| |
| |||||||
Log-Analyse und Auswertung: UCGuard nicht entfernbar und andere MalwareWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
05.11.2016, 13:05
| #1 |
 |  UCGuard nicht entfernbar und andere Malware Guten Tag, seit gestern macht mein Rechner seltsame Sachen. der Defender wurde in der Registry deaktiviert, der Startbutton hat Linksklick keine Funktion mehr also habe ich mal den AdwCleaner durchlaufen lassen und er wurde fündig. Problem ist derzeit, er hat einen Dienst "UCGuard" gefunden, Adwcleaner hängt sich allerdings beim versuch diesen zu entfernen auf. Ich hoffe das vllt jemand eine Lösung für dieses Problem hat. LG Kakuzu Log vom AdwCleaner Code:
ATTFilter # AdwCleaner v6.030 - Bericht erstellt am 05/11/2016 um 12:58:04
# Aktualisiert am 19/10/2016 von Malwarebytes
# Datenbank : 2016-11-05.1 [Server]
# Betriebssystem : Windows 10 Home (X64)
# Benutzername : Benjamin - PANDORY
# Gestartet von : C:\Users\Benjamin\Downloads\AdwCleaner_6.030.exe
# Modus: Suchlauf
# Unterstützung : https://www.malwarebytes.com/support
***** [ Dienste ] *****
Dienst Gefunden: UCGuard
***** [ Ordner ] *****
Keine schädlichen Ordner gefunden.
***** [ Dateien ] *****
Datei Gefunden: C:\WINDOWS\SysNative\drivers\ucguard.sys
***** [ DLL ] *****
Keine infizierten DLLs gefunden.
***** [ WMI ] *****
Keine schädlichen Schlüssel gefunden.
***** [ Verknüpfungen ] *****
Verknüpfung infiziert: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dragon's Prophet\Drаgоn's Prоphеt.lnk ( "hxxp://gotut.ru/?from=im3sng" )
***** [ Aufgabenplanung ] *****
Keine schädlichen Aufgaben gefunden.
***** [ Registrierungsdatenbank ] *****
Schlüssel Gefunden: HKU\S-1-5-21-3046321304-749213656-246317510-1001\Software\UCBrowser
Schlüssel Gefunden: HKCU\Software\UCBrowser
Schlüssel Gefunden: HKLM\SOFTWARE\UCBrowser
Schlüssel Gefunden: HKLM\SOFTWARE\UCBrowserPID
Schlüssel Gefunden: [x64] HKCU\Software\UCBrowser
***** [ Internetbrowser ] *****
Keine schädlichen Elemente in Firefox basierten Browsern gefunden.
Chrome pref Gefunden: [C:\Users\Benjamin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Secure Preferences] - hxxp://mysearch.avg.com?cid={6906F778-DF21-4A84-8687-5B71364FFFCF}&mid=8fa50f37953e47d2a1f5d16b2f1ec0c5-
Chrome pref Gefunden: [C:\Users\Benjamin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Secure Preferences ] - ehoopddfhgaehhmphfcooacjdpmbjlao
Chrome pref Gefunden: [C:\Users\Benjamin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Secure Preferences ] - hxxp://mysearch.avg.com?cid={6906F778-DF21-4A84-8687-5B71364FFFCF}&mid=8fa50f37953e47d2a1f5d16b2f1ec0c5
*************************
C:\AdwCleaner\AdwCleaner[S0].txt - [2059 Bytes] - [05/11/2016 12:58:04]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2132 Bytes] ##########
|
|
05.11.2016, 13:46
| #2 |
| /// TB-Ausbilder   | UCGuard nicht entfernbar und andere Malware Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen. Bitte beachte folgende Hinweise:
Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags:  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Danke für deine Mitarbeit! Zur ersten Analyse bitte FRST und TDSS-Killer ausführen: Schritt 1 Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
Schritt 2 Downloade dir bitte  TDSSKiller.exe und speichere diese Datei auf dem Desktop
Bitte poste mit deiner nächsten Antwort
|
|
05.11.2016, 23:39
| #3 |
| | UCGuard nicht entfernbar und andere Malware FRST lässt sich bei mir nicht ausführen weder die 32 bit noch die eigentlich benötigte 64bit Version.
__________________32bit Version nicht kompatibel mit meiner 64bit Platform 64bit Version startet überhaupt nicht. Nur kurz das ladeicon am Mauszeiger dann nix. Zudem ist mir aufgefallen das beim Systemstart und beim versuch den Windowsbutton, der mit linksklick keine Funktion hat, ein Sound abgespielt wird, denn man auch hört wenn die Benutzerkontensteuerung aufgeruden wird. Ein Ping geräusch. Code:
ATTFilter 23:35:26.0085 0x5a3c TDSS rootkit removing tool 3.1.0.11 Aug 5 2016 12:13:31
23:35:26.0085 0x5a3c UEFI system
23:35:29.0607 0x5a3c ============================================================
23:35:29.0607 0x5a3c Current date / time: 2016/11/05 23:35:29.0607
23:35:29.0608 0x5a3c SystemInfo:
23:35:29.0608 0x5a3c
23:35:29.0608 0x5a3c OS Version: 10.0.14393 ServicePack: 0.0
23:35:29.0608 0x5a3c Product type: Workstation
23:35:29.0608 0x5a3c ComputerName: PANDORY
23:35:29.0608 0x5a3c UserName: Benjamin
23:35:29.0608 0x5a3c Windows directory: C:\WINDOWS
23:35:29.0608 0x5a3c System windows directory: C:\WINDOWS
23:35:29.0608 0x5a3c Running under WOW64
23:35:29.0608 0x5a3c Processor architecture: Intel x64
23:35:29.0608 0x5a3c Number of processors: 4
23:35:29.0608 0x5a3c Page size: 0x1000
23:35:29.0608 0x5a3c Boot type: Normal boot
23:35:29.0608 0x5a3c CodeIntegrityOptions = 0x00000001
23:35:29.0608 0x5a3c ============================================================
23:35:29.0699 0x5a3c KLMD registered as C:\WINDOWS\system32\drivers\30580314.sys
23:35:29.0699 0x5a3c KLMD ARK init status: drvProperties = 0xFFF00, osBuild = 14393.351, osProperties = 0x19
23:35:30.0008 0x5a3c System UUID: {A6B730A1-7071-0B8B-D12B-9015180BA20F}
23:35:30.0571 0x5a3c Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
23:35:30.0576 0x5a3c ============================================================
23:35:30.0576 0x5a3c \Device\Harddisk0\DR0:
23:35:30.0576 0x5a3c GPT partitions:
23:35:30.0577 0x5a3c \Device\Harddisk0\DR0\Partition1: GPT, TypeGUID: {DE94BBA4-06D1-4D40-A16A-BFD50179D6AC}, UniqueGUID: {63C29FC2-692E-4DF6-AC25-A2F8474F43BF}, Name: Basic data partition, StartLBA 0x800, BlocksNum 0x1F4000
23:35:30.0577 0x5a3c \Device\Harddisk0\DR0\Partition2: GPT, TypeGUID: {C12A7328-F81F-11D2-BA4B-00A0C93EC93B}, UniqueGUID: {8BF56545-1BB9-4A99-9D03-EDF8CAECADE2}, Name: EFI system partition, StartLBA 0x1F4800, BlocksNum 0x82000
23:35:30.0577 0x5a3c \Device\Harddisk0\DR0\Partition3: GPT, TypeGUID: {BFBFAFE7-A34F-448A-9A5B-6213EB736C22}, UniqueGUID: {3F37ABD9-3265-4741-A1FD-11988C7F0E0F}, Name: Basic data partition, StartLBA 0x276800, BlocksNum 0x1F4000
23:35:30.0577 0x5a3c \Device\Harddisk0\DR0\Partition4: GPT, TypeGUID: {E3C9E316-0B5C-4DB8-817D-F92DF00215AE}, UniqueGUID: {AED0EF8F-20A7-4687-B2B5-75535138F9D0}, Name: Microsoft reserved partition, StartLBA 0x46A800, BlocksNum 0x40000
23:35:30.0577 0x5a3c \Device\Harddisk0\DR0\Partition5: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {8B35356D-B091-4746-B3A2-A6A35C1458C3}, Name: Basic data partition, StartLBA 0x4AA800, BlocksNum 0x6F3D0800
23:35:30.0577 0x5a3c \Device\Harddisk0\DR0\Partition6: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {C9FC75C4-3E8B-454D-ABFC-31F9980840C6}, Name: Basic data partition, StartLBA 0x6F87B000, BlocksNum 0x3200000
23:35:30.0577 0x5a3c \Device\Harddisk0\DR0\Partition7: GPT, TypeGUID: {DE94BBA4-06D1-4D40-A16A-BFD50179D6AC}, UniqueGUID: {FCDEBC20-B397-420C-A500-E1CA3F452777}, Name: Basic data partition, StartLBA 0x72A7B000, BlocksNum 0x1C8B800
23:35:30.0577 0x5a3c MBR partitions:
23:35:30.0577 0x5a3c ============================================================
23:35:30.0588 0x5a3c C: <-> \Device\Harddisk0\DR0\Partition5
23:35:30.0636 0x5a3c D: <-> \Device\Harddisk0\DR0\Partition6
23:35:30.0636 0x5a3c ============================================================
23:35:30.0636 0x5a3c Initialize success
23:35:30.0636 0x5a3c ============================================================
23:35:50.0890 0x40dc ============================================================
23:35:50.0890 0x40dc Scan started
23:35:50.0890 0x40dc Mode: Manual; SigCheck; TDLFS;
23:35:50.0890 0x40dc ============================================================
23:35:50.0890 0x40dc KSN ping started
23:35:51.0006 0x40dc KSN ping finished: true
23:35:52.0017 0x40dc ================ Scan system memory ========================
23:35:52.0017 0x40dc System memory - ok
23:35:52.0017 0x40dc ================ Scan services =============================
23:35:52.0222 0x40dc 1394ohci - ok
23:35:52.0232 0x40dc 3ware - ok
23:35:52.0244 0x40dc ACPI - ok
23:35:52.0254 0x40dc AcpiDev - ok
23:35:52.0262 0x40dc acpiex - ok
23:35:52.0269 0x40dc acpipagr - ok
23:35:52.0298 0x40dc AcpiPmi - ok
23:35:52.0304 0x40dc acpitime - ok
23:35:52.0317 0x40dc [ E13DE7CD2B62254DD4FF658B7798A37D, 9FCCC90DEF6BE83F8C41D4552D235A7BB5534954D2E7CB7B1C336A31FCCAB3AD ] ACPIVPC C:\WINDOWS\System32\drivers\AcpiVpc.sys
23:35:52.0395 0x40dc ACPIVPC - ok
23:35:52.0404 0x40dc ADP80XX - ok
23:35:52.0462 0x40dc AFD - ok
23:35:52.0477 0x40dc ahcache - ok
23:35:52.0487 0x40dc AJRouter - ok
23:35:52.0497 0x40dc ALG - ok
23:35:52.0504 0x40dc AmdK8 - ok
23:35:52.0511 0x40dc AmdPPM - ok
23:35:52.0516 0x40dc amdsata - ok
23:35:52.0523 0x40dc amdsbs - ok
23:35:52.0529 0x40dc amdxata - ok
23:35:52.0535 0x40dc [ 4126D30992B26303E47E8981313FD6D6, 4C8DB2DDDB88FBEA87CDBFB93D9855B40043778878AF4A5571C174434F9C0D4C ] AmUStor C:\WINDOWS\system32\drivers\AmUStor.SYS
23:35:52.0545 0x40dc AmUStor - ok
23:35:52.0652 0x40dc [ 3FD1A2079EB3FF7F158D135E5CAA96E3, AFDA1FE052304B721CD3653F24421A581308220269534C3D14899A683B44825E ] Apache2.4 C:\xampp\apache\bin\httpd.exe
23:35:52.0733 0x40dc Apache2.4 - detected UnsignedFile.Multi.Generic ( 1 )
23:35:52.0834 0x40dc Detect skipped due to KSN trusted
23:35:52.0834 0x40dc Apache2.4 - ok
23:35:52.0845 0x40dc AppID - ok
23:35:52.0854 0x40dc AppIDSvc - ok
23:35:52.0877 0x40dc Appinfo - ok
23:35:52.0882 0x40dc applockerfltr - ok
23:35:52.0900 0x40dc AppReadiness - ok
23:35:52.0917 0x40dc AppXSvc - ok
23:35:52.0975 0x40dc [ 8F1359937B6401C79C42CF6646FECA9B, D42093B5B21E9DECFFFDB15EC1B157AFB22268E38449AF508AD3BE084BDC3D77 ] Arakosatuhph C:\Program Files (x86)\Phowert\qonakclecisycln.dll
23:35:53.0062 0x40dc Arakosatuhph - detected UnsignedFile.Multi.Generic ( 1 )
23:35:53.0265 0x40dc Arakosatuhph ( UnsignedFile.Multi.Generic ) - warning
23:35:53.0429 0x40dc arcsas - ok
23:35:53.0443 0x40dc AsyncMac - ok
23:35:53.0454 0x40dc atapi - ok
23:35:53.0462 0x40dc athr - ok
23:35:53.0467 0x40dc AudioEndpointBuilder - ok
23:35:53.0476 0x40dc Audiosrv - ok
23:35:53.0506 0x40dc AxInstSV - ok
23:35:53.0509 0x40dc b06bdrv - ok
23:35:53.0512 0x40dc BasicDisplay - ok
23:35:53.0516 0x40dc BasicRender - ok
23:35:53.0521 0x40dc bcmfn - ok
23:35:53.0524 0x40dc bcmfn2 - ok
23:35:53.0527 0x40dc BDESVC - ok
23:35:53.0531 0x40dc Beep - ok
23:35:53.0599 0x40dc [ E543472B75FC78B3205273AE1E8CFE5F, 97CCA65B2BD59DF45B069DE66522E768968CD03B377F797691429E14D448BE9F ] BEService C:\Program Files (x86)\Common Files\BattlEye\BEService.exe
23:35:53.0633 0x40dc BEService - ok
23:35:53.0650 0x40dc BFE - ok
23:35:53.0664 0x40dc BITS - ok
23:35:53.0742 0x40dc [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD, 17BFFC5DF609CE3B2F0CAB4BD6C118608C66A3AD86116A47E90B2BB7D8954122 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
23:35:53.0782 0x40dc Bonjour Service - ok
23:35:53.0790 0x40dc bowser - ok
23:35:53.0794 0x40dc BrokerInfrastructure - ok
23:35:53.0797 0x40dc Browser - ok
23:35:53.0866 0x40dc [ 0471D5669F18C50E552B2BC0CB15E7B3, 472F471FF9E5A1FDD5610BAC2F5E727AB284B7B5A71C4E515D549667F0B5EB86 ] BrYNSvc C:\Program Files (x86)\Browny02\BrYNSvc.exe
23:35:53.0913 0x40dc BrYNSvc - detected UnsignedFile.Multi.Generic ( 1 )
23:35:54.0005 0x40dc Detect skipped due to KSN trusted
23:35:54.0005 0x40dc BrYNSvc - ok
23:35:54.0046 0x40dc [ C6978F7EBA6F37D626482AC6B9390630, B4BF939AB9962A61DE9518604C20347DC2A6FCDCEB3D8AEF295AF12E6F2CDCF3 ] BTATH_BUS C:\WINDOWS\System32\drivers\btath_bus.sys
23:35:54.0073 0x40dc BTATH_BUS - ok
23:35:54.0120 0x40dc [ C8BF11D79B29BB23A461B65B58BA8593, 35AFAD5ED40304976287E6C982085DF7A91FF48F0320DAC32370FA039AA03C69 ] BtFilter C:\WINDOWS\system32\DRIVERS\btfilter.sys
23:35:54.0153 0x40dc BtFilter - ok
23:35:54.0173 0x40dc BthAvrcpTg - ok
23:35:54.0177 0x40dc BthHFEnum - ok
23:35:54.0180 0x40dc bthhfhid - ok
23:35:54.0184 0x40dc BthHFSrv - ok
23:35:54.0188 0x40dc BTHMODEM - ok
23:35:54.0192 0x40dc BTHPORT - ok
23:35:54.0195 0x40dc bthserv - ok
23:35:54.0244 0x40dc BTHUSB - ok
23:35:54.0271 0x40dc buttonconverter - ok
23:35:54.0282 0x40dc CapImg - ok
23:35:54.0294 0x40dc cdfs - ok
23:35:54.0320 0x40dc CDPSvc - ok
23:35:54.0346 0x40dc CDPUserSvc - ok
23:35:54.0395 0x40dc cdrom - ok
23:35:54.0407 0x40dc CertPropSvc - ok
23:35:54.0418 0x40dc cht4iscsi - ok
23:35:54.0423 0x40dc cht4vbd - ok
23:35:54.0428 0x40dc circlass - ok
23:35:54.0436 0x40dc CLFS - ok
23:35:54.0443 0x40dc ClipSVC - ok
23:35:54.0448 0x40dc clreg - ok
23:35:54.0459 0x40dc CmBatt - ok
23:35:54.0463 0x40dc CNG - ok
23:35:54.0467 0x40dc cnghwassist - ok
23:35:54.0530 0x40dc CompositeBus - ok
23:35:54.0542 0x40dc COMSysApp - ok
23:35:54.0557 0x40dc condrv - ok
23:35:54.0576 0x40dc CoreMessagingRegistrar - ok
23:35:54.0664 0x40dc [ 75C568E62A2BD89A869C34119A66D19B, 2954F25E511947728FE50AA76ACECE0B6952D1984301027F499E2F3DAAEB65D3 ] cphs C:\WINDOWS\SysWow64\IntelCpHeciSvc.exe
23:35:54.0722 0x40dc cphs - ok
23:35:54.0761 0x40dc CryptSvc - ok
23:35:54.0764 0x40dc dam - ok
23:35:54.0769 0x40dc DcomLaunch - ok
23:35:54.0772 0x40dc DcpSvc - ok
23:35:54.0778 0x40dc defragsvc - ok
23:35:54.0786 0x40dc DeviceAssociationService - ok
23:35:54.0789 0x40dc DeviceInstall - ok
23:35:54.0811 0x40dc DevQueryBroker - ok
23:35:54.0826 0x40dc Dfsc - ok
23:35:54.0866 0x40dc [ 9593475FBC857A05D93BFF4FA7323C2B, D2A958AF5EFDC6136A6ABB7F8D5FE1F84C967E79BEA96C5BE3661A0145DEB907 ] dg_ssudbus C:\WINDOWS\system32\DRIVERS\ssudbus.sys
23:35:54.0890 0x40dc dg_ssudbus - ok
23:35:54.0927 0x40dc Dhcp - ok
23:35:54.0990 0x40dc diagnosticshub.standardcollector.service - ok
23:35:55.0023 0x40dc DiagTrack - ok
23:35:55.0033 0x40dc disk - ok
23:35:55.0048 0x40dc DmEnrollmentSvc - ok
23:35:55.0057 0x40dc dmvsc - ok
23:35:55.0062 0x40dc dmwappushservice - ok
23:35:55.0081 0x40dc Dnscache - ok
23:35:55.0090 0x40dc dot3svc - ok
23:35:55.0095 0x40dc DPS - ok
23:35:55.0118 0x40dc drmkaud - ok
23:35:55.0122 0x40dc DsmSvc - ok
23:35:55.0126 0x40dc DsSvc - ok
23:35:55.0138 0x40dc DXGKrnl - ok
23:35:55.0155 0x40dc [ E10FB5C1071F2ACC6638E1A157EEB389, F2E6F305E9B2625D4329E80FC2C66B230524EED493F750D7AF8071CB551E3BF6 ] EagleX64 C:\WINDOWS\system32\drivers\EagleX64.sys
23:35:55.0168 0x40dc EagleX64 - ok
23:35:55.0172 0x40dc EapHost - ok
23:35:55.0175 0x40dc EasyAntiCheat - ok
23:35:55.0179 0x40dc ebdrv - ok
23:35:55.0205 0x40dc EFS - ok
23:35:55.0209 0x40dc EhStorClass - ok
23:35:55.0224 0x40dc EhStorTcgDrv - ok
23:35:55.0227 0x40dc embeddedmode - ok
23:35:55.0230 0x40dc EntAppSvc - ok
23:35:55.0234 0x40dc ErrDev - ok
23:35:55.0258 0x40dc EventSystem - ok
23:35:55.0261 0x40dc exfat - ok
23:35:55.0264 0x40dc fastfat - ok
23:35:55.0281 0x40dc Fax - ok
23:35:55.0285 0x40dc fdc - ok
23:35:55.0288 0x40dc fdPHost - ok
23:35:55.0291 0x40dc FDResPub - ok
23:35:55.0294 0x40dc fhsvc - ok
23:35:55.0305 0x40dc FileCrypt - ok
23:35:55.0309 0x40dc FileInfo - ok
23:35:55.0312 0x40dc Filetrace - ok
23:35:55.0315 0x40dc flpydisk - ok
23:35:55.0318 0x40dc FltMgr - ok
23:35:55.0322 0x40dc FontCache - ok
23:35:55.0454 0x40dc FontCache3.0.0.0 - ok
23:35:55.0465 0x40dc FrameServer - ok
23:35:55.0476 0x40dc FsDepends - ok
23:35:55.0487 0x40dc Fs_Rec - ok
23:35:55.0497 0x40dc fvevol - ok
23:35:55.0600 0x40dc [ D56EE61F9B62AD677395BF003A49B4A7, A4B657AF38253F4BAE2A8BE7E9453E662BC378773A93631C0445C96267296B53 ] GDCAgent C:\Program Files (x86)\Lenovo\GDCAgentSetupRed\GDCAgent.exe
23:35:55.0632 0x40dc GDCAgent - ok
23:35:55.0670 0x40dc gencounter - ok
23:35:55.0673 0x40dc genericusbfn - ok
23:35:55.0676 0x40dc GPIOClx0101 - ok
23:35:55.0681 0x40dc gpsvc - ok
23:35:55.0692 0x40dc GpuEnergyDrv - ok
23:35:55.0763 0x40dc [ DD7423ABBE2913E70D50E9318AD57EE4, 74BC123808F3FA60ADDC51C1383F8250608D3DBA3A8DC175B3418A1CF0BC53E9 ] gupdate C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
23:35:55.0781 0x40dc gupdate - ok
23:35:55.0789 0x40dc [ DD7423ABBE2913E70D50E9318AD57EE4, 74BC123808F3FA60ADDC51C1383F8250608D3DBA3A8DC175B3418A1CF0BC53E9 ] gupdatem C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
23:35:55.0804 0x40dc gupdatem - ok
23:35:55.0807 0x40dc HDAudBus - ok
23:35:55.0811 0x40dc HidBatt - ok
23:35:55.0814 0x40dc HidBth - ok
23:35:55.0817 0x40dc hidi2c - ok
23:35:55.0821 0x40dc hidinterrupt - ok
23:35:55.0824 0x40dc HidIr - ok
23:35:55.0827 0x40dc hidserv - ok
23:35:55.0876 0x40dc HidUsb - ok
23:35:55.0891 0x40dc HomeGroupListener - ok
23:35:55.0909 0x40dc HomeGroupProvider - ok
23:35:55.0915 0x40dc HpSAMD - ok
23:35:55.0922 0x40dc HTTP - ok
23:35:55.0932 0x40dc HvHost - ok
23:35:55.0969 0x40dc hvservice - ok
23:35:55.0974 0x40dc [ EF558A02D734A1403583E95CCEEC2487, F0D052DAF48A62E4A90D067BFCB5EE9563804DE68D0EA82E0E11C8D16AD19D29 ] HWiNFO32 C:\WINDOWS\system32\drivers\HWiNFO64A.SYS
23:35:55.0986 0x40dc HWiNFO32 - ok
23:35:55.0990 0x40dc hwpolicy - ok
23:35:55.0996 0x40dc hyperkbd - ok
23:35:56.0013 0x40dc i8042prt - ok
23:35:56.0016 0x40dc iagpio - ok
23:35:56.0020 0x40dc iai2c - ok
23:35:56.0024 0x40dc iaLPSS2i_GPIO2 - ok
23:35:56.0028 0x40dc iaLPSS2i_I2C - ok
23:35:56.0031 0x40dc iaLPSSi_GPIO - ok
23:35:56.0035 0x40dc iaLPSSi_I2C - ok
23:35:56.0064 0x40dc [ E5A15FEDEBDFB8E12CB94DBF01833775, 9C751A1FD8A5CEC8DD9FE8AE46E86A514C67F07EED04AB23A26A36F400DF8EA4 ] iaStorA C:\WINDOWS\system32\drivers\iaStorA.sys
23:35:56.0083 0x40dc iaStorA - ok
23:35:56.0087 0x40dc iaStorAV - ok
23:35:56.0162 0x40dc [ 95BA9605AE793746D8F6AD18E5DA7EFE, 1CFB12E798E268D812EB20EBC85AC1DD1345F073389DEF79986BA45E7BDC701D ] IAStorDataMgrSvc C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
23:35:56.0181 0x40dc IAStorDataMgrSvc - ok
23:35:56.0191 0x40dc iaStorV - ok
23:35:56.0195 0x40dc ibbus - ok
23:35:56.0242 0x40dc icssvc - ok
23:35:56.0475 0x40dc [ 658287D76E8D77C08AE98989F99B8948, DBA67B5772E1FE43ABDB3908A1CF86D76F2774BABC20359D2511F06A2A8CAC57 ] igfx C:\WINDOWS\system32\DRIVERS\igdkmd64.sys
23:35:56.0736 0x40dc igfx - ok
23:35:56.0769 0x40dc [ A105AD05696D55E6E4F078ED850F6305, 8121A4226D2941EDD4809D516E7684E5C7164ADCF5AA4C8BC6620110625D3E8D ] igfxCUIService2.0.0.0 C:\WINDOWS\system32\igfxCUIService.exe
23:35:56.0837 0x40dc igfxCUIService2.0.0.0 - ok
23:35:56.0860 0x40dc IKEEXT - ok
23:35:56.0870 0x40dc IndirectKmd - ok
23:35:56.0890 0x40dc [ CF25067821BB89E87021E9493C178863, 1AA25378EFD977BC6CD9405A395FA2962770385FAB5A9A55FC95B5F6DFD8D1AE ] intaud_WaveExtensible C:\WINDOWS\system32\drivers\intelaud.sys
23:35:56.0898 0x40dc intaud_WaveExtensible - ok
23:35:56.0911 0x40dc [ E300D1E37B737ED14F7A08CD5604E5D9, 5C1135081E29D7F4A97D5CAA2C8FBE1DD04EC7A3D8E648E69F2AA9EBDD88EBBB ] IntcDAud C:\WINDOWS\system32\DRIVERS\IntcDAud.sys
23:35:56.0931 0x40dc IntcDAud - ok
23:35:56.0993 0x40dc [ 0DB1E3F6189C628675F855C0EB510419, 989F539E82105019D2D81255369B96DC65826CD2A421DA09809155B26F69C555 ] Intel(R) Capability Licensing Service Interface C:\Program Files\Intel\iCLS Client\HeciServer.exe
23:35:57.0057 0x40dc Intel(R) Capability Licensing Service Interface - detected UnsignedFile.Multi.Generic ( 1 )
23:35:57.0156 0x40dc Detect skipped due to KSN trusted
23:35:57.0157 0x40dc Intel(R) Capability Licensing Service Interface - ok
23:35:57.0235 0x40dc [ 492AAF2FF66F437F0E796574B116EFC3, 6BF21C61ED05705DD58203952A750D1AB4D4B62F3A2B640BBBD9B85D1ECC3E5C ] Intel(R) Capability Licensing Service TCP IP Interface C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
23:35:57.0269 0x40dc Intel(R) Capability Licensing Service TCP IP Interface - ok
23:35:57.0310 0x40dc [ B1B3CED4AACC96080EE7E7516A558184, 3B76DDC32EDEF6FFC5722FB063576FBE154A958A73F9E3B377E541C9BB2F06D5 ] IntelHSWPcc C:\WINDOWS\system32\drivers\IntelPcc.sys
23:35:57.0324 0x40dc IntelHSWPcc - ok
23:35:57.0334 0x40dc intelide - ok
23:35:57.0355 0x40dc intelpep - ok
23:35:57.0359 0x40dc intelppm - ok
23:35:57.0363 0x40dc iorate - ok
23:35:57.0368 0x40dc IpFilterDriver - ok
23:35:57.0378 0x40dc iphlpsvc - ok
23:35:57.0382 0x40dc IPMIDRV - ok
23:35:57.0386 0x40dc IPNAT - ok
23:35:57.0391 0x40dc irda - ok
23:35:57.0394 0x40dc IRENUM - ok
23:35:57.0397 0x40dc irmon - ok
23:35:57.0401 0x40dc isapnp - ok
23:35:57.0404 0x40dc iScsiPrt - ok
23:35:57.0414 0x40dc [ 2DB1E2AE4A0DE62026296F0A6C29F3F5, A5A3D4D5BF9FF1DB5AC3BE15699B52707C8EB71EFA8FA82E7AE7A0C52C224380 ] iwdbus C:\WINDOWS\System32\drivers\iwdbus.sys
23:35:57.0422 0x40dc iwdbus - ok
23:35:57.0455 0x40dc [ 52069AEB42D3D0F97CBCA1085EBF55E6, ADB2EFFF563B3FE113FCD156FD1E469BC24FC1D68AFEDCA21306F76592C9FF88 ] jhi_service C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
23:35:57.0468 0x40dc jhi_service - ok
23:35:57.0477 0x40dc kbdclass - ok
23:35:57.0483 0x40dc kbdhid - ok
23:35:57.0501 0x40dc kdnic - ok
23:35:57.0504 0x40dc KeyIso - ok
23:35:57.0526 0x40dc KSecDD - ok
23:35:57.0528 0x40dc KSecPkg - ok
23:35:57.0532 0x40dc ksthunk - ok
23:35:57.0559 0x40dc KtmRm - ok
23:35:57.0562 0x40dc L1C - ok
23:35:57.0628 0x40dc [ 86F06574763A0E7CDCD57DD85632E44F, 045940240494DBD1158C017754A14404E7D7F857D57DF78D4ECA326A2E3000B1 ] LADF_BakerCOnly C:\WINDOWS\system32\DRIVERS\ladfBakerCamd64.sys
23:35:57.0653 0x40dc LADF_BakerCOnly - ok
23:35:57.0674 0x40dc [ 89B4981F949A14148365DE8D98A310B5, DE408582146B98C8867C49738E585A18ABC6C135DB51B9D20786EEEC34CFAFAB ] LADF_BakerROnly C:\WINDOWS\system32\DRIVERS\ladfBakerRamd64.sys
23:35:57.0690 0x40dc LADF_BakerROnly - ok
23:35:57.0712 0x40dc [ 305BB2AC00D46542E0A653AB63F4ABB1, E3BE57A0EBB1194656D20C11688863A7864B06223419F688D82881F9F49604B6 ] LADF_CaptureOnly C:\WINDOWS\system32\DRIVERS\ladfGSCamd64.sys
23:35:57.0728 0x40dc LADF_CaptureOnly - ok
23:35:57.0745 0x40dc [ 28CDDC7D478A6313F55077416DCBD0DE, EE4174FC9444856DF0693D1A5F16EB88352A3B012AA82D49C462980703981A7A ] LADF_RenderOnly C:\WINDOWS\system32\DRIVERS\ladfGSRamd64.sys
23:35:57.0755 0x40dc LADF_RenderOnly - ok
23:35:57.0777 0x40dc LanmanServer - ok
23:35:57.0780 0x40dc LanmanWorkstation - ok
23:35:57.0848 0x40dc [ 1D5C6790425CB6DBB1B3C2722C34E199, D8BCC31A443B77711A7CA468E754A73137C1CC47D6F3DA5BEE3735B654327B0C ] LBTServ C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
23:35:57.0872 0x40dc LBTServ - ok
23:35:57.0899 0x40dc lfsvc - ok
23:35:57.0903 0x40dc [ FA529FB35694C24BF98A9EF67C1CD9D0, 7B3C587C38CF13D514140F0A55E58997D6071D1DEFD97E274E3F490660AC6075 ] LGBusEnum C:\WINDOWS\system32\drivers\LGBusEnum.sys
23:35:57.0910 0x40dc LGBusEnum - ok
23:35:57.0940 0x40dc [ C7AF05942E041D4B1F345ACF79993BB3, E8FAAE356C99A11F6CF17640FD9C67F87AFBFEFB70C458CB85178F2AD94DF848 ] LGJoyXlCore C:\WINDOWS\system32\drivers\LGJoyXlCore.sys
23:35:57.0953 0x40dc LGJoyXlCore - ok
23:35:57.0967 0x40dc [ 07B1C1927BAE6431D3DFB1816DF05BBA, 9B296F6E801D14CE89F5E3EA9B3962EE99E1D3E22077D075F5B0EE4FE3CAB65E ] lgLowAudio C:\WINDOWS\system32\drivers\lgLowAudio.sys
23:35:57.0977 0x40dc lgLowAudio - ok
23:35:58.0015 0x40dc [ 94B29CE153765E768F004FB3440BE2B0, E74C01CEBDA589CDDE35CBCBAA18700E3742DD3B48A90DB3630992467FFC5024 ] LGVirHid C:\WINDOWS\system32\drivers\LGVirHid.sys
23:35:58.0027 0x40dc LGVirHid - ok
23:35:58.0052 0x40dc LicenseManager - ok
23:35:58.0058 0x40dc lltdio - ok
23:35:58.0065 0x40dc lltdsvc - ok
23:35:58.0093 0x40dc lmhosts - ok
23:35:58.0147 0x40dc [ 6A35B295812CE7064CFBCD9F254169CF, 561DD131FED6F90686D8C031B45B87B6D065C7E0C8804AEFCDE239725AAEE43E ] LMS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
23:35:58.0174 0x40dc LMS - ok
23:35:58.0205 0x40dc LSI_SAS - ok
23:35:58.0208 0x40dc LSI_SAS2i - ok
23:35:58.0212 0x40dc LSI_SAS3i - ok
23:35:58.0216 0x40dc LSI_SSS - ok
23:35:58.0219 0x40dc LSM - ok
23:35:58.0232 0x40dc luafv - ok
23:35:58.0250 0x40dc MapsBroker - ok
23:35:58.0293 0x40dc [ 78BFF5425E044086E74E78650A359FBB, 294738C10F3ED933D4EC40EA0659372FCF19A3C6D45D356917438CA495F2CB45 ] MBAMProtector C:\WINDOWS\system32\drivers\mbam.sys
23:35:58.0312 0x40dc MBAMProtector - ok
23:35:58.0359 0x40dc [ 9611577752E293259C7DCE19E9026362, 8CB5DFD63FA15603BB6FA6B501E09ED7F4DE0E8F68CB28B78CECAC3711BEFD24 ] MBAMScheduler C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
23:35:58.0396 0x40dc MBAMScheduler - ok
23:35:58.0427 0x40dc [ F1A89A34388B5626F1548D393B23ECB1, EA00AC76C4C8C9340753B58A3313C9177A9B98F9F1BDE08F184CD0F53D0C186F ] MBAMService C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
23:35:58.0452 0x40dc MBAMService - ok
23:35:58.0522 0x40dc [ 78488AF2AB2111D67B3C4044707A519B, 7AA71B9C4C7949A1A21F60EF7CCEDE0079794990696B60557B5DC86F4D47223A ] MBAMSwissArmy C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys
23:35:58.0533 0x40dc MBAMSwissArmy - ok
23:35:58.0578 0x40dc [ 898415AC0B5F1D2A9A48ABCB68A6DC4B, E1FD9AE5E22E3E5A18288E66A6184E92A4B63A1274DCE147A7728BB09C6A225E ] MBAMWebAccessControl C:\WINDOWS\system32\drivers\mwac.sys
23:35:58.0594 0x40dc MBAMWebAccessControl - ok
23:35:58.0600 0x40dc megasas - ok
23:35:58.0649 0x40dc megasas2i - ok
23:35:58.0658 0x40dc megasr - ok
23:35:58.0674 0x40dc [ 926C135CFB0C75B32FB714B5C0C58FAA, AF627CD125794B69D450D298D5608D357F2C91FB89EBFAA0DA2A0F07C6A304A8 ] MEIx64 C:\WINDOWS\system32\DRIVERS\TeeDriverx64.sys
23:35:58.0694 0x40dc MEIx64 - ok
23:35:58.0716 0x40dc MessagingService - ok
23:35:58.0738 0x40dc mlx4_bus - ok
23:35:58.0742 0x40dc MMCSS - ok
23:35:58.0746 0x40dc Modem - ok
23:35:58.0767 0x40dc monitor - ok
23:35:58.0771 0x40dc mouclass - ok
23:35:58.0774 0x40dc mouhid - ok
23:35:58.0778 0x40dc mountmgr - ok
23:35:58.0834 0x40dc [ 269BDB3CB77EB77BABE2862BEAB1F208, EC693365C73D59244CB77E181042128A9901BA5C1109CD4F1B9A2008DF1F9582 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
23:35:58.0847 0x40dc MozillaMaintenance - ok
23:35:58.0852 0x40dc mpsdrv - ok
23:35:58.0856 0x40dc MpsSvc - ok
23:35:58.0860 0x40dc MRxDAV - ok
23:35:58.0876 0x40dc mrxsmb - ok
23:35:58.0887 0x40dc mrxsmb10 - ok
23:35:58.0900 0x40dc mrxsmb20 - ok
23:35:58.0918 0x40dc MsBridge - ok
23:35:58.0922 0x40dc MSDTC - ok
23:35:58.0927 0x40dc Msfs - ok
23:35:58.0933 0x40dc msgpiowin32 - ok
23:35:58.0937 0x40dc mshidkmdf - ok
23:35:58.0940 0x40dc mshidumdf - ok
23:35:58.0943 0x40dc msisadrv - ok
23:35:58.0955 0x40dc MSiSCSI - ok
23:35:58.0958 0x40dc msiserver - ok
23:35:58.0961 0x40dc MSKSSRV - ok
23:35:58.0965 0x40dc MsLldp - ok
23:35:58.0968 0x40dc MSPCLOCK - ok
23:35:58.0971 0x40dc MSPQM - ok
23:35:58.0974 0x40dc MsRPC - ok
23:35:58.0978 0x40dc mssmbios - ok
23:35:58.0982 0x40dc MSTEE - ok
23:35:58.0986 0x40dc MTConfig - ok
23:35:58.0990 0x40dc Mup - ok
23:35:58.0994 0x40dc mvumis - ok
23:35:59.0072 0x40dc mysql - ok
23:35:59.0099 0x40dc NativeWifiP - ok
23:35:59.0107 0x40dc NcaSvc - ok
23:35:59.0135 0x40dc NcbService - ok
23:35:59.0141 0x40dc NcdAutoSetup - ok
23:35:59.0149 0x40dc ndfltr - ok
23:35:59.0164 0x40dc NDIS - ok
23:35:59.0171 0x40dc NdisCap - ok
23:35:59.0178 0x40dc NdisImPlatform - ok
23:35:59.0184 0x40dc NdisTapi - ok
23:35:59.0190 0x40dc Ndisuio - ok
23:35:59.0194 0x40dc NdisVirtualBus - ok
23:35:59.0197 0x40dc NdisWan - ok
23:35:59.0201 0x40dc ndiswanlegacy - ok
23:35:59.0204 0x40dc ndproxy - ok
23:35:59.0209 0x40dc Ndu - ok
23:35:59.0213 0x40dc NetAdapterCx - ok
23:35:59.0217 0x40dc NetBIOS - ok
23:35:59.0223 0x40dc NetBT - ok
23:35:59.0226 0x40dc Netlogon - ok
23:35:59.0230 0x40dc Netman - ok
23:35:59.0234 0x40dc netprofm - ok
23:35:59.0245 0x40dc NetSetupSvc - ok
23:35:59.0332 0x40dc NetTcpPortSharing - ok
23:35:59.0349 0x40dc NgcCtnrSvc - ok
23:35:59.0360 0x40dc NgcSvc - ok
23:35:59.0414 0x40dc [ 02E736F9861F1A6134736CF7473C513F, 7C574A50980885B213EFC0C394AFE613879B669246A4EA5EA6B5F791F7F6F32E ] NitroDriverReadSpool9 C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe
23:35:59.0433 0x40dc NitroDriverReadSpool9 - ok
23:35:59.0438 0x40dc NlaSvc - ok
23:35:59.0504 0x40dc [ CD2C0C25ECFCF816306126D3C208614B, C0C8B59BDDB349A593DFF5107841EB76618631C867D7C8F234C9ECBD76713CB0 ] nlsX86cc C:\WINDOWS\SysWOW64\NLSSRV32.EXE
23:35:59.0530 0x40dc nlsX86cc - ok
23:35:59.0537 0x40dc Npfs - ok
23:35:59.0544 0x40dc npsvctrig - ok
23:35:59.0550 0x40dc nsi - ok
23:35:59.0553 0x40dc nsiproxy - ok
23:35:59.0558 0x40dc NTFS - ok
23:35:59.0561 0x40dc Null - ok
23:35:59.0589 0x40dc [ EEA88C63F67A236097F02EEF0944152E, 1256BFAF5960D794DB9C6587B15E05BC681FD7AC159590F8E2C1250477AF95B7 ] NvContainerLocalSystem C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
23:35:59.0603 0x40dc NvContainerLocalSystem - ok
23:35:59.0612 0x40dc [ EEA88C63F67A236097F02EEF0944152E, 1256BFAF5960D794DB9C6587B15E05BC681FD7AC159590F8E2C1250477AF95B7 ] NvContainerNetworkService C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
23:35:59.0626 0x40dc NvContainerNetworkService - ok
23:35:59.0669 0x40dc [ 2D6C4040310C274F93C7B35DF894EA16, E28E516EB3BF40FF27EBD3AE2B248D0AB3F10BD4F757C57423AE70D032C857A5 ] NVIDIA Wireless Controller Service C:\Program Files\NVIDIA Corporation\GeForce Experience Service\nvwirelesscontroller.exe
23:35:59.0695 0x40dc NVIDIA Wireless Controller Service - ok
23:36:00.0148 0x40dc [ 9E42C9D22FAB2D286E85AB7D91097BA8, 7E6A13A34C82740D3212B29115C52F3AAEEFF20FD35970089045D28B7B46D292 ] nvlddmkm C:\WINDOWS\System32\DriverStore\FileRepository\nvlti.inf_amd64_463df33ecac6d590\nvlddmkm.sys
23:36:00.0433 0x40dc nvlddmkm - ok
23:36:00.0470 0x40dc nvraid - ok
23:36:00.0473 0x40dc nvstor - ok
23:36:00.0502 0x40dc [ 6DF7C9E4BF71EBA2CE838394D2EF55B4, 2F13422A2EB4AF6BFDADA9A2DB3BE6A3AFA0D7588645D24222D3A7D813721C7D ] NvStreamKms C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys
23:36:00.0508 0x40dc NvStreamKms - ok
23:36:00.0529 0x40dc [ C29547CB9B1ED535AE76384D888BB90C, 63E4F5AE16EC13486340F73A3613038A0363C37E48B4F099B4CBBD476226E4DB ] nvvad_WaveExtensible C:\WINDOWS\system32\drivers\nvvad64v.sys
23:36:00.0538 0x40dc nvvad_WaveExtensible - ok
23:36:00.0562 0x40dc OneSyncSvc - ok
23:36:00.0717 0x40dc [ 2906AF02B5D06B0EFCD32382F19B88DB, 52A57816017591AC18693095ED6877EC6187F01A1B075ECC0F7E8FA73543E9D0 ] Origin Client Service C:\Program Files (x86)\Origin\OriginClientService.exe
23:36:00.0806 0x40dc Origin Client Service - ok
23:36:00.0874 0x40dc [ 9D10F99A6712E28F8ACD5641E3A7EA6B, 70964A0ED9011EA94044E15FA77EDD9CF535CC79ED8E03A3721FF007E69595CC ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
23:36:00.0903 0x40dc ose - ok
23:36:00.0955 0x40dc [ 94F4247BB74CE835705EE4013118181A, 7412CFEBFAD1EBB39B91F2C42E4DD560EDF0B1CE0FA05D9506B16BE7CDD51BD2 ] OverwolfUpdater C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe
23:36:00.0984 0x40dc OverwolfUpdater - ok
23:36:01.0009 0x40dc p2pimsvc - ok
23:36:01.0019 0x40dc p2psvc - ok
23:36:01.0024 0x40dc Parport - ok
23:36:01.0052 0x40dc partmgr - ok
23:36:01.0091 0x40dc PcaSvc - ok
23:36:01.0118 0x40dc pci - ok
23:36:01.0146 0x40dc pciide - ok
23:36:01.0154 0x40dc pcmcia - ok
23:36:01.0159 0x40dc pcw - ok
23:36:01.0166 0x40dc pdc - ok
23:36:01.0228 0x40dc [ 1EAE050F8CDC82B12C9F8C58DFB7567A, DE5B4839FCFDD09CA33D8ACB97635D805FAFED33C7F6DD119AE4D5EC17733B62 ] PDFProFiltSrvPP C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
23:36:01.0270 0x40dc PDFProFiltSrvPP - ok
23:36:01.0306 0x40dc PEAUTH - ok
23:36:01.0310 0x40dc percsas2i - ok
23:36:01.0314 0x40dc percsas3i - ok
23:36:01.0399 0x40dc PerfHost - ok
23:36:01.0433 0x40dc PhoneSvc - ok
23:36:01.0437 0x40dc PimIndexMaintenanceSvc - ok
23:36:01.0447 0x40dc pla - ok
23:36:01.0473 0x40dc PlugPlay - ok
23:36:01.0477 0x40dc PNRPAutoReg - ok
23:36:01.0481 0x40dc PNRPsvc - ok
23:36:01.0497 0x40dc PolicyAgent - ok
23:36:01.0506 0x40dc Power - ok
23:36:01.0514 0x40dc PptpMiniport - ok
23:36:01.0667 0x40dc [ 7196D3C2E2E3129814C8DAB91F9A7D1E, 6763E4BF8E846B597E78778E520F5BADC95608BAA4EA0AC84971384B5D976DD7 ] PrintNotify C:\WINDOWS\system32\spool\drivers\x64\3\PrintConfig.dll
23:36:01.0960 0x40dc PrintNotify - ok
23:36:01.0971 0x40dc Processor - ok
23:36:01.0983 0x40dc ProfSvc - ok
23:36:02.0004 0x40dc Psched - ok
23:36:02.0008 0x40dc QWAVE - ok
23:36:02.0011 0x40dc QWAVEdrv - ok
23:36:02.0015 0x40dc RasAcd - ok
23:36:02.0019 0x40dc RasAgileVpn - ok
23:36:02.0022 0x40dc RasAuto - ok
23:36:02.0025 0x40dc Rasl2tp - ok
23:36:02.0029 0x40dc RasMan - ok
23:36:02.0032 0x40dc RasPppoe - ok
23:36:02.0036 0x40dc RasSstp - ok
23:36:02.0171 0x40dc [ 170C5DE900F60768C380ECD8A812512F, BFD085C32CF25E8261EF4BCFA5903A496785BCDA08037F4EB580BBDEDF42B656 ] Razer Game Scanner Service C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
23:36:02.0196 0x40dc Razer Game Scanner Service - ok
23:36:02.0205 0x40dc rdbss - ok
23:36:02.0228 0x40dc rdpbus - ok
23:36:02.0232 0x40dc RDPDR - ok
23:36:02.0266 0x40dc RdpVideoMiniport - ok
23:36:02.0269 0x40dc rdyboost - ok
23:36:02.0275 0x40dc ReFSv1 - ok
23:36:02.0279 0x40dc RemoteAccess - ok
23:36:02.0285 0x40dc RemoteRegistry - ok
23:36:02.0295 0x40dc RetailDemo - ok
23:36:02.0337 0x40dc [ FBA61BB4C484A01A655AFB18FF86C417, D53B2110CB09D0A909C4E330C468351BFE076BB056CCDDCB8ADA2FB91E96352E ] RichVideo64 C:\Program Files\CyberLink\Shared files\RichVideo64.exe
23:36:02.0349 0x40dc RichVideo64 - ok
23:36:02.0365 0x40dc RmSvc - ok
23:36:02.0368 0x40dc RpcEptMapper - ok
23:36:02.0384 0x40dc RpcLocator - ok
23:36:02.0387 0x40dc RpcSs - ok
23:36:02.0391 0x40dc rspndr - ok
23:36:02.0635 0x40dc [ 5D298E56746D170E95C763F1BB65687B, 35BB342748246488595D47FC85BB90C6EC4BB3C9D89758541E7D0D87ED5217DD ] rtsuvc C:\WINDOWS\system32\DRIVERS\rtsuvc.sys
23:36:02.0908 0x40dc rtsuvc - ok
23:36:02.0929 0x40dc [ 0C90E6CEA576095888E779E5BD9DD060, 8A13A92D5A8E577E2B919CC879FA8CFA1FAD0A6BFF0CF4FCC59B8E74AB22A673 ] rzpmgrk C:\WINDOWS\system32\drivers\rzpmgrk.sys
23:36:02.0937 0x40dc rzpmgrk - ok
23:36:02.0955 0x40dc [ 288471F132C7249F598032D03575F083, 9E3430D5E0E93BC4A5DCCC985053912065E65722BFC2EAF431BC1DA91410434C ] rzpnk C:\WINDOWS\system32\drivers\rzpnk.sys
23:36:02.0965 0x40dc rzpnk - ok
23:36:02.0969 0x40dc s3cap - ok
23:36:03.0005 0x40dc SamSs - ok
23:36:03.0008 0x40dc sbp2port - ok
23:36:03.0012 0x40dc SCardSvr - ok
23:36:03.0036 0x40dc ScDeviceEnum - ok
23:36:03.0039 0x40dc scfilter - ok
23:36:03.0043 0x40dc Schedule - ok
23:36:03.0045 0x40dc scmbus - ok
23:36:03.0049 0x40dc scmdisk0101 - ok
23:36:03.0061 0x40dc SCPolicySvc - ok
23:36:03.0068 0x40dc sdbus - ok
23:36:03.0073 0x40dc SDRSVC - ok
23:36:03.0077 0x40dc sdstor - ok
23:36:03.0082 0x40dc seclogon - ok
23:36:03.0085 0x40dc SENS - ok
23:36:03.0120 0x40dc SensorDataService - ok
23:36:03.0133 0x40dc SensorService - ok
23:36:03.0136 0x40dc SensrSvc - ok
23:36:03.0140 0x40dc SerCx - ok
23:36:03.0143 0x40dc SerCx2 - ok
23:36:03.0147 0x40dc Serenum - ok
23:36:03.0151 0x40dc Serial - ok
23:36:03.0155 0x40dc sermouse - ok
23:36:03.0163 0x40dc SessionEnv - ok
23:36:03.0167 0x40dc sfloppy - ok
23:36:03.0170 0x40dc SharedAccess - ok
23:36:03.0184 0x40dc ShellHWDetection - ok
23:36:03.0188 0x40dc shpamsvc - ok
23:36:03.0192 0x40dc SiSRaid2 - ok
23:36:03.0197 0x40dc SiSRaid4 - ok
23:36:03.0230 0x40dc [ 6749AD471D1D44CBD1F30257C861F77B, D5A554F35E380948F13BFE0673B49F8FD8AE5A438BF3645857522E2560A58685 ] SkypeUpdate C:\Program Files (x86)\Skype\Updater\Updater.exe
23:36:03.0254 0x40dc SkypeUpdate - ok
23:36:03.0282 0x40dc [ 8A6571231D93C08434A56E19E33A35CB, 78A12B58D129D5B2017C9A94734656B9F1ED41345DF1D01F82702D4D95C1BE3F ] SmbDrvI C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys
23:36:03.0292 0x40dc SmbDrvI - ok
23:36:03.0346 0x40dc smphost - ok
23:36:03.0381 0x40dc SmsRouter - ok
23:36:03.0403 0x40dc SNMPTRAP - ok
23:36:03.0445 0x40dc spaceport - ok
23:36:03.0451 0x40dc SpbCx - ok
23:36:03.0471 0x40dc Spooler - ok
23:36:03.0489 0x40dc sppsvc - ok
23:36:03.0495 0x40dc srv - ok
23:36:03.0501 0x40dc srv2 - ok
23:36:03.0506 0x40dc srvnet - ok
23:36:03.0552 0x40dc SSDPSRV - ok
23:36:03.0601 0x40dc SstpSvc - ok
23:36:03.0676 0x40dc [ 592FF34A2FD6C6351B8A3AA76B2C0A9E, 152B7472DE531AC45492F562DD470B2CE33F1EEF13BC78F26046AE5ABF54E32F ] ssudmdm C:\WINDOWS\system32\DRIVERS\ssudmdm.sys
23:36:03.0701 0x40dc ssudmdm - ok
23:36:03.0819 0x40dc [ 7DB9E612A2742ACEAB080B882E83141C, FFD1FA36E732F55223F3F4B5F845331DBB3073B023C2C5BF51A0E7680DEE7FA7 ] ss_conn_service C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
23:36:03.0848 0x40dc ss_conn_service - ok
23:36:03.0884 0x40dc [ BE46045F8BF205454C2D3C43843A9531, E86074A8205E0A04DC5E5E2C080B2EE9F315BFDBA915C1AE63974CC0BE7C3B6F ] STacSV C:\Program Files\IDT\WDM\STacSV64.exe
23:36:03.0931 0x40dc STacSV - detected UnsignedFile.Multi.Generic ( 1 )
23:36:04.0020 0x40dc Detect skipped due to KSN trusted
23:36:04.0020 0x40dc STacSV - ok
23:36:04.0056 0x40dc StateRepository - ok
23:36:04.0181 0x40dc [ 90E22D7CDE08E07446D238A569BCAB7C, 3D4F413D0B0C9CF28D06E0476F24AC6441C8678DF786D9971B39C91C9F9B8020 ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe
23:36:04.0231 0x40dc Steam Client Service - ok
23:36:04.0254 0x40dc stexstor - ok
23:36:04.0269 0x40dc [ 4CB363C52A44E14DE73E3D41FD5CEC3B, 0DE8CF21B4A18B7D408DD5B22B41348EF6FC356EB8A545A72FBE969FCEEFC812 ] STHDA C:\WINDOWS\system32\DRIVERS\stwrt64.sys
23:36:04.0349 0x40dc STHDA - ok
23:36:04.0355 0x40dc [ B11724BFE7DA1BA55903B4D849415F1A, ED09B6AD68C87FED34FC66CB6C7A74DFC3AF524E3BE89EDD18A5B6685F656ACA ] StillCam C:\WINDOWS\system32\DRIVERS\serscan.sys
23:36:04.0394 0x40dc StillCam - ok
23:36:04.0450 0x40dc stisvc - ok
23:36:04.0483 0x40dc storahci - ok
23:36:04.0494 0x40dc storflt - ok
23:36:04.0506 0x40dc stornvme - ok
23:36:04.0524 0x40dc storqosflt - ok
23:36:04.0554 0x40dc StorSvc - ok
23:36:04.0560 0x40dc storufs - ok
23:36:04.0566 0x40dc storvsc - ok
23:36:04.0573 0x40dc svsvc - ok
23:36:04.0579 0x40dc swenum - ok
23:36:04.0585 0x40dc swprv - ok
23:36:04.0603 0x40dc Synth3dVsc - ok
23:36:04.0620 0x40dc [ 7DC2B34FB6F1798F2D13453E0321D025, 60EF12A8824384DD88D9C5D188E8FB137F0F85A63C06AAF720CB2D616EB847F4 ] SynTP C:\WINDOWS\system32\DRIVERS\SynTP.sys
23:36:04.0638 0x40dc SynTP - ok
23:36:04.0731 0x40dc [ 6FBDBC24B1642868E041463795CBFA44, E9FA0DB094E7B2129ABD325BC91A48D6646380D6AA97BE6233C220E0C98637AF ] SynTPEnhService C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
23:36:04.0753 0x40dc SynTPEnhService - ok
23:36:04.0760 0x40dc SysMain - ok
23:36:04.0795 0x40dc SystemEventsBroker - ok
23:36:04.0806 0x40dc TabletInputService - ok
23:36:04.0811 0x40dc TapiSrv - ok
23:36:04.0824 0x40dc Tcpip - ok
23:36:04.0829 0x40dc Tcpip6 - ok
23:36:04.0837 0x40dc tcpipreg - ok
23:36:04.0845 0x40dc tdx - ok
23:36:05.0065 0x40dc [ F2F02E436BA56A96A06E4427C5787B6E, 1562FF264011A15AC69808CB74F387917C4E8ED3B91546B12933BE10B6E20B3A ] TeamViewer C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
23:36:05.0195 0x40dc TeamViewer - ok
23:36:05.0206 0x40dc terminpt - ok
23:36:05.0210 0x40dc TermService - ok
23:36:05.0217 0x40dc Themes - ok
23:36:05.0236 0x40dc TieringEngineService - ok
23:36:05.0241 0x40dc tiledatamodelsvc - ok
23:36:05.0245 0x40dc TimeBrokerSvc - ok
23:36:05.0249 0x40dc TPM - ok
23:36:05.0254 0x40dc TrkWks - ok
23:36:05.0288 0x40dc TrustedInstaller - ok
23:36:05.0293 0x40dc tsusbflt - ok
23:36:05.0298 0x40dc TsUsbGD - ok
23:36:05.0301 0x40dc tunnel - ok
23:36:05.0316 0x40dc tzautoupdate - ok
23:36:05.0320 0x40dc UASPStor - ok
23:36:05.0336 0x40dc [ 209F5CEAAAFE601851E7B40902FC230D, B7BFD753DF9EA1AD6D6BD8FB47F24E79FA84208E7A66C88B934C3A13B087901D ] ucdrv C:\WINDOWS\System32\drivers:ucdrv-x64.sys
23:36:05.0440 0x40dc Suspicious file ( Hidden ): C:\WINDOWS\System32\drivers:ucdrv-x64.sys. md5: 209F5CEAAAFE601851E7B40902FC230D, sha256: B7BFD753DF9EA1AD6D6BD8FB47F24E79FA84208E7A66C88B934C3A13B087901D
23:36:05.0440 0x40dc ucdrv - detected HiddenFile.Multi.Generic ( 1 )
23:36:05.0541 0x40dc Detect skipped due to KSN trusted
23:36:05.0541 0x40dc ucdrv - ok
23:36:05.0581 0x40dc [ EB482DBC9786F1A9E3ED5AB6864794FA, 4154B259587D743612830F67800450DD04031C215A8459CC26E11D3498640BA0 ] UCGuard C:\WINDOWS\system32\DRIVERS\ucguard.sys
23:36:05.0613 0x40dc UCGuard - ok
23:36:05.0618 0x40dc UcmCx0101 - ok
23:36:05.0623 0x40dc UcmTcpciCx0101 - ok
23:36:05.0627 0x40dc UcmUcsi - ok
23:36:05.0632 0x40dc Ucx01000 - ok
23:36:05.0637 0x40dc UdeCx - ok
23:36:05.0643 0x40dc udfs - ok
23:36:05.0646 0x40dc UEFI - ok
23:36:05.0650 0x40dc Ufx01000 - ok
23:36:05.0653 0x40dc UfxChipidea - ok
23:36:05.0657 0x40dc ufxsynopsys - ok
23:36:05.0665 0x40dc UI0Detect - ok
23:36:05.0668 0x40dc umbus - ok
23:36:05.0671 0x40dc UmPass - ok
23:36:05.0675 0x40dc UmRdpService - ok
23:36:05.0679 0x40dc UnistoreSvc - ok
23:36:05.0684 0x40dc upnphost - ok
23:36:05.0689 0x40dc UrsChipidea - ok
23:36:05.0693 0x40dc UrsCx01000 - ok
23:36:05.0696 0x40dc UrsSynopsys - ok
23:36:05.0707 0x40dc usbaudio - ok
23:36:05.0711 0x40dc usbccgp - ok
23:36:05.0715 0x40dc usbcir - ok
23:36:05.0719 0x40dc usbehci - ok
23:36:05.0723 0x40dc usbhub - ok
23:36:05.0726 0x40dc USBHUB3 - ok
23:36:05.0731 0x40dc usbohci - ok
23:36:05.0736 0x40dc usbprint - ok
23:36:05.0739 0x40dc usbser - ok
23:36:05.0742 0x40dc USBSTOR - ok
23:36:05.0747 0x40dc usbuhci - ok
23:36:05.0750 0x40dc USBXHCI - ok
23:36:05.0755 0x40dc UserDataSvc - ok
23:36:05.0760 0x40dc UserManager - ok
23:36:05.0777 0x40dc UsoSvc - ok
23:36:05.0781 0x40dc VaultSvc - ok
23:36:05.0850 0x40dc [ 1AEF0B09CC241604ECFCCA037FC9B9A7, 992CD1F3647585F3CF7B92ECDBD9537BFB159D0C0DF0BF7D37432F3DA44C2422 ] VBoxDrv C:\WINDOWS\system32\DRIVERS\VBoxDrv.sys
23:36:05.0876 0x40dc VBoxDrv - ok
23:36:05.0902 0x40dc [ F429FED78CC80F85BD55CDA8403FD681, 581579E2616D4F69B068BC37C63DD0EC87AE28F1D011B9564EB7756A1FD22A9F ] VBoxNetAdp C:\WINDOWS\System32\drivers\VBoxNetAdp6.sys
23:36:05.0912 0x40dc VBoxNetAdp - ok
23:36:05.0928 0x40dc [ 37C2B3B717BB16C003074B17911682EE, E8EBBBF325D04E33532265DF518B6CDAB59521766660905178BEFFC1C9A47E22 ] VBoxNetLwf C:\WINDOWS\system32\DRIVERS\VBoxNetLwf.sys
23:36:05.0938 0x40dc VBoxNetLwf - ok
23:36:05.0946 0x40dc [ D31F5F9B3D768C68DBB5BCE5855471D4, 7462FCDD7C4FCA0E1DE42E2C677F31AF509475C76B6030CEA3ACEF25B50C50D7 ] VBoxUSBMon C:\WINDOWS\system32\DRIVERS\VBoxUSBMon.sys
23:36:05.0955 0x40dc VBoxUSBMon - ok
23:36:05.0959 0x40dc vdrvroot - ok
23:36:05.0965 0x40dc vds - ok
23:36:05.0968 0x40dc VerifierExt - ok
23:36:05.0972 0x40dc vhdmp - ok
23:36:05.0975 0x40dc vhf - ok
23:36:05.0978 0x40dc vmbus - ok
23:36:05.0982 0x40dc VMBusHID - ok
23:36:05.0985 0x40dc vmgid - ok
23:36:05.0990 0x40dc vmicguestinterface - ok
23:36:05.0993 0x40dc vmicheartbeat - ok
23:36:05.0997 0x40dc vmickvpexchange - ok
23:36:06.0022 0x40dc vmicrdv - ok
23:36:06.0025 0x40dc vmicshutdown - ok
23:36:06.0030 0x40dc vmictimesync - ok
23:36:06.0037 0x40dc vmicvmsession - ok
23:36:06.0045 0x40dc vmicvss - ok
23:36:06.0053 0x40dc volmgr - ok
23:36:06.0060 0x40dc volmgrx - ok
23:36:06.0065 0x40dc volsnap - ok
23:36:06.0069 0x40dc volume - ok
23:36:06.0085 0x40dc vpci - ok
23:36:06.0089 0x40dc vsmraid - ok
23:36:06.0092 0x40dc VSS - ok
23:36:06.0097 0x40dc VSTXRAID - ok
23:36:06.0101 0x40dc vwifibus - ok
23:36:06.0104 0x40dc vwififlt - ok
23:36:06.0108 0x40dc vwifimp - ok
23:36:06.0135 0x40dc W32Time - ok
23:36:06.0138 0x40dc WacomPen - ok
23:36:06.0143 0x40dc WalletService - ok
23:36:06.0215 0x40dc [ E3FC2555BE0E38969E52DE08818B8CD8, A17C543DFDD5D3A00EA998889B1D4715F2B48FD4D0888FC1EBEB74F1105D20B1 ] wampstackApache C:\Bitnami\WAMPST~1.0BE\apache2\bin\httpd.exe
23:36:06.0252 0x40dc wampstackApache - detected UnsignedFile.Multi.Generic ( 1 )
23:36:06.0342 0x40dc Detect skipped due to KSN trusted
23:36:06.0342 0x40dc wampstackApache - ok
23:36:06.0362 0x40dc wampstackMySQL - ok
23:36:06.0373 0x40dc wanarp - ok
23:36:06.0387 0x40dc wanarpv6 - ok
23:36:06.0396 0x40dc wbengine - ok
23:36:06.0424 0x40dc WbioSrvc - ok
23:36:06.0432 0x40dc wcifs - ok
23:36:06.0441 0x40dc Wcmsvc - ok
23:36:06.0448 0x40dc wcncsvc - ok
23:36:06.0455 0x40dc wcnfs - ok
23:36:06.0459 0x40dc WdBoot - ok
23:36:06.0465 0x40dc Wdf01000 - ok
23:36:06.0469 0x40dc WdFilter - ok
23:36:06.0474 0x40dc WdiServiceHost - ok
23:36:06.0479 0x40dc WdiSystemHost - ok
23:36:06.0483 0x40dc wdiwifi - ok
23:36:06.0487 0x40dc WdNisDrv - ok
23:36:06.0502 0x40dc WdNisSvc - ok
23:36:06.0507 0x40dc WebClient - ok
23:36:06.0512 0x40dc Wecsvc - ok
23:36:06.0516 0x40dc WEPHOSTSVC - ok
23:36:06.0520 0x40dc wercplsupport - ok
23:36:06.0523 0x40dc WerSvc - ok
23:36:06.0527 0x40dc WFPLWFS - ok
23:36:06.0532 0x40dc WiaRpc - ok
23:36:06.0536 0x40dc WIMMount - ok
23:36:06.0538 0x40dc WinDefend - ok
23:36:06.0557 0x40dc WindowsTrustedRT - ok
23:36:06.0565 0x40dc WindowsTrustedRTProxy - ok
23:36:06.0579 0x40dc WinHttpAutoProxySvc - ok
23:36:06.0583 0x40dc WinMad - ok
23:36:06.0615 0x40dc Winmgmt - ok
23:36:06.0650 0x40dc WinRM - ok
23:36:06.0670 0x40dc WINUSB - ok
23:36:06.0674 0x40dc WinVerbs - ok
23:36:06.0685 0x40dc wisvc - ok
23:36:06.0699 0x40dc WlanSvc - ok
23:36:06.0734 0x40dc wlidsvc - ok
23:36:06.0737 0x40dc WmiAcpi - ok
23:36:06.0743 0x40dc wmiApSrv - ok
23:36:06.0747 0x40dc WMPNetworkSvc - ok
23:36:06.0751 0x40dc Wof - ok
23:36:06.0757 0x40dc workfolderssvc - ok
23:36:06.0762 0x40dc WPDBusEnum - ok
23:36:06.0767 0x40dc WpdUpFltr - ok
23:36:06.0772 0x40dc WpnService - ok
23:36:06.0775 0x40dc WpnUserService - ok
23:36:06.0795 0x40dc ws2ifsl - ok
23:36:06.0815 0x40dc wscsvc - ok
23:36:06.0831 0x40dc WSDPrintDevice - ok
23:36:06.0835 0x40dc WSDScan - ok
23:36:06.0838 0x40dc WSearch - ok
23:36:06.0868 0x40dc [ 72B4E9DF6456C43C42A1419B09486045, 536BA7377B5BEA7EA46864453933111DB88DB8FB689C68915ACD7261A996E61D ] wsvd C:\WINDOWS\system32\DRIVERS\wsvd.sys
23:36:06.0876 0x40dc wsvd - ok
23:36:06.0889 0x40dc wuauserv - ok
23:36:06.0893 0x40dc WudfPf - ok
23:36:06.0897 0x40dc WUDFRd - ok
23:36:06.0901 0x40dc wudfsvc - ok
23:36:06.0905 0x40dc WUDFWpdFs - ok
23:36:06.0908 0x40dc WUDFWpdMtp - ok
23:36:06.0913 0x40dc WwanSvc - ok
23:36:06.0917 0x40dc XblAuthManager - ok
23:36:06.0931 0x40dc XblGameSave - ok
23:36:06.0958 0x40dc xboxgip - ok
23:36:06.0963 0x40dc XboxNetApiSvc - ok
23:36:06.0981 0x40dc [ 92693510C2636CC86622724FB4581E75, A660E4A0C452654ACA6892857ECF9C019863A02A46A75D5A88A8961564926A41 ] xhunter1 C:\WINDOWS\xhunter1.sys
23:36:06.0989 0x40dc xhunter1 - ok
23:36:07.0005 0x40dc xinputhid - ok
23:36:07.0011 0x40dc xusb22 - ok
23:36:07.0073 0x40dc [ 86B8B1F5C1189D68B07666784BE882FE, 0DD8C627F3DDBDB61B1910540C465C0D62C9F8D84C7CBB6C80782DB02D535AF0 ] ZAtheros Bt and Wlan Coex Agent C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
23:36:07.0142 0x40dc ZAtheros Bt and Wlan Coex Agent - detected UnsignedFile.Multi.Generic ( 1 )
23:36:07.0257 0x40dc Detect skipped due to KSN trusted
23:36:07.0257 0x40dc ZAtheros Bt and Wlan Coex Agent - ok
23:36:07.0258 0x40dc ================ Scan global ===============================
23:36:07.0326 0x40dc [ Global ] - ok
23:36:07.0327 0x40dc ================ Scan MBR ==================================
23:36:07.0350 0x40dc [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk0\DR0
23:36:07.0473 0x40dc \Device\Harddisk0\DR0 - ok
23:36:07.0474 0x40dc ================ Scan VBR ==================================
23:36:07.0491 0x40dc [ 2035F77E8501BB5D016AAD63E680E798 ] \Device\Harddisk0\DR0\Partition1
23:36:07.0494 0x40dc \Device\Harddisk0\DR0\Partition1 - ok
23:36:07.0512 0x40dc [ FB2D66BC4070DAC477A1FE3777DB4917 ] \Device\Harddisk0\DR0\Partition2
23:36:07.0515 0x40dc \Device\Harddisk0\DR0\Partition2 - ok
23:36:07.0529 0x40dc [ 175BA71408419365814693E98A43B1A8 ] \Device\Harddisk0\DR0\Partition3
23:36:07.0532 0x40dc \Device\Harddisk0\DR0\Partition3 - ok
23:36:07.0537 0x40dc [ 5D14BFFB51A238D3EBA2523AFA9B1649 ] \Device\Harddisk0\DR0\Partition4
23:36:07.0537 0x40dc \Device\Harddisk0\DR0\Partition4 - ok
23:36:07.0544 0x40dc [ 667402E12DE1DE8FE8D97EE08BDF64C0 ] \Device\Harddisk0\DR0\Partition5
23:36:07.0547 0x40dc \Device\Harddisk0\DR0\Partition5 - ok
23:36:07.0553 0x40dc [ 881D88CA05DF6E1F07EBBAAD6E5A95BC ] \Device\Harddisk0\DR0\Partition6
23:36:07.0556 0x40dc \Device\Harddisk0\DR0\Partition6 - ok
23:36:07.0561 0x40dc [ 208C4D4546BF660CE1B49EE67299C745 ] \Device\Harddisk0\DR0\Partition7
23:36:07.0562 0x40dc \Device\Harddisk0\DR0\Partition7 - ok
23:36:07.0563 0x40dc ================ Scan generic autorun ======================
23:36:07.0566 0x40dc Logitech Download Assistant - ok
23:36:07.0771 0x40dc [ 50D20C57D4977601FD66F2ACDE1B1D3A, 6432868E2DEC32D6391FA7E16C049260C8A168C5D3159245A9D0463FCC69E2BD ] C:\WINDOWS\RTFTrack.exe
23:36:07.0877 0x40dc RtsFT - ok
23:36:07.0900 0x40dc [ F3E1B4D249B9E2E820870A3C1ED82AC8, AA8BA7B6B0C064253289896CE5283F429C43A22E9D58DB687130899F1A09F8EF ] C:\WINDOWS\system32\igfxtray.exe
23:36:07.0917 0x40dc IgfxTray - ok
23:36:07.0952 0x40dc [ 37F0C08BFCEDF218A43C84B2447AACB1, 895C1EAF1BC4C7CB4AA803D19A422E8CC59FDC07FAC1A78E5FCC03C31D4AFB84 ] C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe
23:36:07.0980 0x40dc IAStorIcon - detected UnsignedFile.Multi.Generic ( 1 )
23:36:08.0068 0x40dc Detect skipped due to KSN trusted
23:36:08.0068 0x40dc IAStorIcon - ok
23:36:08.0246 0x40dc [ E7C8E8D71978722E1D3C4D6FBC7D98C0, C45B79FCAA1D3D25DD50A525CE26D1469E4C6183E117DDD7950B57BBAB31E8D9 ] C:\Program Files\Lenovo\Onekey Theater\OnekeyStudio.exe
23:36:08.0319 0x40dc OnekeyStudio - ok
23:36:08.0431 0x40dc [ 51B634D617073986FA73417318F7C121, CAB64175383F501FA515D335167334D7F2147F0889E5052484AA1FF866C6F8CF ] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe
23:36:08.0460 0x40dc AdobeAAMUpdater-1.0 - ok
23:36:08.0515 0x40dc [ C72FB9CC856ECFF3B6459B27CB674638, 4D5FED8FD31E24A0BC52AE11C1FBCB9C08B1B7EB4A90771B0174117E8D84B966 ] C:\WINDOWS\PixArt\PAC207\Monitor.exe
23:36:08.0624 0x40dc PAC207_Monitor - ok
23:36:08.0771 0x40dc [ 2433692BFC2631DC28B0705C1B760FF2, BBDE902F984E0968A3062F3EEA624E804B03095C67C280CDA4E85D02F46B7CDC ] C:\Program Files\Logitech\SetPointP\SetPoint.exe
23:36:08.0826 0x40dc EvtMgr6 - ok
23:36:08.0854 0x40dc [ EF271BF6215D7FD3C2955015582A0B45, D32564C5AA6087F1D87CD7B2CB7FC8613A453D4555CAD0EE839F86AA90FB87F3 ] c:\Program Files\TortoiseHg\TortoiseHgOverlayServer.exe
23:36:08.0862 0x40dc TortoiseHgOverlayIconServer - ok
23:36:08.0905 0x40dc [ ED43758BF94B8A5221D69F1B7F63F13D, F6E7418823E45085F4D4F50DD25A55ED517C0A335C6C2F69A1139B30677D3DA9 ] C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe
23:36:08.0924 0x40dc XboxStat - ok
23:36:09.0275 0x40dc [ 3F0B5EBDEB180C073E01A4A2DFA28C12, 0ACE6F70260E17284B8307D0DD0ACC9B59B379A99AE43429AB644B421ADAE8A7 ] C:\Program Files\Logitech Gaming Software\LCore.exe
23:36:09.0493 0x40dc Launch LCore - ok
23:36:09.0504 0x40dc SynTPEnh - ok
23:36:09.0505 0x40dc WindowsDefender - ok
23:36:09.0508 0x40dc ShadowPlay - ok
23:36:09.0582 0x40dc [ E71832FC681D0F1E0F917D265CDDB6A1, 9C82E57C1261E97760AD1343BA49D2F3BB7ADFF2958DBEE0E9F5077F1D0D0E90 ] C:\Program Files\IDT\WDM\sttray64.exe
23:36:09.0657 0x40dc SysTrayApp - detected UnsignedFile.Multi.Generic ( 1 )
23:36:09.0746 0x40dc Detect skipped due to KSN trusted
23:36:09.0746 0x40dc SysTrayApp - ok
23:36:09.0801 0x40dc [ 8F83160C43C61FC6775391B46B7C16BF, 648588126B2CD0B9F50F478BF4F7474137D1285061A3B22B56C1CB5B4FD3C3BF ] C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe
23:36:09.0823 0x40dc UpdateP2GShortCut - ok
23:36:09.0951 0x40dc [ 86E7B43D60B16FCEB967FA089111F796, C32F8BA0BC253C7049ED6D160EFD657C47698A23EBEA11BBDEFEF59C2DC14059 ] C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
23:36:09.0998 0x40dc Adobe Creative Cloud - ok
23:36:10.0037 0x40dc [ 2199723879C9F75A709680E2935C052F, DDD5B5CC86463284D9137372CB8541D1258AC020EA811F1AD3735809F314B086 ] C:\Program Files (x86)\PDF24\pdf24.exe
23:36:10.0049 0x40dc PDFPrint - ok
23:36:10.0135 0x40dc OneDriveSetup - ok
23:36:10.0138 0x40dc OneDriveSetup - ok
23:36:10.0221 0x40dc [ 406E7DF08CE79BE3016CC6D15E2ED956, 9DA8D10AE642B9411A3EB253F97918A6F470F1772F0057964267497CE0BDA53A ] C:\Program Files (x86)\ExKode\Dxtory2.0\UpdateChecker.exe
23:36:10.0276 0x40dc Dxtory Update Checker 2.0 - detected UnsignedFile.Multi.Generic ( 1 )
23:36:10.0384 0x40dc Detect skipped due to KSN trusted
23:36:10.0384 0x40dc Dxtory Update Checker 2.0 - ok
23:36:10.0541 0x40dc [ AA7DDCE2175C6D58E83966DEF236F732, 2EA65CDD5096A0A88FAB788CEE29A6B0161856061C9C625D27A58BA987E1E38E ] C:\Spiele\World of Tanks\WargamingGameUpdater.exe
23:36:10.0599 0x40dc World of Tanks - ok
23:36:10.0655 0x40dc [ 72C4380EE0D19B7B76196B488E2DFD39, 066E21A906F954D8054CA8601BA2663998AA9018AE47A8A8DB398111E973F7EF ] C:\Program Files (x86)\TradeSkillMaster Application\app\TSMApplication.exe
23:36:10.0724 0x40dc TSMApplication - detected UnsignedFile.Multi.Generic ( 1 )
23:36:10.0811 0x40dc TSMApplication ( UnsignedFile.Multi.Generic ) - warning
23:36:10.0995 0x40dc Uninstall C:\Users\Benjamin\AppData\Local\Microsoft\OneDrive\17.3.6201.1019\amd64 - ok
23:36:10.0996 0x40dc Waiting for KSN requests completion. In queue: 88
23:36:12.0082 0x40dc AV detected via SS2: Windows Defender, C:\Program Files\Windows Defender\MSASCui.exe ( 4.10.14393.187 ), 0x61100 ( enabled : updated )
23:36:12.0098 0x40dc Win FW state via NFP2: enabled ( trusted )
23:36:12.0206 0x40dc ============================================================
23:36:12.0206 0x40dc Scan finished
23:36:12.0206 0x40dc ============================================================
23:36:12.0224 0x4d04 Detected object count: 2
23:36:12.0224 0x4d04 Actual detected object count: 2
23:37:49.0906 0x4d04 Arakosatuhph ( UnsignedFile.Multi.Generic ) - skipped by user
23:37:49.0906 0x4d04 Arakosatuhph ( UnsignedFile.Multi.Generic ) - User select action: Skip
23:37:49.0906 0x4d04 TSMApplication ( UnsignedFile.Multi.Generic ) - skipped by user
23:37:49.0906 0x4d04 TSMApplication ( UnsignedFile.Multi.Generic ) - User select action: Skip
23:38:01.0655 0x58fc Deinitialize success
Geändert von kakuzu (05.11.2016 um 23:57 Uhr) |
|
06.11.2016, 12:59
| #4 |
| /// TB-Ausbilder | UCGuard nicht entfernbar und andere Malware Servus, benenne die FRST64.exe in kakuzu.exe um (Rechtsklick > Umbenennen) und versuche es erneut. Sollte das nicht helfen, lösche die kakuzu.exe. Dann versuchen wir es so: Schritt 1 Bitte lade dir rKill von Grinler auf deinen Desktop von einem der folgenden Links: RKill oder http://www.trojaner-board.de/85629-rkill-download.html
Schritt 2 Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
Bitte poste mit deiner nächsten Antwort
|
|
06.11.2016, 14:38
| #5 |
| | UCGuard nicht entfernbar und andere Malware Umbenennen der Datei hat geholfen. Log Dateien sind zu groß, habe sie mal als Anhang bei gefügt. Oder soll ich die Logs File besser Splitten? Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 04-11-2016
durchgeführt von Benjamin (06-11-2016 14:23:45)
Gestartet von C:\Users\Benjamin\Downloads
Windows 10 Home Version 1607 (X64) (2016-08-17 16:33:15)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-3046321304-749213656-246317510-500 - Administrator - Disabled)
Benjamin (S-1-5-21-3046321304-749213656-246317510-1001 - Administrator - Enabled) => C:\Users\Benjamin
DefaultAccount (S-1-5-21-3046321304-749213656-246317510-503 - Limited - Disabled)
Gast (S-1-5-21-3046321304-749213656-246317510-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3046321304-749213656-246317510-1003 - Limited - Enabled)
priva (S-1-5-21-3046321304-749213656-246317510-1006 - Administrator - Enabled)
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
4K Video Downloader (HKLM\...\4K Video DownloaderLatest) (Version: Latest - Franki Hack)
4K Video Downloader 4.1 (HKLM-x32\...\4K Video Downloader_is1) (Version: 4.1.2.2075 - Open Media LLC)
7 Days to Die (HKLM-x32\...\Steam App 251570) (Version: - The Fun Pimps)
7-Zip 15.14 (x64 edition) (HKLM\...\{23170F69-40C1-2702-1514-000001000000}) (Version: 15.14.00.0 - Igor Pavlov)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 3.0.1.88 - Adobe Systems Incorporated)
Adobe Photoshop CC 2014 (HKLM-x32\...\{D7A4F897-B20A-42D0-862D-CB5F6DB7391D}) (Version: 15.2.2 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 5.7.1 64-bit (HKLM\...\{BC86B82C-8C0E-4408-9AC1-6B0F2D636963}) (Version: 5.7.1 - Adobe Systems Incorporated)
AION Free-to-Play (HKLM-x32\...\{82E73E8D-E1E7-45A4-A311-6D31492AA913}_is1) (Version: - Gameforge)
Alcor Micro USB Card Reader (HKLM-x32\...\AmUStor) (Version: 20.2.1245.53580 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 20.2.1245.53580 - Alcor Micro Corp.) Hidden
Amazon Cloud Drive (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\Amazon Cloud Drive) (Version: 3.2.1.29 - Amazon.com, Inc.)
Ansel (Version: 375.70 - NVIDIA Corporation) Hidden
AnyBurn (HKLM-x32\...\AnyBurn) (Version: 3.0 - Power Software Ltd)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
Benutzerhandbücher (x32 Version: 3.0.0.3 - Lenovo) Hidden
Bethesda.net Launcher (HKLM-x32\...\{3448917E-E4FE-4E30-9502-9FD52EABB6F5}_is1) (Version: 1.0 - Bethesda Softworks)
Bitnami WAMP Stack (HKLM-x32\...\Bitnami WAMP Stack 7.0.0beta2-1) (Version: 7.0.0beta2-1 - Bitnami)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Brother MFL-Pro Suite MFC-J5620DW (HKLM-x32\...\{7FC49664-DAA4-4E7C-ADD0-614ABB43691B}) (Version: 1.0.5.0 - Brother Industries, Ltd.)
Brother P-touch Editor 5.1 (HKLM-x32\...\{39270390-A851-4E4B-94A9-D5C468216ED3}) (Version: 5.1.0610 - Brother Industries, Ltd.)
C9 (HKLM-x32\...\C9(Continent of the Ninth Seal)_is1) (Version: - WEBZEN)
Command & Conquer™ Red Alert 2 and Yuri’s Revenge (HKLM-x32\...\{F5275D1C-D133-486D-8F07-D6C571F0A8EC}) (Version: 1.0.0.0 - Electronic Arts, Inc.)
Composer - Php Dependency Manager (HKLM-x32\...\{7315AF68-E777-496A-A6A2-4763A98ED35A}_is1) (Version: - getcomposer.org)
Counter-Strike Nexon: Zombies (HKLM-x32\...\Steam App 273110) (Version: - Nexon)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve)
Creation Kit: Fallout 4 (HKLM-x32\...\Creation Kit: Fallout 4) (Version: - Bethesda Softworks)
Curse (HKLM-x32\...\{1F2611FB-6F69-4AA8-BECD-243BD8CB45F3}) (Version: 6.0.0.0 - Curse)
Curse Client (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\101a9f93b8f0bb6f) (Version: 5.1.1.844 - Curse)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)
CyberLink PowerDirector 10 (Version: 10.0.0.2810 - CyberLink Corp.) Hidden
DayZ (HKLM-x32\...\Steam App 221100) (Version: - Bohemia Interactive)
Dead by Daylight (HKLM\...\Steam App 381210) (Version: - Behaviour Digital Inc.)
Diablo III (HKLM-x32\...\Diablo III) (Version: - Blizzard Entertainment)
Dolby Digital Plus Home Theater (HKLM\...\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.3.2.2 - Dolby Laboratories Inc)
Dragon's Prophet (HKLM-x32\...\{C31556D7-F2B9-4787-B223-F7A035067E89}_is1) (Version: 2.1.1434.29 - Infernum Productions AG)
Dxtory version 2.0.135 (HKLM-x32\...\Dxtory2.0_is1) (Version: 2.0.135 - ExKode Co. Ltd.)
eBlendr Version 2.0.2.60 (HKLM-x32\...\eBlendr_is1) (Version: 2.0.2.60 - H. Brinkhaus Onlineservices)
eMule (HKLM-x32\...\eMule) (Version: - )
Euro Truck Simulator 2 (HKLM\...\Steam App 227300) (Version: - SCS Software)
Euro Truck Simulator 2 (HKLM-x32\...\{1B705E8F-9893-4486-B5D7-4F7FEB9C871E}_is1) (Version: 1.25.2.5 - SCS Software)
EVEREST Home Edition v2.20 (HKLM-x32\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
Fallout 3 - Game of the Year Edition (HKLM-x32\...\Steam App 22370) (Version: - Bethesda Game Studios)
Fallout 4 (HKLM-x32\...\Steam App 377160) (Version: - Bethesda Game Studios)
Fallout Mod Manager 0.12.6 (HKLM-x32\...\Fallout Mod Manager_is1) (Version: - Timeslip, Q)
Fallout: New Vegas (HKLM-x32\...\Steam App 22380) (Version: - Obsidian Entertainment)
Farming Simulator 17 (HKLM\...\Steam App 447020) (Version: - Giants Software)
FileZilla Client 3.22.1 (HKLM-x32\...\FileZilla Client) (Version: 3.22.1 - Tim Kosse)
Flash Decompiler Trillix (HKLM-x32\...\Flash Decompiler Trillix_is1) (Version: 5.3 - Eltima Software)
FlashDevelop (HKLM-x32\...\FlashDevelop) (Version: 5.1.1 - FlashDevelop.org)
FlashFXP 5 (HKLM-x32\...\FlashFXP 5) (Version: 5.0.0.3791 - OpenSight Software LLC)
Fraps (HKLM-x32\...\Fraps) (Version: - )
Gameforge Live 2.0.6 (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 2.0.6 - Gameforge)
Genymotion version 2.5.2 (HKLM\...\{6D180286-D4DF-40EF-9227-923B9C07C08A}_is1) (Version: 2.5.2 - Genymobile)
GIANTS Editor 7.0.2 64-bit (HKLM-x32\...\giants_editor_7.0.2_win64_is1) (Version: 7.0.2 - GIANTS Software GmbH)
GIMP 2.8.16 (HKLM\...\GIMP-2_is1) (Version: 2.8.16 - The GIMP Team)
Git version 1.9.5-preview20150319 (HKLM-x32\...\Git_is1) (Version: 1.9.5-preview20150319 - The Git Development Community)
GitHub (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\5f7eb300e2ea4ebf) (Version: 3.1.1.4 - GitHub, Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 54.0.2840.87 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden
Guild Wars 2 (HKLM-x32\...\Guild Wars 2) (Version: - NCsoft Corporation, Ltd.)
H1Z1 (HKLM-x32\...\Steam App 295110) (Version: - Daybreak Games)
H1Z1: King of the Kill (HKLM-x32\...\Steam App 433850) (Version: - Daybreak Game Company)
Hearthstone Deck Tracker (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\HearthstoneDeckTracker) (Version: 1.0.5 - HearthSim)
Heroes of the Storm (HKLM-x32\...\Heroes of the Storm) (Version: - Blizzard Entertainment)
Hide and Shriek (HKLM\...\Steam App 480430) (Version: - Funcom)
HiDrive (HKLM-x32\...\{88D57A8B-DF01-4C4D-8EF4-289C08BD2F96}) (Version: 4.2.1.0 - STRATO AG)
HP ePrint (HKLM-x32\...\{2794875B-6CCF-48B8-84A5-5B10DB98BEE6}) (Version: 14.0.14176.1823 - Hewlett-Packard)
HP ePrint (HKLM-x32\...\{2dbf7d69-d76e-4907-8ee6-ad90bf62aab7}) (Version: 1.0.7.31082 - HP)
HWiNFO64 Version 5.06 (HKLM\...\HWiNFO64_is1) (Version: 5.06 - Martin Malík - REALiX)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6503.0 - IDT)
Intel Collaborative Processor Performance Control (HKLM-x32\...\0E7DAF70-FB54-4B91-B192-7E771C25AEEB) (Version: 1.0.0.1013 - Intel Corporation)
Intel WiDi Media Share (x32 Version: 1.1.0.0 - Intel Corporation) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4531 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.5.1000 - Intel Corporation)
Intel® WiDi Media Share (HKLM-x32\...\{32d14b1d-18fa-48e7-867d-93b7a72c816a}) (Version: 1.1.0.0 - Intel Corporation)
IsoBuster 3.7 (HKLM-x32\...\IsoBuster_is1) (Version: 3.7 - Smart Projects)
Java 8 Update 77 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218077F0}) (Version: 8.0.770.3 - Oracle Corporation)
Java 8 Update 91 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218091F0}) (Version: 8.0.910.14 - Oracle Corporation)
Java 8 Update 92 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418092F0}) (Version: 8.0.920.14 - Oracle Corporation)
Java SE Development Kit 8 Update 92 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180920}) (Version: 8.0.920.14 - Oracle Corporation)
JetBrains PhpStorm 2016.1 (HKLM-x32\...\PhpStorm 2016.1) (Version: 145.258.2 - JetBrains s.r.o.)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Lenovo EasyCamera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10245 - Realtek Semiconductor Corp.)
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.0.0.2105 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 8.0.0.2105 - CyberLink Corp.) Hidden
Lenovo Photo Master Trial (HKLM-x32\...\{BC94C56A-3649-420C-8756-2ADEBE399D33}) (Version: 2.2.3317.01 Trial - CyberLink Corp.)
Lenovo PowerDVD10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.5630.52 - CyberLink Corp.)
Lenovo PowerDVD10 (x32 Version: 10.0.5630.52 - CyberLink Corp.) Hidden
LibreOffice 5.0.5.2 (HKLM-x32\...\{43D862C3-739D-4FF6-91C0-25612368CC81}) (Version: 5.0.5.2 - The Document Foundation)
Lioncast LK15 Keyboard Driver (HKLM-x32\...\{54C8FBB3-B992-43CB-8F0A-E26228013F88}) (Version: 1.0 - )
Lioncast LM30 Gaming Mouse Version 1.1 (HKLM-x32\...\{BF8BC0AC-979B-4085-8F94-7933AF19CBD2}_is1) (Version: 1.1 - LIONCAST)
Livestreamer 1.12.2 (HKLM-x32\...\Livestreamer) (Version: - )
Logitech Gaming Software 8.58 (HKLM\...\Logitech Gaming Software) (Version: 8.58.183 - Logitech Inc.)
Logitech SetPoint 6.65 (HKLM\...\sp6) (Version: 6.65.62 - Logitech)
LS Mod Manager (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\fee48a2c9be21a28) (Version: 3.0.1.5 - Thomas Müller)
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft Access database engine 2010 (German) (HKLM-x32\...\{90140000-00D1-0407-0000-0000000FF1CE}) (Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{67F42018-F647-4D3C-BE62-F8CB4FE2FCD5}) (Version: 3.5.67.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{887868A2-D6DE-3255-AA92-AA0B5A59B874}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24210 (HKLM-x32\...\{f144e08f-9cbe-4f09-9a8c-f2b858b7ee7f}) (Version: 14.0.24210.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24210 (HKLM-x32\...\{23658c02-145e-483d-ba6b-1eb82c580529}) (Version: 14.0.24210.0 - Microsoft Corporation)
Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}) (Version: 1.20.146.0 - Microsoft)
Mozilla Firefox 46.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 46.0.1 (x86 de)) (Version: 46.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 37.0.1 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MultiBit HD 0.3.0 (HKLM\...\6925-4794-5772-4956) (Version: 0.3.0 - Bitcoin Solutions Ltd)
MySQL Workbench 6.2 CE (HKLM\...\{82D50D82-CAF2-4ABA-8BB7-090668162290}) (Version: 6.2.5 - Oracle Corporation)
Need for Speed™ Most Wanted (HKLM-x32\...\{FB0127F3-985B-44CE-AE29-378CAF60B361}) (Version: 1.5.0.0 - Electronic Arts)
Need for Speed™ Rivals (HKLM-x32\...\{E0A32336-AA27-4053-99B2-C3380B7B95AC}) (Version: 1.4.0.0 - Electronic Arts)
NetBeans IDE 8.0.2 (HKLM-x32\...\nbi-nb-base-8.0.2.0.201411181905) (Version: 8.0.2 - NetBeans.org)
NetStat4Win 1.60 (HKLM\...\NetStat4Win) (Version: - Mirko Böer)
Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.63.3 - Black Tree Gaming)
NifSkope (remove only) (HKLM-x32\...\NifSkope) (Version: - )
Nitro Pro 9 (HKLM\...\{4C32F7E8-A65F-4D3C-9153-9F3B57CB6872}) (Version: 9.0.5.9 - Nitro)
Node.js (HKLM\...\{40435563-20B0-4DA3-8E52-E5BF28ABE5C3}) (Version: 0.12.2 - Joyent, Inc. and other Node contributors)
Nuance PaperPort 12 (HKLM-x32\...\{2A770862-7142-4C77-8117-F933E4110A3F}) (Version: 12.1.0006 - Nuance Communications, Inc.)
Nuance PDF Viewer Plus (HKLM-x32\...\{28656860-4728-433C-8AD4-D1A930437BC8}) (Version: 5.30.3290 - Nuance Communications, Inc)
NVIDIA 3D Vision Treiber 375.70 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 375.70 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.1.0.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.1.0.52 - NVIDIA Corporation)
NVIDIA Grafiktreiber 375.70 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 375.70 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.16.0318 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.16.0318 - NVIDIA Corporation)
NvNodejs (Version: 3.1.0.52 - NVIDIA Corporation) Hidden
NvTelemetry (Version: 1.2.0.0 - NVIDIA Corporation) Hidden
Nylas N1 (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\nylas) (Version: 0.4.5 - Nylas Inc.)
OBS Studio (HKLM-x32\...\OBS Studio) (Version: 0.16.2 - OBS Project)
Onekey Theater (HKLM-x32\...\{91CC5BAE-A098-40D3-A43B-C0DC7CE263FE}) (Version: 3.0.1.2 - Lenovo)
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version: - )
Oracle VM VirtualBox 5.0.20 (HKLM\...\{8209969B-9A31-4021-B0D8-E6F719F7F995}) (Version: 5.0.20 - Oracle Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.8.3.59237 - Electronic Arts, Inc.)
Outlast (HKLM-x32\...\Steam App 238320) (Version: - Red Barrels)
Overwolf (HKLM-x32\...\Overwolf) (Version: 0.98.211.0 - Overwolf Ltd.)
PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 14.00.0000 - Nuance Communications, Inc.)
PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
PhotoScape (HKLM-x32\...\PhotoScape) (Version: - )
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9.141.259 - Google, Inc.)
Pinegrow Web Designer version 2.01 (HKLM-x32\...\Pinegrow Web Designer_is1) (Version: 2.01 - )
PlayClaw 5 fast codec (HKLM-x32\...\PlayClaw 5 fast codec_is1) (Version: 5.5 - )
PlayClaw 5 Plus (HKLM-x32\...\PlayClaw 5 Plus_is1) (Version: 5 - )
Plex Media Server (HKLM-x32\...\{06f702c0-12c1-4d02-a753-2c00d9f1d01e}) (Version: 0.9.1506 - Plex, Inc.)
Plex Media Server (x32 Version: 0.9.1506 - Plex, Inc.) Hidden
Poedit (HKLM-x32\...\{68EB2C37-083A-4303-B5D8-41FA67E50B8F}_is1) (Version: 1.8.7 - Vaclav Slavik)
PosteRazor (HKLM-x32\...\PosteRazor_is1) (Version: 1.5.2 - Alessandro Portale)
Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.0.10525 - CyberLink Corp.)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.305 - Qualcomm Atheros Communications)
Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
Qualcomm Atheros Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.21 - Qualcomm Atheros Inc.)
Razer Synapse (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 1.18.21.27343 - Razer Inc.)
Revo Uninstaller 2.0.1 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.1 - VS Revo Group, Ltd.)
Rocket League (HKLM-x32\...\Steam App 252950) (Version: - Psyonix)
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.16035.2 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.16035.2 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG Mobile Composite Device Software (HKLM\...\SAMSUNG Mobile Composite Device) (Version: - )
SAMSUNG Mobile Modem Driver Set (HKLM\...\SAMSUNG Mobile Modem) (Version: - )
Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version: - )
SAMSUNG Mobile USB Modem 1.0 Software (HKLM\...\SAMSUNG Mobile USB Modem 1.0) (Version: - )
SAMSUNG Mobile USB Modem Software (HKLM\...\SAMSUNG Mobile USB Modem) (Version: - )
Samsung PC Studio 3 (HKLM-x32\...\{C4A4722E-79F9-417C-BD72-8D359A090C97}) (Version: 3.2.2.80601 - Samsung Electronics Co., Ltd.)
Samsung PC Studio 3 (x32 Version: 3.0.0.80601 - Samsung Electronics Co., Ltd.) Hidden
Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.59.0 - Samsung Electronics Co., Ltd.)
Scansoft PDF Professional (x32 Version: - ) Hidden
SeaTools for Windows 1.4.0.2 (HKLM-x32\...\SeaTools for Windows) (Version: 1.4.0.2 - Seagate Technology)
SF-Etikett 13 (HKLM-x32\...\{B3966C9F-E4EC-4AB7-BFF3-8ACFAC844EAC}) (Version: 13.00.000 - Frank Stolzer)
SHIELD Streaming (Version: 7.1.0330 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 3.1.0.52 - NVIDIA Corporation) Hidden
Should I Remove It (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\Should I Remove It 1.0.4) (Version: 1.0.4 - Reason Software Company Inc.)
Should I Remove It (x32 Version: 1.0.4 - Reason Software Company Inc.) Hidden
SketchUp 2015 (HKLM\...\{350488A4-1540-4103-8F01-B27503891EB0}) (Version: 15.3.331 - Trimble Navigation Limited)
Skype™ 7.26 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.26.101 - Skype Technologies S.A.)
Sothink SWF Decompiler (HKLM-x32\...\{BCDB856C-D247-4DEE-9132-89C02F4D6B8C}_is1) (Version: 7.4 - SourceTec Software Co., LTD)
Sothink SWF Editor (HKLM-x32\...\{0BF1DE3D-31B9-417F-A915-4BCC5AAEE3CD}_is1) (Version: 1.3 - SourceTec Software Co., LTD)
SourceTree (HKLM-x32\...\SourceTree 1.6.14) (Version: 1.6.14 - Atlassian)
SourceTree (x32 Version: 1.6.14 - Atlassian) Hidden
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Streamline (HKLM-x32\...\d229a310-2468-4f0c-b49b-4a6dcdd47809) (Version: - PS363)
Sublime Text Build 3065 (HKLM\...\Sublime Text 3_is1) (Version: - Sublime HQ Pty Ltd)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.0.9.5 - Synaptics Incorporated)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
TeamViewer 11 (HKLM-x32\...\TeamViewer) (Version: 11.0.66695 - TeamViewer)
TechPowerUp GPU-Z (HKLM-x32\...\TechPowerUp GPU-Z) (Version: - TechPowerUp)
Telegram Desktop Version 0.7.10 (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1) (Version: 0.7.10 - Telegram Messenger LLP)
The Crew (Worldwide) (HKLM-x32\...\Uplay Install 413) (Version: - Ubisoft)
The Forest (HKLM-x32\...\Steam App 242760) (Version: - Endnight Games Ltd)
Tom Clancy's Rainbow Six Siege (HKLM-x32\...\Uplay Install 635) (Version: - Ubisoft Montreal)
TortoiseHg 3.3.3 (x64) (HKLM\...\{2A25209F-23B5-4F5F-A484-E7A0C30B5975}) (Version: 3.3.3 - Steve Borho and others)
TruckersMP 0.2.1.2.5 Alpha (HKLM\...\{A227B892-C548-4490-9C5D-DB341F8194A6}_is1) (Version: 0.2.1.2.5 Alpha - TruckersMP Team)
Trust 100K Series Webcam (HKLM-x32\...\{C679F9B9-C65D-4C65-BD6C-BF90B859E281}) (Version: 1.0.4.15 - Trust)
Tukui Client (HKLM-x32\...\{BAD6EBBD-A6A9-41C9-898A-8C868A552E4C}) (Version: 2.4.6 - Tukui)
Twitch Launcher (HKLM-x32\...\Twitch Launcher 1.0.0) (Version: 1.0.0 - Twitch)
Twitch Leecher 1.3.2 (HKLM-x32\...\{90604deb-1435-465e-9485-862937465b6b}) (Version: 1.3.2.0 - Fake Smile Revolution)
Twitch Leecher 1.3.2 (Version: 1.3.2.0 - Fake Smile Revolution) Hidden
UnderCover10 2.03 (HKLM-x32\...\UnderCover10_is1) (Version: - Wicked & Wild Inc.)
Uplay (HKLM-x32\...\Uplay) (Version: 21.1 - Ubisoft)
User Manuals (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 3.0.0.3 - Lenovo)
Vagrant (HKLM-x32\...\{DBD58741-B374-4518-B0F7-8F33D09E3164}) (Version: 1.8.1 - HashiCorp)
Vanilla DayZmod Launcher (HKLM-x32\...\{2F318942-6CAC-4D3C-AA18-259B8C5600EE}_is1) (Version: 1.0.4 - AmberHelios)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.3 - VideoLAN)
Vulkan Run Time Libraries 1.0.26.0 (HKLM\...\VulkanRT1.0.26.0) (Version: 1.0.26.0 - LunarG, Inc.)
Vulkan Run Time Libraries 1.0.3.0 (HKLM\...\VulkanRT1.0.3.0) (Version: 1.0.3.0 - LunarG, Inc.)
WEBZEN Browser Extension (HKLM-x32\...\{95723791-2C44-454B-9220-C65D47D70E9C}) (Version: 1.12.010 - WEBZEN)
Windows-Treiberpaket - Dimension Engineering USB Serial Converter (11/12/2015 1.0.3.13) (HKLM\...\32A12E2F88EE40BDBADBB41ECCB8559DEE67F7A3) (Version: 11/12/2015 1.0.3.13 - Dimension Engineering)
WinRAR 5.31 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.31.0 - win.rar GmbH)
World of Warcraft (HKLM-x32\...\World of Warcraft) (Version: - Blizzard Entertainment)
WYSIWYG Web Builder 10 (HKLM-x32\...\WYSIWYG_Web_Builder_10) (Version: - )
XAMPP (HKLM-x32\...\xampp) (Version: 5.6.21-0 - Bitnami)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-3046321304-749213656-246317510-1001_Classes\CLSID\{33C169DA-833A-456A-9059-F3D6D429ED42}\InprocServer32 -> C:\WINDOWS\system32\timedate.cpl (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3046321304-749213656-246317510-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Benjamin\AppData\Local\Microsoft\OneDrive\17.3.6381.0405\FileCoAuth.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3046321304-749213656-246317510-1001_Classes\CLSID\{ca586c80-7c84-4b88-8537-726724df6929}\InprocServer32 -> C:\Program Files (x86)\Git\git-cheetah\git_shell_ext64.dll ()
CustomCLSID: HKU\S-1-5-21-3046321304-749213656-246317510-1001_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
CustomCLSID: HKU\S-1-5-21-3046321304-749213656-246317510-1001_Classes\CLSID\{ecfae962-f1ac-499d-a4e9-3eec574033d8}\InprocServer32 -> C:\WINDOWS\system32\dfshim.dll (Microsoft Corporation)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {09C19643-230A-4D8C-A476-C9748F3E0760} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2016-10-25] (NVIDIA Corporation)
Task: {239108FA-ADB7-43A4-9BF6-8674581B4641} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2016-10-25] (NVIDIA Corporation)
Task: {2CA40D83-1939-47D2-A855-2F7A4FAB06E8} - System32\Tasks\SecureUpdater => C:\Program Files (x86)\UCBrowser\Application\uclauncher.exe [2016-11-04] (UC Web Inc.) <==== ACHTUNG
Task: {33E118EB-0693-4BEC-88A4-A38AF88114D0} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\WINDOWS\System32\AutoWorkplace.exe
Task: {40BD5A48-16A5-429F-85F3-0176EF3735A2} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {41CECE4F-3BE9-4752-8C1E-BF27E58428A8} - System32\Tasks\PDVDServ Task => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.EXE [2013-03-08] (CyberLink Corp.)
Task: {43E0225D-0996-45E3-BC8E-A4C886C60E52} - System32\Tasks\UCBrowserUpdaterCore => C:\Program Files (x86)\UCBrowser\Application\update_task.exe [2016-10-31] (UCWeb Inc) <==== ACHTUNG
Task: {4DF13BBA-9FFD-48E0-93AD-3EADE7C6B18B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {548B1208-8B1A-4755-BA2F-F879AF00D78C} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {5A3D076E-4860-4BEB-9F01-29C47D023B28} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {64AAF96A-BD92-463B-BE03-B8B88DC23005} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {67265F0E-F9EA-4783-A6DC-099E6F1CDE42} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2016-10-25] (NVIDIA Corporation)
Task: {6E4FA571-8BCF-4512-89EE-E03C92BD34A1} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-10-11] (Microsoft Corporation)
Task: {75196BBE-3737-4678-AE57-464270E71418} - System32\Tasks\090814979df9a1cbff315bc3871a6032 => Rundll32.exe "C:\Program Files (x86)\PDF24\5emdqf.dll",e62dc6c6547f46bda862da2d05af6862 <==== ACHTUNG
Task: {7A34A017-10ED-43F4-B3ED-275D45FE199B} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {826CF2EA-D0DF-45E0-AF6A-95816F289396} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {83DB1462-D709-4D90-AF96-587D1CC5676A} - System32\Tasks\Overwolf Updater Task => C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [2016-09-27] (Overwolf LTD)
Task: {8B599AAE-2D21-421A-824F-D21139601E27} - System32\Tasks\CyberLink\Photo Master Gadget startup => C:\Program Files (x86)\Lenovo\Lenovo Photo Master\PhotoMasterWorker.exe [2015-09-17] (CyberLink Corp.)
Task: {8EE9593D-A158-457B-AECD-8DB785316ED5} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2016-10-25] (NVIDIA Corporation)
Task: {96B2DA81-9A99-40BB-AC28-1AA2DB91F55E} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {99363A44-6DEC-4356-B050-29265EFD2B77} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {9DC45D87-CD47-4FF5-B828-8EEAA989237A} - System32\Tasks\Cwspgajother Provider => C:\Program Files (x86)\Phowert\steiing.exe [2016-11-04] (Glarysoft Ltd)
Task: {A1C858F2-D3C0-4A7D-86C0-B8524A5EFD60} - System32\Tasks\AdobeAAMUpdater-1.0-MicrosoftAccount-pandory@outlook.de => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2015-03-30] (Adobe Systems Incorporated)
Task: {A392F5FC-6486-4E05-AEBD-55CDEC33D22A} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {A54A7010-1548-4C4B-A473-6223323ADCC3} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG
Task: {A71A91F7-F713-455E-8C89-857AF9816B51} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2016-10-25] (NVIDIA Corporation)
Task: {A8B04EAC-2AF5-4B8A-86CA-687A402989E2} - System32\Tasks\UCBrowserUpdater => C:\Program Files (x86)\UCBrowser\Application\update_task.exe [2016-10-31] (UCWeb Inc) <==== ACHTUNG
Task: {B24FF775-0247-4A53-8D67-9BB4BA20F0E4} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {CE0EE6F4-7D41-4703-A6F8-FB026CFD393E} - System32\Tasks\Microsoft\Windows\RestartManager\{6FCA8F0B-9FC1-4d99-997C-A2EE39124A9A} => C:\WINDOWS\system32\rmclient.exe [2016-07-16] (Microsoft Corporation)
Task: {D082025C-E335-415A-A00D-C3591ED52A58} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {D274DC96-E8BC-4642-92F0-F538D9913564} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Task: {DCD3F4CA-2722-41AE-8AF5-4061C951D0D8} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2016-10-25] (NVIDIA Corporation)
Task: {DEE81BB9-0E5F-4A5E-9A82-18C6FF7F3472} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {F5486DC8-52DD-4D86-AA31-237997D44139} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\UCBrowserUpdater.job => C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\UCBrowserUpdaterCore.job => C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== ACHTUNG
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intеrnеt Ехplоrеr.lnk -> C:\iexplore.bat ()
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Lаunсh Intеrnеt Ехplоrеr Вrоwsеr.lnk -> C:\iexplore.bat ()
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Gооglе Сhrоmе.lnk -> C:\Program Files (x86)\Google\chrome.bat (Keine Datei)
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Intеrnеt Ехplоrеr.lnk -> C:\iexplore.bat ()
ShortcutWithArgument: C:\Users\Benjamin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js command prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation) -> /k "C:\Program Files\nodejs\nodevars.bat"
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2016-07-16 12:42 - 2016-07-16 12:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-09-29 22:11 - 2016-09-15 18:25 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2015-02-23 12:36 - 2013-06-17 17:40 - 00035944 _____ () C:\WINDOWS\system32\ddmon4-64x.dll
2014-11-26 02:03 - 2012-04-25 03:43 - 00390632 ____N () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2016-05-28 23:29 - 2016-03-24 04:20 - 11583304 _____ () C:\xampp\mysql\bin\mysqld.exe
2015-06-23 20:11 - 2015-06-23 20:11 - 00187048 _____ () C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
2015-12-31 13:31 - 2005-04-22 05:36 - 00143360 ____R () C:\WINDOWS\system32\BrSNMP64.dll
2015-08-02 10:53 - 2015-05-05 12:35 - 11048960 _____ () C:\Bitnami\wampstack-7.0.0beta2-1\mysql\bin\mysqld.exe
2016-09-29 22:11 - 2016-09-15 18:25 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2015-04-16 16:42 - 2015-04-16 16:42 - 00997536 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
2016-08-18 02:00 - 2016-08-18 02:00 - 00959168 _____ () C:\Users\Benjamin\AppData\Local\Microsoft\OneDrive\17.3.6381.0405\amd64\ClientTelemetry.dll
2016-10-03 15:57 - 2016-10-03 15:57 - 00052400 _____ () C:\Program Files\FileZilla FTP Client\fzshellext_64.dll
2015-06-01 16:03 - 2015-03-19 22:33 - 00736962 _____ () C:\Program Files (x86)\Git\git-cheetah\git_shell_ext64.dll
2014-09-18 08:23 - 2014-09-18 08:23 - 00866584 _____ () C:\Program Files\Logitech Gaming Software\libGLESv2.dll
2015-03-12 19:23 - 2015-03-12 19:23 - 01050904 _____ () C:\Program Files\Logitech Gaming Software\platforms\qwindows.dll
2014-09-18 08:23 - 2014-09-18 08:23 - 00059160 _____ () C:\Program Files\Logitech Gaming Software\libEGL.dll
2015-03-12 19:23 - 2015-03-12 19:23 - 00242456 _____ () C:\Program Files\Logitech Gaming Software\imageformats\qjpeg.dll
2016-10-13 15:31 - 2016-10-13 15:31 - 06673568 _____ () C:\Users\Benjamin\AppData\Roaming\STRATO\HiDrive\HiDrive.App.exe
2016-09-08 19:25 - 2016-10-25 21:21 - 01148984 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\libprotobuf.dll
2016-09-08 19:25 - 2016-10-25 21:21 - 04490808 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\Poco.dll
2016-09-08 19:25 - 2016-10-25 21:21 - 00420408 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\plugins\LocalSystem\_nvspserviceplugin64.dll
2016-08-17 16:53 - 2016-10-25 21:17 - 00133056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-02-28 10:14 - 2016-08-03 16:36 - 00174872 _____ () C:\Program Files\TeamSpeak 3 Client\quazip.dll
2014-08-04 14:43 - 2016-08-03 16:36 - 00103192 _____ () C:\Program Files\TeamSpeak 3 Client\soundbackends\directsound_win64.dll
2014-08-04 14:43 - 2016-08-03 16:36 - 00107800 _____ () C:\Program Files\TeamSpeak 3 Client\soundbackends\windowsaudiosession_win64.dll
2014-08-04 14:46 - 2016-08-03 16:36 - 00312088 _____ () C:\Program Files\TeamSpeak 3 Client\plugins\clientquery_plugin.dll
2014-08-04 14:46 - 2016-08-03 16:36 - 00485656 _____ () C:\Program Files\TeamSpeak 3 Client\plugins\teamspeak_control_plugin.dll
2016-11-04 18:24 - 2016-11-04 18:24 - 00274944 _____ () c:\program files (x86)\phowert\qonakclecisycln.dll
2015-08-02 10:53 - 2015-07-21 14:17 - 00409600 _____ () C:\Bitnami\WAMPST~1.0BE\apache2\bin\pcre.dll
2015-08-02 10:53 - 2015-07-21 14:23 - 00071680 _____ () C:\Bitnami\WAMPST~1.0BE\apache2\bin\zlib1.dll
2015-08-02 10:53 - 2015-07-23 21:39 - 00121856 _____ () C:\Bitnami\wampstack-7.0.0beta2-1\php\libpq.dll
2015-08-02 10:57 - 2015-07-23 21:39 - 00168960 _____ () C:\Bitnami\WAMPST~1.0BE\apache2\bin\libssh2.dll
2016-09-13 15:04 - 2015-09-17 11:31 - 00875960 _____ () C:\Program Files (x86)\Lenovo\Lenovo Photo Master\subsys\Kernel\Boomerang\UNO.dll
2016-09-13 15:03 - 2015-09-17 11:01 - 00081920 _____ () C:\Program Files (x86)\Lenovo\Lenovo Photo Master\koan\_ctypes.pyd
2016-10-13 15:31 - 2016-10-13 15:31 - 01035936 _____ () C:\Users\Benjamin\AppData\Roaming\STRATO\HiDrive\CefSharp.Core.dll
2016-10-13 15:31 - 2016-10-13 15:31 - 48943768 _____ () C:\Users\Benjamin\AppData\Roaming\STRATO\HiDrive\libcef.dll
2014-11-26 01:20 - 2013-09-04 16:53 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2015-04-15 17:36 - 2016-10-25 21:21 - 00020536 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2016-09-08 19:25 - 2016-10-25 20:57 - 00506424 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NvSpCapsAPINode.node
2016-09-08 19:25 - 2016-10-25 20:57 - 00255936 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\DriverInstall.node
2016-09-08 19:25 - 2016-10-25 20:57 - 02808256 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\Downloader.node
2016-09-08 19:25 - 2016-10-25 21:21 - 00901688 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\libprotobuf.dll
2016-09-08 19:25 - 2016-10-25 21:21 - 03776056 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\Poco.dll
2016-09-08 19:25 - 2016-10-25 20:57 - 00246840 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NvGameShareAPINode.node
2016-09-08 19:25 - 2016-10-25 20:57 - 00436792 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NvGalleryAPINode.node
2016-09-08 19:25 - 2016-10-25 20:57 - 00338488 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVAccountAPINode.node
2016-09-08 19:25 - 2016-10-25 20:57 - 00968248 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NvCameraAPINode.node
2016-10-03 15:57 - 2016-10-03 15:57 - 00048304 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll
2015-08-29 18:34 - 2016-09-08 04:14 - 00784672 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2015-08-29 18:34 - 2016-09-01 02:02 - 04969248 _____ () C:\Program Files (x86)\Steam\v8.dll
2015-08-29 18:34 - 2016-10-13 02:58 - 02321696 _____ () C:\Program Files (x86)\Steam\video.dll
2015-08-29 18:34 - 2016-09-01 02:02 - 01563936 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2015-08-29 18:34 - 2016-09-01 02:02 - 01195296 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2015-08-29 18:34 - 2016-01-27 08:49 - 02549760 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2015-08-29 18:34 - 2016-01-27 08:49 - 00491008 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2015-08-29 18:34 - 2016-01-27 08:49 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2015-08-29 18:34 - 2016-01-27 08:49 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2015-08-29 18:34 - 2016-01-27 08:49 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2015-08-29 18:34 - 2016-10-13 02:58 - 00836896 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2016-03-11 18:43 - 2016-07-04 23:17 - 00266560 _____ () C:\Program Files (x86)\Steam\openvr_api.dll
2016-10-22 07:46 - 2016-08-04 21:56 - 49825056 _____ () C:\Program Files (x86)\Steam\bin\cef\cef.winxp\libcef.dll
2015-08-29 18:34 - 2015-09-25 00:52 - 00119208 _____ () C:\Program Files (x86)\Steam\winh264.dll
2016-08-18 02:00 - 2016-08-18 02:00 - 00679624 _____ () C:\Users\Benjamin\AppData\Local\Microsoft\OneDrive\17.3.6381.0405\ClientTelemetry.dll
2016-11-03 02:05 - 2016-10-31 06:29 - 01819240 _____ () C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.87\libglesv2.dll
2016-11-03 02:05 - 2016-10-31 06:29 - 00093288 _____ () C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.87\libegl.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\Windows:nlsPreferences [386]
AlternateDataStreams: C:\WINDOWS\system32\drivers:ucdrv-x64.sys [80850]
AlternateDataStreams: C:\WINDOWS\system32\drivers:x64 [360536]
AlternateDataStreams: C:\WINDOWS\system32\drivers:x86 [1156450]
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2013-08-22 14:25 - 2016-11-05 04:28 - 00000832 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-3046321304-749213656-246317510-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Benjamin\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\img13.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
MSCONFIG\Services: BEService => 3
HKLM\...\StartupApproved\StartupFolder: => "PydioSync.lnk"
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKLM\...\StartupApproved\Run: => "IAStorIcon"
HKLM\...\StartupApproved\Run: => "HotKeysCmds"
HKLM\...\StartupApproved\Run: => "SysTrayApp"
HKLM\...\StartupApproved\Run: => "IgfxTray"
HKLM\...\StartupApproved\Run: => "Energy Manager"
HKLM\...\StartupApproved\Run: => "OnekeyStudio"
HKLM\...\StartupApproved\Run: => "Lenovo Utility"
HKLM\...\StartupApproved\Run: => "ShadowPlay"
HKLM\...\StartupApproved\Run: => "Persistence"
HKLM\...\StartupApproved\Run: => "RtsFT"
HKLM\...\StartupApproved\Run: => "SynTPEnh"
HKLM\...\StartupApproved\Run: => "EvtMgr6"
HKLM\...\StartupApproved\Run: => "AdobeAAMUpdater-1.0"
HKLM\...\StartupApproved\Run: => "PAC207_Monitor"
HKLM\...\StartupApproved\Run: => "TortoiseHgOverlayIconServer"
HKLM\...\StartupApproved\Run: => "XboxStat"
HKLM\...\StartupApproved\Run: => "WindowsDefender"
HKLM\...\StartupApproved\Run32: => "UpdateP2GShortCut"
HKLM\...\StartupApproved\Run32: => "Adobe Creative Cloud"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "PDFPrint"
HKLM\...\StartupApproved\Run32: => "vmware-tray.exe"
HKLM\...\StartupApproved\Run32: => "Razer Synapse"
HKLM\...\StartupApproved\Run32: => "LCgmmouseRun"
HKLM\...\StartupApproved\Run32: => "Lioncast LK15 Keyboard Driver"
HKLM\...\StartupApproved\Run32: => "BrHelp"
HKLM\...\StartupApproved\Run32: => "BrStsMon00"
HKLM\...\StartupApproved\Run32: => "ControlCenter4"
HKLM\...\StartupApproved\Run32: => "PDF5 Registry Controller"
HKLM\...\StartupApproved\Run32: => "PDFHook"
HKLM\...\StartupApproved\Run32: => "PaperPort PTD"
HKLM\...\StartupApproved\Run32: => "IndexSearch"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\StartupFolder: => "CurseClientStartup.ccip"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\StartupFolder: => "Logitech blank Produktregistrierung.lnk"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\StartupFolder: => "Curse.lnk"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "Battle.net"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "deskPDF Creator"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "GoogleChromeAutoLaunch_2CB4D10DAD5AE20CADEFA2B4E24F69E5"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "Steam"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "EADM"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "Overwolf"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "ISUSPM"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "Amazon Cloud Drive"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "Plex Media Server"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "TSMApplication"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "Dxtory Update Checker 2.0"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "World of Tanks"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [TCP Query User{0C343DB2-595E-4609-91E0-5FBBBCFD66D0}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [UDP Query User{73BF8670-C78B-4344-8F68-D8CCCA0CDD28}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [{541B8CF6-0579-48D8-B589-F5BE8EA3D4AE}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{09DC59C6-C561-4CFA-B014-880C8D701F3A}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{791D5014-C773-469D-888A-EA064D95FBEC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Forest\TheForest.exe
FirewallRules: [{A6EEA21D-E1B9-48F3-BA22-4B4DD3658920}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Forest\TheForest.exe
FirewallRules: [TCP Query User{C8977BBE-7EAD-4591-9306-7453C1398E5C}C:\program files (x86)\steam\steamapps\common\farming simulator 17\x64\farmingsimulator2017game.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\farming simulator 17\x64\farmingsimulator2017game.exe
FirewallRules: [UDP Query User{7129E83C-67D3-4121-9627-A618858F3635}C:\program files (x86)\steam\steamapps\common\farming simulator 17\x64\farmingsimulator2017game.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\farming simulator 17\x64\farmingsimulator2017game.exe
FirewallRules: [{BAEC0A83-AC21-401C-954A-85B3CF8D2CAD}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\NvContainer.exe
FirewallRules: [{FE443B3A-5295-46DE-BFC1-0149E7ED415B}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\NvContainer.exe
FirewallRules: [{DABEC3FA-F3BC-4EDD-852C-A26CD2F4ECCD}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{8F65F44C-4088-4B8E-9E52-16B39816EE82}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{AF3F8ADC-663D-42D2-9432-0FF78B92924F}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
==================== Wiederherstellungspunkte =========================
06-11-2016 01:11:15 Installed Should I Remove It
06-11-2016 01:23:21 Removed VPNAutoconnect
06-11-2016 01:25:27 Removed PydioSync
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (11/06/2016 02:07:00 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PANDORY)
Description: Bei der Aktivierung der App „Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (11/06/2016 02:06:58 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PANDORY)
Description: Bei der Aktivierung der App „Microsoft.WindowsAlarms_8wekyb3d8bbwe!App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (11/06/2016 02:06:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Music.UI.exe, Version: 10.16092.1031.0, Zeitstempel: 0x5806afe7
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 10.0.14393.321, Zeitstempel: 0x57f4c4f0
Ausnahmecode: 0xe06d7363
Fehleroffset: 0x0000000000017788
ID des fehlerhaften Prozesses: 0x4c24
Startzeit der fehlerhaften Anwendung: 0x01d2382ea7e3aca6
Pfad der fehlerhaften Anwendung: C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16092.10311.0_x64__8wekyb3d8bbwe\Music.UI.exe
Pfad des fehlerhaften Moduls: C:\WINDOWS\System32\KERNELBASE.dll
Berichtskennung: 81f1f8c2-ad7f-4b3c-95f3-b5603fdd9013
Vollständiger Name des fehlerhaften Pakets: Microsoft.ZuneMusic_10.16092.10311.0_x64__8wekyb3d8bbwe
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Microsoft.ZuneMusic
Error: (11/06/2016 01:55:21 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PANDORY)
Description: Bei der Aktivierung der App „Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (11/06/2016 01:55:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ShellExperienceHost.exe, Version: 10.0.14393.187, Zeitstempel: 0x57cf9d73
Name des fehlerhaften Moduls: ShellExperienceHost.exe, Version: 10.0.14393.187, Zeitstempel: 0x57cf9d73
Ausnahmecode: 0xc000027b
Fehleroffset: 0x0000000000022e37
ID des fehlerhaften Prozesses: 0x1780
Startzeit der fehlerhaften Anwendung: 0x01d2382d07791967
Pfad der fehlerhaften Anwendung: C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
Pfad des fehlerhaften Moduls: C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
Berichtskennung: e5976a74-17a3-45d6-ac14-ee5296717a4e
Vollständiger Name des fehlerhaften Pakets: Microsoft.Windows.ShellExperienceHost_10.0.14393.206_neutral_neutral_cw5n1h2txyewy
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App
Error: (11/06/2016 01:54:59 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PANDORY)
Description: Bei der Aktivierung der App „Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (11/06/2016 01:54:57 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ShellExperienceHost.exe, Version: 10.0.14393.187, Zeitstempel: 0x57cf9d73
Name des fehlerhaften Moduls: ShellExperienceHost.exe, Version: 10.0.14393.187, Zeitstempel: 0x57cf9d73
Ausnahmecode: 0xc000027b
Fehleroffset: 0x0000000000022e37
ID des fehlerhaften Prozesses: 0x4fa0
Startzeit der fehlerhaften Anwendung: 0x01d2382cf9b8a0c3
Pfad der fehlerhaften Anwendung: C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
Pfad des fehlerhaften Moduls: C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
Berichtskennung: 3d923c12-790a-47bf-a4f2-0b3774178c97
Vollständiger Name des fehlerhaften Pakets: Microsoft.Windows.ShellExperienceHost_10.0.14393.206_neutral_neutral_cw5n1h2txyewy
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App
Error: (11/06/2016 01:51:57 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PANDORY)
Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (11/06/2016 01:46:07 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PANDORY)
Description: Bei der Aktivierung der App „Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (11/06/2016 01:46:05 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ShellExperienceHost.exe, Version: 10.0.14393.187, Zeitstempel: 0x57cf9d73
Name des fehlerhaften Moduls: ShellExperienceHost.exe, Version: 10.0.14393.187, Zeitstempel: 0x57cf9d73
Ausnahmecode: 0xc000027b
Fehleroffset: 0x0000000000022e37
ID des fehlerhaften Prozesses: 0x1d8c
Startzeit der fehlerhaften Anwendung: 0x01d2382bbc50b694
Pfad der fehlerhaften Anwendung: C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
Pfad des fehlerhaften Moduls: C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
Berichtskennung: 5c11c5ae-802f-4938-86d1-c0989b44f47f
Vollständiger Name des fehlerhaften Pakets: Microsoft.Windows.ShellExperienceHost_10.0.14393.206_neutral_neutral_cw5n1h2txyewy
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App
Systemfehler:
=============
Error: (11/06/2016 02:07:00 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "Microsoft.ZuneMusic.AppXg7frm9cyrqhbagxce6zrshkx8fn0ycca.mca" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/06/2016 02:06:58 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "App.AppXvwgnrrhcka99admvy9fqan3zpdmgg69a.mca" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/06/2016 01:55:21 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "App" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/06/2016 01:54:59 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "App" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/06/2016 01:51:57 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "CortanaUI.AppXtpp90jhw9p0njjb85kvhxpppgrqfp117.mca" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/06/2016 01:46:07 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "App" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/06/2016 01:06:57 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "CortanaUI.AppXvtawfp8s388m3217mfbq5fa3myj37wpa.mca" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/06/2016 01:00:58 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "App" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/06/2016 12:48:52 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "App" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/06/2016 12:47:50 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "App" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
CodeIntegrity:
===================================
Date: 2016-11-06 02:22:13.019
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_463df33ecac6d590\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-11-05 03:35:30.918
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\winhttp.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-11-05 03:35:30.893
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\winhttp.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-10-30 01:17:17.435
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_463df33ecac6d590\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-10-25 20:44:54.114
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_463df33ecac6d590\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-10-16 01:16:37.295
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_0326b872c1b453bb\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-10-12 22:00:50.316
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_0326b872c1b453bb\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-10-01 02:15:54.025
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_37b47f49d2675149\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-09-25 22:05:54.353
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_37b47f49d2675149\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-09-20 20:22:29.840
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i5-4210M CPU @ 2.60GHz
Prozentuale Nutzung des RAM: 42%
Installierter physikalischer RAM: 12212.27 MB
Verfügbarer physikalischer RAM: 7037.73 MB
Summe virtueller Speicher: 14068.27 MB
Verfügbarer virtueller Speicher: 6129.12 MB
==================== Laufwerke ================================
Drive c: (Windows8_OS) (Fixed) (Total:889.91 GB) (Free:224.98 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:22 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 6D82B2C4)
Partition: GPT.
==================== Ende von Addition.txt ============================
|
|
06.11.2016, 21:04
| #6 |
| /// TB-Ausbilder | UCGuard nicht entfernbar und andere Malware Servus, passt schon so. Bitte alle Schritte aufmerksam durchlesen und genau so mit den genannten Optionen/Einstellungen, insbesondere bei AdwCleaner, anwenden! Habe schon lange nicht mehr so viele Malware gesehen...  Schritt 1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start
CloseProcesses:
HKLM-x32\...\Run: [] => [X]
ShellExecuteHooks: - {47BCB852-9E94-11E6-AEC8-64006A5CFC23} - C:\Users\Benjamin\AppData\Roaming\Hnentqerky\Domesanruent.dll Keine Datei [ ]
C:\Users\Benjamin\AppData\Roaming\Hnentqerky
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => Keine Datei
SearchScopes: HKU\S-1-5-21-3046321304-749213656-246317510-1001 -> {467914D1-0A20-41D7-8496-E7B7AD0E48D4} URL =
R2 Arakosatuhph; C:\Program Files (x86)\Phowert\qonakclecisycln.dll [274944 2016-11-04] () [Datei ist nicht signiert]
C:\Program Files (x86)\Phowert
S2 xecotyvo; kein ImagePath
R1 ucdrv; C:\WINDOWS\System32\drivers:ucdrv-x64.sys [80850 ] (UC Web Inc.) <==== ACHTUNG
Unlock: C:\WINDOWS\System32\drivers:ucdrv-x64.sys
C:\WINDOWS\System32\drivers:ucdrv-x64.sys
R1 UCGuard; C:\WINDOWS\System32\DRIVERS\ucguard.sys [81792 2016-08-29] (Huorong Borui (Beijing) Technology Co., Ltd.) <==== ACHTUNG
Unlock: C:\WINDOWS\System32\DRIVERS\ucguard.sys
C:\WINDOWS\System32\DRIVERS\ucguard.sys
Unlock: C:\Users\Benjamin\AppData\Roaming\wyUpdate AU
C:\Users\Benjamin\AppData\Roaming\wyUpdate AU
C:\WINDOWS\Tasks\UCBrowserUpdaterCore.job
C:\WINDOWS\System32\Tasks\UCBrowserUpdaterCore
C:\WINDOWS\Tasks\UCBrowserUpdater.job
C:\WINDOWS\System32\Tasks\UCBrowserUpdater
C:\WINDOWS\System32\Tasks\SecureUpdater
C:\Users\Benjamin\AppData\Local\UCBrowser
C:\Program Files (x86)\UCBrowser
C:\ProgramData\Avira
C:\ProgramData\Avg
C:\ProgramData\AVAST Software
C:\WINDOWS\System32\Tasks\Cwspgajother Provider
C:\WINDOWS\System32\Tasks\090814979df9a1cbff315bc3871a6032
C:\Users\Public\Thunder Network
C:\Program Files (x86)\Phowert
C:\Users\Benjamin\AppData\Roaming\Hnentqerky
C:\Users\Benjamin\AppData\Local\Wisahoroly
C:\Users\Benjamin\Downloads\Cheat Bot Package.zip
Task: {2CA40D83-1939-47D2-A855-2F7A4FAB06E8} - System32\Tasks\SecureUpdater => C:\Program Files (x86)\UCBrowser\Application\uclauncher.exe [2016-11-04] (UC Web Inc.) <==== ACHTUNG
Task: {33E118EB-0693-4BEC-88A4-A38AF88114D0} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {40BD5A48-16A5-429F-85F3-0176EF3735A2} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {43E0225D-0996-45E3-BC8E-A4C886C60E52} - System32\Tasks\UCBrowserUpdaterCore => C:\Program Files (x86)\UCBrowser\Application\update_task.exe [2016-10-31] (UCWeb Inc) <==== ACHTUNG
Task: {64AAF96A-BD92-463B-BE03-B8B88DC23005} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {7A34A017-10ED-43F4-B3ED-275D45FE199B} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {826CF2EA-D0DF-45E0-AF6A-95816F289396} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {96B2DA81-9A99-40BB-AC28-1AA2DB91F55E} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {99363A44-6DEC-4356-B050-29265EFD2B77} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {9DC45D87-CD47-4FF5-B828-8EEAA989237A} - System32\Tasks\Cwspgajother Provider => C:\Program Files (x86)\Phowert\steiing.exe [2016-11-04] (Glarysoft Ltd)
Task: {A392F5FC-6486-4E05-AEBD-55CDEC33D22A} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {A54A7010-1548-4C4B-A473-6223323ADCC3} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG
Task: {A8B04EAC-2AF5-4B8A-86CA-687A402989E2} - System32\Tasks\UCBrowserUpdater => C:\Program Files (x86)\UCBrowser\Application\update_task.exe [2016-10-31] (UCWeb Inc) <==== ACHTUNG
Task: {D082025C-E335-415A-A00D-C3591ED52A58} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {D274DC96-E8BC-4642-92F0-F538D9913564} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Unlock: C:\Program Files (x86)\UCBrowser
C:\Program Files (x86)\UCBrowser
CMD: type "C:\iexplore.bat"
C:\iexplore.bat
CMD: type "C:\launcher.bat"
C:\launcher.bat
CMD: type "C:\Users\Benjamin\AppData\Roaming\2.txt"
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intеrnеt Ехplоrеr.lnk -> C:\iexplore.bat ()
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Lаunсh Intеrnеt Ехplоrеr Вrоwsеr.lnk -> C:\iexplore.bat ()
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Gооglе Сhrоmе.lnk -> C:\Program Files (x86)\Google\chrome.bat (Keine Datei)
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Intеrnеt Ехplоrеr.lnk -> C:\iexplore.bat ()
ShortcutWithArgument: C:\Users\Benjamin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js command prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation) -> /k "C:\Program Files\nodejs\nodevars.bat"
Unlock: C:\Program Files\nodejs
C:\Program Files\nodejs
AlternateDataStreams: C:\Windows:nlsPreferences [386]
AlternateDataStreams: C:\WINDOWS\system32\drivers:ucdrv-x64.sys [80850]
AlternateDataStreams: C:\WINDOWS\system32\drivers:x64 [360536]
AlternateDataStreams: C:\WINDOWS\system32\drivers:x86 [1156450]
RemoveProxy:
CMD: ipconfig /flushdns
CMD: netsh winsock reset
EmptyTemp:
end
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 2 Downloade Dir bitte AdwCleaner auf deinen Desktop.
Schritt 3 Downloade Dir bitte  Malwarebytes Anti-Malware
Schritt 4 Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Schritt 5
Bitte poste mit deiner nächsten Antwort
|
|
06.11.2016, 23:17
| #7 |
| | UCGuard nicht entfernbar und andere Malware Poste jeweils die Log sobald der Schritt erledigt ist. Habe früher nie Probleme gehabt bis mir gesagt wurde seit Windows 10 reicht der Defender. Code:
ATTFilter Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version: 04-11-2016
durchgeführt von Benjamin (06-11-2016 23:10:52) Run:1
Gestartet von C:\Users\Benjamin\Downloads
Geladene Profile: Benjamin (Verfügbare Profile: Benjamin)
Start-Modus: Normal
==============================================
fixlist Inhalt:
*****************
U1 UCGuard; C:\Windows\System32\DRIVERS\ucguard.sys [81792 2016-07-04] () [Datei ist nicht signiert] <==== ACHTUNG
emptytemp:
*****************
UCGuard => Dienst konnte nicht gestoppt werden.
UCGuard => Dienst erfolgreich entfernt
=========== EmptyTemp: ==========
BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 64931435 B
Java, Flash, Steam htmlcache => 380736368 B
Windows/system/drivers => 24911428 B
Edge => 727263 B
Chrome => 809405422 B
Firefox => 624004 B
Opera => 0 B
Temp, IE cache, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 468882 B
NetworkService => 1863086 B
Benjamin => 1040496492 B
RecycleBin => 24835121 B
EmptyTemp: => 2.2 GB temporäre Dateien entfernt.
================================
Das System musste neu gestartet werden.
==== Ende von Fixlog 23:13:17 ====
Code:
ATTFilter # AdwCleaner v6.030 - Bericht erstellt am 06/11/2016 um 23:22:01
# Aktualisiert am 19/10/2016 von Malwarebytes
# Datenbank : 2016-11-05.1 [Server]
# Betriebssystem : Windows 10 Home (X64)
# Benutzername : Benjamin - PANDORY
# Gestartet von : C:\Users\Benjamin\Desktop\AdwCleaner_6.030.exe
# Modus: Löschen
# Unterstützung : hxxps://www.malwarebytes.com/support
***** [ Dienste ] *****
***** [ Ordner ] *****
***** [ Dateien ] *****
[-] Datei gelöscht: C:\WINDOWS\SysNative\drivers\ucguard.sys
[-] Datei gelöscht: C:\END
***** [ DLL ] *****
***** [ WMI ] *****
***** [ Verknüpfungen ] *****
***** [ Aufgabenplanung ] *****
***** [ Registrierungsdatenbank ] *****
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\UCHTML
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\UCHTML.AssocFile.CRX
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\UCHTML.AssocFile.HTM
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\UCHTML.AssocFile.HTML
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\UCHTML.AssocFile.MHT
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\UCHTML.AssocFile.SHTM
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\UCHTML.AssocFile.SHTML
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\UCHTML.AssocFile.WEBP
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\UCHTML.AssocFile.XHT
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\UCHTML.AssocFile.XHTML
[-] Schlüssel gelöscht: HKU\.DEFAULT\Software\UCBrowser
[-] Schlüssel gelöscht: HKU\.DEFAULT\Software\UCBrowserPID
[-] Schlüssel gelöscht: HKU\S-1-5-21-3046321304-749213656-246317510-1001\Software\UCBrowser
[-] Schlüssel gelöscht: HKU\S-1-5-21-3046321304-749213656-246317510-1001\Software\UCBrowserPID
[#] Schlüssel mit Neustart gelöscht: HKU\S-1-5-18\Software\UCBrowser
[#] Schlüssel mit Neustart gelöscht: HKU\S-1-5-18\Software\UCBrowserPID
[#] Schlüssel mit Neustart gelöscht: HKCU\Software\UCBrowser
[#] Schlüssel mit Neustart gelöscht: HKCU\Software\UCBrowserPID
[-] Schlüssel gelöscht: HKLM\SOFTWARE\UCBrowser
[-] Schlüssel gelöscht: HKLM\SOFTWARE\UCBrowserPID
[#] Schlüssel mit Neustart gelöscht: [x64] HKCU\Software\UCBrowser
[#] Schlüssel mit Neustart gelöscht: [x64] HKCU\Software\UCBrowserPID
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Clients\StartMenuInternet\UCBrowser
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\UCBrowser.exe
[-] Wert gelöscht: HKLM\SOFTWARE\RegisteredApplications [UCBrowser]
***** [ Browser ] *****
[-] [C:\Users\Benjamin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Web data] [Search Provider] Gelöscht: de.yhs4.search.yahoo.com
[-] [C:\Users\Benjamin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData] [startup_urls] Gelöscht: hxxp://mysearch.avg.com?cid={6906F778-DF21-4A84-8687-5B71364FFFCF}&mid=8fa50f37953e47d2a1f5d16b2f1ec0c5-20f00ebcee5ffec2e6b9d26a73226d781000484a&lang=de&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-03-05 11:33:10&v=17.3.1.91&pid=safeguard&sg=&sap=hp
[-] [C:\Users\Benjamin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData] [extension] Gelöscht: ehoopddfhgaehhmphfcooacjdpmbjlao
[-] [C:\Users\Benjamin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData] [homepage] Gelöscht: hxxp://mysearch.avg.com?cid={6906F778-DF21-4A84-8687-5B71364FFFCF}&mid=8fa50f37953e47d2a1f5d16b2f1ec0c5-20f00ebcee5ffec2e6b9d26a73226d781000484a&lang=de&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-03-05 11:33:10&v=17.3.1.91&pid=safeguard&sg=&sap=hp
*************************
:: "Tracing" Schlüssel gelöscht
:: Winsock Einstellungen zurückgesetzt
:: "Image File Execution Options" Schlüssel gelöscht
:: "Prefetch" Dateien gelöscht
:: Proxy Einstellungen zurückgesetzt
:: Internet Explorer Richtlinien gelöscht
:: Chrome Richtlinien gelöscht
!! Chrome Einstellungen nicht zurückgesetzt: C:\Users\Benjamin\AppData\Local\Google\Chrome\User Data\Default
:: Chrome Einstellungen zurückgesetzt: C:\Users\Benjamin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData
*************************
C:\AdwCleaner\AdwCleaner[C0].txt - [4091 Bytes] - [06/11/2016 23:22:01]
C:\AdwCleaner\AdwCleaner[S0].txt - [3564 Bytes] - [06/11/2016 23:21:31]
########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [4237 Bytes] ##########
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 06.11.2016 Suchlaufzeit: 23:25 Protokolldatei: mbam.txt Administrator: Ja Version: 2.2.1.1043 Malware-Datenbank: v2016.11.06.09 Rootkit-Datenbank: v2016.10.31.01 Lizenz: Premium-Version Malware-Schutz: Aktiviert Schutz vor bösartigen Websites: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 10 CPU: x64 Dateisystem: NTFS Benutzer: Benjamin Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 363115 Abgelaufene Zeit: 9 Min., 38 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 0 (keine bösartigen Elemente erkannt) Registrierungswerte: 0 (keine bösartigen Elemente erkannt) Registrierungsdaten: 0 (keine bösartigen Elemente erkannt) Ordner: 0 (keine bösartigen Elemente erkannt) Dateien: 0 (keine bösartigen Elemente erkannt) Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.9 (09.30.2016)
Operating System: Windows 10 Home x64
Ran by Benjamin (Administrator) on 06.11.2016 at 23:37:54,41
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 4
Successfully deleted: C:\Users\Benjamin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio (Folder)
Successfully deleted: C:\Users\Benjamin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gkojfkhlekighikafcpjkiklfbnlmeio (Folder)
Successfully deleted: C:\Users\Benjamin\AppData\Roaming\wyupdate au (Folder)
Successfully deleted: C:\Users\Public\thunder network (Folder)
Deleted the following from C:\Users\Benjamin\AppData\Roaming\Mozilla\Firefox\Profiles\wc7b0vga.default\prefs.js
user_pref(browser.search.searchengine.uid, ST1000LM014-SSHD-8GB_W770HWX7XXXXW770HWX7);
user_pref(browser.urlbar.suggest.searches, true);
Registry: 1
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{467914D1-0A20-41D7-8496-E7B7AD0E48D4} (Registry Key)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 06.11.2016 at 23:40:17,48
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 04-11-2016
durchgeführt von Benjamin (06-11-2016 23:42:12)
Gestartet von C:\Users\Benjamin\Desktop
Windows 10 Home Version 1607 (X64) (2016-08-17 16:33:15)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-3046321304-749213656-246317510-500 - Administrator - Disabled)
Benjamin (S-1-5-21-3046321304-749213656-246317510-1001 - Administrator - Enabled) => C:\Users\Benjamin
DefaultAccount (S-1-5-21-3046321304-749213656-246317510-503 - Limited - Disabled)
Gast (S-1-5-21-3046321304-749213656-246317510-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3046321304-749213656-246317510-1003 - Limited - Enabled)
priva (S-1-5-21-3046321304-749213656-246317510-1006 - Administrator - Enabled)
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
4K Video Downloader (HKLM\...\4K Video DownloaderLatest) (Version: Latest - Franki Hack)
4K Video Downloader 4.1 (HKLM-x32\...\4K Video Downloader_is1) (Version: 4.1.2.2075 - Open Media LLC)
7 Days to Die (HKLM-x32\...\Steam App 251570) (Version: - The Fun Pimps)
7-Zip 15.14 (x64 edition) (HKLM\...\{23170F69-40C1-2702-1514-000001000000}) (Version: 15.14.00.0 - Igor Pavlov)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 3.0.1.88 - Adobe Systems Incorporated)
Adobe Photoshop CC 2014 (HKLM-x32\...\{D7A4F897-B20A-42D0-862D-CB5F6DB7391D}) (Version: 15.2.2 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 5.7.1 64-bit (HKLM\...\{BC86B82C-8C0E-4408-9AC1-6B0F2D636963}) (Version: 5.7.1 - Adobe Systems Incorporated)
AION Free-to-Play (HKLM-x32\...\{82E73E8D-E1E7-45A4-A311-6D31492AA913}_is1) (Version: - Gameforge)
Alcor Micro USB Card Reader (HKLM-x32\...\AmUStor) (Version: 20.2.1245.53580 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 20.2.1245.53580 - Alcor Micro Corp.) Hidden
Amazon Cloud Drive (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\Amazon Cloud Drive) (Version: 3.2.1.29 - Amazon.com, Inc.)
Ansel (Version: 375.70 - NVIDIA Corporation) Hidden
AnyBurn (HKLM-x32\...\AnyBurn) (Version: 3.0 - Power Software Ltd)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
Benutzerhandbücher (x32 Version: 3.0.0.3 - Lenovo) Hidden
Bethesda.net Launcher (HKLM-x32\...\{3448917E-E4FE-4E30-9502-9FD52EABB6F5}_is1) (Version: 1.0 - Bethesda Softworks)
Bitnami WAMP Stack (HKLM-x32\...\Bitnami WAMP Stack 7.0.0beta2-1) (Version: 7.0.0beta2-1 - Bitnami)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Brother MFL-Pro Suite MFC-J5620DW (HKLM-x32\...\{7FC49664-DAA4-4E7C-ADD0-614ABB43691B}) (Version: 1.0.5.0 - Brother Industries, Ltd.)
Brother P-touch Editor 5.1 (HKLM-x32\...\{39270390-A851-4E4B-94A9-D5C468216ED3}) (Version: 5.1.0610 - Brother Industries, Ltd.)
C9 (HKLM-x32\...\C9(Continent of the Ninth Seal)_is1) (Version: - WEBZEN)
Command & Conquer™ Red Alert 2 and Yuri’s Revenge (HKLM-x32\...\{F5275D1C-D133-486D-8F07-D6C571F0A8EC}) (Version: 1.0.0.0 - Electronic Arts, Inc.)
Composer - Php Dependency Manager (HKLM-x32\...\{7315AF68-E777-496A-A6A2-4763A98ED35A}_is1) (Version: - getcomposer.org)
Counter-Strike Nexon: Zombies (HKLM-x32\...\Steam App 273110) (Version: - Nexon)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve)
Creation Kit: Fallout 4 (HKLM-x32\...\Creation Kit: Fallout 4) (Version: - Bethesda Softworks)
Curse (HKLM-x32\...\{1F2611FB-6F69-4AA8-BECD-243BD8CB45F3}) (Version: 6.0.0.0 - Curse)
Curse Client (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\101a9f93b8f0bb6f) (Version: 5.1.1.844 - Curse)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)
CyberLink PowerDirector 10 (Version: 10.0.0.2810 - CyberLink Corp.) Hidden
DayZ (HKLM-x32\...\Steam App 221100) (Version: - Bohemia Interactive)
Dead by Daylight (HKLM\...\Steam App 381210) (Version: - Behaviour Digital Inc.)
Diablo III (HKLM-x32\...\Diablo III) (Version: - Blizzard Entertainment)
Dolby Digital Plus Home Theater (HKLM\...\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.3.2.2 - Dolby Laboratories Inc)
Dragon's Prophet (HKLM-x32\...\{C31556D7-F2B9-4787-B223-F7A035067E89}_is1) (Version: 2.1.1434.29 - Infernum Productions AG)
Dxtory version 2.0.135 (HKLM-x32\...\Dxtory2.0_is1) (Version: 2.0.135 - ExKode Co. Ltd.)
eBlendr Version 2.0.2.60 (HKLM-x32\...\eBlendr_is1) (Version: 2.0.2.60 - H. Brinkhaus Onlineservices)
eMule (HKLM-x32\...\eMule) (Version: - )
Euro Truck Simulator 2 (HKLM\...\Steam App 227300) (Version: - SCS Software)
Euro Truck Simulator 2 (HKLM-x32\...\{1B705E8F-9893-4486-B5D7-4F7FEB9C871E}_is1) (Version: 1.25.2.5 - SCS Software)
EVEREST Home Edition v2.20 (HKLM-x32\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
Fallout 3 - Game of the Year Edition (HKLM-x32\...\Steam App 22370) (Version: - Bethesda Game Studios)
Fallout 4 (HKLM-x32\...\Steam App 377160) (Version: - Bethesda Game Studios)
Fallout Mod Manager 0.12.6 (HKLM-x32\...\Fallout Mod Manager_is1) (Version: - Timeslip, Q)
Fallout: New Vegas (HKLM-x32\...\Steam App 22380) (Version: - Obsidian Entertainment)
Farming Simulator 17 (HKLM\...\Steam App 447020) (Version: - Giants Software)
FileZilla Client 3.22.1 (HKLM-x32\...\FileZilla Client) (Version: 3.22.1 - Tim Kosse)
Flash Decompiler Trillix (HKLM-x32\...\Flash Decompiler Trillix_is1) (Version: 5.3 - Eltima Software)
FlashDevelop (HKLM-x32\...\FlashDevelop) (Version: 5.1.1 - FlashDevelop.org)
FlashFXP 5 (HKLM-x32\...\FlashFXP 5) (Version: 5.0.0.3791 - OpenSight Software LLC)
Fraps (HKLM-x32\...\Fraps) (Version: - )
Gameforge Live 2.0.6 (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 2.0.6 - Gameforge)
Genymotion version 2.5.2 (HKLM\...\{6D180286-D4DF-40EF-9227-923B9C07C08A}_is1) (Version: 2.5.2 - Genymobile)
GIANTS Editor 7.0.2 64-bit (HKLM-x32\...\giants_editor_7.0.2_win64_is1) (Version: 7.0.2 - GIANTS Software GmbH)
GIMP 2.8.16 (HKLM\...\GIMP-2_is1) (Version: 2.8.16 - The GIMP Team)
Git version 1.9.5-preview20150319 (HKLM-x32\...\Git_is1) (Version: 1.9.5-preview20150319 - The Git Development Community)
GitHub (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\5f7eb300e2ea4ebf) (Version: 3.1.1.4 - GitHub, Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 54.0.2840.87 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden
Guild Wars 2 (HKLM-x32\...\Guild Wars 2) (Version: - NCsoft Corporation, Ltd.)
H1Z1 (HKLM-x32\...\Steam App 295110) (Version: - Daybreak Games)
H1Z1: King of the Kill (HKLM-x32\...\Steam App 433850) (Version: - Daybreak Game Company)
Hearthstone Deck Tracker (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\HearthstoneDeckTracker) (Version: 1.0.5 - HearthSim)
Heroes of the Storm (HKLM-x32\...\Heroes of the Storm) (Version: - Blizzard Entertainment)
Hide and Shriek (HKLM\...\Steam App 480430) (Version: - Funcom)
HiDrive (HKLM-x32\...\{88D57A8B-DF01-4C4D-8EF4-289C08BD2F96}) (Version: 4.2.1.0 - STRATO AG)
HP ePrint (HKLM-x32\...\{2794875B-6CCF-48B8-84A5-5B10DB98BEE6}) (Version: 14.0.14176.1823 - Hewlett-Packard)
HP ePrint (HKLM-x32\...\{2dbf7d69-d76e-4907-8ee6-ad90bf62aab7}) (Version: 1.0.7.31082 - HP)
HWiNFO64 Version 5.06 (HKLM\...\HWiNFO64_is1) (Version: 5.06 - Martin Malík - REALiX)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6503.0 - IDT)
Intel Collaborative Processor Performance Control (HKLM-x32\...\0E7DAF70-FB54-4B91-B192-7E771C25AEEB) (Version: 1.0.0.1013 - Intel Corporation)
Intel WiDi Media Share (x32 Version: 1.1.0.0 - Intel Corporation) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4531 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.5.1000 - Intel Corporation)
Intel® WiDi Media Share (HKLM-x32\...\{32d14b1d-18fa-48e7-867d-93b7a72c816a}) (Version: 1.1.0.0 - Intel Corporation)
IsoBuster 3.7 (HKLM-x32\...\IsoBuster_is1) (Version: 3.7 - Smart Projects)
Java 8 Update 77 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218077F0}) (Version: 8.0.770.3 - Oracle Corporation)
Java 8 Update 91 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218091F0}) (Version: 8.0.910.14 - Oracle Corporation)
Java 8 Update 92 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418092F0}) (Version: 8.0.920.14 - Oracle Corporation)
Java SE Development Kit 8 Update 92 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180920}) (Version: 8.0.920.14 - Oracle Corporation)
JetBrains PhpStorm 2016.1 (HKLM-x32\...\PhpStorm 2016.1) (Version: 145.258.2 - JetBrains s.r.o.)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Lenovo EasyCamera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10245 - Realtek Semiconductor Corp.)
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.0.0.2105 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 8.0.0.2105 - CyberLink Corp.) Hidden
Lenovo Photo Master Trial (HKLM-x32\...\{BC94C56A-3649-420C-8756-2ADEBE399D33}) (Version: 2.2.3317.01 Trial - CyberLink Corp.)
Lenovo PowerDVD10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.5630.52 - CyberLink Corp.)
Lenovo PowerDVD10 (x32 Version: 10.0.5630.52 - CyberLink Corp.) Hidden
LibreOffice 5.0.5.2 (HKLM-x32\...\{43D862C3-739D-4FF6-91C0-25612368CC81}) (Version: 5.0.5.2 - The Document Foundation)
Lioncast LK15 Keyboard Driver (HKLM-x32\...\{54C8FBB3-B992-43CB-8F0A-E26228013F88}) (Version: 1.0 - )
Lioncast LM30 Gaming Mouse Version 1.1 (HKLM-x32\...\{BF8BC0AC-979B-4085-8F94-7933AF19CBD2}_is1) (Version: 1.1 - LIONCAST)
Livestreamer 1.12.2 (HKLM-x32\...\Livestreamer) (Version: - )
Logitech Gaming Software 8.58 (HKLM\...\Logitech Gaming Software) (Version: 8.58.183 - Logitech Inc.)
Logitech SetPoint 6.65 (HKLM\...\sp6) (Version: 6.65.62 - Logitech)
LS Mod Manager (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\fee48a2c9be21a28) (Version: 3.0.1.5 - Thomas Müller)
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft Access database engine 2010 (German) (HKLM-x32\...\{90140000-00D1-0407-0000-0000000FF1CE}) (Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{67F42018-F647-4D3C-BE62-F8CB4FE2FCD5}) (Version: 3.5.67.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{887868A2-D6DE-3255-AA92-AA0B5A59B874}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24210 (HKLM-x32\...\{f144e08f-9cbe-4f09-9a8c-f2b858b7ee7f}) (Version: 14.0.24210.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24210 (HKLM-x32\...\{23658c02-145e-483d-ba6b-1eb82c580529}) (Version: 14.0.24210.0 - Microsoft Corporation)
Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}) (Version: 1.20.146.0 - Microsoft)
Mozilla Firefox 46.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 46.0.1 (x86 de)) (Version: 46.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 37.0.1 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MultiBit HD 0.3.0 (HKLM\...\6925-4794-5772-4956) (Version: 0.3.0 - Bitcoin Solutions Ltd)
MySQL Workbench 6.2 CE (HKLM\...\{82D50D82-CAF2-4ABA-8BB7-090668162290}) (Version: 6.2.5 - Oracle Corporation)
Need for Speed™ Most Wanted (HKLM-x32\...\{FB0127F3-985B-44CE-AE29-378CAF60B361}) (Version: 1.5.0.0 - Electronic Arts)
Need for Speed™ Rivals (HKLM-x32\...\{E0A32336-AA27-4053-99B2-C3380B7B95AC}) (Version: 1.4.0.0 - Electronic Arts)
NetBeans IDE 8.0.2 (HKLM-x32\...\nbi-nb-base-8.0.2.0.201411181905) (Version: 8.0.2 - NetBeans.org)
NetStat4Win 1.60 (HKLM\...\NetStat4Win) (Version: - Mirko Böer)
Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.63.3 - Black Tree Gaming)
NifSkope (remove only) (HKLM-x32\...\NifSkope) (Version: - )
Nitro Pro 9 (HKLM\...\{4C32F7E8-A65F-4D3C-9153-9F3B57CB6872}) (Version: 9.0.5.9 - Nitro)
Node.js (HKLM\...\{40435563-20B0-4DA3-8E52-E5BF28ABE5C3}) (Version: 0.12.2 - Joyent, Inc. and other Node contributors)
Nuance PaperPort 12 (HKLM-x32\...\{2A770862-7142-4C77-8117-F933E4110A3F}) (Version: 12.1.0006 - Nuance Communications, Inc.)
Nuance PDF Viewer Plus (HKLM-x32\...\{28656860-4728-433C-8AD4-D1A930437BC8}) (Version: 5.30.3290 - Nuance Communications, Inc)
NVIDIA 3D Vision Treiber 375.70 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 375.70 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.1.0.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.1.0.52 - NVIDIA Corporation)
NVIDIA Grafiktreiber 375.70 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 375.70 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.16.0318 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.16.0318 - NVIDIA Corporation)
NvNodejs (Version: 3.1.0.52 - NVIDIA Corporation) Hidden
NvTelemetry (Version: 1.2.0.0 - NVIDIA Corporation) Hidden
Nylas N1 (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\nylas) (Version: 0.4.5 - Nylas Inc.)
OBS Studio (HKLM-x32\...\OBS Studio) (Version: 0.16.2 - OBS Project)
Onekey Theater (HKLM-x32\...\{91CC5BAE-A098-40D3-A43B-C0DC7CE263FE}) (Version: 3.0.1.2 - Lenovo)
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version: - )
Oracle VM VirtualBox 5.0.20 (HKLM\...\{8209969B-9A31-4021-B0D8-E6F719F7F995}) (Version: 5.0.20 - Oracle Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.8.3.59237 - Electronic Arts, Inc.)
Outlast (HKLM-x32\...\Steam App 238320) (Version: - Red Barrels)
Overwolf (HKLM-x32\...\Overwolf) (Version: 0.99.11.0 - Overwolf Ltd.)
PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 14.00.0000 - Nuance Communications, Inc.)
PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
PhotoScape (HKLM-x32\...\PhotoScape) (Version: - )
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9.141.259 - Google, Inc.)
Pinegrow Web Designer version 2.01 (HKLM-x32\...\Pinegrow Web Designer_is1) (Version: 2.01 - )
PlayClaw 5 fast codec (HKLM-x32\...\PlayClaw 5 fast codec_is1) (Version: 5.5 - )
PlayClaw 5 Plus (HKLM-x32\...\PlayClaw 5 Plus_is1) (Version: 5 - )
Plex Media Server (HKLM-x32\...\{06f702c0-12c1-4d02-a753-2c00d9f1d01e}) (Version: 0.9.1506 - Plex, Inc.)
Plex Media Server (x32 Version: 0.9.1506 - Plex, Inc.) Hidden
Poedit (HKLM-x32\...\{68EB2C37-083A-4303-B5D8-41FA67E50B8F}_is1) (Version: 1.8.7 - Vaclav Slavik)
PosteRazor (HKLM-x32\...\PosteRazor_is1) (Version: 1.5.2 - Alessandro Portale)
Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.0.10525 - CyberLink Corp.)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.305 - Qualcomm Atheros Communications)
Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
Qualcomm Atheros Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.21 - Qualcomm Atheros Inc.)
Razer Synapse (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 1.18.21.27343 - Razer Inc.)
Revo Uninstaller 2.0.1 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.1 - VS Revo Group, Ltd.)
Rocket League (HKLM-x32\...\Steam App 252950) (Version: - Psyonix)
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.16035.2 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.16035.2 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG Mobile Composite Device Software (HKLM\...\SAMSUNG Mobile Composite Device) (Version: - )
SAMSUNG Mobile Modem Driver Set (HKLM\...\SAMSUNG Mobile Modem) (Version: - )
Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version: - )
SAMSUNG Mobile USB Modem 1.0 Software (HKLM\...\SAMSUNG Mobile USB Modem 1.0) (Version: - )
SAMSUNG Mobile USB Modem Software (HKLM\...\SAMSUNG Mobile USB Modem) (Version: - )
Samsung PC Studio 3 (HKLM-x32\...\{C4A4722E-79F9-417C-BD72-8D359A090C97}) (Version: 3.2.2.80601 - Samsung Electronics Co., Ltd.)
Samsung PC Studio 3 (x32 Version: 3.0.0.80601 - Samsung Electronics Co., Ltd.) Hidden
Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.59.0 - Samsung Electronics Co., Ltd.)
Scansoft PDF Professional (x32 Version: - ) Hidden
SeaTools for Windows 1.4.0.2 (HKLM-x32\...\SeaTools for Windows) (Version: 1.4.0.2 - Seagate Technology)
SF-Etikett 13 (HKLM-x32\...\{B3966C9F-E4EC-4AB7-BFF3-8ACFAC844EAC}) (Version: 13.00.000 - Frank Stolzer)
SHIELD Streaming (Version: 7.1.0330 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 3.1.0.52 - NVIDIA Corporation) Hidden
Should I Remove It (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\Should I Remove It 1.0.4) (Version: 1.0.4 - Reason Software Company Inc.)
Should I Remove It (x32 Version: 1.0.4 - Reason Software Company Inc.) Hidden
SketchUp 2015 (HKLM\...\{350488A4-1540-4103-8F01-B27503891EB0}) (Version: 15.3.331 - Trimble Navigation Limited)
Skype™ 7.26 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.26.101 - Skype Technologies S.A.)
Sothink SWF Decompiler (HKLM-x32\...\{BCDB856C-D247-4DEE-9132-89C02F4D6B8C}_is1) (Version: 7.4 - SourceTec Software Co., LTD)
Sothink SWF Editor (HKLM-x32\...\{0BF1DE3D-31B9-417F-A915-4BCC5AAEE3CD}_is1) (Version: 1.3 - SourceTec Software Co., LTD)
SourceTree (HKLM-x32\...\SourceTree 1.6.14) (Version: 1.6.14 - Atlassian)
SourceTree (x32 Version: 1.6.14 - Atlassian) Hidden
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Streamline (HKLM-x32\...\d229a310-2468-4f0c-b49b-4a6dcdd47809) (Version: - PS363)
Sublime Text Build 3065 (HKLM\...\Sublime Text 3_is1) (Version: - Sublime HQ Pty Ltd)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.0.9.5 - Synaptics Incorporated)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
TeamViewer 11 (HKLM-x32\...\TeamViewer) (Version: 11.0.66695 - TeamViewer)
TechPowerUp GPU-Z (HKLM-x32\...\TechPowerUp GPU-Z) (Version: - TechPowerUp)
Telegram Desktop Version 0.7.10 (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1) (Version: 0.7.10 - Telegram Messenger LLP)
The Crew (Worldwide) (HKLM-x32\...\Uplay Install 413) (Version: - Ubisoft)
The Forest (HKLM-x32\...\Steam App 242760) (Version: - Endnight Games Ltd)
Tom Clancy's Rainbow Six Siege (HKLM-x32\...\Uplay Install 635) (Version: - Ubisoft Montreal)
TortoiseHg 3.3.3 (x64) (HKLM\...\{2A25209F-23B5-4F5F-A484-E7A0C30B5975}) (Version: 3.3.3 - Steve Borho and others)
TruckersMP 0.2.1.2.5 Alpha (HKLM\...\{A227B892-C548-4490-9C5D-DB341F8194A6}_is1) (Version: 0.2.1.2.5 Alpha - TruckersMP Team)
Trust 100K Series Webcam (HKLM-x32\...\{C679F9B9-C65D-4C65-BD6C-BF90B859E281}) (Version: 1.0.4.15 - Trust)
Tukui Client (HKLM-x32\...\{BAD6EBBD-A6A9-41C9-898A-8C868A552E4C}) (Version: 2.4.6 - Tukui)
Twitch Launcher (HKLM-x32\...\Twitch Launcher 1.0.0) (Version: 1.0.0 - Twitch)
Twitch Leecher 1.3.2 (HKLM-x32\...\{90604deb-1435-465e-9485-862937465b6b}) (Version: 1.3.2.0 - Fake Smile Revolution)
Twitch Leecher 1.3.2 (Version: 1.3.2.0 - Fake Smile Revolution) Hidden
UnderCover10 2.03 (HKLM-x32\...\UnderCover10_is1) (Version: - Wicked & Wild Inc.)
Uplay (HKLM-x32\...\Uplay) (Version: 21.1 - Ubisoft)
User Manuals (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 3.0.0.3 - Lenovo)
Vagrant (HKLM-x32\...\{DBD58741-B374-4518-B0F7-8F33D09E3164}) (Version: 1.8.1 - HashiCorp)
Vanilla DayZmod Launcher (HKLM-x32\...\{2F318942-6CAC-4D3C-AA18-259B8C5600EE}_is1) (Version: 1.0.4 - AmberHelios)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.3 - VideoLAN)
Vulkan Run Time Libraries 1.0.26.0 (HKLM\...\VulkanRT1.0.26.0) (Version: 1.0.26.0 - LunarG, Inc.)
Vulkan Run Time Libraries 1.0.3.0 (HKLM\...\VulkanRT1.0.3.0) (Version: 1.0.3.0 - LunarG, Inc.)
WEBZEN Browser Extension (HKLM-x32\...\{95723791-2C44-454B-9220-C65D47D70E9C}) (Version: 1.12.010 - WEBZEN)
Windows-Treiberpaket - Dimension Engineering USB Serial Converter (11/12/2015 1.0.3.13) (HKLM\...\32A12E2F88EE40BDBADBB41ECCB8559DEE67F7A3) (Version: 11/12/2015 1.0.3.13 - Dimension Engineering)
WinRAR 5.31 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.31.0 - win.rar GmbH)
World of Warcraft (HKLM-x32\...\World of Warcraft) (Version: - Blizzard Entertainment)
WYSIWYG Web Builder 10 (HKLM-x32\...\WYSIWYG_Web_Builder_10) (Version: - )
XAMPP (HKLM-x32\...\xampp) (Version: 5.6.21-0 - Bitnami)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-3046321304-749213656-246317510-1001_Classes\CLSID\{33C169DA-833A-456A-9059-F3D6D429ED42}\InprocServer32 -> C:\WINDOWS\system32\timedate.cpl (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3046321304-749213656-246317510-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Benjamin\AppData\Local\Microsoft\OneDrive\17.3.6381.0405\FileCoAuth.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3046321304-749213656-246317510-1001_Classes\CLSID\{ca586c80-7c84-4b88-8537-726724df6929}\InprocServer32 -> C:\Program Files (x86)\Git\git-cheetah\git_shell_ext64.dll ()
CustomCLSID: HKU\S-1-5-21-3046321304-749213656-246317510-1001_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
CustomCLSID: HKU\S-1-5-21-3046321304-749213656-246317510-1001_Classes\CLSID\{ecfae962-f1ac-499d-a4e9-3eec574033d8}\InprocServer32 -> C:\WINDOWS\system32\dfshim.dll (Microsoft Corporation)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {09C19643-230A-4D8C-A476-C9748F3E0760} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2016-10-25] (NVIDIA Corporation)
Task: {239108FA-ADB7-43A4-9BF6-8674581B4641} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2016-10-25] (NVIDIA Corporation)
Task: {2CA40D83-1939-47D2-A855-2F7A4FAB06E8} - System32\Tasks\SecureUpdater => C:\Program Files (x86)\UCBrowser\Application\uclauncher.exe [2016-11-04] (UC Web Inc.) <==== ACHTUNG
Task: {33E118EB-0693-4BEC-88A4-A38AF88114D0} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\WINDOWS\System32\AutoWorkplace.exe
Task: {40BD5A48-16A5-429F-85F3-0176EF3735A2} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {41CECE4F-3BE9-4752-8C1E-BF27E58428A8} - System32\Tasks\PDVDServ Task => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.EXE [2013-03-08] (CyberLink Corp.)
Task: {43E0225D-0996-45E3-BC8E-A4C886C60E52} - System32\Tasks\UCBrowserUpdaterCore => C:\Program Files (x86)\UCBrowser\Application\update_task.exe [2016-10-31] (UCWeb Inc) <==== ACHTUNG
Task: {4DF13BBA-9FFD-48E0-93AD-3EADE7C6B18B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {548B1208-8B1A-4755-BA2F-F879AF00D78C} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {5A3D076E-4860-4BEB-9F01-29C47D023B28} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {64AAF96A-BD92-463B-BE03-B8B88DC23005} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {67265F0E-F9EA-4783-A6DC-099E6F1CDE42} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2016-10-25] (NVIDIA Corporation)
Task: {6E4FA571-8BCF-4512-89EE-E03C92BD34A1} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-10-11] (Microsoft Corporation)
Task: {75196BBE-3737-4678-AE57-464270E71418} - System32\Tasks\090814979df9a1cbff315bc3871a6032 => Rundll32.exe "C:\Program Files (x86)\PDF24\5emdqf.dll",e62dc6c6547f46bda862da2d05af6862 <==== ACHTUNG
Task: {7A34A017-10ED-43F4-B3ED-275D45FE199B} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {826CF2EA-D0DF-45E0-AF6A-95816F289396} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {83DB1462-D709-4D90-AF96-587D1CC5676A} - System32\Tasks\Overwolf Updater Task => C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [2016-10-30] (Overwolf LTD)
Task: {8B599AAE-2D21-421A-824F-D21139601E27} - System32\Tasks\CyberLink\Photo Master Gadget startup => C:\Program Files (x86)\Lenovo\Lenovo Photo Master\PhotoMasterWorker.exe [2015-09-17] (CyberLink Corp.)
Task: {8EE9593D-A158-457B-AECD-8DB785316ED5} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2016-10-25] (NVIDIA Corporation)
Task: {96B2DA81-9A99-40BB-AC28-1AA2DB91F55E} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {99363A44-6DEC-4356-B050-29265EFD2B77} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {9DC45D87-CD47-4FF5-B828-8EEAA989237A} - System32\Tasks\Cwspgajother Provider => C:\Program Files (x86)\Phowert\steiing.exe [2016-11-04] (Glarysoft Ltd)
Task: {A1C858F2-D3C0-4A7D-86C0-B8524A5EFD60} - System32\Tasks\AdobeAAMUpdater-1.0-MicrosoftAccount-pandory@outlook.de => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2015-03-30] (Adobe Systems Incorporated)
Task: {A392F5FC-6486-4E05-AEBD-55CDEC33D22A} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {A54A7010-1548-4C4B-A473-6223323ADCC3} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG
Task: {A71A91F7-F713-455E-8C89-857AF9816B51} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2016-10-25] (NVIDIA Corporation)
Task: {A8B04EAC-2AF5-4B8A-86CA-687A402989E2} - System32\Tasks\UCBrowserUpdater => C:\Program Files (x86)\UCBrowser\Application\update_task.exe [2016-10-31] (UCWeb Inc) <==== ACHTUNG
Task: {B24FF775-0247-4A53-8D67-9BB4BA20F0E4} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {D082025C-E335-415A-A00D-C3591ED52A58} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {D274DC96-E8BC-4642-92F0-F538D9913564} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Task: {DCD3F4CA-2722-41AE-8AF5-4061C951D0D8} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2016-10-25] (NVIDIA Corporation)
Task: {DEE81BB9-0E5F-4A5E-9A82-18C6FF7F3472} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {F5486DC8-52DD-4D86-AA31-237997D44139} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\UCBrowserUpdater.job => C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\UCBrowserUpdaterCore.job => C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== ACHTUNG
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intеrnеt Ехplоrеr.lnk -> C:\iexplore.bat ()
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Lаunсh Intеrnеt Ехplоrеr Вrоwsеr.lnk -> C:\iexplore.bat ()
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Gооglе Сhrоmе.lnk -> C:\Program Files (x86)\Google\chrome.bat (Keine Datei)
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Intеrnеt Ехplоrеr.lnk -> C:\iexplore.bat ()
ShortcutWithArgument: C:\Users\Benjamin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js command prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation) -> /k "C:\Program Files\nodejs\nodevars.bat"
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2016-07-16 12:42 - 2016-07-16 12:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-09-29 22:11 - 2016-09-15 18:25 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2015-02-23 12:36 - 2013-06-17 17:40 - 00035944 _____ () C:\WINDOWS\system32\ddmon4-64x.dll
2015-08-02 10:53 - 2015-05-05 12:35 - 11048960 _____ () C:\Bitnami\wampstack-7.0.0beta2-1\mysql\bin\mysqld.exe
2015-06-23 20:11 - 2015-06-23 20:11 - 00187048 _____ () C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
2015-12-31 13:31 - 2005-04-22 05:36 - 00143360 ____R () C:\WINDOWS\system32\BrSNMP64.dll
2016-05-28 23:29 - 2016-03-24 04:20 - 11583304 _____ () C:\xampp\mysql\bin\mysqld.exe
2014-11-26 02:03 - 2012-04-25 03:43 - 00390632 ____N () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2016-09-29 22:11 - 2016-09-15 18:25 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2015-04-16 16:42 - 2015-04-16 16:42 - 00997536 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
2016-08-18 02:00 - 2016-08-18 02:00 - 00959168 _____ () C:\Users\Benjamin\AppData\Local\Microsoft\OneDrive\17.3.6381.0405\amd64\ClientTelemetry.dll
2016-09-08 19:25 - 2016-10-25 21:21 - 01148984 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\libprotobuf.dll
2016-09-08 19:25 - 2016-10-25 21:21 - 04490808 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\Poco.dll
2016-09-08 19:25 - 2016-10-25 21:21 - 00420408 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\plugins\LocalSystem\_nvspserviceplugin64.dll
2015-08-02 10:53 - 2015-07-21 14:17 - 00409600 _____ () C:\Bitnami\WAMPST~1.0BE\apache2\bin\pcre.dll
2015-08-02 10:53 - 2015-07-21 14:23 - 00071680 _____ () C:\Bitnami\WAMPST~1.0BE\apache2\bin\zlib1.dll
2015-08-02 10:53 - 2015-07-23 21:39 - 00121856 _____ () C:\Bitnami\wampstack-7.0.0beta2-1\php\libpq.dll
2015-08-02 10:57 - 2015-07-23 21:39 - 00168960 _____ () C:\Bitnami\WAMPST~1.0BE\apache2\bin\libssh2.dll
2016-11-04 18:24 - 2016-11-04 18:24 - 00274944 _____ () c:\program files (x86)\phowert\qonakclecisycln.dll
2014-11-26 01:20 - 2013-09-04 16:53 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2015-04-15 17:36 - 2016-10-25 21:21 - 00020536 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2016-11-03 02:05 - 2016-10-31 06:29 - 01819240 _____ () C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.87\libglesv2.dll
2016-11-03 02:05 - 2016-10-31 06:29 - 00093288 _____ () C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.87\libegl.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\Windows:nlsPreferences [386]
AlternateDataStreams: C:\WINDOWS\system32\drivers:ucdrv-x64.sys [80850]
AlternateDataStreams: C:\WINDOWS\system32\drivers:x64 [360536]
AlternateDataStreams: C:\WINDOWS\system32\drivers:x86 [1156450]
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2013-08-22 14:25 - 2016-11-05 04:28 - 00000832 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-3046321304-749213656-246317510-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Benjamin\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\img13.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
MSCONFIG\Services: BEService => 3
HKLM\...\StartupApproved\StartupFolder: => "PydioSync.lnk"
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKLM\...\StartupApproved\Run: => "IAStorIcon"
HKLM\...\StartupApproved\Run: => "HotKeysCmds"
HKLM\...\StartupApproved\Run: => "SysTrayApp"
HKLM\...\StartupApproved\Run: => "IgfxTray"
HKLM\...\StartupApproved\Run: => "Energy Manager"
HKLM\...\StartupApproved\Run: => "OnekeyStudio"
HKLM\...\StartupApproved\Run: => "Lenovo Utility"
HKLM\...\StartupApproved\Run: => "ShadowPlay"
HKLM\...\StartupApproved\Run: => "Persistence"
HKLM\...\StartupApproved\Run: => "RtsFT"
HKLM\...\StartupApproved\Run: => "SynTPEnh"
HKLM\...\StartupApproved\Run: => "EvtMgr6"
HKLM\...\StartupApproved\Run: => "AdobeAAMUpdater-1.0"
HKLM\...\StartupApproved\Run: => "PAC207_Monitor"
HKLM\...\StartupApproved\Run: => "TortoiseHgOverlayIconServer"
HKLM\...\StartupApproved\Run: => "XboxStat"
HKLM\...\StartupApproved\Run: => "WindowsDefender"
HKLM\...\StartupApproved\Run32: => "UpdateP2GShortCut"
HKLM\...\StartupApproved\Run32: => "Adobe Creative Cloud"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "PDFPrint"
HKLM\...\StartupApproved\Run32: => "vmware-tray.exe"
HKLM\...\StartupApproved\Run32: => "Razer Synapse"
HKLM\...\StartupApproved\Run32: => "LCgmmouseRun"
HKLM\...\StartupApproved\Run32: => "Lioncast LK15 Keyboard Driver"
HKLM\...\StartupApproved\Run32: => "BrHelp"
HKLM\...\StartupApproved\Run32: => "BrStsMon00"
HKLM\...\StartupApproved\Run32: => "ControlCenter4"
HKLM\...\StartupApproved\Run32: => "PDF5 Registry Controller"
HKLM\...\StartupApproved\Run32: => "PDFHook"
HKLM\...\StartupApproved\Run32: => "PaperPort PTD"
HKLM\...\StartupApproved\Run32: => "IndexSearch"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\StartupFolder: => "CurseClientStartup.ccip"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\StartupFolder: => "Logitech blank Produktregistrierung.lnk"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\StartupFolder: => "Curse.lnk"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "Battle.net"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "deskPDF Creator"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "GoogleChromeAutoLaunch_2CB4D10DAD5AE20CADEFA2B4E24F69E5"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "Steam"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "EADM"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "Overwolf"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "ISUSPM"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "Amazon Cloud Drive"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "Plex Media Server"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "TSMApplication"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "Dxtory Update Checker 2.0"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "World of Tanks"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [TCP Query User{0C343DB2-595E-4609-91E0-5FBBBCFD66D0}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [UDP Query User{73BF8670-C78B-4344-8F68-D8CCCA0CDD28}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [{541B8CF6-0579-48D8-B589-F5BE8EA3D4AE}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{09DC59C6-C561-4CFA-B014-880C8D701F3A}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{791D5014-C773-469D-888A-EA064D95FBEC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Forest\TheForest.exe
FirewallRules: [{A6EEA21D-E1B9-48F3-BA22-4B4DD3658920}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Forest\TheForest.exe
FirewallRules: [{BAEC0A83-AC21-401C-954A-85B3CF8D2CAD}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\NvContainer.exe
FirewallRules: [{FE443B3A-5295-46DE-BFC1-0149E7ED415B}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\NvContainer.exe
FirewallRules: [{DABEC3FA-F3BC-4EDD-852C-A26CD2F4ECCD}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{8F65F44C-4088-4B8E-9E52-16B39816EE82}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{AF3F8ADC-663D-42D2-9432-0FF78B92924F}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{24C14A46-60C8-4E01-A678-D16C19606CA3}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Farming Simulator 17\x64\FarmingSimulator2017Game.exe
FirewallRules: [{A6439C3D-BC7F-43D6-8461-ECC12F53AE87}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Farming Simulator 17\x64\FarmingSimulator2017Game.exe
FirewallRules: [{7B9BE528-FD6F-49CF-AAE6-02D4629E98E3}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Farming Simulator 17\x86\FarmingSimulator2017Game.exe
FirewallRules: [{934D007C-8D8F-49B9-9AC4-72DED6B4E510}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Farming Simulator 17\x86\FarmingSimulator2017Game.exe
==================== Wiederherstellungspunkte =========================
06-11-2016 01:11:15 Installed Should I Remove It
06-11-2016 01:23:21 Removed VPNAutoconnect
06-11-2016 01:25:27 Removed PydioSync
06-11-2016 23:37:58 JRT Pre-Junkware Removal
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (11/06/2016 11:44:53 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PANDORY)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (11/06/2016 11:44:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: HxTsr.exe, Version: 16.0.7369.4082, Zeitstempel: 0x580fe9d7
Name des fehlerhaften Moduls: Mso20Imm.dll, Version: 16.0.7329.1013, Zeitstempel: 0x57e535af
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000005567d
ID des fehlerhaften Prozesses: 0xbd0
Startzeit der fehlerhaften Anwendung: 0x01d2387f63478bff
Pfad der fehlerhaften Anwendung: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7369.40827.0_x64__8wekyb3d8bbwe\HxTsr.exe
Pfad des fehlerhaften Moduls: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7369.40827.0_x64__8wekyb3d8bbwe\Mso20Imm.dll
Berichtskennung: f06052b5-5fa7-450d-82a1-e1186051e9aa
Vollständiger Name des fehlerhaften Pakets: microsoft.windowscommunicationsapps_17.7369.40827.0_x64__8wekyb3d8bbwe
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ppleae38af2e007f4358a809ac99a64a67c1
Error: (11/06/2016 11:38:20 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
System Error:
Zugriff verweigert
.
Error: (11/06/2016 11:35:12 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PANDORY)
Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2144927142. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (11/06/2016 11:35:12 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: PANDORY)
Description: Die App „Microsoft.Windows.Cortana_1.7.0.14393_neutral_neutral_cw5n1h2txyewy+CortanaUI“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.
Error: (11/06/2016 11:35:05 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PANDORY)
Description: Bei der Aktivierung der App „Microsoft.WindowsStore_8wekyb3d8bbwe!App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (11/06/2016 11:35:00 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PANDORY)
Description: Bei der Aktivierung der App „Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (11/06/2016 11:33:10 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PANDORY)
Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2144927142. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (11/06/2016 11:33:10 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: PANDORY)
Description: Die App „Microsoft.Windows.Cortana_1.7.0.14393_neutral_neutral_cw5n1h2txyewy+CortanaUI“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.
Error: (11/06/2016 11:31:08 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PANDORY)
Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2144927142. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Systemfehler:
=============
Error: (11/06/2016 11:44:53 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "microsoft.windowslive.calendar.AppXwkn9j84yh1kvnt49k5r8h6y1ecsv09hs.mca" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/06/2016 11:38:39 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "NVIDIA LocalSystem Container" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 1000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (11/06/2016 11:35:12 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "CortanaUI" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/06/2016 11:35:05 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "App.AppX65azfy60a5wn91mcvdd3dr2y0wj02n39.mca" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/06/2016 11:35:00 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "Windows.Security.Authentication.Web.Core.BackgroundGetTokenTask.ClassId.WebAccountProvider" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/06/2016 11:33:10 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "CortanaUI" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/06/2016 11:31:08 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "CortanaUI" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/06/2016 11:29:06 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "CortanaUI" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/06/2016 11:29:01 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "Windows.Security.Authentication.Web.Core.BackgroundGetTokenTask.ClassId.WebAccountProvider" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/06/2016 11:27:04 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "CortanaUI" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
CodeIntegrity:
===================================
Date: 2016-11-06 02:22:13.019
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_463df33ecac6d590\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-11-05 03:35:30.918
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\winhttp.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-11-05 03:35:30.893
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\winhttp.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-10-30 01:17:17.435
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_463df33ecac6d590\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-10-25 20:44:54.114
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_463df33ecac6d590\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-10-16 01:16:37.295
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_0326b872c1b453bb\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-10-12 22:00:50.316
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_0326b872c1b453bb\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-10-01 02:15:54.025
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_37b47f49d2675149\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-09-25 22:05:54.353
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_37b47f49d2675149\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-09-20 20:22:29.840
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i5-4210M CPU @ 2.60GHz
Prozentuale Nutzung des RAM: 20%
Installierter physikalischer RAM: 12212.27 MB
Verfügbarer physikalischer RAM: 9687.8 MB
Summe virtueller Speicher: 14068.27 MB
Verfügbarer virtueller Speicher: 10973.84 MB
==================== Laufwerke ================================
Drive c: (Windows8_OS) (Fixed) (Total:889.91 GB) (Free:226.89 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:22 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 6D82B2C4)
Partition: GPT.
==================== Ende von Addition.txt ============================
Geändert von kakuzu (06.11.2016 um 23:45 Uhr) |
|
06.11.2016, 23:48
| #8 |
| | UCGuard nicht entfernbar und andere Malware FRST.txt wegen Überlänge wieder als Anhang. |
|
07.11.2016, 16:33
| #9 |
| /// TB-Ausbilder | UCGuard nicht entfernbar und andere Malware Servus, also irgendwas ist da komplett in die Hose gegangen... Guck dir mal, was da bei mir alles in die Code-Box steht: Code:
ATTFilter start
CloseProcesses:
HKLM-x32\...\Run: [] => [X]
ShellExecuteHooks: - {47BCB852-9E94-11E6-AEC8-64006A5CFC23} - C:\Users\Benjamin\AppData\Roaming\Hnentqerky\Domesanruent.dll Keine Datei [ ]
C:\Users\Benjamin\AppData\Roaming\Hnentqerky
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => Keine Datei
SearchScopes: HKU\S-1-5-21-3046321304-749213656-246317510-1001 -> {467914D1-0A20-41D7-8496-E7B7AD0E48D4} URL =
R2 Arakosatuhph; C:\Program Files (x86)\Phowert\qonakclecisycln.dll [274944 2016-11-04] () [Datei ist nicht signiert]
C:\Program Files (x86)\Phowert
S2 xecotyvo; kein ImagePath
R1 ucdrv; C:\WINDOWS\System32\drivers:ucdrv-x64.sys [80850 ] (UC Web Inc.) <==== ACHTUNG
Unlock: C:\WINDOWS\System32\drivers:ucdrv-x64.sys
C:\WINDOWS\System32\drivers:ucdrv-x64.sys
R1 UCGuard; C:\WINDOWS\System32\DRIVERS\ucguard.sys [81792 2016-08-29] (Huorong Borui (Beijing) Technology Co., Ltd.) <==== ACHTUNG
Unlock: C:\WINDOWS\System32\DRIVERS\ucguard.sys
C:\WINDOWS\System32\DRIVERS\ucguard.sys
Unlock: C:\Users\Benjamin\AppData\Roaming\wyUpdate AU
C:\Users\Benjamin\AppData\Roaming\wyUpdate AU
C:\WINDOWS\Tasks\UCBrowserUpdaterCore.job
C:\WINDOWS\System32\Tasks\UCBrowserUpdaterCore
C:\WINDOWS\Tasks\UCBrowserUpdater.job
C:\WINDOWS\System32\Tasks\UCBrowserUpdater
C:\WINDOWS\System32\Tasks\SecureUpdater
C:\Users\Benjamin\AppData\Local\UCBrowser
C:\Program Files (x86)\UCBrowser
C:\ProgramData\Avira
C:\ProgramData\Avg
C:\ProgramData\AVAST Software
C:\WINDOWS\System32\Tasks\Cwspgajother Provider
C:\WINDOWS\System32\Tasks\090814979df9a1cbff315bc3871a6032
C:\Users\Public\Thunder Network
C:\Program Files (x86)\Phowert
C:\Users\Benjamin\AppData\Roaming\Hnentqerky
C:\Users\Benjamin\AppData\Local\Wisahoroly
C:\Users\Benjamin\Downloads\Cheat Bot Package.zip
Task: {2CA40D83-1939-47D2-A855-2F7A4FAB06E8} - System32\Tasks\SecureUpdater => C:\Program Files (x86)\UCBrowser\Application\uclauncher.exe [2016-11-04] (UC Web Inc.) <==== ACHTUNG
Task: {33E118EB-0693-4BEC-88A4-A38AF88114D0} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {40BD5A48-16A5-429F-85F3-0176EF3735A2} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {43E0225D-0996-45E3-BC8E-A4C886C60E52} - System32\Tasks\UCBrowserUpdaterCore => C:\Program Files (x86)\UCBrowser\Application\update_task.exe [2016-10-31] (UCWeb Inc) <==== ACHTUNG
Task: {64AAF96A-BD92-463B-BE03-B8B88DC23005} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {7A34A017-10ED-43F4-B3ED-275D45FE199B} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {826CF2EA-D0DF-45E0-AF6A-95816F289396} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {96B2DA81-9A99-40BB-AC28-1AA2DB91F55E} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {99363A44-6DEC-4356-B050-29265EFD2B77} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {9DC45D87-CD47-4FF5-B828-8EEAA989237A} - System32\Tasks\Cwspgajother Provider => C:\Program Files (x86)\Phowert\steiing.exe [2016-11-04] (Glarysoft Ltd)
Task: {A392F5FC-6486-4E05-AEBD-55CDEC33D22A} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {A54A7010-1548-4C4B-A473-6223323ADCC3} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG
Task: {A8B04EAC-2AF5-4B8A-86CA-687A402989E2} - System32\Tasks\UCBrowserUpdater => C:\Program Files (x86)\UCBrowser\Application\update_task.exe [2016-10-31] (UCWeb Inc) <==== ACHTUNG
Task: {D082025C-E335-415A-A00D-C3591ED52A58} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {D274DC96-E8BC-4642-92F0-F538D9913564} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Unlock: C:\Program Files (x86)\UCBrowser
C:\Program Files (x86)\UCBrowser
CMD: type "C:\iexplore.bat"
C:\iexplore.bat
CMD: type "C:\launcher.bat"
C:\launcher.bat
CMD: type "C:\Users\Benjamin\AppData\Roaming\2.txt"
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intеrnеt Ехplоrеr.lnk -> C:\iexplore.bat ()
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Lаunсh Intеrnеt Ехplоrеr Вrоwsеr.lnk -> C:\iexplore.bat ()
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Gооglе Сhrоmе.lnk -> C:\Program Files (x86)\Google\chrome.bat (Keine Datei)
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Intеrnеt Ехplоrеr.lnk -> C:\iexplore.bat ()
ShortcutWithArgument: C:\Users\Benjamin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js command prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation) -> /k "C:\Program Files\nodejs\nodevars.bat"
Unlock: C:\Program Files\nodejs
C:\Program Files\nodejs
AlternateDataStreams: C:\Windows:nlsPreferences [386]
AlternateDataStreams: C:\WINDOWS\system32\drivers:ucdrv-x64.sys [80850]
AlternateDataStreams: C:\WINDOWS\system32\drivers:x64 [360536]
AlternateDataStreams: C:\WINDOWS\system32\drivers:x86 [1156450]
RemoveProxy:
CMD: ipconfig /flushdns
CMD: netsh winsock reset
EmptyTemp:
end
und was hast du mir gepostet? Das hier: Code:
ATTFilter U1 UCGuard; C:\Windows\System32\DRIVERS\ucguard.sys [81792 2016-07-04] () [Datei ist nicht signiert] <==== ACHTUNG
emptytemp:
Wieso hast du nur diese eine Zeile in die fixlist.txt für FRST kopiert? Man könnte meinen, du willst die Malware auf dem Rechner belassen... Geändert von M-K-D-B (07.11.2016 um 16:44 Uhr) |
|
07.11.2016, 16:53
| #10 |
| | UCGuard nicht entfernbar und andere Malware Meine Fixlis.txt habe ich noch auf dem desktop dort habe ich auch folgenden inhalt drin. Code:
ATTFilter start
CloseProcesses:
HKLM-x32\...\Run: [] => [X]
ShellExecuteHooks: - {47BCB852-9E94-11E6-AEC8-64006A5CFC23} - C:\Users\Benjamin\AppData\Roaming\Hnentqerky\Domesanruent.dll Keine Datei [ ]
C:\Users\Benjamin\AppData\Roaming\Hnentqerky
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => Keine Datei
SearchScopes: HKU\S-1-5-21-3046321304-749213656-246317510-1001 -> {467914D1-0A20-41D7-8496-E7B7AD0E48D4} URL =
R2 Arakosatuhph; C:\Program Files (x86)\Phowert\qonakclecisycln.dll [274944 2016-11-04] () [Datei ist nicht signiert]
C:\Program Files (x86)\Phowert
S2 xecotyvo; kein ImagePath
R1 ucdrv; C:\WINDOWS\System32\drivers:ucdrv-x64.sys [80850 ] (UC Web Inc.) <==== ACHTUNG
Unlock: C:\WINDOWS\System32\drivers:ucdrv-x64.sys
C:\WINDOWS\System32\drivers:ucdrv-x64.sys
R1 UCGuard; C:\WINDOWS\System32\DRIVERS\ucguard.sys [81792 2016-08-29] (Huorong Borui (Beijing) Technology Co., Ltd.) <==== ACHTUNG
Unlock: C:\WINDOWS\System32\DRIVERS\ucguard.sys
C:\WINDOWS\System32\DRIVERS\ucguard.sys
Unlock: C:\Users\Benjamin\AppData\Roaming\wyUpdate AU
C:\Users\Benjamin\AppData\Roaming\wyUpdate AU
C:\WINDOWS\Tasks\UCBrowserUpdaterCore.job
C:\WINDOWS\System32\Tasks\UCBrowserUpdaterCore
C:\WINDOWS\Tasks\UCBrowserUpdater.job
C:\WINDOWS\System32\Tasks\UCBrowserUpdater
C:\WINDOWS\System32\Tasks\SecureUpdater
C:\Users\Benjamin\AppData\Local\UCBrowser
C:\Program Files (x86)\UCBrowser
C:\ProgramData\Avira
C:\ProgramData\Avg
C:\ProgramData\AVAST Software
C:\WINDOWS\System32\Tasks\Cwspgajother Provider
C:\WINDOWS\System32\Tasks\090814979df9a1cbff315bc3871a6032
C:\Users\Public\Thunder Network
C:\Program Files (x86)\Phowert
C:\Users\Benjamin\AppData\Roaming\Hnentqerky
C:\Users\Benjamin\AppData\Local\Wisahoroly
C:\Users\Benjamin\Downloads\Cheat Bot Package.zip
Task: {2CA40D83-1939-47D2-A855-2F7A4FAB06E8} - System32\Tasks\SecureUpdater => C:\Program Files (x86)\UCBrowser\Application\uclauncher.exe [2016-11-04] (UC Web Inc.) <==== ACHTUNG
Task: {33E118EB-0693-4BEC-88A4-A38AF88114D0} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {40BD5A48-16A5-429F-85F3-0176EF3735A2} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {43E0225D-0996-45E3-BC8E-A4C886C60E52} - System32\Tasks\UCBrowserUpdaterCore => C:\Program Files (x86)\UCBrowser\Application\update_task.exe [2016-10-31] (UCWeb Inc) <==== ACHTUNG
Task: {64AAF96A-BD92-463B-BE03-B8B88DC23005} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {7A34A017-10ED-43F4-B3ED-275D45FE199B} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {826CF2EA-D0DF-45E0-AF6A-95816F289396} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {96B2DA81-9A99-40BB-AC28-1AA2DB91F55E} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {99363A44-6DEC-4356-B050-29265EFD2B77} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {9DC45D87-CD47-4FF5-B828-8EEAA989237A} - System32\Tasks\Cwspgajother Provider => C:\Program Files (x86)\Phowert\steiing.exe [2016-11-04] (Glarysoft Ltd)
Task: {A392F5FC-6486-4E05-AEBD-55CDEC33D22A} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {A54A7010-1548-4C4B-A473-6223323ADCC3} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG
Task: {A8B04EAC-2AF5-4B8A-86CA-687A402989E2} - System32\Tasks\UCBrowserUpdater => C:\Program Files (x86)\UCBrowser\Application\update_task.exe [2016-10-31] (UCWeb Inc) <==== ACHTUNG
Task: {D082025C-E335-415A-A00D-C3591ED52A58} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {D274DC96-E8BC-4642-92F0-F538D9913564} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Unlock: C:\Program Files (x86)\UCBrowser
C:\Program Files (x86)\UCBrowser
CMD: type "C:\iexplore.bat"
C:\iexplore.bat
CMD: type "C:\launcher.bat"
C:\launcher.bat
CMD: type "C:\Users\Benjamin\AppData\Roaming\2.txt"
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Int?rn?t ??pl?r?r.lnk -> C:\iexplore.bat ()
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\L?un?h Int?rn?t ??pl?r?r ?r?ws?r.lnk -> C:\iexplore.bat ()
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\G??gl? ?hr?m?.lnk -> C:\Program Files (x86)\Google\chrome.bat (Keine Datei)
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Int?rn?t ??pl?r?r.lnk -> C:\iexplore.bat ()
ShortcutWithArgument: C:\Users\Benjamin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js command prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation) -> /k "C:\Program Files\nodejs\nodevars.bat"
Unlock: C:\Program Files\nodejs
C:\Program Files\nodejs
AlternateDataStreams: C:\Windows:nlsPreferences [386]
AlternateDataStreams: C:\WINDOWS\system32\drivers:ucdrv-x64.sys [80850]
AlternateDataStreams: C:\WINDOWS\system32\drivers:x64 [360536]
AlternateDataStreams: C:\WINDOWS\system32\drivers:x86 [1156450]
RemoveProxy:
CMD: ipconfig /flushdns
CMD: netsh winsock reset
EmptyTemp:
end
FRST udn Fixlist.txt müssen im selben verzeichnis sein oder also beides auf dem desktop |
|
07.11.2016, 16:56
| #11 |
| /// TB-Ausbilder | UCGuard nicht entfernbar und andere Malware Servus, genau das ist die fixlist.txt. die kakuzu.exe nochmal starten und auf den Entfernen-Button drücken. Wenn beides im gleichen Verzeichnis (Desktop) liegt, sollte das klappen. |
|
07.11.2016, 17:01
| #12 |
| | UCGuard nicht entfernbar und andere Malware Log im Anhang. Ich habe den Fehler Mensch gefunden. Ich hatte FRST irrtümlich im Downloadordner. Ich Entschuldige mich schon mal das ich diesen Fehler gemacht habe. Nun wurde die Fixlist.txt auch gelöscht. Denke so hätte es auch sein sollen. |
|
07.11.2016, 17:07
| #13 |
| /// TB-Ausbilder | UCGuard nicht entfernbar und andere Malware Servus, hast du UCBrowser absichtlich installiert oder wie kam das auf deinen Rechner? Kannst du bitte den gleichen Fix jetzt nochmal machen? Und nochmal die Logdatei dazu posten. Dann im Anschluss nochmal FRST so:
|
|
07.11.2016, 17:17
| #14 |
| | UCGuard nicht entfernbar und andere Malware Nein Absichtlich habe ich ihn nicht Installiert. Ich weiß leider auch nicht wie es dazu gekommen ist. Ich habe zuletzt Mods für Landwirtschafts Simulator 17 gesucht und Installiert und später dann gemerkt das irgendwas nicht stimmt. Einer der Mods würde über uploaded.net geladen. Habe Später dann in den Kommentaren der Mod erst gelesen das es mit der Datei wohl Probleme gibt und sich auch jemand was eingefangen hatte. Aber der Defender hatte bei mir nicht angeschlagen. Probleme die derzeit noch Aktuell sind: - Windows startbutton reagiert nicht auf links klick, allerdings auf rechtsklick. - Angeheftete Programme im Startmenü haben bei Rechtsklick kein Menü mehr, außer des Fehlersounds. Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 04-11-2016
durchgeführt von Benjamin (07-11-2016 17:26:08)
Gestartet von C:\Users\Benjamin\Desktop
Windows 10 Home Version 1607 (X64) (2016-08-17 16:33:15)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-3046321304-749213656-246317510-500 - Administrator - Disabled)
Benjamin (S-1-5-21-3046321304-749213656-246317510-1001 - Administrator - Enabled) => C:\Users\Benjamin
DefaultAccount (S-1-5-21-3046321304-749213656-246317510-503 - Limited - Disabled)
Gast (S-1-5-21-3046321304-749213656-246317510-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3046321304-749213656-246317510-1003 - Limited - Enabled)
priva (S-1-5-21-3046321304-749213656-246317510-1006 - Administrator - Enabled)
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
4K Video Downloader (HKLM\...\4K Video DownloaderLatest) (Version: Latest - Franki Hack)
4K Video Downloader 4.1 (HKLM-x32\...\4K Video Downloader_is1) (Version: 4.1.2.2075 - Open Media LLC)
7 Days to Die (HKLM-x32\...\Steam App 251570) (Version: - The Fun Pimps)
7-Zip 15.14 (x64 edition) (HKLM\...\{23170F69-40C1-2702-1514-000001000000}) (Version: 15.14.00.0 - Igor Pavlov)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 3.0.1.88 - Adobe Systems Incorporated)
Adobe Photoshop CC 2014 (HKLM-x32\...\{D7A4F897-B20A-42D0-862D-CB5F6DB7391D}) (Version: 15.2.2 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 5.7.1 64-bit (HKLM\...\{BC86B82C-8C0E-4408-9AC1-6B0F2D636963}) (Version: 5.7.1 - Adobe Systems Incorporated)
AION Free-to-Play (HKLM-x32\...\{82E73E8D-E1E7-45A4-A311-6D31492AA913}_is1) (Version: - Gameforge)
Alcor Micro USB Card Reader (HKLM-x32\...\AmUStor) (Version: 20.2.1245.53580 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 20.2.1245.53580 - Alcor Micro Corp.) Hidden
Amazon Cloud Drive (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\Amazon Cloud Drive) (Version: 3.2.1.29 - Amazon.com, Inc.)
Ansel (Version: 375.70 - NVIDIA Corporation) Hidden
AnyBurn (HKLM-x32\...\AnyBurn) (Version: 3.0 - Power Software Ltd)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
Benutzerhandbücher (x32 Version: 3.0.0.3 - Lenovo) Hidden
Bethesda.net Launcher (HKLM-x32\...\{3448917E-E4FE-4E30-9502-9FD52EABB6F5}_is1) (Version: 1.0 - Bethesda Softworks)
Bitnami WAMP Stack (HKLM-x32\...\Bitnami WAMP Stack 7.0.0beta2-1) (Version: 7.0.0beta2-1 - Bitnami)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Brother MFL-Pro Suite MFC-J5620DW (HKLM-x32\...\{7FC49664-DAA4-4E7C-ADD0-614ABB43691B}) (Version: 1.0.5.0 - Brother Industries, Ltd.)
Brother P-touch Editor 5.1 (HKLM-x32\...\{39270390-A851-4E4B-94A9-D5C468216ED3}) (Version: 5.1.0610 - Brother Industries, Ltd.)
C9 (HKLM-x32\...\C9(Continent of the Ninth Seal)_is1) (Version: - WEBZEN)
Command & Conquer™ Red Alert 2 and Yuri’s Revenge (HKLM-x32\...\{F5275D1C-D133-486D-8F07-D6C571F0A8EC}) (Version: 1.0.0.0 - Electronic Arts, Inc.)
Composer - Php Dependency Manager (HKLM-x32\...\{7315AF68-E777-496A-A6A2-4763A98ED35A}_is1) (Version: - getcomposer.org)
Counter-Strike Nexon: Zombies (HKLM-x32\...\Steam App 273110) (Version: - Nexon)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve)
Creation Kit: Fallout 4 (HKLM-x32\...\Creation Kit: Fallout 4) (Version: - Bethesda Softworks)
Curse (HKLM-x32\...\{1F2611FB-6F69-4AA8-BECD-243BD8CB45F3}) (Version: 6.0.0.0 - Curse)
Curse Client (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\101a9f93b8f0bb6f) (Version: 5.1.1.844 - Curse)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)
CyberLink PowerDirector 10 (Version: 10.0.0.2810 - CyberLink Corp.) Hidden
DayZ (HKLM-x32\...\Steam App 221100) (Version: - Bohemia Interactive)
Dead by Daylight (HKLM\...\Steam App 381210) (Version: - Behaviour Digital Inc.)
Diablo III (HKLM-x32\...\Diablo III) (Version: - Blizzard Entertainment)
Dolby Digital Plus Home Theater (HKLM\...\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.3.2.2 - Dolby Laboratories Inc)
Dragon's Prophet (HKLM-x32\...\{C31556D7-F2B9-4787-B223-F7A035067E89}_is1) (Version: 2.1.1434.29 - Infernum Productions AG)
Dxtory version 2.0.135 (HKLM-x32\...\Dxtory2.0_is1) (Version: 2.0.135 - ExKode Co. Ltd.)
eBlendr Version 2.0.2.60 (HKLM-x32\...\eBlendr_is1) (Version: 2.0.2.60 - H. Brinkhaus Onlineservices)
eMule (HKLM-x32\...\eMule) (Version: - )
Euro Truck Simulator 2 (HKLM\...\Steam App 227300) (Version: - SCS Software)
Euro Truck Simulator 2 (HKLM-x32\...\{1B705E8F-9893-4486-B5D7-4F7FEB9C871E}_is1) (Version: 1.25.2.5 - SCS Software)
EVEREST Home Edition v2.20 (HKLM-x32\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
Fallout 3 - Game of the Year Edition (HKLM-x32\...\Steam App 22370) (Version: - Bethesda Game Studios)
Fallout 4 (HKLM-x32\...\Steam App 377160) (Version: - Bethesda Game Studios)
Fallout Mod Manager 0.12.6 (HKLM-x32\...\Fallout Mod Manager_is1) (Version: - Timeslip, Q)
Fallout: New Vegas (HKLM-x32\...\Steam App 22380) (Version: - Obsidian Entertainment)
Farming Simulator 17 (HKLM\...\Steam App 447020) (Version: - Giants Software)
FileZilla Client 3.22.1 (HKLM-x32\...\FileZilla Client) (Version: 3.22.1 - Tim Kosse)
Flash Decompiler Trillix (HKLM-x32\...\Flash Decompiler Trillix_is1) (Version: 5.3 - Eltima Software)
FlashDevelop (HKLM-x32\...\FlashDevelop) (Version: 5.1.1 - FlashDevelop.org)
FlashFXP 5 (HKLM-x32\...\FlashFXP 5) (Version: 5.0.0.3791 - OpenSight Software LLC)
Fraps (HKLM-x32\...\Fraps) (Version: - )
Gameforge Live 2.0.6 (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 2.0.6 - Gameforge)
Genymotion version 2.5.2 (HKLM\...\{6D180286-D4DF-40EF-9227-923B9C07C08A}_is1) (Version: 2.5.2 - Genymobile)
GIANTS Editor 7.0.2 64-bit (HKLM-x32\...\giants_editor_7.0.2_win64_is1) (Version: 7.0.2 - GIANTS Software GmbH)
GIMP 2.8.16 (HKLM\...\GIMP-2_is1) (Version: 2.8.16 - The GIMP Team)
Git version 1.9.5-preview20150319 (HKLM-x32\...\Git_is1) (Version: 1.9.5-preview20150319 - The Git Development Community)
GitHub (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\5f7eb300e2ea4ebf) (Version: 3.1.1.4 - GitHub, Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 54.0.2840.87 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden
Guild Wars 2 (HKLM-x32\...\Guild Wars 2) (Version: - NCsoft Corporation, Ltd.)
H1Z1 (HKLM-x32\...\Steam App 295110) (Version: - Daybreak Games)
H1Z1: King of the Kill (HKLM-x32\...\Steam App 433850) (Version: - Daybreak Game Company)
Hearthstone Deck Tracker (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\HearthstoneDeckTracker) (Version: 1.0.5 - HearthSim)
Heroes of the Storm (HKLM-x32\...\Heroes of the Storm) (Version: - Blizzard Entertainment)
Hide and Shriek (HKLM\...\Steam App 480430) (Version: - Funcom)
HiDrive (HKLM-x32\...\{88D57A8B-DF01-4C4D-8EF4-289C08BD2F96}) (Version: 4.2.1.0 - STRATO AG)
HP ePrint (HKLM-x32\...\{2794875B-6CCF-48B8-84A5-5B10DB98BEE6}) (Version: 14.0.14176.1823 - Hewlett-Packard)
HP ePrint (HKLM-x32\...\{2dbf7d69-d76e-4907-8ee6-ad90bf62aab7}) (Version: 1.0.7.31082 - HP)
HWiNFO64 Version 5.06 (HKLM\...\HWiNFO64_is1) (Version: 5.06 - Martin Malík - REALiX)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6503.0 - IDT)
Intel Collaborative Processor Performance Control (HKLM-x32\...\0E7DAF70-FB54-4B91-B192-7E771C25AEEB) (Version: 1.0.0.1013 - Intel Corporation)
Intel WiDi Media Share (x32 Version: 1.1.0.0 - Intel Corporation) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4531 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.5.1000 - Intel Corporation)
Intel® WiDi Media Share (HKLM-x32\...\{32d14b1d-18fa-48e7-867d-93b7a72c816a}) (Version: 1.1.0.0 - Intel Corporation)
IsoBuster 3.7 (HKLM-x32\...\IsoBuster_is1) (Version: 3.7 - Smart Projects)
Java 8 Update 77 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218077F0}) (Version: 8.0.770.3 - Oracle Corporation)
Java 8 Update 91 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218091F0}) (Version: 8.0.910.14 - Oracle Corporation)
Java 8 Update 92 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418092F0}) (Version: 8.0.920.14 - Oracle Corporation)
Java SE Development Kit 8 Update 92 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180920}) (Version: 8.0.920.14 - Oracle Corporation)
JetBrains PhpStorm 2016.1 (HKLM-x32\...\PhpStorm 2016.1) (Version: 145.258.2 - JetBrains s.r.o.)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Lenovo EasyCamera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10245 - Realtek Semiconductor Corp.)
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.0.0.2105 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 8.0.0.2105 - CyberLink Corp.) Hidden
Lenovo Photo Master Trial (HKLM-x32\...\{BC94C56A-3649-420C-8756-2ADEBE399D33}) (Version: 2.2.3317.01 Trial - CyberLink Corp.)
Lenovo PowerDVD10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.5630.52 - CyberLink Corp.)
Lenovo PowerDVD10 (x32 Version: 10.0.5630.52 - CyberLink Corp.) Hidden
LibreOffice 5.0.5.2 (HKLM-x32\...\{43D862C3-739D-4FF6-91C0-25612368CC81}) (Version: 5.0.5.2 - The Document Foundation)
Lioncast LK15 Keyboard Driver (HKLM-x32\...\{54C8FBB3-B992-43CB-8F0A-E26228013F88}) (Version: 1.0 - )
Lioncast LM30 Gaming Mouse Version 1.1 (HKLM-x32\...\{BF8BC0AC-979B-4085-8F94-7933AF19CBD2}_is1) (Version: 1.1 - LIONCAST)
Livestreamer 1.12.2 (HKLM-x32\...\Livestreamer) (Version: - )
Logitech Gaming Software 8.58 (HKLM\...\Logitech Gaming Software) (Version: 8.58.183 - Logitech Inc.)
Logitech SetPoint 6.65 (HKLM\...\sp6) (Version: 6.65.62 - Logitech)
LS Mod Manager (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\fee48a2c9be21a28) (Version: 3.0.1.5 - Thomas Müller)
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft Access database engine 2010 (German) (HKLM-x32\...\{90140000-00D1-0407-0000-0000000FF1CE}) (Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{67F42018-F647-4D3C-BE62-F8CB4FE2FCD5}) (Version: 3.5.67.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{887868A2-D6DE-3255-AA92-AA0B5A59B874}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24210 (HKLM-x32\...\{f144e08f-9cbe-4f09-9a8c-f2b858b7ee7f}) (Version: 14.0.24210.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24210 (HKLM-x32\...\{23658c02-145e-483d-ba6b-1eb82c580529}) (Version: 14.0.24210.0 - Microsoft Corporation)
Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}) (Version: 1.20.146.0 - Microsoft)
Mozilla Firefox 46.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 46.0.1 (x86 de)) (Version: 46.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 37.0.1 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MultiBit HD 0.3.0 (HKLM\...\6925-4794-5772-4956) (Version: 0.3.0 - Bitcoin Solutions Ltd)
MySQL Workbench 6.2 CE (HKLM\...\{82D50D82-CAF2-4ABA-8BB7-090668162290}) (Version: 6.2.5 - Oracle Corporation)
Need for Speed™ Most Wanted (HKLM-x32\...\{FB0127F3-985B-44CE-AE29-378CAF60B361}) (Version: 1.5.0.0 - Electronic Arts)
Need for Speed™ Rivals (HKLM-x32\...\{E0A32336-AA27-4053-99B2-C3380B7B95AC}) (Version: 1.4.0.0 - Electronic Arts)
NetBeans IDE 8.0.2 (HKLM-x32\...\nbi-nb-base-8.0.2.0.201411181905) (Version: 8.0.2 - NetBeans.org)
NetStat4Win 1.60 (HKLM\...\NetStat4Win) (Version: - Mirko Böer)
Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.63.3 - Black Tree Gaming)
NifSkope (remove only) (HKLM-x32\...\NifSkope) (Version: - )
Nitro Pro 9 (HKLM\...\{4C32F7E8-A65F-4D3C-9153-9F3B57CB6872}) (Version: 9.0.5.9 - Nitro)
Node.js (HKLM\...\{40435563-20B0-4DA3-8E52-E5BF28ABE5C3}) (Version: 0.12.2 - Joyent, Inc. and other Node contributors)
Nuance PaperPort 12 (HKLM-x32\...\{2A770862-7142-4C77-8117-F933E4110A3F}) (Version: 12.1.0006 - Nuance Communications, Inc.)
Nuance PDF Viewer Plus (HKLM-x32\...\{28656860-4728-433C-8AD4-D1A930437BC8}) (Version: 5.30.3290 - Nuance Communications, Inc)
NVIDIA 3D Vision Treiber 375.70 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 375.70 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.1.0.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.1.0.52 - NVIDIA Corporation)
NVIDIA Grafiktreiber 375.70 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 375.70 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.16.0318 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.16.0318 - NVIDIA Corporation)
NvNodejs (Version: 3.1.0.52 - NVIDIA Corporation) Hidden
NvTelemetry (Version: 1.2.0.0 - NVIDIA Corporation) Hidden
Nylas N1 (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\nylas) (Version: 0.4.5 - Nylas Inc.)
OBS Studio (HKLM-x32\...\OBS Studio) (Version: 0.16.2 - OBS Project)
Onekey Theater (HKLM-x32\...\{91CC5BAE-A098-40D3-A43B-C0DC7CE263FE}) (Version: 3.0.1.2 - Lenovo)
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version: - )
Oracle VM VirtualBox 5.0.20 (HKLM\...\{8209969B-9A31-4021-B0D8-E6F719F7F995}) (Version: 5.0.20 - Oracle Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.8.3.59237 - Electronic Arts, Inc.)
Outlast (HKLM-x32\...\Steam App 238320) (Version: - Red Barrels)
Overwolf (HKLM-x32\...\Overwolf) (Version: 0.99.11.0 - Overwolf Ltd.)
PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 14.00.0000 - Nuance Communications, Inc.)
PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
PhotoScape (HKLM-x32\...\PhotoScape) (Version: - )
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9.141.259 - Google, Inc.)
Pinegrow Web Designer version 2.01 (HKLM-x32\...\Pinegrow Web Designer_is1) (Version: 2.01 - )
PlayClaw 5 fast codec (HKLM-x32\...\PlayClaw 5 fast codec_is1) (Version: 5.5 - )
PlayClaw 5 Plus (HKLM-x32\...\PlayClaw 5 Plus_is1) (Version: 5 - )
Plex Media Server (HKLM-x32\...\{06f702c0-12c1-4d02-a753-2c00d9f1d01e}) (Version: 0.9.1506 - Plex, Inc.)
Plex Media Server (x32 Version: 0.9.1506 - Plex, Inc.) Hidden
Poedit (HKLM-x32\...\{68EB2C37-083A-4303-B5D8-41FA67E50B8F}_is1) (Version: 1.8.7 - Vaclav Slavik)
PosteRazor (HKLM-x32\...\PosteRazor_is1) (Version: 1.5.2 - Alessandro Portale)
Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.0.10525 - CyberLink Corp.)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.305 - Qualcomm Atheros Communications)
Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
Qualcomm Atheros Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.21 - Qualcomm Atheros Inc.)
Razer Synapse (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 1.18.21.27343 - Razer Inc.)
Revo Uninstaller 2.0.1 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.1 - VS Revo Group, Ltd.)
Rocket League (HKLM-x32\...\Steam App 252950) (Version: - Psyonix)
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.16035.2 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.16035.2 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG Mobile Composite Device Software (HKLM\...\SAMSUNG Mobile Composite Device) (Version: - )
SAMSUNG Mobile Modem Driver Set (HKLM\...\SAMSUNG Mobile Modem) (Version: - )
Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version: - )
SAMSUNG Mobile USB Modem 1.0 Software (HKLM\...\SAMSUNG Mobile USB Modem 1.0) (Version: - )
SAMSUNG Mobile USB Modem Software (HKLM\...\SAMSUNG Mobile USB Modem) (Version: - )
Samsung PC Studio 3 (HKLM-x32\...\{C4A4722E-79F9-417C-BD72-8D359A090C97}) (Version: 3.2.2.80601 - Samsung Electronics Co., Ltd.)
Samsung PC Studio 3 (x32 Version: 3.0.0.80601 - Samsung Electronics Co., Ltd.) Hidden
Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.59.0 - Samsung Electronics Co., Ltd.)
Scansoft PDF Professional (x32 Version: - ) Hidden
SeaTools for Windows 1.4.0.2 (HKLM-x32\...\SeaTools for Windows) (Version: 1.4.0.2 - Seagate Technology)
SF-Etikett 13 (HKLM-x32\...\{B3966C9F-E4EC-4AB7-BFF3-8ACFAC844EAC}) (Version: 13.00.000 - Frank Stolzer)
SHIELD Streaming (Version: 7.1.0330 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 3.1.0.52 - NVIDIA Corporation) Hidden
Should I Remove It (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\Should I Remove It 1.0.4) (Version: 1.0.4 - Reason Software Company Inc.)
Should I Remove It (x32 Version: 1.0.4 - Reason Software Company Inc.) Hidden
SketchUp 2015 (HKLM\...\{350488A4-1540-4103-8F01-B27503891EB0}) (Version: 15.3.331 - Trimble Navigation Limited)
Skype™ 7.26 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.26.101 - Skype Technologies S.A.)
Sothink SWF Decompiler (HKLM-x32\...\{BCDB856C-D247-4DEE-9132-89C02F4D6B8C}_is1) (Version: 7.4 - SourceTec Software Co., LTD)
Sothink SWF Editor (HKLM-x32\...\{0BF1DE3D-31B9-417F-A915-4BCC5AAEE3CD}_is1) (Version: 1.3 - SourceTec Software Co., LTD)
SourceTree (HKLM-x32\...\SourceTree 1.6.14) (Version: 1.6.14 - Atlassian)
SourceTree (x32 Version: 1.6.14 - Atlassian) Hidden
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Streamline (HKLM-x32\...\d229a310-2468-4f0c-b49b-4a6dcdd47809) (Version: - PS363)
Sublime Text Build 3065 (HKLM\...\Sublime Text 3_is1) (Version: - Sublime HQ Pty Ltd)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.0.9.5 - Synaptics Incorporated)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
TeamViewer 11 (HKLM-x32\...\TeamViewer) (Version: 11.0.66695 - TeamViewer)
TechPowerUp GPU-Z (HKLM-x32\...\TechPowerUp GPU-Z) (Version: - TechPowerUp)
Telegram Desktop Version 0.7.10 (HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1) (Version: 0.7.10 - Telegram Messenger LLP)
The Crew (Worldwide) (HKLM-x32\...\Uplay Install 413) (Version: - Ubisoft)
The Forest (HKLM-x32\...\Steam App 242760) (Version: - Endnight Games Ltd)
Tom Clancy's Rainbow Six Siege (HKLM-x32\...\Uplay Install 635) (Version: - Ubisoft Montreal)
TortoiseHg 3.3.3 (x64) (HKLM\...\{2A25209F-23B5-4F5F-A484-E7A0C30B5975}) (Version: 3.3.3 - Steve Borho and others)
TruckersMP 0.2.1.2.5 Alpha (HKLM\...\{A227B892-C548-4490-9C5D-DB341F8194A6}_is1) (Version: 0.2.1.2.5 Alpha - TruckersMP Team)
Trust 100K Series Webcam (HKLM-x32\...\{C679F9B9-C65D-4C65-BD6C-BF90B859E281}) (Version: 1.0.4.15 - Trust)
Tukui Client (HKLM-x32\...\{BAD6EBBD-A6A9-41C9-898A-8C868A552E4C}) (Version: 2.4.6 - Tukui)
Twitch Launcher (HKLM-x32\...\Twitch Launcher 1.0.0) (Version: 1.0.0 - Twitch)
Twitch Leecher 1.3.2 (HKLM-x32\...\{90604deb-1435-465e-9485-862937465b6b}) (Version: 1.3.2.0 - Fake Smile Revolution)
Twitch Leecher 1.3.2 (Version: 1.3.2.0 - Fake Smile Revolution) Hidden
UnderCover10 2.03 (HKLM-x32\...\UnderCover10_is1) (Version: - Wicked & Wild Inc.)
Uplay (HKLM-x32\...\Uplay) (Version: 21.1 - Ubisoft)
User Manuals (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 3.0.0.3 - Lenovo)
Vagrant (HKLM-x32\...\{DBD58741-B374-4518-B0F7-8F33D09E3164}) (Version: 1.8.1 - HashiCorp)
Vanilla DayZmod Launcher (HKLM-x32\...\{2F318942-6CAC-4D3C-AA18-259B8C5600EE}_is1) (Version: 1.0.4 - AmberHelios)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.3 - VideoLAN)
Vulkan Run Time Libraries 1.0.26.0 (HKLM\...\VulkanRT1.0.26.0) (Version: 1.0.26.0 - LunarG, Inc.)
Vulkan Run Time Libraries 1.0.3.0 (HKLM\...\VulkanRT1.0.3.0) (Version: 1.0.3.0 - LunarG, Inc.)
Windows-Treiberpaket - Dimension Engineering USB Serial Converter (11/12/2015 1.0.3.13) (HKLM\...\32A12E2F88EE40BDBADBB41ECCB8559DEE67F7A3) (Version: 11/12/2015 1.0.3.13 - Dimension Engineering)
WinRAR 5.31 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.31.0 - win.rar GmbH)
World of Warcraft (HKLM-x32\...\World of Warcraft) (Version: - Blizzard Entertainment)
WYSIWYG Web Builder 10 (HKLM-x32\...\WYSIWYG_Web_Builder_10) (Version: - )
XAMPP (HKLM-x32\...\xampp) (Version: 5.6.21-0 - Bitnami)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-3046321304-749213656-246317510-1001_Classes\CLSID\{33C169DA-833A-456A-9059-F3D6D429ED42}\InprocServer32 -> C:\WINDOWS\system32\timedate.cpl (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3046321304-749213656-246317510-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Benjamin\AppData\Local\Microsoft\OneDrive\17.3.6381.0405\FileCoAuth.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3046321304-749213656-246317510-1001_Classes\CLSID\{ca586c80-7c84-4b88-8537-726724df6929}\InprocServer32 -> C:\Program Files (x86)\Git\git-cheetah\git_shell_ext64.dll ()
CustomCLSID: HKU\S-1-5-21-3046321304-749213656-246317510-1001_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
CustomCLSID: HKU\S-1-5-21-3046321304-749213656-246317510-1001_Classes\CLSID\{ecfae962-f1ac-499d-a4e9-3eec574033d8}\InprocServer32 -> C:\WINDOWS\system32\dfshim.dll (Microsoft Corporation)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {09C19643-230A-4D8C-A476-C9748F3E0760} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2016-10-25] (NVIDIA Corporation)
Task: {239108FA-ADB7-43A4-9BF6-8674581B4641} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2016-10-25] (NVIDIA Corporation)
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\WINDOWS\System32\AutoWorkplace.exe
Task: {41CECE4F-3BE9-4752-8C1E-BF27E58428A8} - System32\Tasks\PDVDServ Task => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.EXE [2013-03-08] (CyberLink Corp.)
Task: {4DF13BBA-9FFD-48E0-93AD-3EADE7C6B18B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {548B1208-8B1A-4755-BA2F-F879AF00D78C} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {5A3D076E-4860-4BEB-9F01-29C47D023B28} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {67265F0E-F9EA-4783-A6DC-099E6F1CDE42} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2016-10-25] (NVIDIA Corporation)
Task: {6E4FA571-8BCF-4512-89EE-E03C92BD34A1} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-10-11] (Microsoft Corporation)
Task: {75196BBE-3737-4678-AE57-464270E71418} - \090814979df9a1cbff315bc3871a6032 -> Keine Datei <==== ACHTUNG
Task: {83DB1462-D709-4D90-AF96-587D1CC5676A} - System32\Tasks\Overwolf Updater Task => C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [2016-10-30] (Overwolf LTD)
Task: {8B599AAE-2D21-421A-824F-D21139601E27} - System32\Tasks\CyberLink\Photo Master Gadget startup => C:\Program Files (x86)\Lenovo\Lenovo Photo Master\PhotoMasterWorker.exe [2015-09-17] (CyberLink Corp.)
Task: {8EE9593D-A158-457B-AECD-8DB785316ED5} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2016-10-25] (NVIDIA Corporation)
Task: {A1C858F2-D3C0-4A7D-86C0-B8524A5EFD60} - System32\Tasks\AdobeAAMUpdater-1.0-MicrosoftAccount-pandory@outlook.de => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2015-03-30] (Adobe Systems Incorporated)
Task: {A71A91F7-F713-455E-8C89-857AF9816B51} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2016-10-25] (NVIDIA Corporation)
Task: {B24FF775-0247-4A53-8D67-9BB4BA20F0E4} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {DCD3F4CA-2722-41AE-8AF5-4061C951D0D8} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2016-10-25] (NVIDIA Corporation)
Task: {DEE81BB9-0E5F-4A5E-9A82-18C6FF7F3472} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {F5486DC8-52DD-4D86-AA31-237997D44139} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intеrnеt Ехplоrеr.lnk -> C:\iexplore.bat (Keine Datei)
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Lаunсh Intеrnеt Ехplоrеr Вrоwsеr.lnk -> C:\iexplore.bat (Keine Datei)
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Gооglе Сhrоmе.lnk -> C:\Program Files (x86)\Google\chrome.bat (Keine Datei)
Shortcut: C:\Users\Benjamin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Intеrnеt Ехplоrеr.lnk -> C:\iexplore.bat (Keine Datei)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2016-07-16 12:42 - 2016-07-16 12:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-09-29 22:11 - 2016-09-15 18:25 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2015-02-23 12:36 - 2013-06-17 17:40 - 00035944 _____ () C:\WINDOWS\system32\ddmon4-64x.dll
2016-05-28 23:29 - 2016-03-24 04:20 - 11583304 _____ () C:\xampp\mysql\bin\mysqld.exe
2015-12-31 13:31 - 2005-04-22 05:36 - 00143360 ____R () C:\WINDOWS\system32\BrSNMP64.dll
2014-11-26 02:03 - 2012-04-25 03:43 - 00390632 ____N () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2016-09-08 19:25 - 2016-10-25 21:21 - 01148984 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\libprotobuf.dll
2016-09-08 19:25 - 2016-10-25 21:21 - 04490808 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\Poco.dll
2016-09-08 19:25 - 2016-10-25 21:21 - 00420408 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\plugins\LocalSystem\_nvspserviceplugin64.dll
2015-08-02 10:53 - 2015-05-05 12:35 - 11048960 _____ () C:\Bitnami\wampstack-7.0.0beta2-1\mysql\bin\mysqld.exe
2015-06-23 20:11 - 2015-06-23 20:11 - 00187048 _____ () C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
2016-08-17 16:53 - 2016-10-25 21:17 - 00133056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2016-09-29 22:11 - 2016-09-15 18:25 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2015-04-16 16:42 - 2015-04-16 16:42 - 00997536 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
2016-08-18 02:00 - 2016-08-18 02:00 - 00959168 _____ () C:\Users\Benjamin\AppData\Local\Microsoft\OneDrive\17.3.6381.0405\amd64\ClientTelemetry.dll
2015-06-01 16:03 - 2015-03-19 22:33 - 00736962 _____ () C:\Program Files (x86)\Git\git-cheetah\git_shell_ext64.dll
2014-09-18 08:23 - 2014-09-18 08:23 - 00866584 _____ () C:\Program Files\Logitech Gaming Software\libGLESv2.dll
2015-03-12 19:23 - 2015-03-12 19:23 - 01050904 _____ () C:\Program Files\Logitech Gaming Software\platforms\qwindows.dll
2014-09-18 08:23 - 2014-09-18 08:23 - 00059160 _____ () C:\Program Files\Logitech Gaming Software\libEGL.dll
2015-03-12 19:23 - 2015-03-12 19:23 - 00242456 _____ () C:\Program Files\Logitech Gaming Software\imageformats\qjpeg.dll
2016-10-13 15:31 - 2016-10-13 15:31 - 06673568 _____ () C:\Users\Benjamin\AppData\Roaming\STRATO\HiDrive\HiDrive.App.exe
2015-08-02 10:53 - 2015-07-21 14:17 - 00409600 _____ () C:\Bitnami\WAMPST~1.0BE\apache2\bin\pcre.dll
2015-08-02 10:53 - 2015-07-21 14:23 - 00071680 _____ () C:\Bitnami\WAMPST~1.0BE\apache2\bin\zlib1.dll
2015-08-02 10:53 - 2015-07-23 21:39 - 00121856 _____ () C:\Bitnami\wampstack-7.0.0beta2-1\php\libpq.dll
2015-08-02 10:57 - 2015-07-23 21:39 - 00168960 _____ () C:\Bitnami\WAMPST~1.0BE\apache2\bin\libssh2.dll
2015-04-15 17:36 - 2016-10-25 21:21 - 00020536 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2016-09-13 15:04 - 2015-09-17 11:31 - 00875960 _____ () C:\Program Files (x86)\Lenovo\Lenovo Photo Master\subsys\Kernel\Boomerang\UNO.dll
2016-09-13 15:03 - 2015-09-17 11:01 - 00081920 _____ () C:\Program Files (x86)\Lenovo\Lenovo Photo Master\koan\_ctypes.pyd
2016-08-18 02:00 - 2016-08-18 02:00 - 00679624 _____ () C:\Users\Benjamin\AppData\Local\Microsoft\OneDrive\17.3.6381.0405\ClientTelemetry.dll
2016-11-03 02:05 - 2016-10-31 06:29 - 01819240 _____ () C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.87\libglesv2.dll
2016-11-03 02:05 - 2016-10-31 06:29 - 00093288 _____ () C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.87\libegl.dll
2016-10-13 15:31 - 2016-10-13 15:31 - 01035936 _____ () C:\Users\Benjamin\AppData\Roaming\STRATO\HiDrive\CefSharp.Core.dll
2016-10-13 15:31 - 2016-10-13 15:31 - 48943768 _____ () C:\Users\Benjamin\AppData\Roaming\STRATO\HiDrive\libcef.dll
2014-11-26 01:20 - 2013-09-04 16:53 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2016-10-26 15:34 - 2016-10-24 10:03 - 17771200 _____ () C:\Users\Benjamin\AppData\Local\Google\Chrome\User Data\PepperFlash\23.0.0.205\pepflashplayer.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2013-08-22 14:25 - 2016-11-05 04:28 - 00000832 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-3046321304-749213656-246317510-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Benjamin\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\img13.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
MSCONFIG\Services: BEService => 3
HKLM\...\StartupApproved\StartupFolder: => "PydioSync.lnk"
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKLM\...\StartupApproved\Run: => "IAStorIcon"
HKLM\...\StartupApproved\Run: => "HotKeysCmds"
HKLM\...\StartupApproved\Run: => "SysTrayApp"
HKLM\...\StartupApproved\Run: => "IgfxTray"
HKLM\...\StartupApproved\Run: => "Energy Manager"
HKLM\...\StartupApproved\Run: => "OnekeyStudio"
HKLM\...\StartupApproved\Run: => "Lenovo Utility"
HKLM\...\StartupApproved\Run: => "ShadowPlay"
HKLM\...\StartupApproved\Run: => "Persistence"
HKLM\...\StartupApproved\Run: => "RtsFT"
HKLM\...\StartupApproved\Run: => "SynTPEnh"
HKLM\...\StartupApproved\Run: => "EvtMgr6"
HKLM\...\StartupApproved\Run: => "AdobeAAMUpdater-1.0"
HKLM\...\StartupApproved\Run: => "PAC207_Monitor"
HKLM\...\StartupApproved\Run: => "TortoiseHgOverlayIconServer"
HKLM\...\StartupApproved\Run: => "XboxStat"
HKLM\...\StartupApproved\Run: => "WindowsDefender"
HKLM\...\StartupApproved\Run32: => "UpdateP2GShortCut"
HKLM\...\StartupApproved\Run32: => "Adobe Creative Cloud"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "PDFPrint"
HKLM\...\StartupApproved\Run32: => "vmware-tray.exe"
HKLM\...\StartupApproved\Run32: => "Razer Synapse"
HKLM\...\StartupApproved\Run32: => "LCgmmouseRun"
HKLM\...\StartupApproved\Run32: => "Lioncast LK15 Keyboard Driver"
HKLM\...\StartupApproved\Run32: => "BrHelp"
HKLM\...\StartupApproved\Run32: => "BrStsMon00"
HKLM\...\StartupApproved\Run32: => "ControlCenter4"
HKLM\...\StartupApproved\Run32: => "PDF5 Registry Controller"
HKLM\...\StartupApproved\Run32: => "PDFHook"
HKLM\...\StartupApproved\Run32: => "PaperPort PTD"
HKLM\...\StartupApproved\Run32: => "IndexSearch"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\StartupFolder: => "CurseClientStartup.ccip"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\StartupFolder: => "Logitech blank Produktregistrierung.lnk"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\StartupFolder: => "Curse.lnk"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "Battle.net"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "deskPDF Creator"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "GoogleChromeAutoLaunch_2CB4D10DAD5AE20CADEFA2B4E24F69E5"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "Steam"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "EADM"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "Overwolf"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "ISUSPM"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "Amazon Cloud Drive"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "Plex Media Server"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "TSMApplication"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "Dxtory Update Checker 2.0"
HKU\S-1-5-21-3046321304-749213656-246317510-1001\...\StartupApproved\Run: => "World of Tanks"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [TCP Query User{0C343DB2-595E-4609-91E0-5FBBBCFD66D0}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [UDP Query User{73BF8670-C78B-4344-8F68-D8CCCA0CDD28}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [{541B8CF6-0579-48D8-B589-F5BE8EA3D4AE}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{09DC59C6-C561-4CFA-B014-880C8D701F3A}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{791D5014-C773-469D-888A-EA064D95FBEC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Forest\TheForest.exe
FirewallRules: [{A6EEA21D-E1B9-48F3-BA22-4B4DD3658920}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Forest\TheForest.exe
FirewallRules: [{BAEC0A83-AC21-401C-954A-85B3CF8D2CAD}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\NvContainer.exe
FirewallRules: [{FE443B3A-5295-46DE-BFC1-0149E7ED415B}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\NvContainer.exe
FirewallRules: [{DABEC3FA-F3BC-4EDD-852C-A26CD2F4ECCD}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{8F65F44C-4088-4B8E-9E52-16B39816EE82}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{AF3F8ADC-663D-42D2-9432-0FF78B92924F}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{24C14A46-60C8-4E01-A678-D16C19606CA3}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Farming Simulator 17\x64\FarmingSimulator2017Game.exe
FirewallRules: [{A6439C3D-BC7F-43D6-8461-ECC12F53AE87}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Farming Simulator 17\x64\FarmingSimulator2017Game.exe
FirewallRules: [{7B9BE528-FD6F-49CF-AAE6-02D4629E98E3}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Farming Simulator 17\x86\FarmingSimulator2017Game.exe
FirewallRules: [{934D007C-8D8F-49B9-9AC4-72DED6B4E510}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Farming Simulator 17\x86\FarmingSimulator2017Game.exe
==================== Wiederherstellungspunkte =========================
06-11-2016 01:11:15 Installed Should I Remove It
06-11-2016 01:23:21 Removed VPNAutoconnect
06-11-2016 01:25:27 Removed PydioSync
06-11-2016 23:37:58 JRT Pre-Junkware Removal
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (11/07/2016 05:28:14 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PANDORY)
Description: Bei der Aktivierung der App „Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (11/07/2016 05:28:12 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PANDORY)
Description: Bei der Aktivierung der App „Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (11/07/2016 05:28:12 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ShellExperienceHost.exe, Version: 10.0.14393.187, Zeitstempel: 0x57cf9d73
Name des fehlerhaften Moduls: ShellExperienceHost.exe, Version: 10.0.14393.187, Zeitstempel: 0x57cf9d73
Ausnahmecode: 0xc000027b
Fehleroffset: 0x0000000000022e37
ID des fehlerhaften Prozesses: 0x1e3c
Startzeit der fehlerhaften Anwendung: 0x01d23913ef3c56bc
Pfad der fehlerhaften Anwendung: C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
Pfad des fehlerhaften Moduls: C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
Berichtskennung: 30ed1686-cb7c-4669-a427-caed2bcfa183
Vollständiger Name des fehlerhaften Pakets: Microsoft.Windows.ShellExperienceHost_10.0.14393.206_neutral_neutral_cw5n1h2txyewy
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App
Error: (11/07/2016 05:28:11 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ShellExperienceHost.exe, Version: 10.0.14393.187, Zeitstempel: 0x57cf9d73
Name des fehlerhaften Moduls: ShellExperienceHost.exe, Version: 10.0.14393.187, Zeitstempel: 0x57cf9d73
Ausnahmecode: 0xc000027b
Fehleroffset: 0x0000000000022e37
ID des fehlerhaften Prozesses: 0x2444
Startzeit der fehlerhaften Anwendung: 0x01d23913ee8078b4
Pfad der fehlerhaften Anwendung: C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
Pfad des fehlerhaften Moduls: C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
Berichtskennung: 3bf383e3-a03e-4f5f-90b3-b03469546815
Vollständiger Name des fehlerhaften Pakets: Microsoft.Windows.ShellExperienceHost_10.0.14393.206_neutral_neutral_cw5n1h2txyewy
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App
Error: (11/07/2016 05:28:11 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PANDORY)
Description: Bei der Aktivierung der App „Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (11/07/2016 05:28:10 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PANDORY)
Description: Bei der Aktivierung der App „Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (11/07/2016 05:28:10 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ShellExperienceHost.exe, Version: 10.0.14393.187, Zeitstempel: 0x57cf9d73
Name des fehlerhaften Moduls: ShellExperienceHost.exe, Version: 10.0.14393.187, Zeitstempel: 0x57cf9d73
Ausnahmecode: 0xc000027b
Fehleroffset: 0x0000000000022e37
ID des fehlerhaften Prozesses: 0x468
Startzeit der fehlerhaften Anwendung: 0x01d23913ed97e074
Pfad der fehlerhaften Anwendung: C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
Pfad des fehlerhaften Moduls: C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
Berichtskennung: 7b1bc71d-49c8-4780-932b-b1f2b534f7f2
Vollständiger Name des fehlerhaften Pakets: Microsoft.Windows.ShellExperienceHost_10.0.14393.206_neutral_neutral_cw5n1h2txyewy
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App
Error: (11/07/2016 05:28:08 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PANDORY)
Description: Bei der Aktivierung der App „Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (11/07/2016 05:28:08 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ShellExperienceHost.exe, Version: 10.0.14393.187, Zeitstempel: 0x57cf9d73
Name des fehlerhaften Moduls: ShellExperienceHost.exe, Version: 10.0.14393.187, Zeitstempel: 0x57cf9d73
Ausnahmecode: 0xc000027b
Fehleroffset: 0x0000000000022e37
ID des fehlerhaften Prozesses: 0x638
Startzeit der fehlerhaften Anwendung: 0x01d23913ece31e9f
Pfad der fehlerhaften Anwendung: C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
Pfad des fehlerhaften Moduls: C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
Berichtskennung: f3781707-ec65-4e5f-ab80-06b454aad3a6
Vollständiger Name des fehlerhaften Pakets: Microsoft.Windows.ShellExperienceHost_10.0.14393.206_neutral_neutral_cw5n1h2txyewy
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App
Error: (11/07/2016 05:28:07 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PANDORY)
Description: Bei der Aktivierung der App „Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Systemfehler:
=============
Error: (11/07/2016 05:28:14 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "App" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/07/2016 05:28:12 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "App" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/07/2016 05:28:11 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "App" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/07/2016 05:28:10 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "App" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/07/2016 05:28:08 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "App" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/07/2016 05:28:07 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "App" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/07/2016 05:28:06 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "App" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/07/2016 05:28:05 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "App" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/07/2016 05:28:03 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "App" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (11/07/2016 05:28:02 PM) (Source: DCOM) (EventID: 10010) (User: PANDORY)
Description: Der Server "CortanaUI" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
CodeIntegrity:
===================================
Date: 2016-11-06 02:22:13.019
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_463df33ecac6d590\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-11-05 03:35:30.918
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\winhttp.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-11-05 03:35:30.893
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\winhttp.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-10-30 01:17:17.435
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_463df33ecac6d590\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-10-25 20:44:54.114
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_463df33ecac6d590\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-10-16 01:16:37.295
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_0326b872c1b453bb\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-10-12 22:00:50.316
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_0326b872c1b453bb\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-10-01 02:15:54.025
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_37b47f49d2675149\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-09-25 22:05:54.353
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\nvlti.inf_amd64_37b47f49d2675149\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-09-20 20:22:29.840
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i5-4210M CPU @ 2.60GHz
Prozentuale Nutzung des RAM: 24%
Installierter physikalischer RAM: 12212.27 MB
Verfügbarer physikalischer RAM: 9236.79 MB
Summe virtueller Speicher: 14068.27 MB
Verfügbarer virtueller Speicher: 10532.55 MB
==================== Laufwerke ================================
Drive c: (Windows8_OS) (Fixed) (Total:889.91 GB) (Free:224.31 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:22 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 6D82B2C4)
Partition: GPT.
==================== Ende von Addition.txt ============================
Geändert von kakuzu (07.11.2016 um 17:30 Uhr) |
|
07.11.2016, 18:06
| #15 |
| /// TB-Ausbilder | UCGuard nicht entfernbar und andere Malware Servus, es sieht schon deutlich besser aus, gibt aber noch einiges zu tun. Ich will zuerst sämtliche Malware finden und entfernen, danach versuchen wir noch zu reparieren. Schritt 1
Schritt 2 Wir müssen Google Chrome komplett deinstallieren, da es noch infiziert ist.
Schritt 3 Downloade dir bitte Shortcut Cleaner (by Grinler) auf deinen Desktop.
Schritt 4 Lade dir die passende Version von SystemLook vom folgenden Spiegel herunter und speichere das Tool auf dem Desktop: SystemLook (32 bit) | SystemLook (64 bit)
Schritt 5
Bitte poste mit deiner nächsten Antwort
|
|
| Themen zu UCGuard nicht entfernbar und andere Malware |
| appdata, bericht, button, cid, code, dateien, defender, dll, entfernen, firefox, google, home, hängt, infizierte, lösung, malware, microsoft, ordner, rechner, registry, secure, server, software, windows, wmi |
Linear-Darstellung
