BDF4DB ] ws2ifsl C:\WINDOWS\system32\drivers\ws2ifsl.sys 14:37:03.0343 0x1be8 ws2ifsl - ok 14:37:03.0356 0x1be8 [ EBA916109A176714E6A7BD152387F13C, 7B38B1708B83271ADA8D1CEC7F5F0A75C7F2572185C0961EFC749D5DF16A03F0 ] wscsvc C:\WINDOWS\System32\wscsvc.dll 14:37:03.0371 0x1be8 wscsvc - ok 14:37:03.0374 0x1be8 WSearch - ok 14:37:03.0448 0x1be8 [ 9EB85802AB625970E05879D15DE56335, B7DCE5E1924A5CEE76CC07FF3B8CEDBBD0DDBB4C4ED0A3BFB8D1ABCAD7C0AA23 ] WSService C:\WINDOWS\System32\WSService.dll 14:37:03.0523 0x1be8 WSService - ok 14:37:03.0575 0x1be8 [ B70FF53144AC4B3C7D98BFB7D7C239BD, 996F6253F24C6D734B777988CDE03CD3A32FFBAD6D7A198F1C590B762CD8DC0E ] wuauserv C:\WINDOWS\system32\wuaueng.dll 14:37:03.0643 0x1be8 wuauserv - ok 14:37:03.0652 0x1be8 [ 835F60262E7E310080EA05F6752BF248, 3010B731DF3D52B56EA16FD29B66F5D3AB9412E49CA4C547BAAECA3225C5DC40 ] WudfPf C:\WINDOWS\system32\drivers\WudfPf.sys 14:37:03.0664 0x1be8 WudfPf - ok 14:37:03.0690 0x1be8 [ 4E848DE29E4279C7F25EF5B34ED94FDD, FD7B0673F4CFA6EB66D7212288223419BFFA02EBF1F1D85F155B5397C6FB21E9 ] WUDFRd C:\WINDOWS\System32\drivers\WUDFRd.sys 14:37:03.0704 0x1be8 WUDFRd - ok 14:37:03.0721 0x1be8 [ 44CF3130AEC8914705487C4AEF756A19, 30B09E32DEC02141F9B99ED012E441056C1663A72E4130EF4221ECC0ED87BF4B ] wudfsvc C:\WINDOWS\System32\WUDFSvc.dll 14:37:03.0733 0x1be8 wudfsvc - ok 14:37:03.0739 0x1be8 [ 4E848DE29E4279C7F25EF5B34ED94FDD, FD7B0673F4CFA6EB66D7212288223419BFFA02EBF1F1D85F155B5397C6FB21E9 ] WUDFWpdFs C:\WINDOWS\system32\DRIVERS\WUDFRd.sys 14:37:03.0753 0x1be8 WUDFWpdFs - ok 14:37:03.0760 0x1be8 [ 4E848DE29E4279C7F25EF5B34ED94FDD, FD7B0673F4CFA6EB66D7212288223419BFFA02EBF1F1D85F155B5397C6FB21E9 ] WUDFWpdMtp C:\WINDOWS\system32\DRIVERS\WUDFRd.sys 14:37:03.0773 0x1be8 WUDFWpdMtp - ok 14:37:03.0807 0x1be8 [ D23F211E1AA0787EFEC373D172D4A1C2, 6CCAB272D121C9946B2CF6B19F50E09946F0187713D54BFBD371B5C017367204 ] WwanSvc C:\WINDOWS\System32\wwansvc.dll 14:37:03.0846 0x1be8 WwanSvc - ok 14:37:03.0873 0x1be8 [ 9BDC2AFCEF4CF1C630D728DE1DBD495A, 5CE19974380CCEC46C181315B349E9A7CE757E19118EC5978A2293D63268BA66 ] XblAuthManager C:\WINDOWS\System32\XblAuthManager.dll 14:37:03.0906 0x1be8 XblAuthManager - ok 14:37:03.0935 0x1be8 [ 3EDB6162310EA223890C2DF44C68358B, 12053291809CA9C38A30EA4B2DE7115F535531F0925220C63B0312979F9CC707 ] XblGameSave C:\WINDOWS\System32\XblGameSave.dll 14:37:03.0971 0x1be8 XblGameSave - ok 14:37:03.0985 0x1be8 [ 30021D1E0407B71E8D5D4F8DAE4E656A, EE2E366A1CC033C068176C7E9F876FFA0EF86A15A482B6964E170DE863CFF542 ] xboxgip C:\WINDOWS\System32\drivers\xboxgip.sys 14:37:03.0997 0x1be8 xboxgip - ok 14:37:04.0035 0x1be8 [ 729B70C81F207541BC6A4ABAE3A8D594, 31F9BC41169D28B397C0D988C367C32FA9A95289E68AB8F38061DA478752A765 ] XboxNetApiSvc C:\WINDOWS\system32\XboxNetApiSvc.dll 14:37:04.0068 0x1be8 XboxNetApiSvc - ok 14:37:04.0087 0x1be8 [ 6851673B90D8CB332439E0339F81A6B6, 4E95F1A63E6DD58BB5BD6FC1D9784837D5E6F5BCF870C7ECC92DCA1AF20B6A4C ] xinputhid C:\WINDOWS\System32\drivers\xinputhid.sys 14:37:04.0095 0x1be8 xinputhid - ok 14:37:04.0099 0x1be8 ================ Scan global =============================== 14:37:04.0137 0x1be8 [ C6BC6E49A7F76AA2BBA58CD08196755F, D02B6B285899E966D19323566A4780D51303D00E66674D7FF4B61991430A69A6 ] C:\WINDOWS\system32\basesrv.dll 14:37:04.0160 0x1be8 [ 70EC9717DC3A1CDF79C703A145E0E5B7, D5ABF42063DFF799FD4099D8A347256CC79B89582B987B3DEE240AFA5BA421BE ] C:\WINDOWS\system32\winsrv.dll 14:37:04.0194 0x1be8 [ F435AFA375ACBAEE44324DD464EDCC11, 815DE470439AE5D96348BEBF971A14FBDCA1D36F31CA0D25F69E5F41817D43D5 ] C:\WINDOWS\system32\sxssrv.dll 14:37:04.0215 0x1be8 [ BB3D8E1C108F7244613FF3993291A922, 1642AF23F200D46F54239C3BA743F1D5ADDC6A32D5F6481264D0C1D7F3E9D533 ] C:\WINDOWS\system32\services.exe 14:37:04.0222 0x1be8 [ Global ] - ok 14:37:04.0222 0x1be8 ================ Scan MBR ================================== 14:37:04.0227 0x1be8 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0 14:37:04.0422 0x1be8 \Device\Harddisk0\DR0 - ok 14:37:04.0423 0x1be8 ================ Scan VBR ================================== 14:37:04.0424 0x1be8 [ 31194A5BC033113C8F2ADADC0B531DB0 ] \Device\Harddisk0\DR0\Partition1 14:37:04.0477 0x1be8 \Device\Harddisk0\DR0\Partition1 - ok 14:37:04.0479 0x1be8 [ 59D6649D13DE29A400A47EC9082AEEF3 ] \Device\Harddisk0\DR0\Partition2 14:37:04.0507 0x1be8 \Device\Harddisk0\DR0\Partition2 - ok 14:37:04.0509 0x1be8 [ 8C1F92150F3D5923FB61ED24811E5CE9 ] \Device\Harddisk0\DR0\Partition3 14:37:04.0559 0x1be8 \Device\Harddisk0\DR0\Partition3 - ok 14:37:04.0559 0x1be8 ================ Scan generic autorun ====================== 14:37:04.0828 0x1be8 [ 324B8DDDF70D28B7A767E0608256DF36, 2FA4AA3F5E6D9C16A50F986027708AF657ADE9AE2A286E4F7686A1DF510FC2C1 ] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe 14:37:05.0110 0x1be8 RtHDVCpl - ok 14:37:05.0168 0x1be8 [ 4A0477ADCD07EC9D21257A2E456B16C5, CEF9C81730C12283A7600C3D921D89A62B14D1C46544B493F3AF7520DD2D1F79 ] C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe 14:37:05.0179 0x1be8 IAStorIcon - detected UnsignedFile.Multi.Generic ( 1 ) 14:37:07.0511 0x1be8 Detect skipped due to KSN trusted 14:37:07.0511 0x1be8 IAStorIcon - ok 14:37:07.0592 0x1be8 [ 9DFE8B0B6C982C31144CED1795304A60, DFE0253CD9DEE63D94F7538833048F48BFBDAC39B18A17F1CAE7413B94A8DE4D ] C:\Program Files\ASRock\XFast LAN\cFosSpeed.exe 14:37:07.0628 0x1be8 XFast LAN - ok 14:37:07.0664 0x1be8 [ 21D9910EF7EA9C58C8E31EE2C29D5F49, 7F68C168AA029B61810297F21D340B6756F4140642DAD0E3F2CA22AF525312EB ] C:\Program Files\iTunes\iTunesHelper.exe 14:37:07.0671 0x1be8 iTunesHelper - ok 14:37:07.0803 0x1be8 [ 4B6FB7DE94D91974950976108D2B837E, 8F6FD897DA2DE048020679AE1309922EC41DDA87FB57FB195292A2B8A73665A4 ] C:\Program Files (x86)\XFastUSB\XFastUsb.exe 14:37:07.0904 0x1be8 XFastUSB - ok 14:37:08.0101 0x1be8 [ EA4F9B19B3614349C79CC97DCA4C23A8, EC330F2E4F002FE450CDC1FC84AC0122C21C7912A483A99143450822004795E3 ] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe 14:37:08.0119 0x1be8 StartCCC - ok 14:37:08.0157 0x1be8 [ 36A6B9DF1A19D2007DC22A77C66E3764, DEA5AEC4DFD7AFD2F3BB455933A7AF97AA6027284940DF063793F989FDC31325 ] C:\Program Files (x86)\ROCCAT\Kone Pure Mouse\KonePureMonitor.EXE 14:37:08.0194 0x1be8 RoccatKonePure - detected UnsignedFile.Multi.Generic ( 1 ) 14:37:10.0521 0x1be8 RoccatKonePure ( UnsignedFile.Multi.Generic ) - warning 14:37:12.0677 0x03d0 Object required for P2P: [ 7EBD20284AC9BF9F0A020B86769BB074 ] Tcpip 14:37:13.0041 0x1be8 [ 88F8A731DEA7F49D92F84A0A77C5CC67, 030458922DA43AAF6C95EC430860A73032616851E03E58170F71E918720717CB ] C:\Windows\SysWOW64\OneDriveSetup.exe 14:37:13.0216 0x1be8 OneDriveSetup - ok 14:37:13.0357 0x1be8 [ 88F8A731DEA7F49D92F84A0A77C5CC67, 030458922DA43AAF6C95EC430860A73032616851E03E58170F71E918720717CB ] C:\Windows\SysWOW64\OneDriveSetup.exe 14:37:13.0483 0x1be8 OneDriveSetup - ok 14:37:13.0625 0x1be8 [ 0BE64FAB577BFA54443C680343AEC85F, E734355E9D195A60C41CA17073F5F5E2FFED0314A00DE78F1208C15ACFE611CA ] C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 14:37:13.0656 0x1be8 GoogleChromeAutoLaunch_A5B343D047FD8BD2F268B0EA0F8DBD7C - ok 14:37:13.0807 0x1be8 [ D6E2ED7F1F7BE7CCB8676491BF950B57, CBF07EE746F2C27ACC532E83ADC43FBE954DC3C598C4333F13B1A7615AEA9AD5 ] C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe 14:37:13.0919 0x1be8 Akamai NetSession Interface - ok 14:37:14.0009 0x1be8 [ C3E6128725B7C509EB6742A6F2310576, C8348D91AF275185FE90BAB2315AC05B4009E36ECF321E5CECF34D1C3F8AC8B6 ] C:\Users\Admin\AppData\Roaming\Spotify\SpotifyWebHelper.exe 14:37:14.0050 0x1be8 Spotify Web Helper - ok 14:37:14.0108 0x1be8 [ 9F2ECA252720B25E8FEC1CAB2984B98D, 476EE2929901CD43F15869B763376393AA0942A3B934532055E037C6DCE3CD2D ] C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe 14:37:14.0124 0x1be8 OneDrive - ok 14:37:14.0274 0x1be8 [ 62A076C5767090FA3D5128735ADF2995, 2B68994E6BBCBE2EE90867E7C503433DF0C1D59C04DAD368122CC9FE9D7C30B1 ] C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe 14:37:14.0427 0x1be8 Spotify - ok 14:37:14.0813 0x1be8 [ B05E1CE24CC555E189FCEB1AD07DFCED, 074E7F84C64B6BB54EE3F1BA4EF1804FA33A21ADB1E80904BF56706AA5EB457D ] C:\Program Files\CCleaner\CCleaner64.exe 14:37:14.0984 0x1be8 CCleaner Monitoring - ok 14:37:14.0989 0x1be8 Waiting for KSN requests completion. In queue: 147 14:37:15.0111 0x03d0 Object send P2P result: true 14:37:15.0112 0x03d0 Object required for P2P: [ 7EBD20284AC9BF9F0A020B86769BB074 ] Tcpip6 14:37:15.0991 0x1be8 Waiting for KSN requests completion. In queue: 146 14:37:16.0991 0x1be8 Waiting for KSN requests completion. In queue: 146 14:37:17.0514 0x03d0 Object send P2P result: true 14:37:17.0521 0x03d0 Object required for P2P: [ 0968D575D9108497A6DC37749D4A6C4F ] wlidsvc 14:37:17.0991 0x1be8 Waiting for KSN requests completion. In queue: 29 14:37:18.0992 0x1be8 Waiting for KSN requests completion. In queue: 29 14:37:19.0931 0x03d0 Object send P2P result: true 14:37:20.0004 0x1be8 AV detected via SS2: Windows Defender, C:\Program Files\Windows Defender\MSASCui.exe ( 4.8.10240.16384 ), 0x61100 ( enabled : updated ) 14:37:20.0006 0x1be8 Win FW state via NFP2: enabled ( trusted ) 14:37:22.0341 0x1be8 ============================================================ 14:37:22.0341 0x1be8 Scan finished 14:37:22.0341 0x1be8 ============================================================ 14:37:22.0347 0x0bfc Detected object count: 2 14:37:22.0347 0x0bfc Actual detected object count: 2 14:38:07.0205 0x0bfc Service KMSELDI ( UnsignedFile.Multi.Generic ) - skipped by user 14:38:07.0206 0x0bfc Service KMSELDI ( UnsignedFile.Multi.Generic ) - User select action: Skip 14:38:07.0206 0x0bfc RoccatKonePure ( UnsignedFile.Multi.Generic ) - skipped by user 14:38:07.0206 0x0bfc RoccatKonePure ( UnsignedFile.Multi.Generic ) - User select action: Skip Mit freundlichen Grüßen, Martin |
06.11.2015, 11:36 | #6 |
/// TB-Ausbilder | Easycalender lässt sich nicht entfernen Servus, wir beginnen erst einmal so: Schritt 1 Downloade Dir bitte AdwCleaner auf deinen Desktop.
Schritt 2 Downloade Dir bitte Malwarebytes Anti-Malware
Schritt 3 Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Schritt 4
Bitte poste mit deiner nächsten Antwort
|
06.11.2015, 12:55 | #7 |
| Easycalender lässt sich nicht entfernen Hallo! Anbei erstmal die Logdatei vom AdwCleaner: Code:
ATTFilter # AdwCleaner v5.018 - Bericht erstellt am 06/11/2015 um 12:07:38 # Aktualisiert am 05/11/2015 von Xplode # Datenbank : 2015-11-03.2 [Server] # Betriebssystem : Windows 10 Pro (x64) # Benutzername : Admin - PC # Gestartet von : C:\Users\Admin\Downloads\AdwCleaner_5.018.exe # Option : Löschen # Unterstützung : hxxp://toolslib.net/forum ***** [ Dienste ] ***** ***** [ Ordner ] ***** [-] Ordner Gelöscht : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcgcoifbkbphhjnekfkmohklfaimhikk ***** [ Dateien ] ***** [-] Datei Gelöscht : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_jcgcoifbkbphhjnekfkmohklfaimhikk_0.localstorage [-] Datei Gelöscht : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_jcgcoifbkbphhjnekfkmohklfaimhikk_0.localstorage-journal [-] Datei Gelöscht : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.pricepeep00.pricepeep.net_0.localstorage [-] Datei Gelöscht : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.pricepeep00.pricepeep.net_0.localstorage-journal [-] Datei Gelöscht : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_pstatic.bestpriceninja.com_0.localstorage [-] Datei Gelöscht : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_pstatic.bestpriceninja.com_0.localstorage-journal ***** [ DLLs ] ***** ***** [ Verknüpfungen ] ***** ***** [ Aufgabenplanung ] ***** ***** [ Registrierungsdatenbank ] ***** ***** [ Internetbrowser ] ***** [-] [C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Gelöscht : jcgcoifbkbphhjnekfkmohklfaimhikk ************************* :: "Tracing" Schlüssel gelöscht :: Proxy Einstellungen zurückgesetzt :: Winsock Einstellungen zurückgesetzt :: Chrome Richtlinien gelöscht ########## EOF - C:\AdwCleaner\AdwCleaner[C3].txt - [1994 Bytes] ########## Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 06.11.2015 Suchlaufzeit: 12:12 Protokolldatei: mbam.txt Administrator: Ja Version: 2.2.0.1024 Malware-Datenbank: v2015.11.06.03 Rootkit-Datenbank: v2015.11.04.02 Lizenz: Testversion Malware-Schutz: Aktiviert Schutz vor bösartigen Websites: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 10 CPU: x64 Dateisystem: NTFS Benutzer: Admin Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 368790 Abgelaufene Zeit: 14 Min., 32 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 11 PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\temp_813a5cd0-04f6-4ddb-a269-e350a08d2cae-10_user, Löschen bei Neustart, [814acfabe8a342f461e7293add26f60a], PUP.Optional.FasterSearch, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\uhy3013, Löschen bei Neustart, [e3e83e3c0b80989edb1308c63fc49c64], PUP.Optional.MyBrowser, HKLM\SOFTWARE\WOW6432NODE\MyBrowser, In Quarantäne, [5d6e7efc711acb6b4fa3d8c3ca3908f8], PUP.Optional.SwiftSearch, HKLM\SOFTWARE\WOW6432NODE\SwiftSearch_1.10.0.25, In Quarantäne, [dcef86f4a4e7f1459750f19c1de64cb4], PUP.Optional.CinemaPlus, HKU\S-1-5-18\SOFTWARE\CinemaPlus_1.3dV04.11-nv, In Quarantäne, [b21957230c7f3ef84c3c352753b04fb1], PUP.Optional.CinemaPlus, HKU\S-1-5-18\SOFTWARE\CinemaPlus_1.3dV04.11-nv-ie, In Quarantäne, [ccffabcf7516c076078177e524df4cb4], PUP.Optional.CinePlus, HKU\S-1-5-18\SOFTWARE\CinePlus-1.44V04.11-nv, In Quarantäne, [f7d4a3d777149b9b5e8f015b27dcc040], PUP.Optional.CinePlus, HKU\S-1-5-18\SOFTWARE\CinePlus-1.44V04.11-nv-ie, In Quarantäne, [18b3a1d9f99242f46489510b3ec5847c], PUP.Optional.CinemaPlus, HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\CinemaPlus_1.3dV04.11-nv-ie, In Quarantäne, [a9224238098292a41375500ccb38a957], PUP.Optional.CinePlus, HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\CinePlus-1.44V04.11-nv-ie, In Quarantäne, [745793e7bfcc1e18e30a134904ff33cd], PUP.Optional.MyBrowser, HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\MyBrowser, In Quarantäne, [3992dd9dbdce56e0c98ea4f8b2519070], Registrierungswerte: 0 (keine bösartigen Elemente erkannt) Registrierungsdaten: 0 (keine bösartigen Elemente erkannt) Ordner: 3 PUP.Optional.GlobalUpdate, C:\Users\Admin\AppData\Local\Temp\comh.360610, In Quarantäne, [d6f59ae04b40290d72edadb4aa5806fa], PUP.Optional.GlobalUpdate, C:\Users\Admin\AppData\Local\Temp\comh.442473, In Quarantäne, [913a4e2c7813c76f17481b46748e2fd1], PUP.Optional.MBot, C:\Program Files (x86)\mbot_de_014010136, In Quarantäne, [a9229ae0a4e773c315aee77ea75be719], Dateien: 50 PUP.Optional.CrossRider, C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe, In Quarantäne, [8e3dd2a8533857df7856e145ee1323dd], PUP.Optional.CrossRider, C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe, In Quarantäne, [ac1ff7839fec0b2bb8165fc7ee1304fc], PUP.Optional.CrossBrowse, C:\Users\Admin\AppData\Local\Temp\225.exe, In Quarantäne, [5f6cec8e95f6ee48d7f578aeaf52d52b], PUP.Optional.MyBrowser, C:\Users\Admin\AppData\Local\Temp\4156.exe, In Quarantäne, [52792852c6c500363b2b174ce81cc53b], PUP.Optional.BonDon, C:\Users\Admin\AppData\Local\Temp\mytmpinstaller.exe, In Quarantäne, [1ead03778605c670ae6994b2b24f5aa6], PUP.Optional.ConvertAd, C:\Users\Admin\AppData\Local\Temp\nsa22EC.tmp, In Quarantäne, [98334436b2d946f02c070ee51ce54eb2], PUP.Optional.NoteUp, C:\Users\Admin\AppData\Local\Temp\nsl8B9B.tmp, In Quarantäne, [7a511466602b71c5a562b1a11ee3e917], PUP.Optional.CrossRider, C:\Users\Admin\AppData\Local\Temp\9768.exe, In Quarantäne, [0cbf95e57318c670b5d36dfb40c48878], PUP.Optional.Amonetize, C:\Users\Admin\AppData\Local\Temp\HarryPotterAndTheOrderOfThePhoenixGame__11652_il54233.exe, In Quarantäne, [b5166d0d33587eb8d3cce88ede23619f], PUP.Optional.MyStartSearch.ShrtCln, C:\Users\Admin\AppData\Local\Temp\f9626892-7a78-3199-abd2-97bbce96297b\adv_76.exe, In Quarantäne, [75560d6d63280b2b82fcee7342c2d52b], PUP.Optional.SwiftSearch, C:\Users\Admin\AppData\Local\Temp\is-1QRA7.tmp\465.exe, In Quarantäne, [04c7a4d65c2fcf67d19da6c36f9501ff], PUP.Optional.Amonetize, C:\Users\Admin\AppData\Local\Temp\Rar$EXa0.430\HarryPotterAndTheOrderOfThePhoenixGame__11652_il54233.exe, In Quarantäne, [62698eec5239b086326d5a1c7190cc34], PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.360610\globalupdate.exe, In Quarantäne, [517a710929620b2ba7263bb41de34db3], PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.360610\globalupdateBroker.exe, In Quarantäne, [99327cfe4843c17537966a8524dc748c], PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.360610\globalupdateCrashHandler.exe, In Quarantäne, [7f4c403a147739fdffce88678878af51], PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.360610\globalupdateOnDemand.exe, In Quarantäne, [e8e34a30f99256e0f8d578773ac67987], PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.360610\goopdate.dll, In Quarantäne, [d3f898e2e9a2dc5afdd0b73826dadc24], PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.360610\goopdateres_en.dll, In Quarantäne, [85467dfd2566ee48af1e9956a06044bc], PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.360610\npglobalupdateUpdate4.dll, In Quarantäne, [e8e391e9fe8d2d090cc10ee19d63eb15], PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.360610\psmachine.dll, In Quarantäne, [5c6fc5b5216a94a2cd00cb242dd3dc24], PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.360610\psuser.dll, In Quarantäne, [d9f213676526fd3915b815da9f615fa1], PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.442473\globalupdate.exe, In Quarantäne, [993232487e0dcf67dfee707fef11a25e], PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.442473\globalupdateBroker.exe, In Quarantäne, [62699edce2a93ff7438af7f82ad6cf31], PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.442473\globalupdateCrashHandler.exe, In Quarantäne, [9f2cc4b6dbb077bf814c0be4c33dd22e], PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.442473\globalupdateOnDemand.exe, In Quarantäne, [4784e8923556989ed3fa678808f8f808], PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.442473\goopdate.dll, In Quarantäne, [b5162b4f6b20cb6b5c717d72887860a0], PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.442473\goopdateres_en.dll, In Quarantäne, [01cabfbb7b102016e0ed509fc63a1ae6], PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.442473\npglobalupdateUpdate4.dll, In Quarantäne, [dcef6812f5961e18e1ec757afd032cd4], PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.442473\psmachine.dll, In Quarantäne, [39927208e9a29e9803ca5e9101ff738d], PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.442473\psuser.dll, In Quarantäne, [3a9196e4e8a3e353e2eb727d05fbe818], PUP.Optional.EoRezo, C:\Users\Admin\AppData\Local\Temp\is-E6IQG.tmp\643.exe, In Quarantäne, [f2d9d2a87912e0569bcec85fe21f17e9], PUP.Optional.EoRezo, C:\Users\Admin\AppData\Local\Temp\is-LQGHH.tmp\465.exe, In Quarantäne, [369517635c2fe6508bde0c1b778a40c0], PUP.Optional.EoRezo, C:\Users\Admin\AppData\Local\Temp\is-LQGHH.tmp\package_SByoutube_installer_multilang.exe, In Quarantäne, [0cbfa6d4602bf343d693e83f1be6c937], Adware.FakeAV, C:\Users\Admin\Downloads\Gimp_Downloader.exe, In Quarantäne, [597271095437da5c54a1cd73b74a7090], PUP.Optional.ABengine, C:\Users\Admin\AppData\Local\Temp\lengine.ini.log, In Quarantäne, [725911696d1e23130fec99ba2bd842be], PUP.Optional.ABengine, C:\Windows\Temp\lengine.ini.log, In Quarantäne, [15b6601aa3e8c571bc3f73e0966d669a], PUP.Optional.Acengine, C:\Users\Admin\AppData\Local\Temp\acengine.log, In Quarantäne, [e4e765159dee30069372193bdb28e21e], PUP.Optional.Acengine, C:\Windows\Temp\acengine.log, In Quarantäne, [408b1367a2e937ff0500df7526dd6a96], PUP.Optional.CrossRider, C:\Windows\System32\Tasks\temp_813a5cd0-04f6-4ddb-a269-e350a08d2cae-10_user, In Quarantäne, [8f3c05753e4d221456a07be6d42fa65a], PUP.Optional.CrossRider, C:\Windows\Tasks\temp_813a5cd0-04f6-4ddb-a269-e350a08d2cae-10_user.job, In Quarantäne, [98339cde206b53e3a94ef36e3bc821df], PUP.Optional.Vitruvian, C:\Users\Admin\AppData\Local\Temp\vitruvian-installer-hardwareprofile-v0001, In Quarantäne, [5774acce0d7ea88eb56dcec546bdf20e], PUP.Optional.Vitruvian, C:\Users\Admin\AppData\Local\Temp\vitruvian-installer-install-v0003, In Quarantäne, [00cb542617748ea872b06b281ae9d52b], PUP.Optional.Vitruvian, C:\Users\Admin\AppData\Local\Temp\vitruvian-installer-processes-v0002, In Quarantäne, [6269a7d38b0059dd47db7e1538cb12ee], PUP.Optional.Vitruvian, C:\Users\Admin\AppData\Local\Temp\vitruvian-installer-scheduledtasks-v0001, In Quarantäne, [8d3ed6a4543740f64cd6761df70c2ad6], PUP.Optional.Vitruvian, C:\Users\Admin\AppData\Local\Temp\vitruvian-installer-uninstall-v0002, In Quarantäne, [66653941b0dbd561e43ef2a12bd8c43c], PUP.Optional.ReMarkit.PrxySvrRST, C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.re-markit00.re-markit.co_0.localstorage, In Quarantäne, [329980fa4645eb4bffb1e9b862a107f9], PUP.Optional.ReMarkit.PrxySvrRST, C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.re-markit00.re-markit.co_0.localstorage-journal, In Quarantäne, [8c3f324814776acce4cceab7aa5922de], PUP.Optional.FasterSearch, C:\Windows\System32\Tasks\uhy3013, In Quarantäne, [6a611f5b216a7eb8ea0266681ee52ed2], PUP.Optional.GlobalUpdate, C:\Users\Admin\AppData\Local\Temp\comh.360610\globalupdateHelper.msi, In Quarantäne, [d6f59ae04b40290d72edadb4aa5806fa], PUP.Optional.GlobalUpdate, C:\Users\Admin\AppData\Local\Temp\comh.442473\globalupdateHelper.msi, In Quarantäne, [913a4e2c7813c76f17481b46748e2fd1], Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Malwarebytes Version: 7.6.4 (09.28.2015:1) OS: Windows 10 Pro x64 Ran by Admin on 06.11.2015 at 12:44:10,93 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Tasks ~~~ Registry Values Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_A5B343D047FD8BD2F268B0EA0F8DBD7C ~~~ Registry Keys ~~~ Files ~~~ Folders Successfully deleted: [Folder] C:\users\Public\Documents\guid ~~~ Chrome [C:\Users\Admin\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset [C:\Users\Admin\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted: [C:\Users\Admin\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset [C:\Users\Admin\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted: [] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 06.11.2015 at 12:46:27,95 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:05-11-2015 durchgeführt von Admin (Administrator) auf PC (06-11-2015 12:50:47) Gestartet von C:\Users\Admin\Desktop Geladene Profile: Admin (Verfügbare Profile: Admin) Platform: Windows 10 Pro (X64) Sprache: Deutsch (Deutschland) Internet Explorer Version 11 (Standard-Browser: Edge) Start-Modus: Normal Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Prozesse (Nicht auf der Ausnahmeliste) ================= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.) (Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe (Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe (Microsoft Corporation) C:\Windows\System32\browser_broker.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe ==================== Registry (Nicht auf der Ausnahmeliste) =========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13636824 2013-07-26] (Realtek Semiconductor) HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation) HKLM\...\Run: [XFast LAN] => C:\Program Files\ASRock\XFast LAN\cFosSpeed.exe [2009952 2013-05-31] (cFos Software GmbH) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169744 2015-09-12] (Apple Inc.) HKLM-x32\...\Run: [XFastUSB] => C:\Program Files (x86)\XFastUSB\XFastUsb.exe [6311104 2014-12-15] (FNet Co., Ltd.) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-21] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [RoccatKonePure] => C:\Program Files (x86)\ROCCAT\Kone Pure Mouse\KonePureMonitor.EXE [561152 2014-01-20] (ROCCAT GmbH) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Spotify Web Helper] => C:\Users\Admin\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2021944 2015-06-17] (Spotify Ltd) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Spotify] => C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe [7323192 2015-06-17] (Spotify Ltd) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8551848 2015-10-19] (Piriform Ltd) HKU\S-1-5-18\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [43816 2015-04-26] (Apple Inc.) Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2015-11-06] ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation) ==================== Internet (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{947ba08f-6d7e-4686-b9ff-2806db41b1ff}: [DhcpNameServer] 192.168.0.1 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-09-29] (Microsoft Corporation) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-25] (Google Inc.) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-15] (Microsoft Corporation) BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-09-29] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-21] (Oracle Corporation) BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-25] (Google Inc.) BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-15] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-21] (Oracle Corporation) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-25] (Google Inc.) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-25] (Google Inc.) Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-10-14] (Microsoft Corporation) FireFox: ======== FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation) FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-09-04] () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-03] (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-03] (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-21] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-21] (Oracle Corporation) FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-03-31] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-19] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-19] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-09-27] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-03-31] (Microsoft Corporation) Chrome: ======= CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-05] CHR Extension: (Google Drive) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-23] CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24] CHR Extension: (Google-Suche) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-28] CHR Extension: (LoungeDestroyer) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghahcnmfjfckcedfajbhekgknjdplfcl [2015-10-07] CHR Extension: (Google Text & Tabellen Offline) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-03] CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-25] CHR Extension: (Google Mail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-29] ==================== Dienste (Nicht auf der Ausnahmeliste) ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-09-02] (Apple Inc.) S2 ASRockIOMon; C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe [454656 2013-05-28] () [Datei ist nicht signiert] S2 cFosSpeedS; C:\Program Files\ASRock\XFast LAN\spd.exe [652640 2013-05-31] (cFos Software GmbH) S3 Futuremark SystemInfo Service; C:\Program Files (x86)\Futuremark\SystemInfo\FMSISvc.exe [614624 2014-12-10] (Futuremark) R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation) R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [Datei ist nicht signiert] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation) S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-03] (Intel Corporation) S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-03] (Intel Corporation) S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes) S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1135416 2015-10-05] (Malwarebytes) S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [966336 2014-10-10] (@ByELDI) [Datei ist nicht signiert] R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation) ===================== Treiber (Nicht auf der Ausnahmeliste) ========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.) S3 AsrDrv101; C:\Windows\SysWOW64\Drivers\AsrDrv101.sys [22280 2014-12-16] (ASRock Incorporation) R0 AsrRamDisk; C:\Windows\System32\drivers\AsrRamDisk.sys [40200 2013-05-09] (ASRock Inc.) R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [102912 2015-07-15] (Advanced Micro Devices) S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider) S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider) R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [16648 2014-12-15] (FNet Co., Ltd.) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2015-11-06] (Malwarebytes) R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation) R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-03] (Intel Corporation) R3 sthid; C:\Windows\System32\drivers\sthid.sys [21216 2014-08-06] (Splashtop Inc.) S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] () S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-07-10] (Microsoft Corporation) R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [291680 2015-07-10] (Microsoft Corporation) R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation) S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X] ==================== NetSvcs (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) ==================== Ein Monat: Erstellte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-11-06 12:50 - 2015-11-06 12:50 - 00000000 ____D C:\Users\Admin\Desktop\FRST-OlderVersion 2015-11-06 12:46 - 2015-11-06 12:46 - 00001283 _____ C:\Users\Admin\Desktop\JRT.txt 2015-11-06 12:43 - 2015-11-06 12:43 - 01798976 _____ (Malwarebytes) C:\Users\Admin\Desktop\JRT.exe 2015-11-06 12:43 - 2015-11-06 12:43 - 00010166 _____ C:\Users\Admin\Desktop\mbam.txt 2015-11-06 12:38 - 2015-11-06 12:38 - 00016148 _____ C:\WINDOWS\system32\PC_Admin_HistoryPrediction.bin 2015-11-06 12:12 - 2015-11-06 12:39 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2015-11-06 12:11 - 2015-11-06 12:37 - 00001169 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-11-06 12:11 - 2015-11-06 12:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-11-06 12:11 - 2015-11-06 12:11 - 00000000 ____D C:\ProgramData\Malwarebytes 2015-11-06 12:11 - 2015-11-06 12:11 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-11-06 12:11 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2015-11-06 12:11 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2015-11-06 12:11 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys 2015-11-06 12:10 - 2015-11-06 12:11 - 22908888 _____ (Malwarebytes ) C:\Users\Admin\Downloads\mbam-setup-2.2.0.1024.exe 2015-11-06 12:09 - 2015-11-06 12:09 - 00002073 _____ C:\Users\Admin\Desktop\AdwCleaner[C3].txt 2015-11-06 12:08 - 2015-11-06 12:38 - 00014854 _____ C:\WINDOWS\PFRO.log 2015-11-06 12:05 - 2015-11-06 12:05 - 01713664 _____ C:\Users\Admin\Downloads\AdwCleaner_5.018.exe 2015-11-05 14:32 - 2015-11-06 12:51 - 00014435 _____ C:\Users\Admin\Desktop\FRST.txt 2015-11-05 14:31 - 2015-11-05 14:31 - 04404952 _____ (Kaspersky Lab ZAO) C:\Users\Admin\Desktop\tdsskiller.exe 2015-11-05 14:30 - 2015-11-06 12:50 - 02198528 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe 2015-11-05 14:30 - 2015-11-06 12:50 - 00000000 ____D C:\FRST 2015-11-05 14:13 - 2015-11-05 14:13 - 04944608 _____ (Advanced Micro Devices, Inc.) C:\Users\Admin\Downloads\autodetectutility.exe 2015-11-05 14:00 - 2015-11-05 14:00 - 00000000 ___HD C:\OneDriveTemp 2015-11-05 12:12 - 2015-11-05 12:12 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (3).exe 2015-11-04 17:15 - 2015-11-04 17:15 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (2).exe 2015-11-04 17:08 - 2015-11-06 12:07 - 00000000 ____D C:\AdwCleaner 2015-11-04 17:08 - 2015-11-04 17:08 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (1).exe 2015-11-04 16:49 - 2015-11-06 12:38 - 00000275 _____ C:\WINDOWS\WindowsUpdate.log 2015-11-04 16:49 - 2015-11-04 16:49 - 00000000 ____D C:\$SysReset 2015-11-04 16:34 - 2015-11-06 12:37 - 00000901 _____ C:\Users\Public\Desktop\CCleaner.lnk 2015-11-04 16:34 - 2015-11-04 16:34 - 00002844 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC 2015-11-04 16:34 - 2015-11-04 16:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2015-11-04 16:34 - 2015-11-04 16:34 - 00000000 ____D C:\Program Files\CCleaner 2015-11-04 16:33 - 2015-11-04 16:34 - 05524624 _____ (Piriform Ltd) C:\Users\Admin\Downloads\ccsetup511_slim.exe 2015-11-04 16:14 - 2015-11-04 16:23 - 00000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job 2015-11-04 16:13 - 2015-11-04 16:13 - 00000000 ____D C:\WINDOWS\pss 2015-11-04 16:07 - 2015-11-04 16:07 - 00003380 _____ C:\WINDOWS\System32\Tasks\{6761BBC9-893A-456B-822C-C0DF98AE0062} 2015-11-04 15:21 - 2015-11-06 12:39 - 00001004 _____ C:\WINDOWS\Tasks\28Arly8BQ3IUn.job 2015-11-04 15:21 - 2015-11-04 15:21 - 00004136 _____ C:\WINDOWS\System32\Tasks\28Arly8BQ3IUn 2015-11-04 15:19 - 2015-11-06 12:39 - 00001014 _____ C:\WINDOWS\Tasks\bSUwmicbiyVJJ5rnrs.job 2015-11-04 15:19 - 2015-11-04 15:19 - 00004156 _____ C:\WINDOWS\System32\Tasks\bSUwmicbiyVJJ5rnrs 2015-11-04 15:17 - 2015-11-04 16:00 - 00000004 _____ C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7 2015-11-04 15:17 - 2013-08-22 14:25 - 00000824 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak 2015-11-04 15:16 - 2015-11-04 15:16 - 00000000 ____D C:\Users\Public\Documents\Baidu 2015-11-04 15:15 - 2015-11-04 15:39 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Opera Software 2015-11-04 15:15 - 2015-11-04 15:39 - 00000000 ____D C:\Users\Admin\AppData\Local\Opera Software 2015-11-04 15:12 - 2015-11-04 15:39 - 00000000 ____D C:\Program Files (x86)\Opera 2015-10-30 17:15 - 2015-10-30 17:15 - 00000000 ____D C:\ProgramData\ROCCAT 2015-10-30 17:15 - 2015-10-30 17:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ROCCAT 2015-10-30 17:14 - 2015-10-30 17:14 - 24907859 _____ C:\Users\Admin\Downloads\ROCCAT_Kone_Pure_DRV1.14_FW1.21.zip 2015-10-30 17:14 - 2015-10-30 17:14 - 00000000 ____D C:\Program Files (x86)\ROCCAT 2015-10-30 17:14 - 2014-01-20 10:53 - 73113600 _____ (ROCCAT GmbH) C:\Users\Admin\Desktop\KonePureOption.exe 2015-10-30 17:13 - 2015-10-28 00:38 - 21871616 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll 2015-10-30 17:13 - 2015-10-28 00:16 - 18801664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll 2015-10-30 17:13 - 2015-10-21 13:45 - 00541024 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcupdate_GenuineIntel.dll 2015-10-30 17:13 - 2015-10-21 13:44 - 00459104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys 2015-10-30 17:13 - 2015-10-21 13:43 - 01392480 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll 2015-10-30 17:13 - 2015-10-21 13:39 - 03621248 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2015-10-30 17:13 - 2015-10-21 13:00 - 24595968 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2015-10-30 17:13 - 2015-10-21 13:00 - 03248128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll 2015-10-30 17:13 - 2015-10-21 12:59 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll 2015-10-30 17:13 - 2015-10-21 12:57 - 02418688 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll 2015-10-30 17:13 - 2015-10-21 12:52 - 02987520 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll 2015-10-30 17:13 - 2015-10-21 12:50 - 00333312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll 2015-10-30 17:13 - 2015-10-21 12:48 - 01068032 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll 2015-10-30 17:13 - 2015-10-21 12:47 - 00453120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Usb.dll 2015-10-30 17:13 - 2015-10-21 12:46 - 02179584 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll 2015-10-30 17:13 - 2015-10-21 12:46 - 01602560 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2015-10-30 17:13 - 2015-10-21 12:44 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll 2015-10-30 17:13 - 2015-10-21 12:44 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe 2015-10-30 17:13 - 2015-10-21 12:43 - 02675200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll 2015-10-30 17:13 - 2015-10-21 12:42 - 00627712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll 2015-10-30 17:13 - 2015-10-21 12:41 - 01795072 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll 2015-10-30 17:13 - 2015-10-21 12:40 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll 2015-10-30 17:13 - 2015-10-21 12:38 - 00502272 _____ (Microsoft Corporation) C:\WINDOWS\system32\dlnashext.dll 2015-10-30 17:13 - 2015-10-21 06:53 - 00961376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll 2015-10-30 17:13 - 2015-10-21 06:49 - 02878512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2015-10-30 17:13 - 2015-10-21 06:13 - 19326464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2015-10-30 17:13 - 2015-10-21 06:11 - 02647040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll 2015-10-30 17:13 - 2015-10-21 06:08 - 01918976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll 2015-10-30 17:13 - 2015-10-21 06:05 - 02639872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll 2015-10-30 17:13 - 2015-10-21 06:03 - 01380864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2015-10-30 17:13 - 2015-10-21 06:03 - 00311296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Usb.dll 2015-10-30 17:13 - 2015-10-21 05:58 - 02049536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepository.dll 2015-10-30 17:13 - 2015-10-21 05:58 - 00464896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll 2015-10-30 17:13 - 2015-10-21 05:55 - 00441344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dlnashext.dll 2015-10-26 19:45 - 2015-10-26 19:45 - 00014336 _____ C:\Users\Admin\Downloads\wenn-2.xls 2015-10-26 19:38 - 2015-10-26 19:38 - 03135063 _____ C:\Users\Admin\Downloads\Pruefung_1_Jugendarbeitsschutzgesetz_.zip 2015-10-17 13:48 - 2015-10-10 08:12 - 00078528 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll 2015-10-17 13:48 - 2015-10-06 04:03 - 16708608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll 2015-10-17 13:48 - 2015-10-06 03:46 - 13027840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll 2015-10-17 13:48 - 2015-10-01 05:01 - 01294352 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2015-10-17 13:48 - 2015-10-01 05:01 - 01123400 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2015-10-17 13:48 - 2015-10-01 05:01 - 01018568 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi 2015-10-17 13:48 - 2015-10-01 05:01 - 00858408 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe 2015-10-17 13:48 - 2015-10-01 05:00 - 08020320 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2015-10-17 13:48 - 2015-10-01 04:03 - 00757760 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll 2015-10-17 13:48 - 2015-09-25 05:01 - 02573768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll 2015-10-17 13:48 - 2015-09-25 05:01 - 00498016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys 2015-10-17 13:48 - 2015-09-25 04:56 - 22322624 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2015-10-17 13:48 - 2015-09-25 04:52 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi 2015-10-17 13:48 - 2015-09-25 04:33 - 01997336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll 2015-10-17 13:48 - 2015-09-25 04:26 - 20858360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2015-10-17 13:48 - 2015-09-25 04:11 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataAccountApis.dll 2015-10-17 13:48 - 2015-09-25 04:11 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneCallHistoryApis.dll 2015-10-17 13:48 - 2015-09-25 04:09 - 12504064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2015-10-17 13:48 - 2015-09-25 04:07 - 01276416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll 2015-10-17 13:48 - 2015-09-25 04:04 - 00826880 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll 2015-10-17 13:48 - 2015-09-25 04:04 - 00771072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll 2015-10-17 13:48 - 2015-09-25 04:03 - 00796160 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll 2015-10-17 13:48 - 2015-09-25 04:03 - 00576000 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll 2015-10-17 13:48 - 2015-09-25 04:02 - 07523840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll 2015-10-17 13:48 - 2015-09-25 04:02 - 00949248 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll 2015-10-17 13:48 - 2015-09-25 04:02 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll 2015-10-17 13:48 - 2015-09-25 04:01 - 04792320 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2015-10-17 13:48 - 2015-09-25 04:01 - 03586560 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys 2015-10-17 13:48 - 2015-09-25 04:00 - 01423872 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll 2015-10-17 13:48 - 2015-09-25 04:00 - 01382400 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys 2015-10-17 13:48 - 2015-09-25 04:00 - 00856576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContactApis.dll 2015-10-17 13:48 - 2015-09-25 04:00 - 00752640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChatApis.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 01205248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\EmailApis.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 00685568 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppointmentApis.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\MessagingDataModel2.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 00288256 _____ (Microsoft Corporation) C:\WINDOWS\system32\PimIndexMaintenance.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\CallHistoryClient.dll 2015-10-17 13:48 - 2015-09-25 03:58 - 01871360 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll 2015-10-17 13:48 - 2015-09-25 03:47 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll 2015-10-17 13:48 - 2015-09-25 03:47 - 00172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhoneCallHistoryApis.dll 2015-10-17 13:48 - 2015-09-25 03:38 - 03580416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2015-10-17 13:48 - 2015-09-25 03:38 - 00650240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll 2015-10-17 13:48 - 2015-09-25 03:38 - 00574464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll 2015-10-17 13:48 - 2015-09-25 03:38 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll 2015-10-17 13:48 - 2015-09-25 03:37 - 00766976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll 2015-10-17 13:48 - 2015-09-25 03:37 - 00613376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll 2015-10-17 13:48 - 2015-09-25 03:37 - 00480256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll 2015-10-17 13:48 - 2015-09-25 03:36 - 11262976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2015-10-17 13:48 - 2015-09-25 03:36 - 05454848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll 2015-10-17 13:48 - 2015-09-25 03:34 - 00928256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll 2015-10-17 13:48 - 2015-09-25 03:34 - 00625152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContactApis.dll 2015-10-17 13:48 - 2015-09-25 03:34 - 00579584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentApis.dll 2015-10-17 13:48 - 2015-09-25 03:34 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ChatApis.dll 2015-10-17 13:48 - 2015-09-25 03:34 - 00525312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EmailApis.dll 2015-10-17 13:48 - 2015-09-25 03:33 - 00131072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CallHistoryClient.dll 2015-10-17 13:48 - 2015-09-25 03:32 - 01594368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll 2015-10-17 13:48 - 2015-09-25 03:32 - 00466432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MessagingDataModel2.dll 2015-10-17 13:39 - 2015-11-04 16:28 - 00000000 ____D C:\Users\Admin\Desktop\Felgen 2015-10-17 13:36 - 2015-11-06 12:37 - 00001816 _____ C:\Users\Public\Desktop\iTunes.lnk 2015-10-17 13:36 - 2015-10-17 13:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2015-10-17 13:35 - 2015-11-06 12:37 - 00002523 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk 2015-10-17 13:35 - 2015-10-17 13:36 - 00000000 ____D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7 2015-10-17 13:35 - 2015-10-17 13:36 - 00000000 ____D C:\Program Files\iTunes 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\WINDOWS\System32\Tasks\Apple 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files\iPod 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files\Bonjour 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\iTunes 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\Bonjour 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\Apple Software Update 2015-10-17 13:30 - 2015-10-17 13:34 - 152447768 _____ (Apple Inc.) C:\Users\Admin\Downloads\iTunes6464Setup (1).exe 2015-10-12 18:13 - 2015-10-12 18:15 - 167601944 _____ (Apple Inc.) C:\Users\Admin\Downloads\iTunes6464Setup.exe 2015-10-12 17:20 - 2015-10-12 17:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud 2015-10-12 17:09 - 2015-10-12 17:19 - 71807792 _____ (Apple Inc.) C:\Users\Admin\Downloads\iCloudSetup.exe 2015-10-12 17:03 - 2015-10-12 17:24 - 1971067436 _____ C:\Users\Admin\Downloads\iPhone7,2_8.4.1_12H321_Restore.ipsw 2015-10-09 15:13 - 2015-10-09 15:13 - 00000000 ____D C:\Users\Admin\AppData\LocalLow\Hyper Hippo Productions Ltd_ 2015-10-09 15:12 - 2015-10-09 15:12 - 00000222 _____ C:\Users\Admin\Desktop\AdVenture Capitalist.url 2015-10-08 16:47 - 2015-10-08 16:47 - 00000000 ____D C:\ProgramData\ATI 2015-10-07 18:54 - 2015-10-07 18:54 - 00062253 _____ C:\WINDOWS\SysWOW64\CCCInstall_201510071954276182.log 2015-10-07 18:54 - 2015-10-07 18:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center 2015-10-07 18:54 - 2015-10-07 18:54 - 00000000 ____D C:\Program Files\ATI Technologies 2015-10-07 18:53 - 2015-10-07 18:54 - 00000000 ____D C:\Program Files (x86)\ATI Technologies 2015-10-07 18:53 - 2015-10-07 18:53 - 00052907 _____ C:\WINDOWS\SysWOW64\CCCInstall_201510071953453509.log 2015-10-07 18:52 - 2015-10-07 18:52 - 47794160 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\amdocl64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 39721456 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\amdocl.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 30776304 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atio6axx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 27544560 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\amdocl12cl64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 25320432 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atioglxx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 22327280 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\amdocl12cl.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 15725552 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticaldd64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 14310896 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticaldd.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 09355016 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdxc64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 08009360 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiumdva.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 07683096 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdxc32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 07482560 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiumdag.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 06686192 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdmantle64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 05216240 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdmantle32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 03471376 _____ C:\WINDOWS\SysWOW64\atiumdva.cap 2015-10-07 18:52 - 2015-10-07 18:52 - 03437632 _____ C:\WINDOWS\system32\atiumd6a.cap 2015-10-07 18:52 - 2015-10-07 18:52 - 01196032 _____ C:\WINDOWS\system32\amdocl_as64.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 01070592 _____ C:\WINDOWS\system32\amdocl_ld64.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 01004032 _____ C:\WINDOWS\SysWOW64\amdocl_as32.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00935408 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atiadlxy.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00935408 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atiadlxx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00833800 _____ C:\WINDOWS\system32\amdicdxx.dat 2015-10-07 18:52 - 2015-10-07 18:52 - 00807424 _____ C:\WINDOWS\SysWOW64\amdocl_ld32.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00662392 _____ C:\WINDOWS\SysWOW64\atiapfxx.blb 2015-10-07 18:52 - 2015-10-07 18:52 - 00662392 _____ C:\WINDOWS\system32\atiapfxx.blb 2015-10-07 18:52 - 2015-10-07 18:52 - 00631280 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\amdlvr64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00524272 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\amdlvr32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00471320 _____ C:\WINDOWS\system32\amdmiracast.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00375792 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atiapfxx.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00341488 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\ATIODE.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00243696 _____ C:\WINDOWS\system32\clinfo.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00213488 _____ C:\WINDOWS\system32\amdgfxinfo64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00199664 _____ (AMD) C:\WINDOWS\system32\atitmm64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00198640 _____ C:\WINDOWS\SysWOW64\amdgfxinfo32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00177344 _____ C:\WINDOWS\system32\ativce03.dat 2015-10-07 18:52 - 2015-10-07 18:52 - 00175648 _____ C:\WINDOWS\system32\amde31a.dat 2015-10-07 18:52 - 2015-10-07 18:52 - 00168944 _____ C:\WINDOWS\system32\atieah64.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00165360 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atig6txx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00152560 _____ C:\WINDOWS\SysWOW64\atieah32.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00151936 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\amdhcp64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00150512 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atigktxx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00143344 _____ C:\WINDOWS\system32\amdhdl64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00138384 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\amdhcp32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00136176 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\mantle64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00132080 _____ C:\WINDOWS\SysWOW64\amdhdl32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00122352 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\mantle32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00117608 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdave64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00112368 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiu9pag.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00111600 _____ C:\WINDOWS\system32\hsa-thunk64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00111088 _____ C:\WINDOWS\SysWOW64\hsa-thunk.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00110320 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdave32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00103408 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\mantleaxl64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00100816 _____ C:\WINDOWS\system32\ativce02.dat 2015-10-07 18:52 - 2015-10-07 18:52 - 00097776 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atisamu64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00096752 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\mantleaxl32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00089584 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atisamu32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00088000 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atimpc64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00088000 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdpcom64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00083952 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atig6pxx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00081168 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atimpc32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00081160 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdpcom32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00078320 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiglpxx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00078320 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiglpxx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00073712 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00071152 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticalrt64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00068080 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00064496 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticalcl64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00060912 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticalrt.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00059888 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\ATIODCLI.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00059376 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdmmcl6.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00057840 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticalcl.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00052208 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\ati2erec.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00048112 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdmmcl.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00047664 _____ C:\WINDOWS\system32\kapp_ci.sbin 2015-10-07 18:52 - 2015-10-07 18:52 - 00043536 _____ C:\WINDOWS\system32\kapp_si.sbin 2015-10-07 18:52 - 2015-10-07 18:52 - 00038384 _____ (AMD) C:\WINDOWS\system32\atimuixx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00012784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\detoured.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00012784 _____ (Microsoft Corporation) C:\WINDOWS\system32\detoured.dll ==================== Ein Monat: Geänderte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-11-06 12:43 - 2015-08-05 21:51 - 01793546 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2015-11-06 12:43 - 2015-07-10 17:34 - 00772138 _____ C:\WINDOWS\system32\perfh007.dat 2015-11-06 12:43 - 2015-07-10 17:34 - 00154500 _____ C:\WINDOWS\system32\perfc007.dat 2015-11-06 12:39 - 2014-12-15 23:33 - 00001120 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2015-11-06 12:38 - 2015-07-10 13:21 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT 2015-11-06 12:37 - 2015-09-08 18:22 - 00000971 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk 2015-11-06 12:37 - 2015-08-05 22:01 - 00002358 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk 2015-11-06 12:37 - 2015-08-05 21:45 - 00001540 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2015-11-06 12:37 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\sru 2015-11-06 12:37 - 2015-07-10 10:05 - 00262144 ___SH C:\WINDOWS\system32\config\BBI 2015-11-06 12:37 - 2015-05-24 23:54 - 00000925 _____ C:\Users\Public\Desktop\VLC media player.lnk 2015-11-06 12:37 - 2015-01-06 20:22 - 00001017 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk 2015-11-06 12:37 - 2014-12-31 19:28 - 00000973 _____ C:\Users\Public\Desktop\Steam.lnk 2015-11-06 12:37 - 2014-12-31 18:33 - 00001813 _____ C:\Users\Admin\Desktop\Spotify.lnk 2015-11-06 12:37 - 2014-12-31 18:33 - 00001799 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk 2015-11-06 12:37 - 2014-12-18 21:21 - 00002445 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2015-11-06 12:37 - 2014-12-15 23:33 - 00001321 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2015-11-06 12:23 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\AppReadiness 2015-11-06 12:19 - 2014-12-15 23:33 - 00001124 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2015-11-06 11:03 - 2014-12-31 19:28 - 00000000 ____D C:\Program Files (x86)\Steam 2015-11-05 20:20 - 2015-08-05 21:41 - 00000000 ____D C:\Users\Admin 2015-11-05 18:47 - 2015-01-06 20:23 - 00000000 ____D C:\Users\Admin\AppData\Roaming\TS3Client 2015-11-05 17:46 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\rescache 2015-11-05 14:57 - 2014-12-30 15:46 - 00000000 ____D C:\ProgramData\Microsoft Help 2015-11-05 14:56 - 2014-12-30 19:00 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013 2015-11-05 14:05 - 2015-08-05 22:01 - 00000000 ___RD C:\Users\Admin\OneDrive 2015-11-04 17:09 - 2015-08-05 21:41 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2015-11-04 17:09 - 2014-12-15 23:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2015-11-04 16:42 - 2015-08-05 22:33 - 00000000 ___DC C:\WINDOWS\Panther 2015-11-04 16:42 - 2014-12-30 23:19 - 00000000 ____D C:\Users\Admin\AppData\Local\CrashDumps 2015-11-04 16:09 - 2014-12-18 21:20 - 00000000 ____D C:\Program Files (x86)\Adobe 2015-11-04 16:08 - 2014-12-15 22:53 - 00000000 ____D C:\Program Files\KMSpico 2015-11-04 15:46 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy 2015-11-04 15:39 - 2015-01-21 20:03 - 00000000 __SHD C:\Users\Admin\AppData\Local\EmieUserList 2015-11-04 15:39 - 2015-01-21 20:03 - 00000000 __SHD C:\Users\Admin\AppData\Local\EmieSiteList 2015-11-04 15:26 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\appraiser 2015-11-02 14:26 - 2015-07-10 11:55 - 00000000 ____D C:\WINDOWS\CbsTemp 2015-11-01 00:33 - 2015-01-05 18:20 - 00003972 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task 2015-10-30 17:14 - 2014-12-15 23:42 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2015-10-27 19:48 - 2014-12-31 18:33 - 00000000 ____D C:\Users\Admin\AppData\Local\Spotify 2015-10-27 19:48 - 2014-12-31 18:32 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Spotify 2015-10-26 20:55 - 2015-04-12 21:14 - 00000000 ____D C:\Users\Admin\Desktop\Mailin 2015-10-26 20:15 - 2013-08-22 14:25 - 00000167 _____ C:\WINDOWS\win.ini 2015-10-26 19:47 - 2014-12-15 22:56 - 00000000 ____D C:\Users\Admin\AppData\Local\Packages 2015-10-17 13:35 - 2015-04-10 06:25 - 00000000 ____D C:\Program Files\Common Files\Apple 2015-10-17 13:34 - 2015-04-10 06:25 - 00000000 ____D C:\ProgramData\Apple 2015-10-16 04:10 - 2015-07-10 12:06 - 00810488 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2015-10-16 04:10 - 2015-07-10 12:06 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2015-10-12 18:13 - 2015-09-08 19:52 - 00000000 ____D C:\WINDOWS\system32\appmgmt 2015-10-12 18:11 - 2014-12-30 17:39 - 00000000 ____D C:\Users\Admin\AppData\Local\Akamai 2015-10-12 17:47 - 2015-07-10 13:20 - 00348328 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2015-10-12 17:45 - 2015-07-10 17:44 - 00000000 ____D C:\Program Files\Windows Journal 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___SD C:\WINDOWS\system32\F12 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___RD C:\WINDOWS\PurchaseDialog 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\Provisioning 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\L2Schemas 2015-10-09 15:12 - 2015-01-06 13:55 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam 2015-10-07 18:53 - 2015-07-30 15:44 - 00000000 ____D C:\Program Files (x86)\AMD 2015-10-07 18:53 - 2014-12-15 22:57 - 00000000 ____D C:\AMD 2015-10-07 18:52 - 2015-07-16 01:12 - 00162240 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiuxp64.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 12088008 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atidxx64.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 10211016 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atidxx32.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 08982440 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiumd6a.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 08864928 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiumd64.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 01479808 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\aticfx64.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 01223552 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\aticfx32.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 00143056 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiuxpag.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 00130072 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiu9p64.dll 2015-10-07 18:52 - 2015-07-16 01:06 - 21648880 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\atikmdag.sys 2015-10-07 18:52 - 2015-07-16 00:17 - 00683504 _____ (AMD) C:\WINDOWS\system32\atieclxx.exe 2015-10-07 18:52 - 2015-07-16 00:17 - 00451056 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atidemgy.dll 2015-10-07 18:52 - 2015-07-16 00:17 - 00255472 _____ (AMD) C:\WINDOWS\system32\atiesrxx.exe 2015-10-07 18:52 - 2015-07-16 00:13 - 01256432 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atiadlxx.dll 2015-10-07 18:52 - 2015-07-16 00:13 - 00674288 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\atikmpag.sys 2015-10-07 18:52 - 2015-07-16 00:12 - 00874480 _____ (AMD) C:\WINDOWS\system32\coinst_15.20.dll ==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ======= 2015-04-19 13:20 - 2015-04-19 13:20 - 0005872 _____ () C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn 2015-04-19 13:20 - 2015-04-19 13:20 - 0005872 _____ () C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs 2015-09-08 19:37 - 2015-09-08 19:37 - 0003225 _____ () C:\Users\Admin\AppData\Local\recently-used.xbel Einige Dateien in TEMP: ==================== C:\Users\Admin\AppData\Local\Temp\8548.exe C:\Users\Admin\AppData\Local\Temp\avgD177.exe C:\Users\Admin\AppData\Local\Temp\InstallHelper.exe C:\Users\Admin\AppData\Local\Temp\Opera_NI_stable.exe C:\Users\Admin\AppData\Local\Temp\sqlite3.dll C:\Users\Admin\AppData\Local\Temp\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\UninstallModule.exe C:\Users\Admin\AppData\Local\Temp\VLX_Player.exe ==================== Bamital & volsnap ================= (Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.) C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert C:\WINDOWS\explorer.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert C:\WINDOWS\system32\services.exe => Datei ist digital signiert C:\WINDOWS\system32\User32.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert LastRegBack: 2015-11-02 14:19 ==================== Ende von FRST.txt ============================ Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:05-11-2015 durchgeführt von Admin (2015-11-06 12:51:40) Gestartet von C:\Users\Admin\Desktop Windows 10 Pro (X64) (2015-08-05 20:58:30) Start-Modus: Normal ========================================================== ==================== Konten: ============================= Admin (S-1-5-21-3896126499-3315573620-1378135710-1001 - Administrator - Enabled) => C:\Users\Admin Administrator (S-1-5-21-3896126499-3315573620-1378135710-500 - Administrator - Disabled) DefaultAccount (S-1-5-21-3896126499-3315573620-1378135710-503 - Limited - Disabled) Gast (S-1-5-21-3896126499-3315573620-1378135710-501 - Limited - Disabled) ==================== Sicherheits-Center ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.) AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installierte Programme ====================== (Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.) 3DMark (HKLM-x32\...\{7330098c-3669-4f39-9e82-4221d489db39}) (Version: 1.4.828.0 - Futuremark) 3DMark (Version: 1.4.828.0 - Futuremark) Hidden Adobe Reader XI (11.0.13) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.13 - Adobe Systems Incorporated) AdVenture Capitalist (HKLM-x32\...\Steam App 346900) (Version: - Hyper Hippo Games) Akamai NetSession Interface (HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Akamai) (Version: - Akamai Technologies, Inc) AMD Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD) AMD Catalyst Install Manager (HKLM\...\{572C982F-95F5-0562-AE8F-8A9D7D024A88}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.) APP Shop v1.0.13 (HKLM-x32\...\{90242E9B-BC60-46E3-8EE7-8E953F702280}_is1) (Version: 1.0.13 - ASRock Inc.) Apple Application Support (32-Bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.) Apple Application Support (64-Bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{FD244E19-6EFE-4A2D-948A-0D45D4C168BE}) (Version: 9.0.0.26 - Apple Inc.) Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.) ASRock App Charger v1.0.6 (HKLM\...\ASRock App Charger_is1) (Version: 1.0.6 - ASRock Inc.) ASRock Restart to UEFI v1.0.3 (HKLM-x32\...\ASRock Restart to UEFI_is1) (Version: - ) ASRock XFast RAM v3.0.2 (HKLM\...\ASRock XFast RAM_is1) (Version: - ASRock Inc.) A-Tuning v2.0.51.1 (HKLM-x32\...\A-Tuning_is1) (Version: 2.0.51.1 - ) Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.) CCleaner (HKLM\...\CCleaner) (Version: 5.11 - Piriform) Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve) Futuremark SystemInfo (HKLM-x32\...\{2FE4C157-30AD-47F3-9D93-D9A2AFF25D3F}) (Version: 4.33.485.0 - Futuremark) GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 46.0.2490.80 - Google Inc.) Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6904.2028 - Google Inc.) Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden iCloud (HKLM\...\{709A2D23-C25E-47B5-9268-CB6FEE648504}) (Version: 4.1.1.53 - Apple Inc.) Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation) Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{0EC7F9CC-4741-45AE-9F55-6E9343F726F5}) (Version: 1.1.0.36960 - Intel Corporation) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation) Intel(R) Network Connections 18.5.54.0 (HKLM\...\PROSetDX) (Version: 18.5.54.0 - Intel) Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation) iTunes (HKLM\...\{CEC7613B-E286-4A31-BEE3-3F7798488D9F}) (Version: 12.1.3.6 - Apple Inc.) Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation) KMSpico (HKLM\...\{8B29D47F-92E2-4C20-9EE0-F710991F5D7C}_is1) (Version: - ) Malwarebytes Anti-Malware Version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes) Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation) Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation) MyDriveConnect 4.0.2.2123 (HKLM-x32\...\MyDriveConnect) (Version: 4.0.2.2123 - TomTom) Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.) ROCCAT Kone Pure Mouse Driver (HKLM-x32\...\{4905245D-56E7-4176-BE68-962728B803D6}) (Version: - Roccat GmbH) Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version: - Microsoft) Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version: - Microsoft) Hidden Splashtop Software Updater (HKLM-x32\...\Splashtop Software Updater) (Version: 1.5.6.15 - Splashtop Inc.) Splashtop Streamer (HKLM-x32\...\{B7C5EA94-B96A-41F5-BE95-25D78B486678}) (Version: 2.6.2.4 - Splashtop Inc.) Spotify (HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Spotify) (Version: 1.0.6.80.g2a801a53 - Spotify AB) Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation) TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH) Update for Skype for Business 2015 (KB2889853) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{CBCC2FD8-7DFE-4752-95B5-2E447C226F45}) (Version: - Microsoft) Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version: - Microsoft) Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version: - Microsoft) Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version: - Microsoft) VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.) VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN) WinRAR 5.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH) XFast LAN v9.05 (HKLM\...\XFast LAN) (Version: 9.05 - cFos Software GmbH, Bonn) XFastUSB (HKLM-x32\...\XFastUSB) (Version: 3.02.38 - ASRock Inc.) ==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) CustomCLSID: HKU\S-1-5-21-3896126499-3315573620-1378135710-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Admin\AppData\Local\Microsoft\OneDrive\17.3.6201.1019\FileCoAuth.exe (Microsoft Corporation) ==================== Wiederherstellungspunkte ========================= 17-10-2015 13:21:53 Removed iTunes 26-10-2015 19:59:23 Windows Update 02-11-2015 14:19:58 Windows Update 04-11-2015 15:33:50 Wiederherstellungsvorgang 06-11-2015 12:44:13 JRT Pre-Junkware Removal ==================== Hosts Inhalt: =============================== (Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.) 2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts ==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) ============= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) Task: {0641E672-CA84-4606-B6D2-9F2BABE58BF5} - System32\Tasks\28Arly8BQ3IUn => C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe <==== ACHTUNG Task: {07181339-8E57-4CB5-BBFE-76170783B9DB} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG Task: {12FB6D15-B5C0-4B66-BF0C-21D82690E855} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation) Task: {1780DAB3-4584-4FBD-92C9-8857F3886BA3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.) Task: {18B3B3A2-AFFF-476E-BA62-AB75BE1E7871} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG Task: {314E7782-948E-4C4F-B24E-BC0CC4B34F09} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG Task: {35EB728D-F128-4075-B375-D45BF71FE8B2} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\BrowserChoice\browserchoice.exe Task: {3A4FD38E-5C92-414E-9586-8C3CAA34B95C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.) Task: {3E9757E4-DB07-4418-A44D-2721FDE15694} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG Task: {4D0FE605-48D7-41B3-AD75-AD266C4238D5} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG Task: {5769C702-F476-4F1D-8161-7F0B757132B2} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation) Task: {6B883A1A-4B18-410C-B686-CE03876036BA} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG Task: {706560C9-EAA0-41D3-833A-15525024E0B5} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-26] (Apple Inc.) Task: {80A4DADB-BA50-49B2-AA96-134B855D9DA2} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation) Task: {829CE483-8082-49CD-A513-92A43A02E5FB} - System32\Tasks\{6761BBC9-893A-456B-822C-C0DF98AE0062} => pcalua.exe -a "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\Installer\setup.exe" -c --uninstall --system-level Task: {91B7D1C5-C4A2-47A1-8301-8BB576FF708E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated) Task: {A0AE8DD5-A88B-4716-868D-7DE54D6A193B} - \AutoKMS -> Keine Datei <==== ACHTUNG Task: {ABDBD144-AC98-4BFB-A605-068E267D2877} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation) Task: {AF2AD4F7-61F8-4A4D-80A1-EC7534DACF61} - System32\Tasks\bSUwmicbiyVJJ5rnrs => C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe <==== ACHTUNG Task: {B5D52175-0BF8-41EC-8DE9-7EA06BDD727D} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG Task: {C094DE92-8467-4C1A-BDA4-A77A51B90A69} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG Task: {CBA55D8E-91C9-42CD-83D1-CCEA95CCAD58} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG Task: {D9512478-B671-48F5-AB7D-4DFDF9C1B3D9} - \AutoPico Daily Restart -> Keine Datei <==== ACHTUNG Task: {DA46E218-00C4-4B54-B5E0-5243E443B1D5} - \uhy3013 -> Keine Datei <==== ACHTUNG Task: {ECA37C1B-4E7F-4781-B87B-E8B93639BBCB} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG Task: {F2497E2D-9818-4923-A176-F89FB32151E5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-10-19] (Piriform Ltd) Task: {F5E604C0-8A2B-485C-9605-9EC1FD317421} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG Task: {F69C0FCA-220E-4675-A1E1-DD67E0976A15} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation) (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.) Task: C:\WINDOWS\Tasks\28Arly8BQ3IUn.job => C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\bSUwmicbiyVJJ5rnrs.job => C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Geladene Module (Nicht auf der Ausnahmeliste) ============== 2015-07-10 12:00 - 2015-07-10 12:00 - 00028160 _____ () C:\WINDOWS\SYSTEM32\efsext.dll 2015-08-05 22:30 - 2015-08-05 22:30 - 00032768 _____ () C:\WINDOWS\SYSTEM32\licensemanagerapi.dll 2015-08-23 21:30 - 2015-08-11 10:14 - 00404480 _____ () C:\WINDOWS\System32\diagtrack_wininternal.dll 2015-10-01 09:14 - 2015-09-17 07:48 - 02494712 _____ () C:\WINDOWS\system32\CoreUIComponents.dll 2015-10-01 09:14 - 2015-09-17 07:48 - 02494712 _____ () C:\WINDOWS\System32\CoreUIComponents.dll 2015-10-19 21:00 - 2015-10-19 21:00 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll 2015-10-01 09:14 - 2015-09-17 06:48 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll 2015-10-01 09:14 - 2015-09-17 06:44 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll 2015-10-01 09:14 - 2015-09-17 06:42 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll 2015-10-01 09:14 - 2015-09-17 06:49 - 00884736 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll 2015-10-01 09:14 - 2015-09-17 06:42 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll 2015-10-01 09:14 - 2015-09-17 06:43 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll 2015-03-20 17:12 - 2015-03-20 17:12 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2015-03-20 17:12 - 2015-03-20 17:12 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2015-10-01 09:14 - 2015-09-17 06:43 - 00928768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RulesBackgroundTasks.dll 2014-12-15 23:45 - 2013-09-03 16:52 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll ==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) ========= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.) ==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.) ==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.) ==================== Internet Explorer Vertrauenswürdig/Eingeschränkt =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.) ==================== Andere Bereiche ============================ (Aktuell gibt es keinen automatisierten Fix für diesen Bereich.) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppBackground\{8f613224-081d-4870-95b1-d3401a9c063b}.jpg DNS Servers: 192.168.0.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Windows Firewall ist aktiviert. ==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge == (Aktuell gibt es keinen automatisierten Fix für diesen Bereich.) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Akamai NetSession Interface" HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Spotify" HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Spotify Web Helper" ==================== Firewall Regeln (Nicht auf der Ausnahmeliste) =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139 FirewallRules: [{AA2759FA-EDA9-49D9-8F1E-31DBB008545D}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe FirewallRules: [{21668B50-B857-45A9-B645-E11ECDD0BA49}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe FirewallRules: [{6CB59014-5555-42F1-8B13-C849BCCFE2D5}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe FirewallRules: [{A3131C8E-696E-4F51-ACFD-B2AB59280978}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe FirewallRules: [{FEE6B3AF-FAFD-4C1B-B25C-3D7B4B195124}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{B443DA33-A6A7-4033-956B-A93AC3CBC433}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{E6CBFDB1-E319-4DB8-AFE5-A4934C2C92BB}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{6A8E79CC-2575-4BAE-8F1C-D7A7E2F46E1E}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{8E7D9FDF-1879-4244-A2C6-EBC14CC669E7}] => (Allow) %USERPROFILE%\jagexcache\jagexlauncher\bin\JagexLauncher.exe FirewallRules: [{35A1C72A-BDD3-483A-89A4-27F37D6F2DF0}] => (Allow) %USERPROFILE%\jagexcache\jagexlauncher\bin\JagexLauncher.exe FirewallRules: [{B6240254-8695-4136-8688-496A32476A12}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe FirewallRules: [{E7AD38FE-F37D-44CA-9649-1701BCC99048}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe FirewallRules: [{B0CB35E9-5E30-4F33-B965-F50096A6FF89}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe FirewallRules: [{D97329F3-5344-4F9A-ABBF-5E569CF1D363}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe FirewallRules: [{CAEEFC92-F0A2-4DE5-A2E7-FFCAFF3B70D4}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe FirewallRules: [{DA773FEA-CDF4-4FFB-818E-B255D4ABA4EF}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe FirewallRules: [{22A49953-B3ED-4BC6-8832-A1E30DE6E35D}] => (Block) C:\users\admin\appdata\roaming\spotify\spotify.exe FirewallRules: [{C130419E-ACEF-4A16-B5CD-F7064DA07399}] => (Block) C:\users\admin\appdata\roaming\spotify\spotify.exe FirewallRules: [UDP Query User{8F3963CA-4443-496D-B9E4-2A16E020A73E}C:\users\admin\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\admin\appdata\roaming\spotify\spotify.exe FirewallRules: [TCP Query User{C9892719-B171-4AE8-B087-57F263271C60}C:\users\admin\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\admin\appdata\roaming\spotify\spotify.exe FirewallRules: [{52E0F1D2-FD56-4E24-A22C-DE206D1494F7}] => (Allow) C:\Windows\AutoKMS\AutoKMS.exe FirewallRules: [{7039608C-3BAF-4175-B1D5-9DB53104CE60}] => (Allow) C:\Windows\AutoKMS\AutoKMS.exe FirewallRules: [{A6677B6E-9570-4D98-87FE-84B9780B452C}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{CD221F27-BA09-4A4E-BC94-50541EBCB868}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{85BC76F4-96B4-4164-A507-B85036C799E4}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe FirewallRules: [{05E12DE1-3BF9-4600-BD77-0809E7D8C280}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe FirewallRules: [UDP Query User{6B3064D8-144A-4C73-834F-582573F693E1}C:\users\admin\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\admin\appdata\local\akamai\netsession_win.exe FirewallRules: [TCP Query User{4F97824E-B35A-4B0C-97A6-D3BAFD6E693B}C:\users\admin\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\admin\appdata\local\akamai\netsession_win.exe FirewallRules: [{ACFE8A12-C5A4-41FC-90A6-7D110C49FAEE}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe FirewallRules: [{55CAAA0F-FBB7-462F-8A31-FCCBE685917A}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe FirewallRules: [{046FF7F9-A214-4106-ADBB-6B8AD4D530E1}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe FirewallRules: [{B26C67AD-595F-4798-8BA9-48A408D1A66A}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe FirewallRules: [{0812631C-DFED-4D26-BAD8-38EC0D43A5F9}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe FirewallRules: [{DD625CA9-74CC-4EF5-8787-672253D8102B}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe FirewallRules: [{92F406C8-75D5-4ABC-B10E-2BCB8528AAD5}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{2E1B87E5-B37C-4C66-97F9-A7331EB138D4}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{20E5CF9D-CD2B-48EC-8529-99B170102939}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\AdVenture Capitalist\adventure-capitalist.exe FirewallRules: [{C1EF0CA2-2081-43FE-8B04-16DE223F8C15}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\AdVenture Capitalist\adventure-capitalist.exe FirewallRules: [{C20F43D5-69D4-45A1-AD1B-C744E89D4511}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{7E097365-0904-432E-929B-8F1CD4D41E51}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{1E925C46-62CE-4FA6-82B0-ABDF754998C5}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{F8DCB71C-268A-4DB2-8339-FDB932450A7D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{DD491145-F36D-48BC-A4CF-458D412FE1DE}] => (Allow) C:\Program Files\iTunes\iTunes.exe FirewallRules: [{9E2BD5A0-E113-4596-8766-27355FE2915D}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe FirewallRules: [{E745B22D-7912-4168-B501-8A08C1F3C580}] => (Allow) C:\Program Files (x86)\Max Driver Updater\maxdu.exe FirewallRules: [{93C38DE8-53A2-4A89-9205-B0807ACAA3F2}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe FirewallRules: [{279EF737-27B1-40C7-99AC-8EAD354171BD}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe FirewallRules: [{7886F932-3D5E-474B-9059-A0E18BD488B9}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\DataProxy.exe ==================== Fehlerhafte Geräte im Gerätemanager ============= ==================== Fehlereinträge in der Ereignisanzeige: ========================= Applikationsfehler: ================== Error: (11/06/2015 12:45:08 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: MicrosoftEdge.exe, Version: 11.0.10240.16566, Zeitstempel: 0x56277dbe Name des fehlerhaften Moduls: CoreUIComponents.dll, Version: 0.0.0.0, Zeitstempel: 0x55fa4b76 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000000000060f73 ID des fehlerhaften Prozesses: 0x7e8 Startzeit der fehlerhaften Anwendung: 0xMicrosoftEdge.exe0 Pfad der fehlerhaften Anwendung: MicrosoftEdge.exe1 Pfad des fehlerhaften Moduls: MicrosoftEdge.exe2 Berichtskennung: MicrosoftEdge.exe3 Vollständiger Name des fehlerhaften Pakets: MicrosoftEdge.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: MicrosoftEdge.exe5 Error: (11/06/2015 12:44:23 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: ) Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer". Details: AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll. System Error: Zugriff verweigert . Error: (11/05/2015 08:20:37 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC) Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“. Error: (11/05/2015 01:57:18 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC) Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2147024865. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“. Error: (11/05/2015 01:57:18 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC) Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2147024865. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“. Error: (11/05/2015 01:57:18 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC) Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“. Error: (11/04/2015 05:09:31 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: MicrosoftEdge.exe, Version: 11.0.10240.16566, Zeitstempel: 0x56277dbe Name des fehlerhaften Moduls: CoreUIComponents.dll, Version: 0.0.0.0, Zeitstempel: 0x55fa4b76 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000000000060f73 ID des fehlerhaften Prozesses: 0x1f70 Startzeit der fehlerhaften Anwendung: 0xMicrosoftEdge.exe0 Pfad der fehlerhaften Anwendung: MicrosoftEdge.exe1 Pfad des fehlerhaften Moduls: MicrosoftEdge.exe2 Berichtskennung: MicrosoftEdge.exe3 Vollständiger Name des fehlerhaften Pakets: MicrosoftEdge.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: MicrosoftEdge.exe5 Error: (11/04/2015 04:53:58 PM) (Source: System Restore) (EventID: 8210) (User: ) Description: Unbekannter Fehler bei der Systemwiederherstellung: (Windows Update). Zusätzliche Informationen: 0x80070571. Error: (11/04/2015 04:23:32 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC) Description: Bei der Aktivierung der App „Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe:MicrosoftEdge.AppX9zvsr9qeth9e9a03yr0g7rpdrcrwgn5r.mca“ ist folgender Fehler aufgetreten: -2144927149. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“. Error: (11/04/2015 04:14:43 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC) Description: Bei der Aktivierung der App „Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe:MicrosoftEdge.AppX9zvsr9qeth9e9a03yr0g7rpdrcrwgn5r.mca“ ist folgender Fehler aufgetreten: -2144927149. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“. Systemfehler: ============= Error: (11/06/2015 12:45:08 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Intel(R) Dynamic Application Loader Host Interface Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (11/06/2015 12:45:08 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Intel(R) ME Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (11/06/2015 12:45:08 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "iPod-Dienst" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (11/06/2015 12:45:07 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "cFosSpeed System Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (11/06/2015 12:45:07 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "Intel(R) Capability Licensing Service Interface" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts. Error: (11/06/2015 12:45:06 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Dienst "Bonjour"" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (11/06/2015 12:45:06 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Service KMSELDI" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (11/06/2015 12:44:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (11/06/2015 12:44:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "MBAMScheduler" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (11/06/2015 12:44:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Intel(R) PROSet Monitoring Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. CodeIntegrity: =================================== Date: 2015-11-06 12:29:17.082 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-11-05 12:39:36.174 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-10-26 20:03:56.406 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-09-28 17:52:15.924 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-09-24 22:29:45.054 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-09-15 19:40:31.474 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-08-29 12:12:37.860 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-08-05 23:10:52.350 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. ==================== Speicherinformationen =========================== Prozessor: Intel(R) Pentium(R) CPU G3420 @ 3.20GHz Prozentuale Nutzung des RAM: 23% Installierter physikalischer RAM: 8111.13 MB Verfügbarer physikalischer RAM: 6176.89 MB Summe virtueller Speicher: 9391.13 MB Verfügbarer virtueller Speicher: 7412.32 MB ==================== Laufwerke ================================ Drive c: () (Fixed) (Total:243.36 GB) (Free:163.71 GB) NTFS Drive d: (Volume) (Fixed) (Total:687.37 GB) (Free:687.19 GB) NTFS ==================== MBR & Partitionstabelle ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: C390FBE7) Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=243.4 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=450 MB) - (Type=27) Partition 4: (Not Active) - (Size=687.4 GB) - (Type=07 NTFS) ==================== Ende von Addition.txt ============================ |
06.11.2015, 12:55 | #8 |
| Easycalender lässt sich nicht entfernen und die beiden Logdateien vom FRST: FRST: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:05-11-2015 durchgeführt von Admin (Administrator) auf PC (06-11-2015 12:50:47) Gestartet von C:\Users\Admin\Desktop Geladene Profile: Admin (Verfügbare Profile: Admin) Platform: Windows 10 Pro (X64) Sprache: Deutsch (Deutschland) Internet Explorer Version 11 (Standard-Browser: Edge) Start-Modus: Normal Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Prozesse (Nicht auf der Ausnahmeliste) ================= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.) (Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe (Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe (Microsoft Corporation) C:\Windows\System32\browser_broker.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe ==================== Registry (Nicht auf der Ausnahmeliste) =========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13636824 2013-07-26] (Realtek Semiconductor) HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation) HKLM\...\Run: [XFast LAN] => C:\Program Files\ASRock\XFast LAN\cFosSpeed.exe [2009952 2013-05-31] (cFos Software GmbH) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169744 2015-09-12] (Apple Inc.) HKLM-x32\...\Run: [XFastUSB] => C:\Program Files (x86)\XFastUSB\XFastUsb.exe [6311104 2014-12-15] (FNet Co., Ltd.) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-21] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [RoccatKonePure] => C:\Program Files (x86)\ROCCAT\Kone Pure Mouse\KonePureMonitor.EXE [561152 2014-01-20] (ROCCAT GmbH) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Spotify Web Helper] => C:\Users\Admin\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2021944 2015-06-17] (Spotify Ltd) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Spotify] => C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe [7323192 2015-06-17] (Spotify Ltd) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8551848 2015-10-19] (Piriform Ltd) HKU\S-1-5-18\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [43816 2015-04-26] (Apple Inc.) Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2015-11-06] ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation) ==================== Internet (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{947ba08f-6d7e-4686-b9ff-2806db41b1ff}: [DhcpNameServer] 192.168.0.1 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-09-29] (Microsoft Corporation) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-25] (Google Inc.) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-15] (Microsoft Corporation) BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-09-29] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-21] (Oracle Corporation) BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-25] (Google Inc.) BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-15] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-21] (Oracle Corporation) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-25] (Google Inc.) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-25] (Google Inc.) Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-10-14] (Microsoft Corporation) FireFox: ======== FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation) FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-09-04] () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-03] (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-03] (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-21] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-21] (Oracle Corporation) FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-03-31] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-19] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-19] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-09-27] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-03-31] (Microsoft Corporation) Chrome: ======= CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-05] CHR Extension: (Google Drive) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-23] CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24] CHR Extension: (Google-Suche) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-28] CHR Extension: (LoungeDestroyer) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghahcnmfjfckcedfajbhekgknjdplfcl [2015-10-07] CHR Extension: (Google Text & Tabellen Offline) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-03] CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-25] CHR Extension: (Google Mail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-29] ==================== Dienste (Nicht auf der Ausnahmeliste) ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-09-02] (Apple Inc.) S2 ASRockIOMon; C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe [454656 2013-05-28] () [Datei ist nicht signiert] S2 cFosSpeedS; C:\Program Files\ASRock\XFast LAN\spd.exe [652640 2013-05-31] (cFos Software GmbH) S3 Futuremark SystemInfo Service; C:\Program Files (x86)\Futuremark\SystemInfo\FMSISvc.exe [614624 2014-12-10] (Futuremark) R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation) R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [Datei ist nicht signiert] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation) S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-03] (Intel Corporation) S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-03] (Intel Corporation) S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes) S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1135416 2015-10-05] (Malwarebytes) S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [966336 2014-10-10] (@ByELDI) [Datei ist nicht signiert] R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation) ===================== Treiber (Nicht auf der Ausnahmeliste) ========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.) S3 AsrDrv101; C:\Windows\SysWOW64\Drivers\AsrDrv101.sys [22280 2014-12-16] (ASRock Incorporation) R0 AsrRamDisk; C:\Windows\System32\drivers\AsrRamDisk.sys [40200 2013-05-09] (ASRock Inc.) R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [102912 2015-07-15] (Advanced Micro Devices) S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider) S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider) R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [16648 2014-12-15] (FNet Co., Ltd.) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2015-11-06] (Malwarebytes) R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation) R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-03] (Intel Corporation) R3 sthid; C:\Windows\System32\drivers\sthid.sys [21216 2014-08-06] (Splashtop Inc.) S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] () S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-07-10] (Microsoft Corporation) R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [291680 2015-07-10] (Microsoft Corporation) R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation) S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X] ==================== NetSvcs (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) ==================== Ein Monat: Erstellte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-11-06 12:50 - 2015-11-06 12:50 - 00000000 ____D C:\Users\Admin\Desktop\FRST-OlderVersion 2015-11-06 12:46 - 2015-11-06 12:46 - 00001283 _____ C:\Users\Admin\Desktop\JRT.txt 2015-11-06 12:43 - 2015-11-06 12:43 - 01798976 _____ (Malwarebytes) C:\Users\Admin\Desktop\JRT.exe 2015-11-06 12:43 - 2015-11-06 12:43 - 00010166 _____ C:\Users\Admin\Desktop\mbam.txt 2015-11-06 12:38 - 2015-11-06 12:38 - 00016148 _____ C:\WINDOWS\system32\PC_Admin_HistoryPrediction.bin 2015-11-06 12:12 - 2015-11-06 12:39 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2015-11-06 12:11 - 2015-11-06 12:37 - 00001169 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-11-06 12:11 - 2015-11-06 12:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-11-06 12:11 - 2015-11-06 12:11 - 00000000 ____D C:\ProgramData\Malwarebytes 2015-11-06 12:11 - 2015-11-06 12:11 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-11-06 12:11 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2015-11-06 12:11 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2015-11-06 12:11 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys 2015-11-06 12:10 - 2015-11-06 12:11 - 22908888 _____ (Malwarebytes ) C:\Users\Admin\Downloads\mbam-setup-2.2.0.1024.exe 2015-11-06 12:09 - 2015-11-06 12:09 - 00002073 _____ C:\Users\Admin\Desktop\AdwCleaner[C3].txt 2015-11-06 12:08 - 2015-11-06 12:38 - 00014854 _____ C:\WINDOWS\PFRO.log 2015-11-06 12:05 - 2015-11-06 12:05 - 01713664 _____ C:\Users\Admin\Downloads\AdwCleaner_5.018.exe 2015-11-05 14:32 - 2015-11-06 12:51 - 00014435 _____ C:\Users\Admin\Desktop\FRST.txt 2015-11-05 14:31 - 2015-11-05 14:31 - 04404952 _____ (Kaspersky Lab ZAO) C:\Users\Admin\Desktop\tdsskiller.exe 2015-11-05 14:30 - 2015-11-06 12:50 - 02198528 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe 2015-11-05 14:30 - 2015-11-06 12:50 - 00000000 ____D C:\FRST 2015-11-05 14:13 - 2015-11-05 14:13 - 04944608 _____ (Advanced Micro Devices, Inc.) C:\Users\Admin\Downloads\autodetectutility.exe 2015-11-05 14:00 - 2015-11-05 14:00 - 00000000 ___HD C:\OneDriveTemp 2015-11-05 12:12 - 2015-11-05 12:12 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (3).exe 2015-11-04 17:15 - 2015-11-04 17:15 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (2).exe 2015-11-04 17:08 - 2015-11-06 12:07 - 00000000 ____D C:\AdwCleaner 2015-11-04 17:08 - 2015-11-04 17:08 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (1).exe 2015-11-04 16:49 - 2015-11-06 12:38 - 00000275 _____ C:\WINDOWS\WindowsUpdate.log 2015-11-04 16:49 - 2015-11-04 16:49 - 00000000 ____D C:\$SysReset 2015-11-04 16:34 - 2015-11-06 12:37 - 00000901 _____ C:\Users\Public\Desktop\CCleaner.lnk 2015-11-04 16:34 - 2015-11-04 16:34 - 00002844 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC 2015-11-04 16:34 - 2015-11-04 16:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2015-11-04 16:34 - 2015-11-04 16:34 - 00000000 ____D C:\Program Files\CCleaner 2015-11-04 16:33 - 2015-11-04 16:34 - 05524624 _____ (Piriform Ltd) C:\Users\Admin\Downloads\ccsetup511_slim.exe 2015-11-04 16:14 - 2015-11-04 16:23 - 00000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job 2015-11-04 16:13 - 2015-11-04 16:13 - 00000000 ____D C:\WINDOWS\pss 2015-11-04 16:07 - 2015-11-04 16:07 - 00003380 _____ C:\WINDOWS\System32\Tasks\{6761BBC9-893A-456B-822C-C0DF98AE0062} 2015-11-04 15:21 - 2015-11-06 12:39 - 00001004 _____ C:\WINDOWS\Tasks\28Arly8BQ3IUn.job 2015-11-04 15:21 - 2015-11-04 15:21 - 00004136 _____ C:\WINDOWS\System32\Tasks\28Arly8BQ3IUn 2015-11-04 15:19 - 2015-11-06 12:39 - 00001014 _____ C:\WINDOWS\Tasks\bSUwmicbiyVJJ5rnrs.job 2015-11-04 15:19 - 2015-11-04 15:19 - 00004156 _____ C:\WINDOWS\System32\Tasks\bSUwmicbiyVJJ5rnrs 2015-11-04 15:17 - 2015-11-04 16:00 - 00000004 _____ C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7 2015-11-04 15:17 - 2013-08-22 14:25 - 00000824 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak 2015-11-04 15:16 - 2015-11-04 15:16 - 00000000 ____D C:\Users\Public\Documents\Baidu 2015-11-04 15:15 - 2015-11-04 15:39 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Opera Software 2015-11-04 15:15 - 2015-11-04 15:39 - 00000000 ____D C:\Users\Admin\AppData\Local\Opera Software 2015-11-04 15:12 - 2015-11-04 15:39 - 00000000 ____D C:\Program Files (x86)\Opera 2015-10-30 17:15 - 2015-10-30 17:15 - 00000000 ____D C:\ProgramData\ROCCAT 2015-10-30 17:15 - 2015-10-30 17:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ROCCAT 2015-10-30 17:14 - 2015-10-30 17:14 - 24907859 _____ C:\Users\Admin\Downloads\ROCCAT_Kone_Pure_DRV1.14_FW1.21.zip 2015-10-30 17:14 - 2015-10-30 17:14 - 00000000 ____D C:\Program Files (x86)\ROCCAT 2015-10-30 17:14 - 2014-01-20 10:53 - 73113600 _____ (ROCCAT GmbH) C:\Users\Admin\Desktop\KonePureOption.exe 2015-10-30 17:13 - 2015-10-28 00:38 - 21871616 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll 2015-10-30 17:13 - 2015-10-28 00:16 - 18801664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll 2015-10-30 17:13 - 2015-10-21 13:45 - 00541024 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcupdate_GenuineIntel.dll 2015-10-30 17:13 - 2015-10-21 13:44 - 00459104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys 2015-10-30 17:13 - 2015-10-21 13:43 - 01392480 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll 2015-10-30 17:13 - 2015-10-21 13:39 - 03621248 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2015-10-30 17:13 - 2015-10-21 13:00 - 24595968 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2015-10-30 17:13 - 2015-10-21 13:00 - 03248128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll 2015-10-30 17:13 - 2015-10-21 12:59 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll 2015-10-30 17:13 - 2015-10-21 12:57 - 02418688 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll 2015-10-30 17:13 - 2015-10-21 12:52 - 02987520 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll 2015-10-30 17:13 - 2015-10-21 12:50 - 00333312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll 2015-10-30 17:13 - 2015-10-21 12:48 - 01068032 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll 2015-10-30 17:13 - 2015-10-21 12:47 - 00453120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Usb.dll 2015-10-30 17:13 - 2015-10-21 12:46 - 02179584 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll 2015-10-30 17:13 - 2015-10-21 12:46 - 01602560 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2015-10-30 17:13 - 2015-10-21 12:44 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll 2015-10-30 17:13 - 2015-10-21 12:44 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe 2015-10-30 17:13 - 2015-10-21 12:43 - 02675200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll 2015-10-30 17:13 - 2015-10-21 12:42 - 00627712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll 2015-10-30 17:13 - 2015-10-21 12:41 - 01795072 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll 2015-10-30 17:13 - 2015-10-21 12:40 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll 2015-10-30 17:13 - 2015-10-21 12:38 - 00502272 _____ (Microsoft Corporation) C:\WINDOWS\system32\dlnashext.dll 2015-10-30 17:13 - 2015-10-21 06:53 - 00961376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll 2015-10-30 17:13 - 2015-10-21 06:49 - 02878512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2015-10-30 17:13 - 2015-10-21 06:13 - 19326464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2015-10-30 17:13 - 2015-10-21 06:11 - 02647040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll 2015-10-30 17:13 - 2015-10-21 06:08 - 01918976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll 2015-10-30 17:13 - 2015-10-21 06:05 - 02639872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll 2015-10-30 17:13 - 2015-10-21 06:03 - 01380864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2015-10-30 17:13 - 2015-10-21 06:03 - 00311296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Usb.dll 2015-10-30 17:13 - 2015-10-21 05:58 - 02049536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepository.dll 2015-10-30 17:13 - 2015-10-21 05:58 - 00464896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll 2015-10-30 17:13 - 2015-10-21 05:55 - 00441344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dlnashext.dll 2015-10-26 19:45 - 2015-10-26 19:45 - 00014336 _____ C:\Users\Admin\Downloads\wenn-2.xls 2015-10-26 19:38 - 2015-10-26 19:38 - 03135063 _____ C:\Users\Admin\Downloads\Pruefung_1_Jugendarbeitsschutzgesetz_.zip 2015-10-17 13:48 - 2015-10-10 08:12 - 00078528 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll 2015-10-17 13:48 - 2015-10-06 04:03 - 16708608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll 2015-10-17 13:48 - 2015-10-06 03:46 - 13027840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll 2015-10-17 13:48 - 2015-10-01 05:01 - 01294352 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2015-10-17 13:48 - 2015-10-01 05:01 - 01123400 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2015-10-17 13:48 - 2015-10-01 05:01 - 01018568 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi 2015-10-17 13:48 - 2015-10-01 05:01 - 00858408 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe 2015-10-17 13:48 - 2015-10-01 05:00 - 08020320 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2015-10-17 13:48 - 2015-10-01 04:03 - 00757760 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll 2015-10-17 13:48 - 2015-09-25 05:01 - 02573768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll 2015-10-17 13:48 - 2015-09-25 05:01 - 00498016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys 2015-10-17 13:48 - 2015-09-25 04:56 - 22322624 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2015-10-17 13:48 - 2015-09-25 04:52 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi 2015-10-17 13:48 - 2015-09-25 04:33 - 01997336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll 2015-10-17 13:48 - 2015-09-25 04:26 - 20858360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2015-10-17 13:48 - 2015-09-25 04:11 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataAccountApis.dll 2015-10-17 13:48 - 2015-09-25 04:11 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneCallHistoryApis.dll 2015-10-17 13:48 - 2015-09-25 04:09 - 12504064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2015-10-17 13:48 - 2015-09-25 04:07 - 01276416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll 2015-10-17 13:48 - 2015-09-25 04:04 - 00826880 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll 2015-10-17 13:48 - 2015-09-25 04:04 - 00771072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll 2015-10-17 13:48 - 2015-09-25 04:03 - 00796160 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll 2015-10-17 13:48 - 2015-09-25 04:03 - 00576000 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll 2015-10-17 13:48 - 2015-09-25 04:02 - 07523840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll 2015-10-17 13:48 - 2015-09-25 04:02 - 00949248 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll 2015-10-17 13:48 - 2015-09-25 04:02 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll 2015-10-17 13:48 - 2015-09-25 04:01 - 04792320 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2015-10-17 13:48 - 2015-09-25 04:01 - 03586560 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys 2015-10-17 13:48 - 2015-09-25 04:00 - 01423872 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll 2015-10-17 13:48 - 2015-09-25 04:00 - 01382400 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys 2015-10-17 13:48 - 2015-09-25 04:00 - 00856576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContactApis.dll 2015-10-17 13:48 - 2015-09-25 04:00 - 00752640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChatApis.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 01205248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\EmailApis.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 00685568 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppointmentApis.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\MessagingDataModel2.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 00288256 _____ (Microsoft Corporation) C:\WINDOWS\system32\PimIndexMaintenance.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\CallHistoryClient.dll 2015-10-17 13:48 - 2015-09-25 03:58 - 01871360 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll 2015-10-17 13:48 - 2015-09-25 03:47 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll 2015-10-17 13:48 - 2015-09-25 03:47 - 00172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhoneCallHistoryApis.dll 2015-10-17 13:48 - 2015-09-25 03:38 - 03580416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2015-10-17 13:48 - 2015-09-25 03:38 - 00650240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll 2015-10-17 13:48 - 2015-09-25 03:38 - 00574464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll 2015-10-17 13:48 - 2015-09-25 03:38 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll 2015-10-17 13:48 - 2015-09-25 03:37 - 00766976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll 2015-10-17 13:48 - 2015-09-25 03:37 - 00613376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll 2015-10-17 13:48 - 2015-09-25 03:37 - 00480256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll 2015-10-17 13:48 - 2015-09-25 03:36 - 11262976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2015-10-17 13:48 - 2015-09-25 03:36 - 05454848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll 2015-10-17 13:48 - 2015-09-25 03:34 - 00928256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll 2015-10-17 13:48 - 2015-09-25 03:34 - 00625152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContactApis.dll 2015-10-17 13:48 - 2015-09-25 03:34 - 00579584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentApis.dll 2015-10-17 13:48 - 2015-09-25 03:34 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ChatApis.dll 2015-10-17 13:48 - 2015-09-25 03:34 - 00525312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EmailApis.dll 2015-10-17 13:48 - 2015-09-25 03:33 - 00131072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CallHistoryClient.dll 2015-10-17 13:48 - 2015-09-25 03:32 - 01594368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll 2015-10-17 13:48 - 2015-09-25 03:32 - 00466432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MessagingDataModel2.dll 2015-10-17 13:39 - 2015-11-04 16:28 - 00000000 ____D C:\Users\Admin\Desktop\Felgen 2015-10-17 13:36 - 2015-11-06 12:37 - 00001816 _____ C:\Users\Public\Desktop\iTunes.lnk 2015-10-17 13:36 - 2015-10-17 13:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2015-10-17 13:35 - 2015-11-06 12:37 - 00002523 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk 2015-10-17 13:35 - 2015-10-17 13:36 - 00000000 ____D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7 2015-10-17 13:35 - 2015-10-17 13:36 - 00000000 ____D C:\Program Files\iTunes 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\WINDOWS\System32\Tasks\Apple 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files\iPod 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files\Bonjour 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\iTunes 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\Bonjour 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\Apple Software Update 2015-10-17 13:30 - 2015-10-17 13:34 - 152447768 _____ (Apple Inc.) C:\Users\Admin\Downloads\iTunes6464Setup (1).exe 2015-10-12 18:13 - 2015-10-12 18:15 - 167601944 _____ (Apple Inc.) C:\Users\Admin\Downloads\iTunes6464Setup.exe 2015-10-12 17:20 - 2015-10-12 17:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud 2015-10-12 17:09 - 2015-10-12 17:19 - 71807792 _____ (Apple Inc.) C:\Users\Admin\Downloads\iCloudSetup.exe 2015-10-12 17:03 - 2015-10-12 17:24 - 1971067436 _____ C:\Users\Admin\Downloads\iPhone7,2_8.4.1_12H321_Restore.ipsw 2015-10-09 15:13 - 2015-10-09 15:13 - 00000000 ____D C:\Users\Admin\AppData\LocalLow\Hyper Hippo Productions Ltd_ 2015-10-09 15:12 - 2015-10-09 15:12 - 00000222 _____ C:\Users\Admin\Desktop\AdVenture Capitalist.url 2015-10-08 16:47 - 2015-10-08 16:47 - 00000000 ____D C:\ProgramData\ATI 2015-10-07 18:54 - 2015-10-07 18:54 - 00062253 _____ C:\WINDOWS\SysWOW64\CCCInstall_201510071954276182.log 2015-10-07 18:54 - 2015-10-07 18:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center 2015-10-07 18:54 - 2015-10-07 18:54 - 00000000 ____D C:\Program Files\ATI Technologies 2015-10-07 18:53 - 2015-10-07 18:54 - 00000000 ____D C:\Program Files (x86)\ATI Technologies 2015-10-07 18:53 - 2015-10-07 18:53 - 00052907 _____ C:\WINDOWS\SysWOW64\CCCInstall_201510071953453509.log 2015-10-07 18:52 - 2015-10-07 18:52 - 47794160 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\amdocl64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 39721456 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\amdocl.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 30776304 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atio6axx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 27544560 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\amdocl12cl64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 25320432 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atioglxx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 22327280 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\amdocl12cl.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 15725552 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticaldd64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 14310896 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticaldd.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 09355016 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdxc64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 08009360 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiumdva.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 07683096 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdxc32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 07482560 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiumdag.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 06686192 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdmantle64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 05216240 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdmantle32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 03471376 _____ C:\WINDOWS\SysWOW64\atiumdva.cap 2015-10-07 18:52 - 2015-10-07 18:52 - 03437632 _____ C:\WINDOWS\system32\atiumd6a.cap 2015-10-07 18:52 - 2015-10-07 18:52 - 01196032 _____ C:\WINDOWS\system32\amdocl_as64.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 01070592 _____ C:\WINDOWS\system32\amdocl_ld64.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 01004032 _____ C:\WINDOWS\SysWOW64\amdocl_as32.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00935408 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atiadlxy.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00935408 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atiadlxx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00833800 _____ C:\WINDOWS\system32\amdicdxx.dat 2015-10-07 18:52 - 2015-10-07 18:52 - 00807424 _____ C:\WINDOWS\SysWOW64\amdocl_ld32.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00662392 _____ C:\WINDOWS\SysWOW64\atiapfxx.blb 2015-10-07 18:52 - 2015-10-07 18:52 - 00662392 _____ C:\WINDOWS\system32\atiapfxx.blb 2015-10-07 18:52 - 2015-10-07 18:52 - 00631280 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\amdlvr64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00524272 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\amdlvr32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00471320 _____ C:\WINDOWS\system32\amdmiracast.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00375792 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atiapfxx.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00341488 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\ATIODE.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00243696 _____ C:\WINDOWS\system32\clinfo.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00213488 _____ C:\WINDOWS\system32\amdgfxinfo64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00199664 _____ (AMD) C:\WINDOWS\system32\atitmm64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00198640 _____ C:\WINDOWS\SysWOW64\amdgfxinfo32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00177344 _____ C:\WINDOWS\system32\ativce03.dat 2015-10-07 18:52 - 2015-10-07 18:52 - 00175648 _____ C:\WINDOWS\system32\amde31a.dat 2015-10-07 18:52 - 2015-10-07 18:52 - 00168944 _____ C:\WINDOWS\system32\atieah64.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00165360 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atig6txx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00152560 _____ C:\WINDOWS\SysWOW64\atieah32.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00151936 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\amdhcp64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00150512 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atigktxx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00143344 _____ C:\WINDOWS\system32\amdhdl64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00138384 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\amdhcp32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00136176 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\mantle64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00132080 _____ C:\WINDOWS\SysWOW64\amdhdl32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00122352 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\mantle32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00117608 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdave64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00112368 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiu9pag.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00111600 _____ C:\WINDOWS\system32\hsa-thunk64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00111088 _____ C:\WINDOWS\SysWOW64\hsa-thunk.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00110320 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdave32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00103408 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\mantleaxl64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00100816 _____ C:\WINDOWS\system32\ativce02.dat 2015-10-07 18:52 - 2015-10-07 18:52 - 00097776 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atisamu64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00096752 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\mantleaxl32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00089584 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atisamu32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00088000 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atimpc64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00088000 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdpcom64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00083952 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atig6pxx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00081168 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atimpc32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00081160 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdpcom32.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00078320 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiglpxx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00078320 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiglpxx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00073712 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00071152 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticalrt64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00068080 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00064496 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticalcl64.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00060912 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticalrt.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00059888 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\ATIODCLI.exe 2015-10-07 18:52 - 2015-10-07 18:52 - 00059376 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdmmcl6.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00057840 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticalcl.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00052208 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\ati2erec.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00048112 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdmmcl.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00047664 _____ C:\WINDOWS\system32\kapp_ci.sbin 2015-10-07 18:52 - 2015-10-07 18:52 - 00043536 _____ C:\WINDOWS\system32\kapp_si.sbin 2015-10-07 18:52 - 2015-10-07 18:52 - 00038384 _____ (AMD) C:\WINDOWS\system32\atimuixx.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00012784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\detoured.dll 2015-10-07 18:52 - 2015-10-07 18:52 - 00012784 _____ (Microsoft Corporation) C:\WINDOWS\system32\detoured.dll ==================== Ein Monat: Geänderte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-11-06 12:43 - 2015-08-05 21:51 - 01793546 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2015-11-06 12:43 - 2015-07-10 17:34 - 00772138 _____ C:\WINDOWS\system32\perfh007.dat 2015-11-06 12:43 - 2015-07-10 17:34 - 00154500 _____ C:\WINDOWS\system32\perfc007.dat 2015-11-06 12:39 - 2014-12-15 23:33 - 00001120 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2015-11-06 12:38 - 2015-07-10 13:21 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT 2015-11-06 12:37 - 2015-09-08 18:22 - 00000971 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk 2015-11-06 12:37 - 2015-08-05 22:01 - 00002358 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk 2015-11-06 12:37 - 2015-08-05 21:45 - 00001540 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2015-11-06 12:37 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\sru 2015-11-06 12:37 - 2015-07-10 10:05 - 00262144 ___SH C:\WINDOWS\system32\config\BBI 2015-11-06 12:37 - 2015-05-24 23:54 - 00000925 _____ C:\Users\Public\Desktop\VLC media player.lnk 2015-11-06 12:37 - 2015-01-06 20:22 - 00001017 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk 2015-11-06 12:37 - 2014-12-31 19:28 - 00000973 _____ C:\Users\Public\Desktop\Steam.lnk 2015-11-06 12:37 - 2014-12-31 18:33 - 00001813 _____ C:\Users\Admin\Desktop\Spotify.lnk 2015-11-06 12:37 - 2014-12-31 18:33 - 00001799 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk 2015-11-06 12:37 - 2014-12-18 21:21 - 00002445 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2015-11-06 12:37 - 2014-12-15 23:33 - 00001321 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2015-11-06 12:23 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\AppReadiness 2015-11-06 12:19 - 2014-12-15 23:33 - 00001124 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2015-11-06 11:03 - 2014-12-31 19:28 - 00000000 ____D C:\Program Files (x86)\Steam 2015-11-05 20:20 - 2015-08-05 21:41 - 00000000 ____D C:\Users\Admin 2015-11-05 18:47 - 2015-01-06 20:23 - 00000000 ____D C:\Users\Admin\AppData\Roaming\TS3Client 2015-11-05 17:46 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\rescache 2015-11-05 14:57 - 2014-12-30 15:46 - 00000000 ____D C:\ProgramData\Microsoft Help 2015-11-05 14:56 - 2014-12-30 19:00 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013 2015-11-05 14:05 - 2015-08-05 22:01 - 00000000 ___RD C:\Users\Admin\OneDrive 2015-11-04 17:09 - 2015-08-05 21:41 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2015-11-04 17:09 - 2014-12-15 23:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2015-11-04 16:42 - 2015-08-05 22:33 - 00000000 ___DC C:\WINDOWS\Panther 2015-11-04 16:42 - 2014-12-30 23:19 - 00000000 ____D C:\Users\Admin\AppData\Local\CrashDumps 2015-11-04 16:09 - 2014-12-18 21:20 - 00000000 ____D C:\Program Files (x86)\Adobe 2015-11-04 16:08 - 2014-12-15 22:53 - 00000000 ____D C:\Program Files\KMSpico 2015-11-04 15:46 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy 2015-11-04 15:39 - 2015-01-21 20:03 - 00000000 __SHD C:\Users\Admin\AppData\Local\EmieUserList 2015-11-04 15:39 - 2015-01-21 20:03 - 00000000 __SHD C:\Users\Admin\AppData\Local\EmieSiteList 2015-11-04 15:26 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\appraiser 2015-11-02 14:26 - 2015-07-10 11:55 - 00000000 ____D C:\WINDOWS\CbsTemp 2015-11-01 00:33 - 2015-01-05 18:20 - 00003972 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task 2015-10-30 17:14 - 2014-12-15 23:42 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2015-10-27 19:48 - 2014-12-31 18:33 - 00000000 ____D C:\Users\Admin\AppData\Local\Spotify 2015-10-27 19:48 - 2014-12-31 18:32 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Spotify 2015-10-26 20:55 - 2015-04-12 21:14 - 00000000 ____D C:\Users\Admin\Desktop\Mailin 2015-10-26 20:15 - 2013-08-22 14:25 - 00000167 _____ C:\WINDOWS\win.ini 2015-10-26 19:47 - 2014-12-15 22:56 - 00000000 ____D C:\Users\Admin\AppData\Local\Packages 2015-10-17 13:35 - 2015-04-10 06:25 - 00000000 ____D C:\Program Files\Common Files\Apple 2015-10-17 13:34 - 2015-04-10 06:25 - 00000000 ____D C:\ProgramData\Apple 2015-10-16 04:10 - 2015-07-10 12:06 - 00810488 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2015-10-16 04:10 - 2015-07-10 12:06 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2015-10-12 18:13 - 2015-09-08 19:52 - 00000000 ____D C:\WINDOWS\system32\appmgmt 2015-10-12 18:11 - 2014-12-30 17:39 - 00000000 ____D C:\Users\Admin\AppData\Local\Akamai 2015-10-12 17:47 - 2015-07-10 13:20 - 00348328 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2015-10-12 17:45 - 2015-07-10 17:44 - 00000000 ____D C:\Program Files\Windows Journal 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___SD C:\WINDOWS\system32\F12 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___RD C:\WINDOWS\PurchaseDialog 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\Provisioning 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\L2Schemas 2015-10-09 15:12 - 2015-01-06 13:55 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam 2015-10-07 18:53 - 2015-07-30 15:44 - 00000000 ____D C:\Program Files (x86)\AMD 2015-10-07 18:53 - 2014-12-15 22:57 - 00000000 ____D C:\AMD 2015-10-07 18:52 - 2015-07-16 01:12 - 00162240 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiuxp64.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 12088008 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atidxx64.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 10211016 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atidxx32.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 08982440 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiumd6a.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 08864928 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiumd64.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 01479808 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\aticfx64.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 01223552 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\aticfx32.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 00143056 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiuxpag.dll 2015-10-07 18:52 - 2015-07-16 01:11 - 00130072 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiu9p64.dll 2015-10-07 18:52 - 2015-07-16 01:06 - 21648880 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\atikmdag.sys 2015-10-07 18:52 - 2015-07-16 00:17 - 00683504 _____ (AMD) C:\WINDOWS\system32\atieclxx.exe 2015-10-07 18:52 - 2015-07-16 00:17 - 00451056 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atidemgy.dll 2015-10-07 18:52 - 2015-07-16 00:17 - 00255472 _____ (AMD) C:\WINDOWS\system32\atiesrxx.exe 2015-10-07 18:52 - 2015-07-16 00:13 - 01256432 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atiadlxx.dll 2015-10-07 18:52 - 2015-07-16 00:13 - 00674288 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\atikmpag.sys 2015-10-07 18:52 - 2015-07-16 00:12 - 00874480 _____ (AMD) C:\WINDOWS\system32\coinst_15.20.dll ==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ======= 2015-04-19 13:20 - 2015-04-19 13:20 - 0005872 _____ () C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn 2015-04-19 13:20 - 2015-04-19 13:20 - 0005872 _____ () C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs 2015-09-08 19:37 - 2015-09-08 19:37 - 0003225 _____ () C:\Users\Admin\AppData\Local\recently-used.xbel Einige Dateien in TEMP: ==================== C:\Users\Admin\AppData\Local\Temp\8548.exe C:\Users\Admin\AppData\Local\Temp\avgD177.exe C:\Users\Admin\AppData\Local\Temp\InstallHelper.exe C:\Users\Admin\AppData\Local\Temp\Opera_NI_stable.exe C:\Users\Admin\AppData\Local\Temp\sqlite3.dll C:\Users\Admin\AppData\Local\Temp\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\UninstallModule.exe C:\Users\Admin\AppData\Local\Temp\VLX_Player.exe ==================== Bamital & volsnap ================= (Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.) C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert C:\WINDOWS\explorer.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert C:\WINDOWS\system32\services.exe => Datei ist digital signiert C:\WINDOWS\system32\User32.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert LastRegBack: 2015-11-02 14:19 ==================== Ende von FRST.txt ============================ Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:05-11-2015 durchgeführt von Admin (2015-11-06 12:51:40) Gestartet von C:\Users\Admin\Desktop Windows 10 Pro (X64) (2015-08-05 20:58:30) Start-Modus: Normal ========================================================== ==================== Konten: ============================= Admin (S-1-5-21-3896126499-3315573620-1378135710-1001 - Administrator - Enabled) => C:\Users\Admin Administrator (S-1-5-21-3896126499-3315573620-1378135710-500 - Administrator - Disabled) DefaultAccount (S-1-5-21-3896126499-3315573620-1378135710-503 - Limited - Disabled) Gast (S-1-5-21-3896126499-3315573620-1378135710-501 - Limited - Disabled) ==================== Sicherheits-Center ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.) AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installierte Programme ====================== (Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.) 3DMark (HKLM-x32\...\{7330098c-3669-4f39-9e82-4221d489db39}) (Version: 1.4.828.0 - Futuremark) 3DMark (Version: 1.4.828.0 - Futuremark) Hidden Adobe Reader XI (11.0.13) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.13 - Adobe Systems Incorporated) AdVenture Capitalist (HKLM-x32\...\Steam App 346900) (Version: - Hyper Hippo Games) Akamai NetSession Interface (HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Akamai) (Version: - Akamai Technologies, Inc) AMD Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD) AMD Catalyst Install Manager (HKLM\...\{572C982F-95F5-0562-AE8F-8A9D7D024A88}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.) APP Shop v1.0.13 (HKLM-x32\...\{90242E9B-BC60-46E3-8EE7-8E953F702280}_is1) (Version: 1.0.13 - ASRock Inc.) Apple Application Support (32-Bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.) Apple Application Support (64-Bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{FD244E19-6EFE-4A2D-948A-0D45D4C168BE}) (Version: 9.0.0.26 - Apple Inc.) Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.) ASRock App Charger v1.0.6 (HKLM\...\ASRock App Charger_is1) (Version: 1.0.6 - ASRock Inc.) ASRock Restart to UEFI v1.0.3 (HKLM-x32\...\ASRock Restart to UEFI_is1) (Version: - ) ASRock XFast RAM v3.0.2 (HKLM\...\ASRock XFast RAM_is1) (Version: - ASRock Inc.) A-Tuning v2.0.51.1 (HKLM-x32\...\A-Tuning_is1) (Version: 2.0.51.1 - ) Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.) CCleaner (HKLM\...\CCleaner) (Version: 5.11 - Piriform) Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve) Futuremark SystemInfo (HKLM-x32\...\{2FE4C157-30AD-47F3-9D93-D9A2AFF25D3F}) (Version: 4.33.485.0 - Futuremark) GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 46.0.2490.80 - Google Inc.) Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6904.2028 - Google Inc.) Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden iCloud (HKLM\...\{709A2D23-C25E-47B5-9268-CB6FEE648504}) (Version: 4.1.1.53 - Apple Inc.) Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation) Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{0EC7F9CC-4741-45AE-9F55-6E9343F726F5}) (Version: 1.1.0.36960 - Intel Corporation) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation) Intel(R) Network Connections 18.5.54.0 (HKLM\...\PROSetDX) (Version: 18.5.54.0 - Intel) Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation) iTunes (HKLM\...\{CEC7613B-E286-4A31-BEE3-3F7798488D9F}) (Version: 12.1.3.6 - Apple Inc.) Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation) KMSpico (HKLM\...\{8B29D47F-92E2-4C20-9EE0-F710991F5D7C}_is1) (Version: - ) Malwarebytes Anti-Malware Version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes) Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation) Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation) MyDriveConnect 4.0.2.2123 (HKLM-x32\...\MyDriveConnect) (Version: 4.0.2.2123 - TomTom) Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.) ROCCAT Kone Pure Mouse Driver (HKLM-x32\...\{4905245D-56E7-4176-BE68-962728B803D6}) (Version: - Roccat GmbH) Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version: - Microsoft) Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version: - Microsoft) Hidden Splashtop Software Updater (HKLM-x32\...\Splashtop Software Updater) (Version: 1.5.6.15 - Splashtop Inc.) Splashtop Streamer (HKLM-x32\...\{B7C5EA94-B96A-41F5-BE95-25D78B486678}) (Version: 2.6.2.4 - Splashtop Inc.) Spotify (HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Spotify) (Version: 1.0.6.80.g2a801a53 - Spotify AB) Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation) TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH) Update for Skype for Business 2015 (KB2889853) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{CBCC2FD8-7DFE-4752-95B5-2E447C226F45}) (Version: - Microsoft) Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version: - Microsoft) Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version: - Microsoft) Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version: - Microsoft) VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.) VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN) WinRAR 5.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH) XFast LAN v9.05 (HKLM\...\XFast LAN) (Version: 9.05 - cFos Software GmbH, Bonn) XFastUSB (HKLM-x32\...\XFastUSB) (Version: 3.02.38 - ASRock Inc.) ==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) CustomCLSID: HKU\S-1-5-21-3896126499-3315573620-1378135710-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Admin\AppData\Local\Microsoft\OneDrive\17.3.6201.1019\FileCoAuth.exe (Microsoft Corporation) ==================== Wiederherstellungspunkte ========================= 17-10-2015 13:21:53 Removed iTunes 26-10-2015 19:59:23 Windows Update 02-11-2015 14:19:58 Windows Update 04-11-2015 15:33:50 Wiederherstellungsvorgang 06-11-2015 12:44:13 JRT Pre-Junkware Removal ==================== Hosts Inhalt: =============================== (Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.) 2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts ==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) ============= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) Task: {0641E672-CA84-4606-B6D2-9F2BABE58BF5} - System32\Tasks\28Arly8BQ3IUn => C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe <==== ACHTUNG Task: {07181339-8E57-4CB5-BBFE-76170783B9DB} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG Task: {12FB6D15-B5C0-4B66-BF0C-21D82690E855} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation) Task: {1780DAB3-4584-4FBD-92C9-8857F3886BA3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.) Task: {18B3B3A2-AFFF-476E-BA62-AB75BE1E7871} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG Task: {314E7782-948E-4C4F-B24E-BC0CC4B34F09} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG Task: {35EB728D-F128-4075-B375-D45BF71FE8B2} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\BrowserChoice\browserchoice.exe Task: {3A4FD38E-5C92-414E-9586-8C3CAA34B95C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.) Task: {3E9757E4-DB07-4418-A44D-2721FDE15694} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG Task: {4D0FE605-48D7-41B3-AD75-AD266C4238D5} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG Task: {5769C702-F476-4F1D-8161-7F0B757132B2} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation) Task: {6B883A1A-4B18-410C-B686-CE03876036BA} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG Task: {706560C9-EAA0-41D3-833A-15525024E0B5} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-26] (Apple Inc.) Task: {80A4DADB-BA50-49B2-AA96-134B855D9DA2} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation) Task: {829CE483-8082-49CD-A513-92A43A02E5FB} - System32\Tasks\{6761BBC9-893A-456B-822C-C0DF98AE0062} => pcalua.exe -a "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\Installer\setup.exe" -c --uninstall --system-level Task: {91B7D1C5-C4A2-47A1-8301-8BB576FF708E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated) Task: {A0AE8DD5-A88B-4716-868D-7DE54D6A193B} - \AutoKMS -> Keine Datei <==== ACHTUNG Task: {ABDBD144-AC98-4BFB-A605-068E267D2877} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation) Task: {AF2AD4F7-61F8-4A4D-80A1-EC7534DACF61} - System32\Tasks\bSUwmicbiyVJJ5rnrs => C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe <==== ACHTUNG Task: {B5D52175-0BF8-41EC-8DE9-7EA06BDD727D} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG Task: {C094DE92-8467-4C1A-BDA4-A77A51B90A69} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG Task: {CBA55D8E-91C9-42CD-83D1-CCEA95CCAD58} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG Task: {D9512478-B671-48F5-AB7D-4DFDF9C1B3D9} - \AutoPico Daily Restart -> Keine Datei <==== ACHTUNG Task: {DA46E218-00C4-4B54-B5E0-5243E443B1D5} - \uhy3013 -> Keine Datei <==== ACHTUNG Task: {ECA37C1B-4E7F-4781-B87B-E8B93639BBCB} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG Task: {F2497E2D-9818-4923-A176-F89FB32151E5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-10-19] (Piriform Ltd) Task: {F5E604C0-8A2B-485C-9605-9EC1FD317421} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG Task: {F69C0FCA-220E-4675-A1E1-DD67E0976A15} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation) (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.) Task: C:\WINDOWS\Tasks\28Arly8BQ3IUn.job => C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\bSUwmicbiyVJJ5rnrs.job => C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Geladene Module (Nicht auf der Ausnahmeliste) ============== 2015-07-10 12:00 - 2015-07-10 12:00 - 00028160 _____ () C:\WINDOWS\SYSTEM32\efsext.dll 2015-08-05 22:30 - 2015-08-05 22:30 - 00032768 _____ () C:\WINDOWS\SYSTEM32\licensemanagerapi.dll 2015-08-23 21:30 - 2015-08-11 10:14 - 00404480 _____ () C:\WINDOWS\System32\diagtrack_wininternal.dll 2015-10-01 09:14 - 2015-09-17 07:48 - 02494712 _____ () C:\WINDOWS\system32\CoreUIComponents.dll 2015-10-01 09:14 - 2015-09-17 07:48 - 02494712 _____ () C:\WINDOWS\System32\CoreUIComponents.dll 2015-10-19 21:00 - 2015-10-19 21:00 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll 2015-10-01 09:14 - 2015-09-17 06:48 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll 2015-10-01 09:14 - 2015-09-17 06:44 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll 2015-10-01 09:14 - 2015-09-17 06:42 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll 2015-10-01 09:14 - 2015-09-17 06:49 - 00884736 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll 2015-10-01 09:14 - 2015-09-17 06:42 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll 2015-10-01 09:14 - 2015-09-17 06:43 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll 2015-03-20 17:12 - 2015-03-20 17:12 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2015-03-20 17:12 - 2015-03-20 17:12 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2015-10-01 09:14 - 2015-09-17 06:43 - 00928768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RulesBackgroundTasks.dll 2014-12-15 23:45 - 2013-09-03 16:52 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll ==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) ========= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.) ==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.) ==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.) ==================== Internet Explorer Vertrauenswürdig/Eingeschränkt =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.) ==================== Andere Bereiche ============================ (Aktuell gibt es keinen automatisierten Fix für diesen Bereich.) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppBackground\{8f613224-081d-4870-95b1-d3401a9c063b}.jpg DNS Servers: 192.168.0.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Windows Firewall ist aktiviert. ==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge == (Aktuell gibt es keinen automatisierten Fix für diesen Bereich.) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Akamai NetSession Interface" HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Spotify" HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Spotify Web Helper" ==================== Firewall Regeln (Nicht auf der Ausnahmeliste) =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139 FirewallRules: [{AA2759FA-EDA9-49D9-8F1E-31DBB008545D}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe FirewallRules: [{21668B50-B857-45A9-B645-E11ECDD0BA49}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe FirewallRules: [{6CB59014-5555-42F1-8B13-C849BCCFE2D5}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe FirewallRules: [{A3131C8E-696E-4F51-ACFD-B2AB59280978}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe FirewallRules: [{FEE6B3AF-FAFD-4C1B-B25C-3D7B4B195124}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{B443DA33-A6A7-4033-956B-A93AC3CBC433}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{E6CBFDB1-E319-4DB8-AFE5-A4934C2C92BB}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{6A8E79CC-2575-4BAE-8F1C-D7A7E2F46E1E}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{8E7D9FDF-1879-4244-A2C6-EBC14CC669E7}] => (Allow) %USERPROFILE%\jagexcache\jagexlauncher\bin\JagexLauncher.exe FirewallRules: [{35A1C72A-BDD3-483A-89A4-27F37D6F2DF0}] => (Allow) %USERPROFILE%\jagexcache\jagexlauncher\bin\JagexLauncher.exe FirewallRules: [{B6240254-8695-4136-8688-496A32476A12}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe FirewallRules: [{E7AD38FE-F37D-44CA-9649-1701BCC99048}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe FirewallRules: [{B0CB35E9-5E30-4F33-B965-F50096A6FF89}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe FirewallRules: [{D97329F3-5344-4F9A-ABBF-5E569CF1D363}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe FirewallRules: [{CAEEFC92-F0A2-4DE5-A2E7-FFCAFF3B70D4}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe FirewallRules: [{DA773FEA-CDF4-4FFB-818E-B255D4ABA4EF}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe FirewallRules: [{22A49953-B3ED-4BC6-8832-A1E30DE6E35D}] => (Block) C:\users\admin\appdata\roaming\spotify\spotify.exe FirewallRules: [{C130419E-ACEF-4A16-B5CD-F7064DA07399}] => (Block) C:\users\admin\appdata\roaming\spotify\spotify.exe FirewallRules: [UDP Query User{8F3963CA-4443-496D-B9E4-2A16E020A73E}C:\users\admin\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\admin\appdata\roaming\spotify\spotify.exe FirewallRules: [TCP Query User{C9892719-B171-4AE8-B087-57F263271C60}C:\users\admin\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\admin\appdata\roaming\spotify\spotify.exe FirewallRules: [{52E0F1D2-FD56-4E24-A22C-DE206D1494F7}] => (Allow) C:\Windows\AutoKMS\AutoKMS.exe FirewallRules: [{7039608C-3BAF-4175-B1D5-9DB53104CE60}] => (Allow) C:\Windows\AutoKMS\AutoKMS.exe FirewallRules: [{A6677B6E-9570-4D98-87FE-84B9780B452C}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{CD221F27-BA09-4A4E-BC94-50541EBCB868}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{85BC76F4-96B4-4164-A507-B85036C799E4}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe FirewallRules: [{05E12DE1-3BF9-4600-BD77-0809E7D8C280}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe FirewallRules: [UDP Query User{6B3064D8-144A-4C73-834F-582573F693E1}C:\users\admin\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\admin\appdata\local\akamai\netsession_win.exe FirewallRules: [TCP Query User{4F97824E-B35A-4B0C-97A6-D3BAFD6E693B}C:\users\admin\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\admin\appdata\local\akamai\netsession_win.exe FirewallRules: [{ACFE8A12-C5A4-41FC-90A6-7D110C49FAEE}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe FirewallRules: [{55CAAA0F-FBB7-462F-8A31-FCCBE685917A}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe FirewallRules: [{046FF7F9-A214-4106-ADBB-6B8AD4D530E1}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe FirewallRules: [{B26C67AD-595F-4798-8BA9-48A408D1A66A}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe FirewallRules: [{0812631C-DFED-4D26-BAD8-38EC0D43A5F9}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe FirewallRules: [{DD625CA9-74CC-4EF5-8787-672253D8102B}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe FirewallRules: [{92F406C8-75D5-4ABC-B10E-2BCB8528AAD5}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{2E1B87E5-B37C-4C66-97F9-A7331EB138D4}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{20E5CF9D-CD2B-48EC-8529-99B170102939}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\AdVenture Capitalist\adventure-capitalist.exe FirewallRules: [{C1EF0CA2-2081-43FE-8B04-16DE223F8C15}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\AdVenture Capitalist\adventure-capitalist.exe FirewallRules: [{C20F43D5-69D4-45A1-AD1B-C744E89D4511}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{7E097365-0904-432E-929B-8F1CD4D41E51}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{1E925C46-62CE-4FA6-82B0-ABDF754998C5}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{F8DCB71C-268A-4DB2-8339-FDB932450A7D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{DD491145-F36D-48BC-A4CF-458D412FE1DE}] => (Allow) C:\Program Files\iTunes\iTunes.exe FirewallRules: [{9E2BD5A0-E113-4596-8766-27355FE2915D}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe FirewallRules: [{E745B22D-7912-4168-B501-8A08C1F3C580}] => (Allow) C:\Program Files (x86)\Max Driver Updater\maxdu.exe FirewallRules: [{93C38DE8-53A2-4A89-9205-B0807ACAA3F2}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe FirewallRules: [{279EF737-27B1-40C7-99AC-8EAD354171BD}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe FirewallRules: [{7886F932-3D5E-474B-9059-A0E18BD488B9}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\DataProxy.exe ==================== Fehlerhafte Geräte im Gerätemanager ============= ==================== Fehlereinträge in der Ereignisanzeige: ========================= Applikationsfehler: ================== Error: (11/06/2015 12:45:08 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: MicrosoftEdge.exe, Version: 11.0.10240.16566, Zeitstempel: 0x56277dbe Name des fehlerhaften Moduls: CoreUIComponents.dll, Version: 0.0.0.0, Zeitstempel: 0x55fa4b76 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000000000060f73 ID des fehlerhaften Prozesses: 0x7e8 Startzeit der fehlerhaften Anwendung: 0xMicrosoftEdge.exe0 Pfad der fehlerhaften Anwendung: MicrosoftEdge.exe1 Pfad des fehlerhaften Moduls: MicrosoftEdge.exe2 Berichtskennung: MicrosoftEdge.exe3 Vollständiger Name des fehlerhaften Pakets: MicrosoftEdge.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: MicrosoftEdge.exe5 Error: (11/06/2015 12:44:23 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: ) Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer". Details: AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll. System Error: Zugriff verweigert . Error: (11/05/2015 08:20:37 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC) Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“. Error: (11/05/2015 01:57:18 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC) Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2147024865. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“. Error: (11/05/2015 01:57:18 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC) Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2147024865. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“. Error: (11/05/2015 01:57:18 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC) Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“. Error: (11/04/2015 05:09:31 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: MicrosoftEdge.exe, Version: 11.0.10240.16566, Zeitstempel: 0x56277dbe Name des fehlerhaften Moduls: CoreUIComponents.dll, Version: 0.0.0.0, Zeitstempel: 0x55fa4b76 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000000000060f73 ID des fehlerhaften Prozesses: 0x1f70 Startzeit der fehlerhaften Anwendung: 0xMicrosoftEdge.exe0 Pfad der fehlerhaften Anwendung: MicrosoftEdge.exe1 Pfad des fehlerhaften Moduls: MicrosoftEdge.exe2 Berichtskennung: MicrosoftEdge.exe3 Vollständiger Name des fehlerhaften Pakets: MicrosoftEdge.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: MicrosoftEdge.exe5 Error: (11/04/2015 04:53:58 PM) (Source: System Restore) (EventID: 8210) (User: ) Description: Unbekannter Fehler bei der Systemwiederherstellung: (Windows Update). Zusätzliche Informationen: 0x80070571. Error: (11/04/2015 04:23:32 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC) Description: Bei der Aktivierung der App „Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe:MicrosoftEdge.AppX9zvsr9qeth9e9a03yr0g7rpdrcrwgn5r.mca“ ist folgender Fehler aufgetreten: -2144927149. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“. Error: (11/04/2015 04:14:43 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC) Description: Bei der Aktivierung der App „Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe:MicrosoftEdge.AppX9zvsr9qeth9e9a03yr0g7rpdrcrwgn5r.mca“ ist folgender Fehler aufgetreten: -2144927149. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“. Systemfehler: ============= Error: (11/06/2015 12:45:08 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Intel(R) Dynamic Application Loader Host Interface Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (11/06/2015 12:45:08 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Intel(R) ME Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (11/06/2015 12:45:08 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "iPod-Dienst" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (11/06/2015 12:45:07 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "cFosSpeed System Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (11/06/2015 12:45:07 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "Intel(R) Capability Licensing Service Interface" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts. Error: (11/06/2015 12:45:06 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Dienst "Bonjour"" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (11/06/2015 12:45:06 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Service KMSELDI" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (11/06/2015 12:44:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (11/06/2015 12:44:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "MBAMScheduler" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (11/06/2015 12:44:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Intel(R) PROSet Monitoring Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. CodeIntegrity: =================================== Date: 2015-11-06 12:29:17.082 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-11-05 12:39:36.174 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-10-26 20:03:56.406 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-09-28 17:52:15.924 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-09-24 22:29:45.054 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-09-15 19:40:31.474 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-08-29 12:12:37.860 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-08-05 23:10:52.350 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. ==================== Speicherinformationen =========================== Prozessor: Intel(R) Pentium(R) CPU G3420 @ 3.20GHz Prozentuale Nutzung des RAM: 23% Installierter physikalischer RAM: 8111.13 MB Verfügbarer physikalischer RAM: 6176.89 MB Summe virtueller Speicher: 9391.13 MB Verfügbarer virtueller Speicher: 7412.32 MB ==================== Laufwerke ================================ Drive c: () (Fixed) (Total:243.36 GB) (Free:163.71 GB) NTFS Drive d: (Volume) (Fixed) (Total:687.37 GB) (Free:687.19 GB) NTFS ==================== MBR & Partitionstabelle ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: C390FBE7) Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=243.4 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=450 MB) - (Type=27) Partition 4: (Not Active) - (Size=687.4 GB) - (Type=07 NTFS) ==================== Ende von Addition.txt ============================ Vielen Dank! Mfg, Martin |
06.11.2015, 13:06 | #9 |
/// TB-Ausbilder | Easycalender lässt sich nicht entfernen Servus, bevor wir weitermachen, bitte nochmal kurz FRST so ausführen:
|
06.11.2015, 13:11 | #10 |
| Easycalender lässt sich nicht entfernen Hallo nochmal, anbei die Search.txt Code:
ATTFilter Farbar Recovery Scan Tool (x64) Version:05-11-2015 durchgeführt von Admin (2015-11-06 13:10:53) Gestartet von C:\Users\Admin\Desktop Start-Modus: Normal ================== Registry-Suche: "CinemaPlus;MyBrowser;mbot_de;re-markit" =========== ===================== Suchergebnis für "CinemaPlus" ========== [HKEY_USERS\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store] "C:\Program Files (x86)\CinemaPlus_1.3dV04.11\Uninstall.exe"="0x534143500100000000000000070000002800000050CE0100AD160200030000000000000000000306000100000261329FFFBAD0010000000000000000020000002800000000000000000000000000000000000000000000000000000068BF0000000000000100000001000000" ===================== Suchergebnis für "MyBrowser" ========== [HKEY_USERS\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store] "C:\Program Files (x86)\MyBrowser\MyBrowser\Application\39.5.2171.95\Installer\setup.exe"="0x534143500100000000000000070000002800000000D20D0000000000030000000000000000000306000100000261329FFFBAD0010000000000000000010000000400000001000000050000001000000000000000000000000000000000000000020000002800000000000000000000000082820000000000008080000000000042240000000000000A0000000A000000" ===================== Suchergebnis für "mbot_de" ========== [HKEY_USERS\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\UFH\SHC] "0"="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MYBESTOFFERSTODAY\MyBestOffersToday.lnk C:\Program Files (x86)\mbot_de_014010136\mybestofferstoday_widget.exe " ====== Ende von Suche ====== |
06.11.2015, 13:21 | #11 |
/// TB-Ausbilder | Easycalender lässt sich nicht entfernen Wir entfernen noch die letzten Reste und kontrollieren anschließend nochmal alles, damit dein Rechner auch sauber ist. Hinweis: Der Suchlauf mit ESET kann länger dauern. Schritt 1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start CloseProcesses: C:\Users\Public\Documents\Baidu C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs Task: C:\WINDOWS\Tasks\28Arly8BQ3IUn.job => C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\bSUwmicbiyVJJ5rnrs.job => C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe <==== ACHTUNG Task: {0641E672-CA84-4606-B6D2-9F2BABE58BF5} - System32\Tasks\28Arly8BQ3IUn => C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe <==== ACHTUNG C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe Task: {AF2AD4F7-61F8-4A4D-80A1-EC7534DACF61} - System32\Tasks\bSUwmicbiyVJJ5rnrs => C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe <==== ACHTUNG C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe Task: {07181339-8E57-4CB5-BBFE-76170783B9DB} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG Task: {18B3B3A2-AFFF-476E-BA62-AB75BE1E7871} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG Task: {314E7782-948E-4C4F-B24E-BC0CC4B34F09} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG Task: {3E9757E4-DB07-4418-A44D-2721FDE15694} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG Task: {4D0FE605-48D7-41B3-AD75-AD266C4238D5} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG Task: {6B883A1A-4B18-410C-B686-CE03876036BA} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG Task: {829CE483-8082-49CD-A513-92A43A02E5FB} - System32\Tasks\{6761BBC9-893A-456B-822C-C0DF98AE0062} => pcalua.exe -a "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\Installer\setup.exe" -c --uninstall --system-level Task: {A0AE8DD5-A88B-4716-868D-7DE54D6A193B} - \AutoKMS -> Keine Datei <==== ACHTUNG Task: {B5D52175-0BF8-41EC-8DE9-7EA06BDD727D} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG Task: {C094DE92-8467-4C1A-BDA4-A77A51B90A69} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG Task: {CBA55D8E-91C9-42CD-83D1-CCEA95CCAD58} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG Task: {D9512478-B671-48F5-AB7D-4DFDF9C1B3D9} - \AutoPico Daily Restart -> Keine Datei <==== ACHTUNG Task: {DA46E218-00C4-4B54-B5E0-5243E443B1D5} - \uhy3013 -> Keine Datei <==== ACHTUNG Task: {ECA37C1B-4E7F-4781-B87B-E8B93639BBCB} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG FirewallRules: [{52E0F1D2-FD56-4E24-A22C-DE206D1494F7}] => (Allow) C:\Windows\AutoKMS\AutoKMS.exe FirewallRules: [{7039608C-3BAF-4175-B1D5-9DB53104CE60}] => (Allow) C:\Windows\AutoKMS\AutoKMS.exe FirewallRules: [{E745B22D-7912-4168-B501-8A08C1F3C580}] => (Allow) C:\Program Files (x86)\Max Driver Updater\maxdu.exe RemoveProxy: EmptyTemp: end Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 2 Downloade dir die passende Version von HitmanPro auf deinen Desktop: HitmanPro - 32 Bit | HitmanPro - 64 Bit.
Schritt 3 ESET Online Scanner
Schritt 4
Bitte poste mit deiner nächsten Antwort
Geändert von M-K-D-B (06.11.2015 um 13:52 Uhr) |
06.11.2015, 21:45 | #12 |
| Easycalender lässt sich nicht entfernen Hallo, anbei die Logdatei des FRST-Fix: Code:
ATTFilter Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version:05-11-2015 durchgeführt von Admin (2015-11-06 19:56:27) Run:1 Gestartet von C:\Users\Admin\Desktop Geladene Profile: Admin (Verfügbare Profile: Admin) Start-Modus: Normal ============================================== fixlist Inhalt: ***************** start CloseProcesses: C:\Users\Public\Documents\Baidu C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs Task: C:\WINDOWS\Tasks\28Arly8BQ3IUn.job => C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\bSUwmicbiyVJJ5rnrs.job => C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe <==== ACHTUNG Task: {0641E672-CA84-4606-B6D2-9F2BABE58BF5} - System32\Tasks\28Arly8BQ3IUn => C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe <==== ACHTUNG C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe Task: {AF2AD4F7-61F8-4A4D-80A1-EC7534DACF61} - System32\Tasks\bSUwmicbiyVJJ5rnrs => C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe <==== ACHTUNG C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe Task: {07181339-8E57-4CB5-BBFE-76170783B9DB} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG Task: {18B3B3A2-AFFF-476E-BA62-AB75BE1E7871} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG Task: {314E7782-948E-4C4F-B24E-BC0CC4B34F09} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG Task: {3E9757E4-DB07-4418-A44D-2721FDE15694} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG Task: {4D0FE605-48D7-41B3-AD75-AD266C4238D5} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG Task: {6B883A1A-4B18-410C-B686-CE03876036BA} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG Task: {829CE483-8082-49CD-A513-92A43A02E5FB} - System32\Tasks\{6761BBC9-893A-456B-822C-C0DF98AE0062} => pcalua.exe -a "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\Installer\setup.exe" -c --uninstall --system-level Task: {A0AE8DD5-A88B-4716-868D-7DE54D6A193B} - \AutoKMS -> Keine Datei <==== ACHTUNG Task: {B5D52175-0BF8-41EC-8DE9-7EA06BDD727D} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG Task: {C094DE92-8467-4C1A-BDA4-A77A51B90A69} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG Task: {CBA55D8E-91C9-42CD-83D1-CCEA95CCAD58} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG Task: {D9512478-B671-48F5-AB7D-4DFDF9C1B3D9} - \AutoPico Daily Restart -> Keine Datei <==== ACHTUNG Task: {DA46E218-00C4-4B54-B5E0-5243E443B1D5} - \uhy3013 -> Keine Datei <==== ACHTUNG Task: {ECA37C1B-4E7F-4781-B87B-E8B93639BBCB} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG FirewallRules: [{52E0F1D2-FD56-4E24-A22C-DE206D1494F7}] => (Allow) C:\Windows\AutoKMS\AutoKMS.exe FirewallRules: [{7039608C-3BAF-4175-B1D5-9DB53104CE60}] => (Allow) C:\Windows\AutoKMS\AutoKMS.exe FirewallRules: [{E745B22D-7912-4168-B501-8A08C1F3C580}] => (Allow) C:\Program Files (x86)\Max Driver Updater\maxdu.exe RemoveProxy: EmptyTemp: end ***************** Prozess erfolgreich geschlossen. C:\Users\Public\Documents\Baidu => erfolgreich verschoben C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn => erfolgreich verschoben C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs => erfolgreich verschoben C:\WINDOWS\Tasks\28Arly8BQ3IUn.job => erfolgreich verschoben C:\WINDOWS\Tasks\bSUwmicbiyVJJ5rnrs.job => erfolgreich verschoben "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{0641E672-CA84-4606-B6D2-9F2BABE58BF5}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0641E672-CA84-4606-B6D2-9F2BABE58BF5}" => Schlüssel erfolgreich entfernt C:\WINDOWS\System32\Tasks\28Arly8BQ3IUn => erfolgreich verschoben "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\28Arly8BQ3IUn" => Schlüssel erfolgreich entfernt "C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe" => nicht gefunden. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{AF2AD4F7-61F8-4A4D-80A1-EC7534DACF61}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AF2AD4F7-61F8-4A4D-80A1-EC7534DACF61}" => Schlüssel erfolgreich entfernt C:\WINDOWS\System32\Tasks\bSUwmicbiyVJJ5rnrs => erfolgreich verschoben "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\bSUwmicbiyVJJ5rnrs" => Schlüssel erfolgreich entfernt "C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe" => nicht gefunden. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{07181339-8E57-4CB5-BBFE-76170783B9DB}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{07181339-8E57-4CB5-BBFE-76170783B9DB}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{18B3B3A2-AFFF-476E-BA62-AB75BE1E7871}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{18B3B3A2-AFFF-476E-BA62-AB75BE1E7871}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{314E7782-948E-4C4F-B24E-BC0CC4B34F09}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{314E7782-948E-4C4F-B24E-BC0CC4B34F09}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3E9757E4-DB07-4418-A44D-2721FDE15694}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3E9757E4-DB07-4418-A44D-2721FDE15694}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4D0FE605-48D7-41B3-AD75-AD266C4238D5}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4D0FE605-48D7-41B3-AD75-AD266C4238D5}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6B883A1A-4B18-410C-B686-CE03876036BA}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6B883A1A-4B18-410C-B686-CE03876036BA}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{829CE483-8082-49CD-A513-92A43A02E5FB}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{829CE483-8082-49CD-A513-92A43A02E5FB}" => Schlüssel erfolgreich entfernt C:\WINDOWS\System32\Tasks\{6761BBC9-893A-456B-822C-C0DF98AE0062} => erfolgreich verschoben "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{6761BBC9-893A-456B-822C-C0DF98AE0062}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{A0AE8DD5-A88B-4716-868D-7DE54D6A193B}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A0AE8DD5-A88B-4716-868D-7DE54D6A193B}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoKMS" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{B5D52175-0BF8-41EC-8DE9-7EA06BDD727D}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B5D52175-0BF8-41EC-8DE9-7EA06BDD727D}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C094DE92-8467-4C1A-BDA4-A77A51B90A69}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C094DE92-8467-4C1A-BDA4-A77A51B90A69}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CBA55D8E-91C9-42CD-83D1-CCEA95CCAD58}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CBA55D8E-91C9-42CD-83D1-CCEA95CCAD58}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D9512478-B671-48F5-AB7D-4DFDF9C1B3D9}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D9512478-B671-48F5-AB7D-4DFDF9C1B3D9}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoPico Daily Restart" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{DA46E218-00C4-4B54-B5E0-5243E443B1D5}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DA46E218-00C4-4B54-B5E0-5243E443B1D5}" => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\uhy3013 => Schlüssel nicht gefunden. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{ECA37C1B-4E7F-4781-B87B-E8B93639BBCB}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ECA37C1B-4E7F-4781-B87B-E8B93639BBCB}" => Schlüssel erfolgreich entfernt "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d" => Schlüssel erfolgreich entfernt HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{52E0F1D2-FD56-4E24-A22C-DE206D1494F7} => Wert erfolgreich entfernt HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{7039608C-3BAF-4175-B1D5-9DB53104CE60} => Wert erfolgreich entfernt HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{E745B22D-7912-4168-B501-8A08C1F3C580} => Wert erfolgreich entfernt ========= RemoveProxy: ========= HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt ========= Ende von RemoveProxy: ========= EmptyTemp: => 248.3 MB temporäre Dateien entfernt. Das System musste neu gestartet werden. ==== Ende von Fixlog 19:56:36 ==== Code:
ATTFilter HitmanPro 3.7.10.251 www.hitmanpro.com Computer name . . . . : PC Windows . . . . . . . : 10.0.0.10240.X64/2 User name . . . . . . : PC\Admin UAC . . . . . . . . . : Enabled License . . . . . . . : Free Scan date . . . . . . : 2015-11-06 20:04:21 Scan mode . . . . . . : Normal Scan duration . . . . : 6m 6s Disk access mode . . : Direct disk access (SRB) Cloud . . . . . . . . : Internet Reboot . . . . . . . : No Threats . . . . . . . : 1 Traces . . . . . . . : 46 Objects scanned . . . : 1.631.223 Files scanned . . . . : 37.539 Remnants scanned . . : 377.131 files / 1.216.553 keys Malware _____________________________________________________________________ C:\Program Files\KMSpico\Service_KMS.exe Size . . . . . . . : 966.336 bytes Age . . . . . . . : 325.9 days (2014-12-15 22:53:52) Entropy . . . . . : 6.0 SHA-256 . . . . . : D446B1B31B823875E0536CA8A2F784093B0DA77A875FB0F2D5EABB6DE711CFFC Needs elevation . : Yes Product . . . . . : Service_KMS Publisher . . . . : @ByELDI Description . . . : Service_KMS Version . . . . . : 14.0.0.4 RSA Key Size . . . : 1024 Service . . . . . : Service KMSELDI LanguageID . . . . : 0 Authenticode . . . : Valid Running processes : 2636 > Kaspersky . . . . : not-a-virus:RiskTool.Win32.ProcPatcher.aat Fuzzy . . . . . . : 90.0 Startup HKLM\SYSTEM\CurrentControlSet\Services\Service KMSELDI\ Suspicious files ____________________________________________________________ C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GDVZFDQ2\FRST64[1].exe Size . . . . . . . : 2.198.528 bytes Age . . . . . . . : 0.3 days (2015-11-06 12:50:38) Entropy . . . . . : 7.6 SHA-256 . . . . . : D33E591C587FD3A772D55ED7718564DA16237D74FE6C5D108EA6611BDAA35A6F Needs elevation . : Yes Fuzzy . . . . . . : 24.0 Program has no publisher information but prompts the user for permission elevation. Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs. Authors name is missing in version info. This is not common to most programs. Version control is missing. This file is probably created by an individual. This is not typical for most programs. Time indicates that the file appeared recently on this computer. Forensic Cluster -0.2s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GDVZFDQ2\82[1].htm -0.2s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\LOQSOK05.txt -0.2s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\88Y1LCKB.txt 0.0s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GDVZFDQ2\FRST64[1].exe 0.0s C:\Users\Admin\Desktop\FRST64.exe 0.8s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\87\922F1042B8692EF7.dat 0.8s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\68\7E43BDF9BABC8E74.dat 3.5s C:\Users\Admin\Desktop\FRST-OlderVersion\ 4.5s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\48\E744E92281773330.dat 4.6s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\08\39D499AEF98EE6B0.dat C:\Users\Admin\Desktop\FRST-OlderVersion\FRST64.exe Size . . . . . . . : 2.198.016 bytes Age . . . . . . . : 1.2 days (2015-11-05 14:30:03) Entropy . . . . . : 7.6 SHA-256 . . . . . : 39FEF3436440B2FC7A998855C3C33446EA14A440EE9A07E1AB2140C46EEAF52E Needs elevation . : Yes Fuzzy . . . . . . : 24.0 Program has no publisher information but prompts the user for permission elevation. Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs. Authors name is missing in version info. This is not common to most programs. Version control is missing. This file is probably created by an individual. This is not typical for most programs. Time indicates that the file appeared recently on this computer. Forensic Cluster 0.0s C:\Users\Admin\Desktop\FRST-OlderVersion\FRST64.exe 3.6s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\73\4D667FACA8CA3F25.dat 3.6s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\4\73\ 3.6s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\4\73\4D667FACA8CA3F25.dat 6.0s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{4F7513BE-038F-445E-9417-D09C682D7AE6} 29.1s C:\Windows\Prefetch\FRST64.EXE-3667DBA6.pf 30.6s C:\FRST\Hives\ 30.6s C:\FRST\Logs\ 30.6s C:\FRST\ 30.6s C:\FRST\Quarantine\ 30.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{D780FC8B-7A6B-4BB9-9743-B34143F3BE53} 30.9s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\3EED5C5703A7C712951A04592694CEA2 31.7s C:\FRST\Hives\ERDNT.INF 31.7s C:\FRST\Hives\ERDNT.CON 31.7s C:\FRST\Hives\SAM 31.7s C:\FRST\Hives\DEFAULT 31.8s C:\FRST\Hives\SECURITY 31.8s C:\FRST\Hives\SYSTEM 31.9s C:\FRST\Hives\SOFTWARE 32.1s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\40\9E4B90858055AAD4.dat 32.2s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\26\4A6D46E8F573A0F6.dat 32.4s C:\FRST\Hives\BCD 32.5s C:\FRST\Hives\Users\ 32.5s C:\FRST\Hives\Users\00000001\ 32.5s C:\FRST\Hives\Users\00000001\NTUSER.DAT 32.5s C:\FRST\Hives\Users\00000002\ 32.5s C:\FRST\Hives\Users\00000002\UsrClass.dat 32.7s C:\FRST\Hives\ERDNT.EXE 32.7s C:\FRST\Hives\ERDNTWIN.LOC 32.7s C:\FRST\Hives\ERDNTDOS.LOC 32.8s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\2\73\4D667FACA8CA3F25.dat 45.8s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\76\776308D43420DF74.dat C:\Users\Admin\Desktop\FRST64.exe Size . . . . . . . : 2.198.528 bytes Age . . . . . . . : 0.3 days (2015-11-06 12:50:38) Entropy . . . . . : 7.6 SHA-256 . . . . . : D33E591C587FD3A772D55ED7718564DA16237D74FE6C5D108EA6611BDAA35A6F Needs elevation . : Yes Fuzzy . . . . . . : 24.0 Program has no publisher information but prompts the user for permission elevation. Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs. Authors name is missing in version info. This is not common to most programs. Version control is missing. This file is probably created by an individual. This is not typical for most programs. Time indicates that the file appeared recently on this computer. Forensic Cluster -0.2s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GDVZFDQ2\82[1].htm -0.2s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\LOQSOK05.txt -0.2s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\88Y1LCKB.txt -0.0s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GDVZFDQ2\FRST64[1].exe 0.0s C:\Users\Admin\Desktop\FRST64.exe 0.8s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\87\922F1042B8692EF7.dat 0.8s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\68\7E43BDF9BABC8E74.dat 3.5s C:\Users\Admin\Desktop\FRST-OlderVersion\ 4.5s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\48\E744E92281773330.dat 4.5s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\08\39D499AEF98EE6B0.dat Potential Unwanted Programs _________________________________________________ HKLM\SOFTWARE\Classes\AppID\{9F2949D6-977B-4B61-B513-0C2EE52C2B4F}\ (Acengine) HKLM\SOFTWARE\Classes\Interface\{00E3D575-A24C-4BBC-A708-BCDB8BBCA6C7}\ (Acengine) HKLM\SOFTWARE\Classes\Interface\{024BF4C8-B53D-45B9-957F-D3BA9655FF39}\ (Acengine) HKLM\SOFTWARE\Classes\Interface\{074DCA49-F6A1-417F-B79E-D5E3ADC30330}\ (Acengine) HKLM\SOFTWARE\Classes\Interface\{3323765B-5B83-4406-841E-473DBA4B8F29}\ (Acengine) HKLM\SOFTWARE\Classes\Interface\{389562C4-59D9-40C4-966E-28DA91725FFE}\ (Acengine) HKLM\SOFTWARE\Classes\Interface\{3F8D3B31-AEB8-4ED7-8B05-5556068D6B54}\ (Acengine) HKLM\SOFTWARE\Classes\Interface\{6ED1EF08-DFF4-4252-8986-691D06C54131}\ (Acengine) HKLM\SOFTWARE\Classes\Interface\{83E07061-02D1-41EC-8751-BB176B823C38}\ (Acengine) HKLM\SOFTWARE\Classes\Interface\{9F0948E7-227A-4F1B-9849-2D8912F185A7}\ (Acengine) HKLM\SOFTWARE\Classes\Interface\{A471A4AA-5C18-429F-81BF-6C760941DB74}\ (Acengine) HKLM\SOFTWARE\Classes\Interface\{C0A7C2B3-86D6-42AF-8221-79C9E4AD50BA}\ (Acengine) HKLM\SOFTWARE\Classes\Interface\{F2FB003D-07C7-4E4D-80E3-00B49468A6F4}\ (Acengine) HKLM\SOFTWARE\Classes\Interface\{F7971E81-FC71-4659-8CCE-C903576E0924}\ (Acengine) HKLM\SOFTWARE\Classes\Wow6432Node\AppID\{9F2949D6-977B-4B61-B513-0C2EE52C2B4F}\ (Acengine) HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{34EBA76A-E745-4B18-96C9-2B8E2BA8B246}\ (Acengine) HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{3A8E009B-E66D-4016-87CF-EC57FA9A4BC1}\ (Acengine) HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{4D4D0357-0376-4656-A040-65AC089E84A2}\ (Acengine) HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{6D5AF218-5F7E-40E0-B49D-54FFAFE2001A}\ (Acengine) HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{89E46EA6-2F87-4D79-8FFA-8B264F93F54A}\ (Acengine) HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{9ECCDEFC-1C26-4BB3-B6DF-252672D9FFFA}\ (Acengine) HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{F1BC674D-15D8-46C5-AC51-12AB16D67616}\ (Acengine) HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{F811C371-1DC7-4E2F-8676-D96B85BE4AF1}\ (Acengine) HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{00E3D575-A24C-4BBC-A708-BCDB8BBCA6C7}\ (Acengine) HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{024BF4C8-B53D-45B9-957F-D3BA9655FF39}\ (Acengine) HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{074DCA49-F6A1-417F-B79E-D5E3ADC30330}\ (Acengine) HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3323765B-5B83-4406-841E-473DBA4B8F29}\ (Acengine) HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{389562C4-59D9-40C4-966E-28DA91725FFE}\ (Acengine) HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3F8D3B31-AEB8-4ED7-8B05-5556068D6B54}\ (Acengine) HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{6ED1EF08-DFF4-4252-8986-691D06C54131}\ (Acengine) HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{83E07061-02D1-41EC-8751-BB176B823C38}\ (Acengine) HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{9F0948E7-227A-4F1B-9849-2D8912F185A7}\ (Acengine) HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{A471A4AA-5C18-429F-81BF-6C760941DB74}\ (Acengine) HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{C0A7C2B3-86D6-42AF-8221-79C9E4AD50BA}\ (Acengine) HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{F2FB003D-07C7-4E4D-80E3-00B49468A6F4}\ (Acengine) HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{F7971E81-FC71-4659-8CCE-C903576E0924}\ (Acengine) HKU\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_\ (Crossrider) HKU\S-1-5-18\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_\ (Crossrider) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_\ (Crossrider) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_\ (Crossrider) Die Logdatei von ESET: Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # product=EOS # version=8 # OnlineScannerApp.exe=1.0.0.1 # EOSSerial=ab736f9ea0dad34a8f47b055b2cb7a0e # end=init # utc_time=2015-11-06 07:13:52 # local_time=2015-11-06 08:13:52 (+0100, Mitteleuropäische Zeit) # country="Germany" # osver=6.2.9200 NT Update Init Update Download Update Finalize Updated modules version: 26602 # product=EOS # version=8 # OnlineScannerApp.exe=1.0.0.1 # EOSSerial=ab736f9ea0dad34a8f47b055b2cb7a0e # end=updated # utc_time=2015-11-06 07:16:41 # local_time=2015-11-06 08:16:41 (+0100, Mitteleuropäische Zeit) # country="Germany" # osver=6.2.9200 NT # product=EOS # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.7777 # api_version=3.1.1 # EOSSerial=ab736f9ea0dad34a8f47b055b2cb7a0e # engine=26602 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2015-11-06 08:17:30 # local_time=2015-11-06 09:17:30 (+0100, Mitteleuropäische Zeit) # country="Germany" # lang=1031 # osver=6.2.9200 NT # compatibility_mode_1='' # compatibility_mode=5893 16776573 100 94 4277 10315062 0 0 # scanned=204649 # found=39 # cleaned=0 # scan_time=3648 sh=E8102E3CB1CF555D01878EE3E29ED2CAC0331154 ft=1 fh=10dc493a6f8fa458 vn="Variante von Win32/Adware.ConvertAd.ABZ Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\03000200-1446646633-0500-0006-000700080009\hnsa9095.tmp.vir" sh=300D82F78DA7ACA73AA37C5D5DC1855192E35A19 ft=1 fh=9f297330aabcb4b9 vn="Variante von Win32/Adware.ConvertAd.ABN Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\03000200-1446646633-0500-0006-000700080009\jnsr7AE8.tmp.vir" sh=804F9C8AFBF710A910ED124A12D3B07D7D6468CF ft=1 fh=c71c0011fd4c8915 vn="Variante von Win32/Adware.ConvertAd.AAP Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\03000200-1446646633-0500-0006-000700080009\knsl5F8A.tmpfs.vir" sh=54D65AE0D791D53C0322B3F914F2FAC349AA902A ft=1 fh=8538336621961c1a vn="Win32/Adware.ConvertAd.YY Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\03000200-1446646633-0500-0006-000700080009\Uninstall.exe.vir" sh=628C4E53E2E36647B7DC7332F3E33665CE70F671 ft=1 fh=47ece30934908b20 vn="Mehrere Bedrohungen" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\03000200-1446646633-0500-0006-000700080009\vnsr460D.tmp.vir" sh=FAA8FF39AF9C5DEA5654C8AEA04B445F779CE48B ft=1 fh=33339b5767a481f8 vn="Mehrere Bedrohungen" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\03000200-1446649120-0500-0006-000700080009\vnsn83C8.tmp.vir" sh=32E88B4495F192995B985213AF28D57590C2D6B7 ft=1 fh=2a536d9de585a48e vn="Variante von Win32/Packed.Komodia.E verdächtige Datei" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Fast-Search\ACDLL.dll.vir" sh=76C4E256F7E8CE4E0E7DC4CD4A67D46B85DCF47B ft=1 fh=d3b35132675a3035 vn="Variante von Win64/Packed.Komodia.F verdächtige Datei" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Fast-Search\ACDLL64.dll.vir" sh=7FA9D4E48AB094CE5E45EC1938E5E7F7BF1B518D ft=1 fh=df1053b26fd5d9fd vn="Variante von Win64/Packed.Komodia.D verdächtige Datei" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Fast-Search\ACDLL64.exe.vir" sh=2A0DAD058E3B9918710EC62D8011E19C0DAFF008 ft=1 fh=9c16eb358d0788e0 vn="Variante von Win32/Packed.Komodia.E verdächtige Datei" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Fast-Search\acengine.dll.vir" sh=5F24F2D7F9CAC7C80C88355665F724C3F6071D26 ft=1 fh=cb34dbb550ae82e5 vn="Variante von Win32/Packed.Komodia.E verdächtige Datei" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Fast-Search\acengine.exe.vir" sh=7F52702D031995D0533F88D1B3F3B7768434E1DB ft=1 fh=9f84886b3143c62a vn="Variante von Win64/Packed.Komodia.E verdächtige Datei" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Fast-Search\acengine64.dll.vir" sh=89D8DB09BD7DA621F7599F0B6621A47837EDC674 ft=1 fh=fde5ee7cce37125c vn="Variante von Win32/Packed.Komodia.E verdächtige Datei" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Fast-Search\acenginecert.dll.vir" sh=C58CEEBFFE8182E00403C03ECF6354993DBA85B1 ft=1 fh=90dc33b9248d1c16 vn="Variante von Win32/Packed.Komodia.F verdächtige Datei" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Fast-Search\lengine.exe.vir" sh=54599F13385AA60EC39F85EC276A62A7C750EA56 ft=1 fh=34071684318313e6 vn="Variante von Win64/Packed.Komodia.D verdächtige Datei" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Fast-Search\lengine64.exe.vir" sh=DD4605E26B48B7C231DBEBA5E8FAA91F33D21B2B ft=1 fh=bb1ffd2794ad6ec5 vn="Win32/AlteredSoftware.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\globalupdate.exe.vir" sh=DD4605E26B48B7C231DBEBA5E8FAA91F33D21B2B ft=1 fh=bb1ffd2794ad6ec5 vn="Win32/AlteredSoftware.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\globalupdate.exe.vir" sh=08976B0143D7A77694D2B3014053542C42F4774E ft=1 fh=67450ef68c8fc670 vn="Win32/AlteredSoftware.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\globalupdateBroker.exe.vir" sh=DD4605E26B48B7C231DBEBA5E8FAA91F33D21B2B ft=1 fh=bb1ffd2794ad6ec5 vn="Win32/AlteredSoftware.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\globalupdateCrashHandler.exe.vir" sh=FE3BD67B77BB38A3110091D17DE69012FAAD4FA6 ft=1 fh=67450ef6f68fd149 vn="Win32/AlteredSoftware.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\globalupdateOnDemand.exe.vir" sh=3C0D9D3A966B1954FEAEAD3BE6358A2AB42385C4 ft=1 fh=c71c001178de99b1 vn="Variante von Win32/AlteredSoftware.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\goopdate.dll.vir" sh=5CFD5CECD9E35ED6C11651D499D9E45FA4E3B295 ft=1 fh=e858233d4598588e vn="Variante von Win32/AlteredSoftware.J evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\goopdateres_en.dll.vir" sh=7B023A2C73FBCB281999C13780C0561E366CE3EF ft=1 fh=c71c00119a74eb7c vn="Variante von Win32/AlteredSoftware.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\npglobalupdateUpdate4.dll.vir" sh=BD08E733D803A193E4FA4118A6D52BCD0FC98F81 ft=1 fh=c71c0011371aa7ff vn="Variante von Win32/AlteredSoftware.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\psmachine.dll.vir" sh=9AE1636DE7E3CB630B3A2C11E41C76BF0B716CCD ft=1 fh=c71c0011864645d3 vn="Variante von Win32/AlteredSoftware.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\psuser.dll.vir" sh=5FFAF9301BF75E359D287D06B9B5380AE41D8920 ft=1 fh=be62b22f47cea8a2 vn="Variante von Win32/Adware.ConvertAd.ACA.gen Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\03000200-1446650279-0500-0006-000700080009\2152.tmp.vir" sh=5FFAF9301BF75E359D287D06B9B5380AE41D8920 ft=1 fh=be62b22f47cea8a2 vn="Variante von Win32/Adware.ConvertAd.ACA.gen Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\03000200-1446650279-0500-0006-000700080009\522E.tmp.vir" sh=AAA0879216B13959E04E87EF6FE3C4090DB560BF ft=1 fh=c71c00118e08d5b5 vn="Variante von Win32/Adware.ConvertAd.ABX Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\03000200-1446650279-0500-0006-000700080009\snsnFB85.tmp.vir" sh=7F52702D031995D0533F88D1B3F3B7768434E1DB ft=1 fh=9f84886b3143c62a vn="Variante von Win64/Packed.Komodia.E verdächtige Datei" ac=I fn="C:\AdwCleaner\Quarantine\C\WINDOWS\SysNative\acengine64.dll.vir" sh=879FAF187CB063AF8FCA4C404E7B549A6D96CF37 ft=1 fh=9193f08fb8b52cac vn="Variante von Win64/NetFilter.A potenziell unsichere Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\WINDOWS\SysNative\drivers\swsedrvr_vw_1_10_0_25.sys.vir" sh=2A0DAD058E3B9918710EC62D8011E19C0DAFF008 ft=1 fh=9c16eb358d0788e0 vn="Variante von Win32/Packed.Komodia.E verdächtige Datei" ac=I fn="C:\AdwCleaner\Quarantine\C\WINDOWS\SysWOW64\acengine.dll.vir" sh=C28052B54F49AACF8660C7759B076341257F2241 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.I evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.xBAD" sh=C28052B54F49AACF8660C7759B076341257F2241 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.I evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.xBAD" sh=08715FB4D3045EE5BEC821DB3315FB4ED459DB49 ft=1 fh=cf3a24109b2aac41 vn="Variante von MSIL/HackTool.IdleKMS.E potenziell unsichere Anwendung" ac=I fn="C:\Program Files\KMSpico\KMSELDI.exe" sh=1DBA0B16BF2570C32B991CC018C112500D7B333C ft=1 fh=a0c3866843c32de8 vn="Variante von MSIL/HackTool.IdleKMS.C potenziell unsichere Anwendung" ac=I fn="C:\Program Files\KMSpico\Service_KMS.exe" sh=86949D0A4B5EAC5D2D921E673DA3D0016152C5EB ft=1 fh=78e8d192b38125e3 vn="Variante von Win32/InstallCore.ADD evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Admin\Desktop\Felgen\CCleaner_Setup.exe" sh=66E99AD765E95D90F7CB30EB9D0323C42DFA81FB ft=1 fh=39e044100eb41b68 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Admin\Downloads\VLC media player 64 Bit - CHIP-Installer.exe" sh=6EF8310627537B1D24409574BC3C398CD97C474C ft=1 fh=8f545065e84edd76 vn="Win64/HackKMS.D potenziell unsichere Anwendung" ac=I fn="C:\Windows\SECOH-QAD.dll" sh=66C72019EAFA41BBF3E708CC3824C7C4447BDAB6 ft=1 fh=0a46a8abafa4da1b vn="Win64/HackKMS.C potenziell unsichere Anwendung" ac=I fn="C:\Windows\SECOH-QAD.exe" Datei: Quarantine.zip empfangen /usr/bin/zip -P infected -j /var/www/vhosts/trojaner-board.de/upload.trojaner-board.de/files/151106-2145_Quarantine.zip.zip /var/www/vhosts/trojaner-board.de/upload.trojaner-board.de/files/Quarantine.zip Vorgang erfolgreich abgeschlossen. Vielen Dank ! |
07.11.2015, 00:13 | #13 |
/// TB-Ausbilder | Easycalender lässt sich nicht entfernen Servus, vielen Dank für den Upload. Schritt 1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start C:\Program Files\KMSpico C:\Users\Admin\Desktop\Felgen\CCleaner_Setup.exe C:\Users\Admin\Downloads\*CHIP-Installer.exe C:\Windows\SECOH-QAD.exe C:\Windows\SECOH-QAD.dll DeleteKey: HKLM\SOFTWARE\Classes\AppID\{9F2949D6-977B-4B61-B513-0C2EE52C2B4F} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{00E3D575-A24C-4BBC-A708-BCDB8BBCA6C7} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{024BF4C8-B53D-45B9-957F-D3BA9655FF39} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{074DCA49-F6A1-417F-B79E-D5E3ADC30330} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{3323765B-5B83-4406-841E-473DBA4B8F29} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{389562C4-59D9-40C4-966E-28DA91725FFE} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{3F8D3B31-AEB8-4ED7-8B05-5556068D6B54} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{6ED1EF08-DFF4-4252-8986-691D06C54131} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{83E07061-02D1-41EC-8751-BB176B823C38} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{9F0948E7-227A-4F1B-9849-2D8912F185A7} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{A471A4AA-5C18-429F-81BF-6C760941DB74} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{C0A7C2B3-86D6-42AF-8221-79C9E4AD50BA} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{F2FB003D-07C7-4E4D-80E3-00B49468A6F4} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{F7971E81-FC71-4659-8CCE-C903576E0924} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\AppID\{9F2949D6-977B-4B61-B513-0C2EE52C2B4F} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{34EBA76A-E745-4B18-96C9-2B8E2BA8B246} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{3A8E009B-E66D-4016-87CF-EC57FA9A4BC1} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{4D4D0357-0376-4656-A040-65AC089E84A2} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{6D5AF218-5F7E-40E0-B49D-54FFAFE2001A} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{89E46EA6-2F87-4D79-8FFA-8B264F93F54A} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{9ECCDEFC-1C26-4BB3-B6DF-252672D9FFFA} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{F1BC674D-15D8-46C5-AC51-12AB16D67616} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{F811C371-1DC7-4E2F-8676-D96B85BE4AF1} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{00E3D575-A24C-4BBC-A708-BCDB8BBCA6C7} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{024BF4C8-B53D-45B9-957F-D3BA9655FF39} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{074DCA49-F6A1-417F-B79E-D5E3ADC30330} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3323765B-5B83-4406-841E-473DBA4B8F29} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{389562C4-59D9-40C4-966E-28DA91725FFE} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3F8D3B31-AEB8-4ED7-8B05-5556068D6B54} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{6ED1EF08-DFF4-4252-8986-691D06C54131} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{83E07061-02D1-41EC-8751-BB176B823C38} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{9F0948E7-227A-4F1B-9849-2D8912F185A7} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{A471A4AA-5C18-429F-81BF-6C760941DB74} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{C0A7C2B3-86D6-42AF-8221-79C9E4AD50BA} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{F2FB003D-07C7-4E4D-80E3-00B49468A6F4} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{F7971E81-FC71-4659-8CCE-C903576E0924} DeleteKey: HKU\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_ DeleteKey: HKU\S-1-5-18\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_ DeleteKey: HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_ DeleteKey: HKU\S-1-5-21-3896126499-3315573620-1378135710-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_ Reboot: end Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 2 Downloade Dir bitte SecurityCheck und:
Schritt 3 Downloade dir bitte Farbar Service Scanner
Poste bitte den Inhalt hier. Schritt 4
Wie läuft dein Rechner momentan? Gibt es noch Probleme mit EasyCalender? Wenn ja, in welchem Browser? Bitte poste mit deiner nächsten Antwort
|
07.11.2015, 01:31 | #14 |
| Easycalender lässt sich nicht entfernen Guten Abend Matthias! also erstmal die Antwort auf die Frage: Mein PC an sich lief schon flüssig nachdem ich die seltsamen Programme die sich mit der Freeware runtergeladen hatten wieder Deinstalliert hatte (zumindest die die ich problemlos deinstallieren konnte..). Nur mein Google Chrome Browser hatte Probleme mit dem EasyCalender und, dass dieser auf so gut wie jeder Seite etliche Werbebanner geschaltet hatte, sodass man die Seite nicht mehr erkennen konnte. Nun hab ich eben nochmal getestet und der EasyCalender ist tatsächlich verschwunden und auch die Werbung scheint nicht mehr aufzupoppen, dafür erstmal ein RIESEN Dankeschön!!! nun noch die Logdateien vom Fixlog: Code:
ATTFilter Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version:05-11-2015 durchgeführt von Admin (2015-11-07 01:17:52) Run:2 Gestartet von C:\Users\Admin\Desktop Geladene Profile: Admin (Verfügbare Profile: Admin) Start-Modus: Normal ============================================== fixlist Inhalt: ***************** start C:\Program Files\KMSpico C:\Users\Admin\Desktop\Felgen\CCleaner_Setup.exe C:\Users\Admin\Downloads\*CHIP-Installer.exe C:\Windows\SECOH-QAD.exe C:\Windows\SECOH-QAD.dll DeleteKey: HKLM\SOFTWARE\Classes\AppID\{9F2949D6-977B-4B61-B513-0C2EE52C2B4F} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{00E3D575-A24C-4BBC-A708-BCDB8BBCA6C7} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{024BF4C8-B53D-45B9-957F-D3BA9655FF39} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{074DCA49-F6A1-417F-B79E-D5E3ADC30330} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{3323765B-5B83-4406-841E-473DBA4B8F29} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{389562C4-59D9-40C4-966E-28DA91725FFE} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{3F8D3B31-AEB8-4ED7-8B05-5556068D6B54} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{6ED1EF08-DFF4-4252-8986-691D06C54131} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{83E07061-02D1-41EC-8751-BB176B823C38} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{9F0948E7-227A-4F1B-9849-2D8912F185A7} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{A471A4AA-5C18-429F-81BF-6C760941DB74} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{C0A7C2B3-86D6-42AF-8221-79C9E4AD50BA} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{F2FB003D-07C7-4E4D-80E3-00B49468A6F4} DeleteKey: HKLM\SOFTWARE\Classes\Interface\{F7971E81-FC71-4659-8CCE-C903576E0924} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\AppID\{9F2949D6-977B-4B61-B513-0C2EE52C2B4F} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{34EBA76A-E745-4B18-96C9-2B8E2BA8B246} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{3A8E009B-E66D-4016-87CF-EC57FA9A4BC1} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{4D4D0357-0376-4656-A040-65AC089E84A2} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{6D5AF218-5F7E-40E0-B49D-54FFAFE2001A} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{89E46EA6-2F87-4D79-8FFA-8B264F93F54A} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{9ECCDEFC-1C26-4BB3-B6DF-252672D9FFFA} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{F1BC674D-15D8-46C5-AC51-12AB16D67616} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{F811C371-1DC7-4E2F-8676-D96B85BE4AF1} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{00E3D575-A24C-4BBC-A708-BCDB8BBCA6C7} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{024BF4C8-B53D-45B9-957F-D3BA9655FF39} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{074DCA49-F6A1-417F-B79E-D5E3ADC30330} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3323765B-5B83-4406-841E-473DBA4B8F29} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{389562C4-59D9-40C4-966E-28DA91725FFE} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3F8D3B31-AEB8-4ED7-8B05-5556068D6B54} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{6ED1EF08-DFF4-4252-8986-691D06C54131} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{83E07061-02D1-41EC-8751-BB176B823C38} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{9F0948E7-227A-4F1B-9849-2D8912F185A7} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{A471A4AA-5C18-429F-81BF-6C760941DB74} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{C0A7C2B3-86D6-42AF-8221-79C9E4AD50BA} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{F2FB003D-07C7-4E4D-80E3-00B49468A6F4} DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{F7971E81-FC71-4659-8CCE-C903576E0924} DeleteKey: HKU\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_ DeleteKey: HKU\S-1-5-18\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_ DeleteKey: HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_ DeleteKey: HKU\S-1-5-21-3896126499-3315573620-1378135710-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_ Reboot: end ***************** C:\Program Files\KMSpico => erfolgreich verschoben C:\Users\Admin\Desktop\Felgen\CCleaner_Setup.exe => erfolgreich verschoben =========== "C:\Users\Admin\Downloads\*CHIP-Installer.exe" ========== C:\Users\Admin\Downloads\VLC media player 64 Bit - CHIP-Installer.exe => erfolgreich verschoben ========= Ende -> "C:\Users\Admin\Downloads\*CHIP-Installer.exe" ======== C:\Windows\SECOH-QAD.exe => erfolgreich verschoben C:\Windows\SECOH-QAD.dll => erfolgreich verschoben HKLM\SOFTWARE\Classes\AppID\{9F2949D6-977B-4B61-B513-0C2EE52C2B4F} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Interface\{00E3D575-A24C-4BBC-A708-BCDB8BBCA6C7} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Interface\{00E3D575-A24C-4BBC-A708-BCDB8BBCA6C7} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Interface\{024BF4C8-B53D-45B9-957F-D3BA9655FF39} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Interface\{024BF4C8-B53D-45B9-957F-D3BA9655FF39} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Interface\{074DCA49-F6A1-417F-B79E-D5E3ADC30330} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Interface\{074DCA49-F6A1-417F-B79E-D5E3ADC30330} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Interface\{3323765B-5B83-4406-841E-473DBA4B8F29} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Interface\{3323765B-5B83-4406-841E-473DBA4B8F29} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Interface\{389562C4-59D9-40C4-966E-28DA91725FFE} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Interface\{389562C4-59D9-40C4-966E-28DA91725FFE} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Interface\{3F8D3B31-AEB8-4ED7-8B05-5556068D6B54} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Interface\{3F8D3B31-AEB8-4ED7-8B05-5556068D6B54} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Interface\{6ED1EF08-DFF4-4252-8986-691D06C54131} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Interface\{6ED1EF08-DFF4-4252-8986-691D06C54131} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Interface\{83E07061-02D1-41EC-8751-BB176B823C38} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Interface\{83E07061-02D1-41EC-8751-BB176B823C38} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Interface\{9F0948E7-227A-4F1B-9849-2D8912F185A7} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Interface\{9F0948E7-227A-4F1B-9849-2D8912F185A7} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Interface\{A471A4AA-5C18-429F-81BF-6C760941DB74} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Interface\{A471A4AA-5C18-429F-81BF-6C760941DB74} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Interface\{C0A7C2B3-86D6-42AF-8221-79C9E4AD50BA} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Interface\{C0A7C2B3-86D6-42AF-8221-79C9E4AD50BA} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Interface\{F2FB003D-07C7-4E4D-80E3-00B49468A6F4} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Interface\{F2FB003D-07C7-4E4D-80E3-00B49468A6F4} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Interface\{F7971E81-FC71-4659-8CCE-C903576E0924} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Interface\{F7971E81-FC71-4659-8CCE-C903576E0924} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Wow6432Node\AppID\{9F2949D6-977B-4B61-B513-0C2EE52C2B4F} => Schlüssel nicht gefunden. HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{34EBA76A-E745-4B18-96C9-2B8E2BA8B246} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{34EBA76A-E745-4B18-96C9-2B8E2BA8B246} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{3A8E009B-E66D-4016-87CF-EC57FA9A4BC1} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{3A8E009B-E66D-4016-87CF-EC57FA9A4BC1} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{4D4D0357-0376-4656-A040-65AC089E84A2} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{4D4D0357-0376-4656-A040-65AC089E84A2} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{6D5AF218-5F7E-40E0-B49D-54FFAFE2001A} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{6D5AF218-5F7E-40E0-B49D-54FFAFE2001A} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{89E46EA6-2F87-4D79-8FFA-8B264F93F54A} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{89E46EA6-2F87-4D79-8FFA-8B264F93F54A} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{9ECCDEFC-1C26-4BB3-B6DF-252672D9FFFA} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{9ECCDEFC-1C26-4BB3-B6DF-252672D9FFFA} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{F1BC674D-15D8-46C5-AC51-12AB16D67616} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{F1BC674D-15D8-46C5-AC51-12AB16D67616} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{F811C371-1DC7-4E2F-8676-D96B85BE4AF1} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{F811C371-1DC7-4E2F-8676-D96B85BE4AF1} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{00E3D575-A24C-4BBC-A708-BCDB8BBCA6C7} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{00E3D575-A24C-4BBC-A708-BCDB8BBCA6C7} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{024BF4C8-B53D-45B9-957F-D3BA9655FF39} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{024BF4C8-B53D-45B9-957F-D3BA9655FF39} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{074DCA49-F6A1-417F-B79E-D5E3ADC30330} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{074DCA49-F6A1-417F-B79E-D5E3ADC30330} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3323765B-5B83-4406-841E-473DBA4B8F29} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3323765B-5B83-4406-841E-473DBA4B8F29} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{389562C4-59D9-40C4-966E-28DA91725FFE} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{389562C4-59D9-40C4-966E-28DA91725FFE} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3F8D3B31-AEB8-4ED7-8B05-5556068D6B54} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3F8D3B31-AEB8-4ED7-8B05-5556068D6B54} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{6ED1EF08-DFF4-4252-8986-691D06C54131} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{6ED1EF08-DFF4-4252-8986-691D06C54131} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{83E07061-02D1-41EC-8751-BB176B823C38} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{83E07061-02D1-41EC-8751-BB176B823C38} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{9F0948E7-227A-4F1B-9849-2D8912F185A7} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{9F0948E7-227A-4F1B-9849-2D8912F185A7} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{A471A4AA-5C18-429F-81BF-6C760941DB74} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{A471A4AA-5C18-429F-81BF-6C760941DB74} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{C0A7C2B3-86D6-42AF-8221-79C9E4AD50BA} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{C0A7C2B3-86D6-42AF-8221-79C9E4AD50BA} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{F2FB003D-07C7-4E4D-80E3-00B49468A6F4} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{F2FB003D-07C7-4E4D-80E3-00B49468A6F4} => Schlüssel erfolgreich entfernt HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{F7971E81-FC71-4659-8CCE-C903576E0924} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{F7971E81-FC71-4659-8CCE-C903576E0924} => Schlüssel erfolgreich entfernt HKU\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_ => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKU\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_ => Schlüssel erfolgreich entfernt HKU\S-1-5-18\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_ => Schlüssel nicht gefunden. HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_ => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile. HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_ => Schlüssel erfolgreich entfernt HKU\S-1-5-21-3896126499-3315573620-1378135710-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_ => Schlüssel nicht gefunden. Das System musste neu gestartet werden. ==== Ende von Fixlog 01:17:54 ==== Die Logdatei des SecurityChecks: Code:
ATTFilter Results of screen317's Security Check version 1.009 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Windows Defender WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` Java 8 Update 31 Java version 32-bit out of Date! Adobe Reader XI Google Chrome (46.0.2490.71) Google Chrome (46.0.2490.80) ````````Process Check: objlist.exe by Laurent```````` Windows Defender MSMpEng.exe Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbam.exe Malwarebytes Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: % ````````````````````End of Log`````````````````````` Code:
ATTFilter Farbar Service Scanner Version: 26-07-2015 Ran by Admin (administrator) on 07-11-2015 at 01:23:11 Running from "C:\Users\Admin\Downloads" Microsoft Windows 10 Pro (X64) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Google IP is accessible. Google.com is accessible. Yahoo.com is accessible. Windows Firewall: ============= Firewall Disabled Policy: ================== System Restore: ============ System Restore Policy: ======================== Action Center: ============ Windows Update: ============ Windows Autoupdate Disabled Policy: ============================ Windows Defender: ============== Other Services: ============== File Check: ======== C:\Windows\System32\nsisvc.dll => File is digitally signed C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed C:\Windows\System32\dhcpcore.dll => File is digitally signed C:\Windows\System32\drivers\afd.sys => File is digitally signed C:\Windows\System32\drivers\tdx.sys => File is digitally signed C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed C:\Windows\System32\dnsrslvr.dll => File is digitally signed C:\Windows\System32\mpssvc.dll => File is digitally signed C:\Windows\System32\bfe.dll => File is digitally signed C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed C:\Windows\System32\wscsvc.dll => File is digitally signed C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed C:\Windows\System32\wuaueng.dll => File is digitally signed C:\Windows\System32\qmgr.dll => File is digitally signed C:\Windows\System32\es.dll => File is digitally signed C:\Windows\System32\cryptsvc.dll => File is digitally signed C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed C:\Program Files\Windows Defender\MsMpEng.exe => File is digitally signed C:\Windows\System32\ipnathlp.dll => File is digitally signed C:\Windows\System32\iphlpsvc.dll => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed **** End of log **** FRST: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:05-11-2015 durchgeführt von Admin (Administrator) auf PC (07-11-2015 01:23:55) Gestartet von C:\Users\Admin\Desktop Geladene Profile: Admin (Verfügbare Profile: Admin) Platform: Windows 10 Pro (X64) Sprache: Deutsch (Deutschland) Internet Explorer Version 11 (Standard-Browser: Edge) Start-Modus: Normal Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Prozesse (Nicht auf der Ausnahmeliste) ================= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.) (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe () C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\spd.exe (Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Malwarebytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe (Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe (Malwarebytes) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe (Microsoft Corporation) C:\Windows\System32\browser_broker.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\cfosspeed.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (FNet Co., Ltd.) C:\Program Files (x86)\XFastUSB\XFastUsb.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Kone Pure Mouse\KonePureMonitor.exe (Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\ActionUriServer.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Nicht auf der Ausnahmeliste) =========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13636824 2013-07-26] (Realtek Semiconductor) HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation) HKLM\...\Run: [XFast LAN] => C:\Program Files\ASRock\XFast LAN\cFosSpeed.exe [2009952 2013-05-31] (cFos Software GmbH) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169744 2015-09-12] (Apple Inc.) HKLM-x32\...\Run: [XFastUSB] => C:\Program Files (x86)\XFastUSB\XFastUsb.exe [6311104 2014-12-15] (FNet Co., Ltd.) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-21] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [RoccatKonePure] => C:\Program Files (x86)\ROCCAT\Kone Pure Mouse\KonePureMonitor.EXE [561152 2014-01-20] (ROCCAT GmbH) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Spotify Web Helper] => C:\Users\Admin\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2021944 2015-06-17] (Spotify Ltd) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Spotify] => C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe [7323192 2015-06-17] (Spotify Ltd) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8551848 2015-10-19] (Piriform Ltd) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [GoogleChromeAutoLaunch_A5B343D047FD8BD2F268B0EA0F8DBD7C] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [811848 2015-10-20] (Google Inc.) HKU\S-1-5-18\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [43816 2015-04-26] (Apple Inc.) Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2015-11-06] ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation) ==================== Internet (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{947ba08f-6d7e-4686-b9ff-2806db41b1ff}: [DhcpNameServer] 192.168.0.1 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-09-29] (Microsoft Corporation) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-25] (Google Inc.) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-15] (Microsoft Corporation) BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-09-29] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-21] (Oracle Corporation) BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-25] (Google Inc.) BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-15] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-21] (Oracle Corporation) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-25] (Google Inc.) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-25] (Google Inc.) Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-10-14] (Microsoft Corporation) FireFox: ======== FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation) FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-09-04] () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-03] (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-03] (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-21] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-21] (Oracle Corporation) FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-03-31] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-19] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-19] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-09-27] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-03-31] (Microsoft Corporation) Chrome: ======= CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-05] CHR Extension: (Google Drive) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-23] CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24] CHR Extension: (Google-Suche) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-28] CHR Extension: (LoungeDestroyer) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghahcnmfjfckcedfajbhekgknjdplfcl [2015-10-07] CHR Extension: (Google Text & Tabellen Offline) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-03] CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-25] CHR Extension: (Google Mail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-29] ==================== Dienste (Nicht auf der Ausnahmeliste) ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-09-02] (Apple Inc.) R2 ASRockIOMon; C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe [454656 2013-05-28] () [Datei ist nicht signiert] R2 cFosSpeedS; C:\Program Files\ASRock\XFast LAN\spd.exe [652640 2013-05-31] (cFos Software GmbH) S3 Futuremark SystemInfo Service; C:\Program Files (x86)\Futuremark\SystemInfo\FMSISvc.exe [614624 2014-12-10] (Futuremark) R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation) R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [Datei ist nicht signiert] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation) R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-03] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-03] (Intel Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1135416 2015-10-05] (Malwarebytes) R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation) S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [X] ===================== Treiber (Nicht auf der Ausnahmeliste) ========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.) S3 AsrDrv101; C:\Windows\SysWOW64\Drivers\AsrDrv101.sys [22280 2014-12-16] (ASRock Incorporation) R0 AsrRamDisk; C:\Windows\System32\drivers\AsrRamDisk.sys [40200 2013-05-09] (ASRock Inc.) R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [102912 2015-07-15] (Advanced Micro Devices) S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider) S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider) R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [16648 2014-12-15] (FNet Co., Ltd.) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2015-11-07] (Malwarebytes) R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation) R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-03] (Intel Corporation) R3 sthid; C:\Windows\System32\drivers\sthid.sys [21216 2014-08-06] (Splashtop Inc.) S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] () S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-07-10] (Microsoft Corporation) R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [291680 2015-07-10] (Microsoft Corporation) R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation) S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X] ==================== NetSvcs (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) ==================== Ein Monat: Erstellte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-11-07 01:23 - 2015-11-07 01:23 - 00002284 _____ C:\WINDOWS\SysWOW64\FSS.txt 2015-11-07 01:23 - 2015-11-07 01:23 - 00002284 _____ C:\Users\Admin\Desktop\FSS.txt 2015-11-07 01:22 - 2015-11-07 01:22 - 00899072 _____ (Farbar) C:\Users\Admin\Downloads\FSS.exe 2015-11-07 01:22 - 2015-11-07 01:22 - 00000936 _____ C:\Users\Admin\Desktop\checkup.txt 2015-11-07 01:20 - 2015-11-07 01:20 - 00852720 _____ C:\Users\Admin\Desktop\SecurityCheck.exe 2015-11-07 01:19 - 2015-11-07 01:19 - 00016148 _____ C:\WINDOWS\system32\PC_Admin_HistoryPrediction.bin 2015-11-06 21:33 - 2015-11-06 21:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip 2015-11-06 21:33 - 2015-11-06 21:33 - 00000000 ____D C:\Program Files\7-Zip 2015-11-06 21:32 - 2015-11-06 21:32 - 01513472 _____ C:\Users\Admin\Downloads\7z938-x64.msi 2015-11-06 20:13 - 2015-11-06 20:13 - 02870984 _____ (ESET) C:\Users\Admin\Desktop\esetsmartinstaller_deu.exe 2015-11-06 20:13 - 2015-11-06 20:13 - 00000000 ____D C:\Program Files (x86)\ESET 2015-11-06 20:11 - 2015-11-06 20:11 - 00024646 _____ C:\Users\Admin\Desktop\HitmanPro_20151106_2011.log 2015-11-06 20:02 - 2015-11-06 20:11 - 00000000 ____D C:\ProgramData\HitmanPro 2015-11-06 20:00 - 2015-11-06 20:01 - 11337112 _____ (SurfRight B.V.) C:\Users\Admin\Desktop\HitmanPro_x64.exe 2015-11-06 13:10 - 2015-11-06 13:10 - 00001740 _____ C:\Users\Admin\Desktop\Search.txt 2015-11-06 12:51 - 2015-11-06 12:51 - 00036247 _____ C:\Users\Admin\Desktop\Addition.txt 2015-11-06 12:50 - 2015-11-06 12:50 - 00000000 ____D C:\Users\Admin\Desktop\FRST-OlderVersion 2015-11-06 12:46 - 2015-11-06 12:46 - 00001283 _____ C:\Users\Admin\Desktop\JRT.txt 2015-11-06 12:43 - 2015-11-06 12:43 - 01798976 _____ (Malwarebytes) C:\Users\Admin\Desktop\JRT.exe 2015-11-06 12:43 - 2015-11-06 12:43 - 00010166 _____ C:\Users\Admin\Desktop\mbam.txt 2015-11-06 12:12 - 2015-11-07 01:19 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2015-11-06 12:11 - 2015-11-06 12:37 - 00001169 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-11-06 12:11 - 2015-11-06 12:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-11-06 12:11 - 2015-11-06 12:11 - 00000000 ____D C:\ProgramData\Malwarebytes 2015-11-06 12:11 - 2015-11-06 12:11 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-11-06 12:11 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2015-11-06 12:11 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2015-11-06 12:11 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys 2015-11-06 12:10 - 2015-11-06 12:11 - 22908888 _____ (Malwarebytes ) C:\Users\Admin\Downloads\mbam-setup-2.2.0.1024.exe 2015-11-06 12:09 - 2015-11-06 12:09 - 00002073 _____ C:\Users\Admin\Desktop\AdwCleaner[C3].txt 2015-11-06 12:08 - 2015-11-06 19:57 - 00015208 _____ C:\WINDOWS\PFRO.log 2015-11-06 12:05 - 2015-11-06 12:05 - 01713664 _____ C:\Users\Admin\Downloads\AdwCleaner_5.018.exe 2015-11-05 14:32 - 2015-11-07 01:24 - 00016899 _____ C:\Users\Admin\Desktop\FRST.txt 2015-11-05 14:31 - 2015-11-05 14:31 - 04404952 _____ (Kaspersky Lab ZAO) C:\Users\Admin\Desktop\tdsskiller.exe 2015-11-05 14:30 - 2015-11-07 01:23 - 00000000 ____D C:\FRST 2015-11-05 14:30 - 2015-11-06 12:50 - 02198528 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe 2015-11-05 14:13 - 2015-11-05 14:13 - 04944608 _____ (Advanced Micro Devices, Inc.) C:\Users\Admin\Downloads\autodetectutility.exe 2015-11-05 14:00 - 2015-11-05 14:00 - 00000000 ___HD C:\OneDriveTemp 2015-11-05 12:12 - 2015-11-05 12:12 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (3).exe 2015-11-04 17:15 - 2015-11-04 17:15 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (2).exe 2015-11-04 17:08 - 2015-11-06 12:07 - 00000000 ____D C:\AdwCleaner 2015-11-04 17:08 - 2015-11-04 17:08 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (1).exe 2015-11-04 16:49 - 2015-11-07 01:18 - 00000275 _____ C:\WINDOWS\WindowsUpdate.log 2015-11-04 16:49 - 2015-11-04 16:49 - 00000000 ____D C:\$SysReset 2015-11-04 16:34 - 2015-11-06 12:37 - 00000901 _____ C:\Users\Public\Desktop\CCleaner.lnk 2015-11-04 16:34 - 2015-11-04 16:34 - 00002844 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC 2015-11-04 16:34 - 2015-11-04 16:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2015-11-04 16:34 - 2015-11-04 16:34 - 00000000 ____D C:\Program Files\CCleaner 2015-11-04 16:33 - 2015-11-04 16:34 - 05524624 _____ (Piriform Ltd) C:\Users\Admin\Downloads\ccsetup511_slim.exe 2015-11-04 16:14 - 2015-11-04 16:23 - 00000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job 2015-11-04 16:13 - 2015-11-04 16:13 - 00000000 ____D C:\WINDOWS\pss 2015-11-04 15:17 - 2015-11-04 16:00 - 00000004 _____ C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7 2015-11-04 15:17 - 2013-08-22 14:25 - 00000824 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak 2015-11-04 15:15 - 2015-11-04 15:39 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Opera Software 2015-11-04 15:15 - 2015-11-04 15:39 - 00000000 ____D C:\Users\Admin\AppData\Local\Opera Software 2015-11-04 15:12 - 2015-11-04 15:39 - 00000000 ____D C:\Program Files (x86)\Opera 2015-10-30 17:15 - 2015-10-30 17:15 - 00000000 ____D C:\ProgramData\ROCCAT 2015-10-30 17:15 - 2015-10-30 17:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ROCCAT 2015-10-30 17:14 - 2015-10-30 17:14 - 24907859 _____ C:\Users\Admin\Downloads\ROCCAT_Kone_Pure_DRV1.14_FW1.21.zip 2015-10-30 17:14 - 2015-10-30 17:14 - 00000000 ____D C:\Program Files (x86)\ROCCAT 2015-10-30 17:14 - 2014-01-20 10:53 - 73113600 _____ (ROCCAT GmbH) C:\Users\Admin\Desktop\KonePureOption.exe 2015-10-30 17:13 - 2015-10-28 00:38 - 21871616 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll 2015-10-30 17:13 - 2015-10-28 00:16 - 18801664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll 2015-10-30 17:13 - 2015-10-21 13:45 - 00541024 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcupdate_GenuineIntel.dll 2015-10-30 17:13 - 2015-10-21 13:44 - 00459104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys 2015-10-30 17:13 - 2015-10-21 13:43 - 01392480 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll 2015-10-30 17:13 - 2015-10-21 13:39 - 03621248 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2015-10-30 17:13 - 2015-10-21 13:00 - 24595968 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2015-10-30 17:13 - 2015-10-21 13:00 - 03248128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll 2015-10-30 17:13 - 2015-10-21 12:59 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll 2015-10-30 17:13 - 2015-10-21 12:57 - 02418688 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll 2015-10-30 17:13 - 2015-10-21 12:52 - 02987520 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll 2015-10-30 17:13 - 2015-10-21 12:50 - 00333312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll 2015-10-30 17:13 - 2015-10-21 12:48 - 01068032 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll 2015-10-30 17:13 - 2015-10-21 12:47 - 00453120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Usb.dll 2015-10-30 17:13 - 2015-10-21 12:46 - 02179584 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll 2015-10-30 17:13 - 2015-10-21 12:46 - 01602560 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2015-10-30 17:13 - 2015-10-21 12:44 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll 2015-10-30 17:13 - 2015-10-21 12:44 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe 2015-10-30 17:13 - 2015-10-21 12:43 - 02675200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll 2015-10-30 17:13 - 2015-10-21 12:42 - 00627712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll 2015-10-30 17:13 - 2015-10-21 12:41 - 01795072 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll 2015-10-30 17:13 - 2015-10-21 12:40 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll 2015-10-30 17:13 - 2015-10-21 12:38 - 00502272 _____ (Microsoft Corporation) C:\WINDOWS\system32\dlnashext.dll 2015-10-30 17:13 - 2015-10-21 06:53 - 00961376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll 2015-10-30 17:13 - 2015-10-21 06:49 - 02878512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2015-10-30 17:13 - 2015-10-21 06:13 - 19326464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2015-10-30 17:13 - 2015-10-21 06:11 - 02647040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll 2015-10-30 17:13 - 2015-10-21 06:08 - 01918976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll 2015-10-30 17:13 - 2015-10-21 06:05 - 02639872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll 2015-10-30 17:13 - 2015-10-21 06:03 - 01380864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2015-10-30 17:13 - 2015-10-21 06:03 - 00311296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Usb.dll 2015-10-30 17:13 - 2015-10-21 05:58 - 02049536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepository.dll 2015-10-30 17:13 - 2015-10-21 05:58 - 00464896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll 2015-10-30 17:13 - 2015-10-21 05:55 - 00441344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dlnashext.dll 2015-10-26 19:45 - 2015-10-26 19:45 - 00014336 _____ C:\Users\Admin\Downloads\wenn-2.xls 2015-10-26 19:38 - 2015-10-26 19:38 - 03135063 _____ C:\Users\Admin\Downloads\Pruefung_1_Jugendarbeitsschutzgesetz_.zip 2015-10-17 13:48 - 2015-10-10 08:12 - 00078528 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll 2015-10-17 13:48 - 2015-10-06 04:03 - 16708608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll 2015-10-17 13:48 - 2015-10-06 03:46 - 13027840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll 2015-10-17 13:48 - 2015-10-01 05:01 - 01294352 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2015-10-17 13:48 - 2015-10-01 05:01 - 01123400 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2015-10-17 13:48 - 2015-10-01 05:01 - 01018568 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi 2015-10-17 13:48 - 2015-10-01 05:01 - 00858408 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe 2015-10-17 13:48 - 2015-10-01 05:00 - 08020320 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2015-10-17 13:48 - 2015-10-01 04:03 - 00757760 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll 2015-10-17 13:48 - 2015-09-25 05:01 - 02573768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll 2015-10-17 13:48 - 2015-09-25 05:01 - 00498016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys 2015-10-17 13:48 - 2015-09-25 04:56 - 22322624 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2015-10-17 13:48 - 2015-09-25 04:52 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi 2015-10-17 13:48 - 2015-09-25 04:33 - 01997336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll 2015-10-17 13:48 - 2015-09-25 04:26 - 20858360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2015-10-17 13:48 - 2015-09-25 04:11 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataAccountApis.dll 2015-10-17 13:48 - 2015-09-25 04:11 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneCallHistoryApis.dll 2015-10-17 13:48 - 2015-09-25 04:09 - 12504064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2015-10-17 13:48 - 2015-09-25 04:07 - 01276416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll 2015-10-17 13:48 - 2015-09-25 04:04 - 00826880 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll 2015-10-17 13:48 - 2015-09-25 04:04 - 00771072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll 2015-10-17 13:48 - 2015-09-25 04:03 - 00796160 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll 2015-10-17 13:48 - 2015-09-25 04:03 - 00576000 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll 2015-10-17 13:48 - 2015-09-25 04:02 - 07523840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll 2015-10-17 13:48 - 2015-09-25 04:02 - 00949248 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll 2015-10-17 13:48 - 2015-09-25 04:02 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll 2015-10-17 13:48 - 2015-09-25 04:01 - 04792320 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2015-10-17 13:48 - 2015-09-25 04:01 - 03586560 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys 2015-10-17 13:48 - 2015-09-25 04:00 - 01423872 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll 2015-10-17 13:48 - 2015-09-25 04:00 - 01382400 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys 2015-10-17 13:48 - 2015-09-25 04:00 - 00856576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContactApis.dll 2015-10-17 13:48 - 2015-09-25 04:00 - 00752640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChatApis.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 01205248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\EmailApis.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 00685568 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppointmentApis.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\MessagingDataModel2.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 00288256 _____ (Microsoft Corporation) C:\WINDOWS\system32\PimIndexMaintenance.dll 2015-10-17 13:48 - 2015-09-25 03:59 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\CallHistoryClient.dll 2015-10-17 13:48 - 2015-09-25 03:58 - 01871360 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll 2015-10-17 13:48 - 2015-09-25 03:47 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll 2015-10-17 13:48 - 2015-09-25 03:47 - 00172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhoneCallHistoryApis.dll 2015-10-17 13:48 - 2015-09-25 03:38 - 03580416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2015-10-17 13:48 - 2015-09-25 03:38 - 00650240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll 2015-10-17 13:48 - 2015-09-25 03:38 - 00574464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll 2015-10-17 13:48 - 2015-09-25 03:38 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll 2015-10-17 13:48 - 2015-09-25 03:37 - 00766976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll 2015-10-17 13:48 - 2015-09-25 03:37 - 00613376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll 2015-10-17 13:48 - 2015-09-25 03:37 - 00480256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll 2015-10-17 13:48 - 2015-09-25 03:36 - 11262976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2015-10-17 13:48 - 2015-09-25 03:36 - 05454848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll 2015-10-17 13:48 - 2015-09-25 03:34 - 00928256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll 2015-10-17 13:48 - 2015-09-25 03:34 - 00625152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContactApis.dll 2015-10-17 13:48 - 2015-09-25 03:34 - 00579584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentApis.dll 2015-10-17 13:48 - 2015-09-25 03:34 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ChatApis.dll 2015-10-17 13:48 - 2015-09-25 03:34 - 00525312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EmailApis.dll 2015-10-17 13:48 - 2015-09-25 03:33 - 00131072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CallHistoryClient.dll 2015-10-17 13:48 - 2015-09-25 03:32 - 01594368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll 2015-10-17 13:48 - 2015-09-25 03:32 - 00466432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MessagingDataModel2.dll 2015-10-17 13:39 - 2015-11-07 01:17 - 00000000 ____D C:\Users\Admin\Desktop\Felgen 2015-10-17 13:36 - 2015-11-06 12:37 - 00001816 _____ C:\Users\Public\Desktop\iTunes.lnk 2015-10-17 13:36 - 2015-10-17 13:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2015-10-17 13:35 - 2015-11-06 12:37 - 00002523 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk 2015-10-17 13:35 - 2015-10-17 13:36 - 00000000 ____D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7 2015-10-17 13:35 - 2015-10-17 13:36 - 00000000 ____D C:\Program Files\iTunes 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\WINDOWS\System32\Tasks\Apple 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files\iPod 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files\Bonjour 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\iTunes 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\Bonjour 2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\Apple Software Update 2015-10-17 13:30 - 2015-10-17 13:34 - 152447768 _____ (Apple Inc.) C:\Users\Admin\Downloads\iTunes6464Setup (1).exe 2015-10-12 18:13 - 2015-10-12 18:15 - 167601944 _____ (Apple Inc.) C:\Users\Admin\Downloads\iTunes6464Setup.exe 2015-10-12 17:20 - 2015-10-12 17:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud 2015-10-12 17:09 - 2015-10-12 17:19 - 71807792 _____ (Apple Inc.) C:\Users\Admin\Downloads\iCloudSetup.exe 2015-10-12 17:03 - 2015-10-12 17:24 - 1971067436 _____ C:\Users\Admin\Downloads\iPhone7,2_8.4.1_12H321_Restore.ipsw 2015-10-09 15:13 - 2015-10-09 15:13 - 00000000 ____D C:\Users\Admin\AppData\LocalLow\Hyper Hippo Productions Ltd_ 2015-10-09 15:12 - 2015-10-09 15:12 - 00000222 _____ C:\Users\Admin\Desktop\AdVenture Capitalist.url 2015-10-08 16:47 - 2015-10-08 16:47 - 00000000 ____D C:\ProgramData\ATI ==================== Ein Monat: Geänderte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-11-07 01:23 - 2015-08-05 21:51 - 01793546 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2015-11-07 01:23 - 2015-07-10 17:34 - 00772138 _____ C:\WINDOWS\system32\perfh007.dat 2015-11-07 01:23 - 2015-07-10 17:34 - 00154500 _____ C:\WINDOWS\system32\perfc007.dat 2015-11-07 01:20 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\sru 2015-11-07 01:19 - 2014-12-15 23:33 - 00001124 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2015-11-07 01:19 - 2014-12-15 23:33 - 00001120 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2015-11-07 01:18 - 2015-07-10 13:21 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT 2015-11-07 01:18 - 2015-07-10 10:05 - 00262144 ___SH C:\WINDOWS\system32\config\BBI 2015-11-07 01:18 - 2014-12-31 19:28 - 00000000 ____D C:\Program Files (x86)\Steam 2015-11-06 22:17 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\AppReadiness 2015-11-06 19:54 - 2014-12-15 23:13 - 00000000 ____D C:\WINDOWS\system32\MRT 2015-11-06 19:53 - 2014-12-15 23:13 - 143481208 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2015-11-06 12:37 - 2015-09-08 18:22 - 00000971 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk 2015-11-06 12:37 - 2015-08-05 22:01 - 00002358 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk 2015-11-06 12:37 - 2015-08-05 21:45 - 00001540 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2015-11-06 12:37 - 2015-05-24 23:54 - 00000925 _____ C:\Users\Public\Desktop\VLC media player.lnk 2015-11-06 12:37 - 2015-01-06 20:22 - 00001017 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk 2015-11-06 12:37 - 2014-12-31 19:28 - 00000973 _____ C:\Users\Public\Desktop\Steam.lnk 2015-11-06 12:37 - 2014-12-31 18:33 - 00001813 _____ C:\Users\Admin\Desktop\Spotify.lnk 2015-11-06 12:37 - 2014-12-31 18:33 - 00001799 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk 2015-11-06 12:37 - 2014-12-18 21:21 - 00002445 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2015-11-06 12:37 - 2014-12-15 23:33 - 00001321 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2015-11-05 20:20 - 2015-08-05 21:41 - 00000000 ____D C:\Users\Admin 2015-11-05 18:47 - 2015-01-06 20:23 - 00000000 ____D C:\Users\Admin\AppData\Roaming\TS3Client 2015-11-05 17:46 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\rescache 2015-11-05 14:57 - 2014-12-30 15:46 - 00000000 ____D C:\ProgramData\Microsoft Help 2015-11-05 14:56 - 2014-12-30 19:00 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013 2015-11-05 14:05 - 2015-08-05 22:01 - 00000000 ___RD C:\Users\Admin\OneDrive 2015-11-04 17:09 - 2015-08-05 21:41 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2015-11-04 17:09 - 2014-12-15 23:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2015-11-04 16:42 - 2015-08-05 22:33 - 00000000 ___DC C:\WINDOWS\Panther 2015-11-04 16:42 - 2014-12-30 23:19 - 00000000 ____D C:\Users\Admin\AppData\Local\CrashDumps 2015-11-04 16:09 - 2014-12-18 21:20 - 00000000 ____D C:\Program Files (x86)\Adobe 2015-11-04 15:46 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy 2015-11-04 15:39 - 2015-01-21 20:03 - 00000000 __SHD C:\Users\Admin\AppData\Local\EmieUserList 2015-11-04 15:39 - 2015-01-21 20:03 - 00000000 __SHD C:\Users\Admin\AppData\Local\EmieSiteList 2015-11-04 15:26 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\appraiser 2015-11-02 14:26 - 2015-07-10 11:55 - 00000000 ____D C:\WINDOWS\CbsTemp 2015-11-01 00:33 - 2015-01-05 18:20 - 00003972 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task 2015-10-30 17:14 - 2014-12-15 23:42 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2015-10-27 19:48 - 2014-12-31 18:33 - 00000000 ____D C:\Users\Admin\AppData\Local\Spotify 2015-10-27 19:48 - 2014-12-31 18:32 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Spotify 2015-10-26 20:55 - 2015-04-12 21:14 - 00000000 ____D C:\Users\Admin\Desktop\Mailin 2015-10-26 20:15 - 2013-08-22 14:25 - 00000167 _____ C:\WINDOWS\win.ini 2015-10-26 19:47 - 2014-12-15 22:56 - 00000000 ____D C:\Users\Admin\AppData\Local\Packages 2015-10-17 13:35 - 2015-04-10 06:25 - 00000000 ____D C:\Program Files\Common Files\Apple 2015-10-17 13:34 - 2015-04-10 06:25 - 00000000 ____D C:\ProgramData\Apple 2015-10-16 04:10 - 2015-07-10 12:06 - 00810488 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2015-10-16 04:10 - 2015-07-10 12:06 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2015-10-12 18:13 - 2015-09-08 19:52 - 00000000 ____D C:\WINDOWS\system32\appmgmt 2015-10-12 18:11 - 2014-12-30 17:39 - 00000000 ____D C:\Users\Admin\AppData\Local\Akamai 2015-10-12 17:47 - 2015-07-10 13:20 - 00348328 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2015-10-12 17:45 - 2015-07-10 17:44 - 00000000 ____D C:\Program Files\Windows Journal 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___SD C:\WINDOWS\system32\F12 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___RD C:\WINDOWS\PurchaseDialog 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\Provisioning 2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\L2Schemas 2015-10-09 15:12 - 2015-01-06 13:55 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam ==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ======= 2015-09-08 19:37 - 2015-09-08 19:37 - 0003225 _____ () C:\Users\Admin\AppData\Local\recently-used.xbel ==================== Bamital & volsnap ================= (Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.) C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert C:\WINDOWS\explorer.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert C:\WINDOWS\system32\services.exe => Datei ist digital signiert C:\WINDOWS\system32\User32.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert LastRegBack: 2015-11-02 14:19 ==================== Ende von FRST.txt ============================ Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:05-11-2015 durchgeführt von Admin (2015-11-07 01:24:36) Gestartet von C:\Users\Admin\Desktop Windows 10 Pro (X64) (2015-08-05 20:58:30) Start-Modus: Normal ========================================================== ==================== Konten: ============================= Admin (S-1-5-21-3896126499-3315573620-1378135710-1001 - Administrator - Enabled) => C:\Users\Admin Administrator (S-1-5-21-3896126499-3315573620-1378135710-500 - Administrator - Disabled) DefaultAccount (S-1-5-21-3896126499-3315573620-1378135710-503 - Limited - Disabled) Gast (S-1-5-21-3896126499-3315573620-1378135710-501 - Limited - Disabled) ==================== Sicherheits-Center ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.) AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installierte Programme ====================== (Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.) 3DMark (HKLM-x32\...\{7330098c-3669-4f39-9e82-4221d489db39}) (Version: 1.4.828.0 - Futuremark) 3DMark (Version: 1.4.828.0 - Futuremark) Hidden 7-Zip 9.38 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0938-000001000000}) (Version: 9.38.00.0 - Igor Pavlov) Adobe Reader XI (11.0.13) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.13 - Adobe Systems Incorporated) AdVenture Capitalist (HKLM-x32\...\Steam App 346900) (Version: - Hyper Hippo Games) Akamai NetSession Interface (HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Akamai) (Version: - Akamai Technologies, Inc) AMD Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD) AMD Catalyst Install Manager (HKLM\...\{572C982F-95F5-0562-AE8F-8A9D7D024A88}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.) APP Shop v1.0.13 (HKLM-x32\...\{90242E9B-BC60-46E3-8EE7-8E953F702280}_is1) (Version: 1.0.13 - ASRock Inc.) Apple Application Support (32-Bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.) Apple Application Support (64-Bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{FD244E19-6EFE-4A2D-948A-0D45D4C168BE}) (Version: 9.0.0.26 - Apple Inc.) Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.) ASRock App Charger v1.0.6 (HKLM\...\ASRock App Charger_is1) (Version: 1.0.6 - ASRock Inc.) ASRock Restart to UEFI v1.0.3 (HKLM-x32\...\ASRock Restart to UEFI_is1) (Version: - ) ASRock XFast RAM v3.0.2 (HKLM\...\ASRock XFast RAM_is1) (Version: - ASRock Inc.) A-Tuning v2.0.51.1 (HKLM-x32\...\A-Tuning_is1) (Version: 2.0.51.1 - ) Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.) CCleaner (HKLM\...\CCleaner) (Version: 5.11 - Piriform) Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve) ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - ) Futuremark SystemInfo (HKLM-x32\...\{2FE4C157-30AD-47F3-9D93-D9A2AFF25D3F}) (Version: 4.33.485.0 - Futuremark) GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 46.0.2490.80 - Google Inc.) Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6904.2028 - Google Inc.) Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden iCloud (HKLM\...\{709A2D23-C25E-47B5-9268-CB6FEE648504}) (Version: 4.1.1.53 - Apple Inc.) Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation) Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{0EC7F9CC-4741-45AE-9F55-6E9343F726F5}) (Version: 1.1.0.36960 - Intel Corporation) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation) Intel(R) Network Connections 18.5.54.0 (HKLM\...\PROSetDX) (Version: 18.5.54.0 - Intel) Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation) iTunes (HKLM\...\{CEC7613B-E286-4A31-BEE3-3F7798488D9F}) (Version: 12.1.3.6 - Apple Inc.) Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation) KMSpico (HKLM\...\{8B29D47F-92E2-4C20-9EE0-F710991F5D7C}_is1) (Version: - ) Malwarebytes Anti-Malware Version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes) Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation) Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation) MyDriveConnect 4.0.2.2123 (HKLM-x32\...\MyDriveConnect) (Version: 4.0.2.2123 - TomTom) Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.) ROCCAT Kone Pure Mouse Driver (HKLM-x32\...\{4905245D-56E7-4176-BE68-962728B803D6}) (Version: - Roccat GmbH) Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version: - Microsoft) Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version: - Microsoft) Hidden Splashtop Software Updater (HKLM-x32\...\Splashtop Software Updater) (Version: 1.5.6.15 - Splashtop Inc.) Splashtop Streamer (HKLM-x32\...\{B7C5EA94-B96A-41F5-BE95-25D78B486678}) (Version: 2.6.2.4 - Splashtop Inc.) Spotify (HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Spotify) (Version: 1.0.6.80.g2a801a53 - Spotify AB) Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation) TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH) Update for Skype for Business 2015 (KB2889853) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{CBCC2FD8-7DFE-4752-95B5-2E447C226F45}) (Version: - Microsoft) Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version: - Microsoft) Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version: - Microsoft) Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version: - Microsoft) VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.) VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN) WinRAR 5.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH) XFast LAN v9.05 (HKLM\...\XFast LAN) (Version: 9.05 - cFos Software GmbH, Bonn) XFastUSB (HKLM-x32\...\XFastUSB) (Version: 3.02.38 - ASRock Inc.) ==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) CustomCLSID: HKU\S-1-5-21-3896126499-3315573620-1378135710-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Admin\AppData\Local\Microsoft\OneDrive\17.3.6201.1019\FileCoAuth.exe (Microsoft Corporation) ==================== Wiederherstellungspunkte ========================= 17-10-2015 13:21:53 Removed iTunes 26-10-2015 19:59:23 Windows Update 02-11-2015 14:19:58 Windows Update 04-11-2015 15:33:50 Wiederherstellungsvorgang 06-11-2015 12:44:13 JRT Pre-Junkware Removal ==================== Hosts Inhalt: =============================== (Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.) 2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts ==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) ============= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) Task: {12FB6D15-B5C0-4B66-BF0C-21D82690E855} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation) Task: {1780DAB3-4584-4FBD-92C9-8857F3886BA3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.) Task: {35EB728D-F128-4075-B375-D45BF71FE8B2} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\BrowserChoice\browserchoice.exe Task: {3A4FD38E-5C92-414E-9586-8C3CAA34B95C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.) Task: {5769C702-F476-4F1D-8161-7F0B757132B2} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation) Task: {706560C9-EAA0-41D3-833A-15525024E0B5} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-26] (Apple Inc.) Task: {80A4DADB-BA50-49B2-AA96-134B855D9DA2} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation) Task: {91B7D1C5-C4A2-47A1-8301-8BB576FF708E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated) Task: {ABDBD144-AC98-4BFB-A605-068E267D2877} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation) Task: {D90353AE-3ED6-447A-9C2D-5A83962EBBF3} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-11-06] (Microsoft Corporation) Task: {F2497E2D-9818-4923-A176-F89FB32151E5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-10-19] (Piriform Ltd) Task: {F5E604C0-8A2B-485C-9605-9EC1FD317421} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG Task: {F69C0FCA-220E-4675-A1E1-DD67E0976A15} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation) (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.) Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Geladene Module (Nicht auf der Ausnahmeliste) ============== 2015-07-10 12:00 - 2015-07-10 12:00 - 00028160 _____ () C:\WINDOWS\SYSTEM32\efsext.dll 2015-08-05 22:30 - 2015-08-05 22:30 - 00032768 _____ () C:\WINDOWS\SYSTEM32\licensemanagerapi.dll 2015-03-20 17:12 - 2015-03-20 17:12 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2015-03-20 17:12 - 2015-03-20 17:12 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2014-12-15 23:54 - 2013-05-28 17:58 - 00454656 _____ () C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe 2015-08-23 21:30 - 2015-08-11 10:14 - 00404480 _____ () C:\WINDOWS\System32\diagtrack_wininternal.dll 2015-10-01 09:14 - 2015-09-17 07:48 - 02494712 _____ () C:\WINDOWS\system32\CoreUIComponents.dll 2015-10-01 09:14 - 2015-09-17 06:43 - 02028544 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RulesService.dll 2015-10-01 09:14 - 2015-09-17 06:42 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll 2015-10-01 09:14 - 2015-09-17 06:42 - 00619008 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SignalsManager.dll 2015-10-01 09:14 - 2015-09-17 06:43 - 00928768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RulesBackgroundTasks.dll 2015-10-01 09:14 - 2015-09-17 06:42 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll 2015-10-01 09:14 - 2015-09-17 07:48 - 02494712 _____ () C:\WINDOWS\System32\CoreUIComponents.dll 2015-10-01 09:14 - 2015-09-17 06:48 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll 2015-10-01 09:14 - 2015-09-17 06:44 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll 2015-10-01 09:14 - 2015-09-17 06:49 - 00884736 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll 2015-10-01 09:14 - 2015-09-17 06:43 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll 2015-07-10 12:00 - 2015-07-10 17:43 - 00210432 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.ProxyStub.dll 2015-10-19 21:00 - 2015-10-19 21:00 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll 2015-10-23 15:20 - 2015-10-20 15:08 - 01532744 _____ () C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.80\libglesv2.dll 2015-10-23 15:20 - 2015-10-20 15:08 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.80\libegl.dll 2015-10-30 17:15 - 2012-06-23 14:54 - 00061440 _____ () C:\Program Files (x86)\ROCCAT\Kone Pure Mouse\hiddriver.dll 2014-12-15 23:45 - 2013-09-03 16:52 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll ==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) ========= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.) ==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.) ==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.) ==================== Internet Explorer Vertrauenswürdig/Eingeschränkt =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.) ==================== Andere Bereiche ============================ (Aktuell gibt es keinen automatisierten Fix für diesen Bereich.) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppBackground\{8f613224-081d-4870-95b1-d3401a9c063b}.jpg DNS Servers: 192.168.0.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Windows Firewall ist aktiviert. ==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge == (Aktuell gibt es keinen automatisierten Fix für diesen Bereich.) HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Akamai NetSession Interface" HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Spotify" HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Spotify Web Helper" ==================== Firewall Regeln (Nicht auf der Ausnahmeliste) =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139 FirewallRules: [{AA2759FA-EDA9-49D9-8F1E-31DBB008545D}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe FirewallRules: [{21668B50-B857-45A9-B645-E11ECDD0BA49}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe FirewallRules: [{6CB59014-5555-42F1-8B13-C849BCCFE2D5}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe FirewallRules: [{A3131C8E-696E-4F51-ACFD-B2AB59280978}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe FirewallRules: [{FEE6B3AF-FAFD-4C1B-B25C-3D7B4B195124}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{B443DA33-A6A7-4033-956B-A93AC3CBC433}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{E6CBFDB1-E319-4DB8-AFE5-A4934C2C92BB}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{6A8E79CC-2575-4BAE-8F1C-D7A7E2F46E1E}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{8E7D9FDF-1879-4244-A2C6-EBC14CC669E7}] => (Allow) %USERPROFILE%\jagexcache\jagexlauncher\bin\JagexLauncher.exe FirewallRules: [{35A1C72A-BDD3-483A-89A4-27F37D6F2DF0}] => (Allow) %USERPROFILE%\jagexcache\jagexlauncher\bin\JagexLauncher.exe FirewallRules: [{B6240254-8695-4136-8688-496A32476A12}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe FirewallRules: [{E7AD38FE-F37D-44CA-9649-1701BCC99048}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe FirewallRules: [{B0CB35E9-5E30-4F33-B965-F50096A6FF89}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe FirewallRules: [{D97329F3-5344-4F9A-ABBF-5E569CF1D363}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe FirewallRules: [{CAEEFC92-F0A2-4DE5-A2E7-FFCAFF3B70D4}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe FirewallRules: [{DA773FEA-CDF4-4FFB-818E-B255D4ABA4EF}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe FirewallRules: [{22A49953-B3ED-4BC6-8832-A1E30DE6E35D}] => (Block) C:\users\admin\appdata\roaming\spotify\spotify.exe FirewallRules: [{C130419E-ACEF-4A16-B5CD-F7064DA07399}] => (Block) C:\users\admin\appdata\roaming\spotify\spotify.exe FirewallRules: [UDP Query User{8F3963CA-4443-496D-B9E4-2A16E020A73E}C:\users\admin\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\admin\appdata\roaming\spotify\spotify.exe FirewallRules: [TCP Query User{C9892719-B171-4AE8-B087-57F263271C60}C:\users\admin\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\admin\appdata\roaming\spotify\spotify.exe FirewallRules: [{A6677B6E-9570-4D98-87FE-84B9780B452C}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{CD221F27-BA09-4A4E-BC94-50541EBCB868}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{85BC76F4-96B4-4164-A507-B85036C799E4}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe FirewallRules: [{05E12DE1-3BF9-4600-BD77-0809E7D8C280}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe FirewallRules: [UDP Query User{6B3064D8-144A-4C73-834F-582573F693E1}C:\users\admin\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\admin\appdata\local\akamai\netsession_win.exe FirewallRules: [TCP Query User{4F97824E-B35A-4B0C-97A6-D3BAFD6E693B}C:\users\admin\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\admin\appdata\local\akamai\netsession_win.exe FirewallRules: [{ACFE8A12-C5A4-41FC-90A6-7D110C49FAEE}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe FirewallRules: [{55CAAA0F-FBB7-462F-8A31-FCCBE685917A}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe FirewallRules: [{046FF7F9-A214-4106-ADBB-6B8AD4D530E1}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe FirewallRules: [{B26C67AD-595F-4798-8BA9-48A408D1A66A}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe FirewallRules: [{0812631C-DFED-4D26-BAD8-38EC0D43A5F9}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe FirewallRules: [{DD625CA9-74CC-4EF5-8787-672253D8102B}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe FirewallRules: [{92F406C8-75D5-4ABC-B10E-2BCB8528AAD5}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{2E1B87E5-B37C-4C66-97F9-A7331EB138D4}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{20E5CF9D-CD2B-48EC-8529-99B170102939}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\AdVenture Capitalist\adventure-capitalist.exe FirewallRules: [{C1EF0CA2-2081-43FE-8B04-16DE223F8C15}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\AdVenture Capitalist\adventure-capitalist.exe FirewallRules: [{C20F43D5-69D4-45A1-AD1B-C744E89D4511}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{7E097365-0904-432E-929B-8F1CD4D41E51}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{1E925C46-62CE-4FA6-82B0-ABDF754998C5}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{F8DCB71C-268A-4DB2-8339-FDB932450A7D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{DD491145-F36D-48BC-A4CF-458D412FE1DE}] => (Allow) C:\Program Files\iTunes\iTunes.exe FirewallRules: [{9E2BD5A0-E113-4596-8766-27355FE2915D}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe FirewallRules: [{FA0C4343-8703-4F6C-9DC8-FFFFAB81E76F}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe FirewallRules: [{ED914587-871F-442A-9BD6-A49AE4D2E7FC}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe FirewallRules: [{0E13C41E-AF31-49F7-B977-A5BFEB095E9A}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\DataProxy.exe ==================== Fehlerhafte Geräte im Gerätemanager ============= ==================== Fehlereinträge in der Ereignisanzeige: ========================= Applikationsfehler: ================== Error: (11/06/2015 09:42:25 PM) (Source: SideBySide) (EventID: 78) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest. Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest. Error: (11/06/2015 09:30:57 PM) (Source: SideBySide) (EventID: 78) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest. Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest. Error: (11/06/2015 08:13:45 PM) (Source: SideBySide) (EventID: 78) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest. Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest. Error: (11/06/2015 08:13:36 PM) (Source: SideBySide) (EventID: 78) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest. Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest. Error: (11/06/2015 08:13:35 PM) (Source: SideBySide) (EventID: 78) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest. Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest. Error: (11/06/2015 08:13:35 PM) (Source: SideBySide) (EventID: 78) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest. Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest. Error: (11/06/2015 08:13:26 PM) (Source: SideBySide) (EventID: 78) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest. Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest. Error: (11/06/2015 08:13:23 PM) (Source: SideBySide) (EventID: 78) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest. Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest. Error: (11/06/2015 12:45:08 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: MicrosoftEdge.exe, Version: 11.0.10240.16566, Zeitstempel: 0x56277dbe Name des fehlerhaften Moduls: CoreUIComponents.dll, Version: 0.0.0.0, Zeitstempel: 0x55fa4b76 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000000000060f73 ID des fehlerhaften Prozesses: 0x7e8 Startzeit der fehlerhaften Anwendung: 0xMicrosoftEdge.exe0 Pfad der fehlerhaften Anwendung: MicrosoftEdge.exe1 Pfad des fehlerhaften Moduls: MicrosoftEdge.exe2 Berichtskennung: MicrosoftEdge.exe3 Vollständiger Name des fehlerhaften Pakets: MicrosoftEdge.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: MicrosoftEdge.exe5 Error: (11/06/2015 12:44:23 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: ) Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer". Details: AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll. System Error: Zugriff verweigert . Systemfehler: ============= Error: (11/07/2015 01:22:14 AM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT) Description: {784E29F4-5EBE-4279-9948-1E8FE941646D} Error: (11/07/2015 01:18:54 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Service KMSELDI" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (11/07/2015 01:18:01 AM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "Benutzerdatenzugriff_Session1" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts. Error: (11/07/2015 01:18:01 AM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "Benutzerdatenspeicher _Session1" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts. Error: (11/07/2015 01:18:01 AM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "Kontaktdaten_Session1" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts. Error: (11/07/2015 01:18:01 AM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "Synchronisierungshost_Session1" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts. Error: (11/06/2015 08:16:39 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: %%1275 Error: (11/06/2015 08:16:39 PM) (Source: Application Popup) (EventID: 1060) (User: ) Description: \??\C:\Users\Admin\AppData\Local\Temp\ehdrv.sys Error: (11/06/2015 08:16:39 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: %%1275 Error: (11/06/2015 08:16:39 PM) (Source: Application Popup) (EventID: 1060) (User: ) Description: \??\C:\Users\Admin\AppData\Local\Temp\ehdrv.sys CodeIntegrity: =================================== Date: 2015-11-06 21:20:14.093 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-11-06 12:29:17.082 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-11-05 12:39:36.174 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-10-26 20:03:56.406 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-09-28 17:52:15.924 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-09-24 22:29:45.054 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-09-15 19:40:31.474 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-08-29 12:12:37.860 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-08-05 23:10:52.350 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. ==================== Speicherinformationen =========================== Prozessor: Intel(R) Pentium(R) CPU G3420 @ 3.20GHz Prozentuale Nutzung des RAM: 27% Installierter physikalischer RAM: 8111.13 MB Verfügbarer physikalischer RAM: 5861.58 MB Summe virtueller Speicher: 9391.13 MB Verfügbarer virtueller Speicher: 6606.91 MB ==================== Laufwerke ================================ Drive c: () (Fixed) (Total:243.36 GB) (Free:161.02 GB) NTFS Drive d: (Volume) (Fixed) (Total:687.37 GB) (Free:687.18 GB) NTFS ==================== MBR & Partitionstabelle ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: C390FBE7) Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=243.4 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=450 MB) - (Type=27) Partition 4: (Not Active) - (Size=687.4 GB) - (Type=07 NTFS) ==================== Ende von Addition.txt ============================ Martin |
07.11.2015, 11:17 | #15 | |||||||||
/// TB-Ausbilder | Easycalender lässt sich nicht entfernenZitat:
Reste entfernen Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [X] Task: {F5E604C0-8A2B-485C-9605-9EC1FD317421} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG Reboot: end Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Die Fixlog von FRST gleich posten, da diese sonst mit DelFix (siehe weiter unten) automatisch entfernt wird! Wenn du keine Probleme mehr mit Malware hast, dann sind wir hier fertig. Deine Logdateien sind sauber. Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern. Cleanup: (Die Reihenfolge ist hier entscheidend) Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken. Falls Combofix verwendet wurde: Combofix deinstallieren
Alle Logs gepostet? Dann lade Dir bitte DelFix herunter.
Starte Deinen Rechner anschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen. Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...und/oder das Forum mit einer kleinen Spende unterstützen. Absicherung: Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen: Browser Java Flash-Player PDF-Reader Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren. Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen. Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig. Sofern du noch unentschieden bist, verwende ein einziges der folgenden Antivirusprogramme mit Echtzeitscanner und stets aktueller Signaturendatenbank: Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen. Optional: Adblock Plus Kann Banner, Pop-ups, Videowerbung, Tracking und Malware-Seiten blockieren. NoScript Verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen. Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen. Lade Software von einem sauberen Portal wie . Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen. Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner . Abschließend noch ein paar grundsätzliche Bemerkungen:
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann. |
Themen zu Easycalender lässt sich nicht entfernen |
addon, befindet, browser, deinstalliert, durch unternehmensrichtlinie installiert, entferne, entfernen, freeware, freue, gestern, google, hallo zusammen, löschen, malware, neu, nicht löschen, plage, problem, rum, runterladen, schei, sofort, systems, systemsteuerung, unternehmensrichtlinie, werbebanner, würde, ziemlich, zusammen |