Hi.
Würde das Problem gerne finden, da es (nach meiner Suche) im Netz nirgends beschrieben steht (ich nicht gefunden habe).
Ich wählte den Titel, weil ich genau danach gesucht aber nichts gefunden habe.

Generell habe ich ein sauberes Backup des PCs (Win 8.1 pro), das ich auch gestern aufspielte, da ich aus irgendeinem Grund kein Laufwerk der DS mehr einbinden konnte.

Danach erneuerte/aktualisierte ich so einiges und spielte auch manches zusätzlich drauf:
(Aktualisierungen fanden nach Empfehlung von AVIRA Software Updater statt)
IObit nehme ich lieber nicht mehr.

Dieses Backup möchte ich aber noch nicht gleich wieder aufsetzen, sondern erstmal dieses komische Verhalten melden und evtl den Bösewicht finden.

Leider hat es mir den Lap ebenso befallen. Irgendeine Software. die ich bei beiden nutze/aktualisierte macht das wohl.

Die Ordner lassen sich löschen. Erstellen sich aber gleich wieder selbst in den gleichen Verzeichnissen.

Wie schlimm kann es sein? Ich muss nämlich weiter mit dem PC arbeiten und will mir die DS nicht auch noch versauen.

Zuerst: (Anhänge ging leider nicht besser eindeutig zu zeigen/erklären)
Anhang 1 zusätzlich neu aufgespielte Software und Aktualisierungen
Anhang 2-4 Seltsame Ordner 1 - 3
Anhang 5-6 Die seltsamen Dateien in den seltsamen Ordnern benennen sich jedesmal anders.
Anhang 7 Diese seltsamen ntuser-Dateien haben mit dem eigentlichen Problem wohl eher nichts zu tun und sind mir nur zusätzlich aufgefallen.

Zuerst FRST
Addition, Avira und Malware muss ich nachtränglich posten. Alles viel zu lang.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 18-07-2017
Ran by *WIR* (ATTENTION: The user is not administrator) on PC-PC (22-07-2017 12:34:02)
Running from C:\Users\*WIR*\Desktop
Loaded Profiles: *WIR* (Available Profiles: Pc & *WIR* & j***** & test)
Platform: Windows 8.1 Pro (Update) (X64) Language: Englisch (Vereinigte Staaten)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

Failed to access process -> smss.exe
Failed to access process -> csrss.exe
Failed to access process -> wininit.exe
Failed to access process -> csrss.exe
Failed to access process -> services.exe
Failed to access process -> lsass.exe
Failed to access process -> winlogon.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> dwm.exe
Failed to access process -> atiesrxx.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> atieclxx.exe
Failed to access process -> svchost.exe
Failed to access process -> SbieSvc.exe
Failed to access process -> svchost.exe
Failed to access process -> spoolsv.exe
Failed to access process -> sched.exe
Failed to access process -> winwfpmonitor.exe
Failed to access process -> conhost.exe
Failed to access process -> svchost.exe
Failed to access process -> schedul2.exe
Failed to access process -> armsvc.exe
Failed to access process -> afcdpsrv.exe
Failed to access process -> Fuel.Service.exe
Failed to access process -> avguard.exe
Failed to access process -> Avira.VpnService.exe
Failed to access process -> Avira.SoftwareUpdater.ServiceHost.exe
Failed to access process -> officeclicktorun.exe
Failed to access process -> CybereasonRansomFreeServiceHost.exe
Failed to access process -> svchost.exe
Failed to access process -> dasHost.exe
Failed to access process -> app_updater.exe
Failed to access process -> DTSU2PAuSrv64.exe
Failed to access process -> LiveUpdate.exe
Failed to access process -> creator-ws.exe
Failed to access process -> Architect Manager.exe
Failed to access process -> Avira.SystemSpeedup.SpeedupService.exe
Failed to access process -> svchost.exe
Failed to access process -> TeamViewer_Service.exe
Failed to access process -> McAfee.TrueKey.Service.exe
Failed to access process -> McTkSchedulerService.exe
Failed to access process -> UsbClientService.exe
Failed to access process -> Avira.ServiceHost.exe
Failed to access process -> MBAMService.exe
Failed to access process -> WmiPrvSE.exe
Failed to access process -> avshadow.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> WUDFHost.exe
Failed to access process -> WUDFHost.exe
Failed to access process -> svchost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.Systray.exe
(Cybereason) C:\Program Files (x86)\Cybereason\RansomFree\CybereasonRansomFree.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
Failed to access process -> dllhost.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
Failed to access process -> tv_w32.exe
Failed to access process -> tv_x64.exe
Failed to access process -> SearchIndexer.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\cnext.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Duplicati Team) C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
() C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr Inc\Raptr\raptr.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr Inc\Raptr\raptr_im.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
Failed to access process -> HPSupportSolutionsFrameworkService.exe
(Raptr Inc.) C:\Program Files (x86)\Raptr Inc\Raptr\raptr_ep64.exe
Failed to access process -> taskhost.exe
Failed to access process -> mobile_backup_server.exe
Failed to access process -> mobile_backup_status_server.exe
Failed to access process -> syncagentsrv.exe
Failed to access process -> wmpnetwk.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
Failed to access process -> taskeng.exe
Failed to access process -> AutoPico.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\cnext.exe [4926664 2016-02-26] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [Seagate Scheduler2 Service] => "C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedhlp.exe"
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8484056 2015-06-12] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_DTS] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1393880 2015-04-28] (Realtek Semiconductor)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [585240 2016-09-13] ()
HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [163800 2016-07-30] (IvoSoft)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [3146704 2017-05-09] (Malwarebytes)
HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [425352 2016-06-03] (Acronis International GmbH)
HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [97512 2017-06-13] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [918008 2017-07-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [3191728 2017-06-09] (Dominik Reichl)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [4654664 2016-09-13] ()
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [210432 2016-07-05] (Geek Software GmbH)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr Inc\Raptr\raptrstub.exe [58584 2017-05-30] (Raptr, Inc)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-07-12] (Oracle Corporation)
HKLM-x32\...\Run: [Avira System Speedup User Starter] => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe [66656 2017-06-28] (Avira Operations GmbH & Co. KG)
HKLM\...\RunOnce: [PDFCreatorRestart] => [X]
HKU\S-1-5-21-223189139-1834683237-3245993289-1002\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-223189139-1834683237-3245993289-1002\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27784672 2017-06-27] (Skype Technologies S.A.)
HKU\S-1-5-21-223189139-1834683237-3245993289-1002\...\Run: [GIMP Updater] => C:\Users\*WIR*\AppData\Roaming\GIMP Updater\Updater.exe [227488 2016-10-09] ()
HKU\S-1-5-21-223189139-1834683237-3245993289-1002\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [798352 2016-09-22] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-223189139-1834683237-3245993289-1002\...\Run: [GoogleChromeAutoLaunch_E702579D22BBCD5513EBCBD038CBA7E5] => "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window /prefetch:5
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE -> 
Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter "C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Duplicati 2.lnk [2017-07-21]
ShortcutTarget: Duplicati 2.lnk -> C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe (Duplicati Team)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\E-POST CLOUD.lnk [2016-10-02]
ShortcutTarget: E-POST CLOUD.lnk -> C:\Program Files (x86)\E-POST\EPostCloud.exe (Deutsche Post AG)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\E-POST MAILER.lnk [2016-10-02]
ShortcutTarget: E-POST MAILER.lnk -> C:\Program Files (x86)\E-POST\EpostMailer.exe (Deutsche Post AG))
Startup: C:\Users\*WIR*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2016-11-23]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
BootExecute: autocheck autochk * auto_reactivate C:\bootwiz\asrm.bin

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\..\Interfaces\{CFEF567D-2932-4AFD-94FE-266AF7F6A876}: [NameServer] 192.168.10.1

Internet Explorer:
==================
HKU\S-1-5-21-223189139-1834683237-3245993289-1002\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/el-gr/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-223189139-1834683237-3245993289-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: True Key Helper -> {0F4B8786-5502-4803-8EBC-F652A1153BB6} -> C:\Program Files\Intel Security\True Key\MSIE\truekey_ie64.dll [2017-06-26] (Intel Security)
BHO: No Name -> {13D67BB7-DB5F-48AA-884D-7A5D94168509} -> No File
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
BHO-x32: True Key Helper -> {0F4B8786-5502-4803-8EBC-F652A1153BB6} -> C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2017-06-26] (Intel Security)
BHO-x32: No Name -> {13D67BB7-DB5F-48AA-884D-7A5D94168509} -> No File
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\OCHelper.dll [2017-07-21] (Microsoft Corporation)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_141\bin\ssv.dll [2017-07-21] (Oracle Corporation)
BHO-x32: PDF Architect 5 Helper -> {AEA429F3-D2D4-4BD7-A03E-5357DA017733} -> C:\Program Files (x86)\PDF Architect 5\creator-ie-helper.dll [2017-07-05] (pdfforge GmbH)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\GROOVEEX.DLL [2017-07-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_141\bin\jp2ssv.dll [2017-07-21] (Oracle Corporation)
Toolbar: HKLM - True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie64.dll [2017-06-26] (Intel Security)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
Toolbar: HKLM-x32 - True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2017-06-26] (Intel Security)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)
Toolbar: HKLM-x32 - PDF Architect 5 Toolbar - {84F23192-A475-4038-B5C0-8584777F2DF4} - C:\Program Files (x86)\PDF Architect 5\creator-ie-plugin.dll [2017-07-05] (pdfforge GmbH)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2016-10-06] (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\MSOSB.DLL [2016-10-06] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\*WIR*\AppData\Roaming\Mozilla\Firefox\Profiles\nfouucwg.default-1475888009370 [2017-07-22]
FF Extension: (QuickFox Notes) - C:\Users\*WIR*\AppData\Roaming\Mozilla\Firefox\Profiles\nfouucwg.default-1475888009370\Extensions\amin.eft_bmnotes@gmail.com [2016-10-21]
FF Extension: (OneTab) - C:\Users\*WIR*\AppData\Roaming\Mozilla\Firefox\Profiles\nfouucwg.default-1475888009370\Extensions\extension@one-tab.com.xpi [2016-10-30]
FF Extension: (YouTube Video and Audio Downloader) - C:\Users\*WIR*\AppData\Roaming\Mozilla\Firefox\Profiles\nfouucwg.default-1475888009370\Extensions\feca4b87-3be4-43da-a1b1-137c24220968@jetpack.xpi [2017-07-21]
FF Extension: (Xmarks) - C:\Users\*WIR*\AppData\Roaming\Mozilla\Firefox\Profiles\nfouucwg.default-1475888009370\Extensions\foxmarks@kei.com [2017-07-21]
FF Extension: (Media Converter and Muxer) - C:\Users\*WIR*\AppData\Roaming\Mozilla\Firefox\Profiles\nfouucwg.default-1475888009370\Extensions\jid1-kps5PrGBNtzSLQ@jetpack.xpi [2017-07-21]
FF Extension: (YouTube ALL HTML5) - C:\Users\*WIR*\AppData\Roaming\Mozilla\Firefox\Profiles\nfouucwg.default-1475888009370\Extensions\jid1-qj0w91o64N7Eeg@jetpack.xpi [2017-07-21]
FF Extension: (Avira Password Manager) - C:\Users\*WIR*\AppData\Roaming\Mozilla\Firefox\Profiles\nfouucwg.default-1475888009370\Extensions\passwordmanager@avira.com [2017-07-21]
FF Extension: (Avira SafeSearch Plus) - C:\Users\*WIR*\AppData\Roaming\Mozilla\Firefox\Profiles\nfouucwg.default-1475888009370\Extensions\safesearchplus2@avira.com [2017-07-21]
FF Extension: (Session Sync) - C:\Users\*WIR*\AppData\Roaming\Mozilla\Firefox\Profiles\nfouucwg.default-1475888009370\Extensions\session-sync@gabrielivanica.com.xpi [2017-07-21]
FF Extension: (Video DownloadHelper) - C:\Users\*WIR*\AppData\Roaming\Mozilla\Firefox\Profiles\nfouucwg.default-1475888009370\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2017-07-21]
FF Extension: (Tab Mix Plus) - C:\Users\*WIR*\AppData\Roaming\Mozilla\Firefox\Profiles\nfouucwg.default-1475888009370\Extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2017-07-21]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_23_0_0_207.dll [2016-11-13] ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2016-09-21] (Tracker Software Products (Canada) Ltd.)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2016-10-06] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.2.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: PDF Architect 5 -> C:\Program Files\PDF Architect 5\np-previewer.dll [2017-07-05] (pdfforge GmbH)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_207.dll [2016-11-13] ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2016-09-21] (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-10-13] (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.141.2 -> C:\Program Files (x86)\Java\jre1.8.0_141\bin\dtplugin\npDeployJava1.dll [2017-07-21] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.141.2 -> C:\Program Files (x86)\Java\jre1.8.0_141\bin\plugin2\npjp2.dll [2017-07-21] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\NPSPWRAP.DLL [2016-10-06] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.2.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-07-03] (Adobe Systems Inc.)

Chrome: 
=======
CHR DefaultSearchURL: Default -> hxxps://search.avira.com/#web/result?source=omnibar&q={searchTerms}
CHR DefaultSearchKeyword: Default -> Avira
CHR DefaultSuggestURL: Default -> hxxps://search.avira.com/suggestions?q={searchTerms}&li=ff&hl=de
CHR Profile: C:\Users\*WIR*\AppData\Local\Google\Chrome\User Data\Default [2017-07-21]
CHR Extension: (Google Präsentationen) - C:\Users\*WIR*\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-11-15]
CHR Extension: (Google Docs) - C:\Users\*WIR*\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-11-15]
CHR Extension: (Google Drive) - C:\Users\*WIR*\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-11-15]
CHR Extension: (Tom's Planner) - C:\Users\*WIR*\AppData\Local\Google\Chrome\User Data\Default\Extensions\bipbkjijodkkdkilghhekodmoagkcdnc [2016-11-15]
CHR Extension: (YouTube) - C:\Users\*WIR*\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-11-15]
CHR Extension: (Avira Password Manager) - C:\Users\*WIR*\AppData\Local\Google\Chrome\User Data\Default\Extensions\caljgklbbfbcjjanaijlacgncafpegll [2017-07-21]
CHR Extension: (Synology Note Station) - C:\Users\*WIR*\AppData\Local\Google\Chrome\User Data\Default\Extensions\cpfefcnbolgjjabocpajaplcgpniphdd [2017-07-21]
CHR Extension: (Google Tabellen) - C:\Users\*WIR*\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-11-15]
CHR Extension: (Avira Browserschutz) - C:\Users\*WIR*\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2016-11-15]
CHR Extension: (Google Docs Offline) - C:\Users\*WIR*\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-11-16]
CHR Extension: (Avira SafeSearch Plus) - C:\Users\*WIR*\AppData\Local\Google\Chrome\User Data\Default\Extensions\ipmkfpcnmccejididiaagpgchgjfajgp [2017-07-21]
CHR Extension: (Skype) - C:\Users\*WIR*\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2017-07-21]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\*WIR*\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-07-21]
CHR Extension: (Synology Download Station) - C:\Users\*WIR*\AppData\Local\Google\Chrome\User Data\Default\Extensions\onhbegdkgonhlokobjefolhpoidcnida [2016-11-15]
CHR Extension: (Synology Web Clipper) - C:\Users\*WIR*\AppData\Local\Google\Chrome\User Data\Default\Extensions\pcfbfimijgibligmbglggnbiobgjgmbk [2017-07-21]
CHR Extension: (Google Mail) - C:\Users\*WIR*\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-11-15]
CHR Extension: (Chrome Media Router) - C:\Users\*WIR*\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-07-20]
CHR HKLM\...\Chrome\Extension: [caljgklbbfbcjjanaijlacgncafpegll] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [ipmkfpcnmccejididiaagpgchgjfajgp] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [caljgklbbfbcjjanaijlacgncafpegll] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ipmkfpcnmccejididiaagpgchgjfajgp] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AcrSch2Svc; C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe [1276216 2016-09-13] ()
R2 afcdpsrv; C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [6086232 2016-10-04] ()
R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-08-04] (Advanced Micro Devices, Inc.) [File not signed]
S2 AntiVirMailService; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [1128432 2017-07-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\Antivirus\sched.exe [490968 2017-07-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [490968 2017-07-20] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [1524216 2017-07-20] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [377976 2017-06-13] (Avira Operations GmbH & Co. KG)
R2 AviraPhantomVPN; C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe [335088 2017-06-23] (Avira Operations GmbH & Co. KG)
R2 AviraUpdaterService; C:\Program Files (x86)\Avira\SoftwareUpdater\Avira.SoftwareUpdater.ServiceHost.exe [100816 2017-04-21] (Avira Operations GmbH & Co. KG)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [3042544 2017-03-14] (Microsoft Corporation)
R2 CybereasonRansomFree; C:\Program Files (x86)\Cybereason\RansomFree\CybereasonRansomFreeServiceHost.exe [19344 2017-06-28] (Cybereason)
R2 DigitalWave.Update.Service; C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe [437224 2016-10-27] (Digital Wave Ltd.)
R2 DTSAudioSvc; C:\Program Files\Realtek\Audio\HDA\DTSU2PAuSrv64.exe [240576 2013-10-07] (DTS, Inc)
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [29728 2016-08-15] (HP Inc.)
R2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [3046688 2016-07-29] (IObit)
R2 lmhosts; C:\Windows\system32\svchost.exe [38792 2014-10-29] (Microsoft Corporation)
R2 lmhosts; C:\Windows\SysWOW64\svchost.exe [33088 2014-10-29] (Microsoft Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4470736 2017-05-09] (Malwarebytes)
S4 mmsminisrv; C:\Program Files (x86)\Common Files\Acronis\Infrastructure\mms_mini.exe [4692840 2016-08-15] (Acronis International GmbH)
R2 mobile_backup_server; C:\Program Files (x86)\Common Files\Acronis\MobileBackupServer\mobile_backup_server.exe [7717528 2016-07-18] (Acronis International GmbH)
R2 mobile_backup_status_server; C:\Program Files (x86)\Acronis\TrueImageHome\mobile_backup_status_server.exe [1510712 2016-09-13] ()
R2 NlaSvc; C:\Windows\System32\svchost.exe [38792 2014-10-29] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\SysWOW64\svchost.exe [33088 2014-10-29] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [38792 2014-10-29] (Microsoft Corporation)
R2 nsi; C:\Windows\SysWOW64\svchost.exe [33088 2014-10-29] (Microsoft Corporation)
S3 PDF Architect 5; C:\Program Files\PDF Architect 5\ws.exe [2709176 2017-07-05] (pdfforge GmbH)
S3 PDF Architect 5 CrashHandler; C:\Program Files\PDF Architect 5\crash-handler-ws.exe [1051312 2017-07-05] (pdfforge GmbH)
R2 PDF Architect 5 Creator; C:\Program Files\PDF Architect 5\creator-ws.exe [859312 2017-07-05] (pdfforge GmbH)
R2 PDF Architect 5 Manager; C:\Program Files (x86)\PDF Architect 5 Manager\PDF Architect 5\Architect Manager.exe [985848 2017-05-16] (© pdfforge GmbH.)
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [197264 2016-09-22] (Sandboxie Holdings, LLC)
S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [1050904 2013-12-12] () [File not signed]
R2 SpeedupService; C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.SpeedupService.exe [74800 2017-06-28] (Avira Operations GmbH & Co. KG)
R2 syncagentsrv; C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe [9729272 2016-08-11] ()
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [10885360 2017-05-31] (TeamViewer GmbH)
R2 TrueKey; C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe [1001920 2017-06-26] (McAfee, Inc.)
R2 TrueKeyScheduler; C:\Program Files\TrueKey\McTkSchedulerService.exe [16928 2017-06-26] (McAfee, Inc.)
S3 TrueKeyServiceHelper; C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe [87760 2017-06-26] (McAfee, Inc.)
R2 UsbClientService; C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [248840 2016-03-18] () [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [361824 2017-01-12] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [119872 2017-01-12] (Microsoft Corporation)
S2 InstallerService; C:\Program Files\TrueKey\Mcafee.TrueKey.InstallerService.exe -originalversion 4.4.127.0 [X]
S2 SgtSch2Svc; "C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedul2.exe" [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [23240 2016-02-26] (Advanced Micro Devices, Inc.)
R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R0 asstahci64; C:\Windows\System32\drivers\asstahci64.sys [88936 2016-10-02] (Asmedia Technology)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [102400 2016-02-26] (Advanced Micro Devices)
R0 avdevprot; C:\Windows\System32\DRIVERS\avdevprot.sys [60920 2017-07-20] (Avira Operations GmbH & Co. KG)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [167504 2017-07-20] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [164824 2017-07-20] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [44488 2017-07-20] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [88488 2017-07-20] (Avira Operations GmbH & Co. KG)
S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77376 2017-06-27] ()
R0 file_tracker; C:\Windows\System32\DRIVERS\file_tracker.sys [375136 2016-10-04] (Acronis International GmbH)
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [27552 2016-10-02] (REALiX(tm))
R0 MBAMChameleon; C:\Windows\System32\drivers\MBAMChameleon.sys [188352 2017-07-21] (Malwarebytes)
R3 MBAMFarflt; C:\Windows\system32\drivers\farflt.sys [101784 2017-07-22] (Malwarebytes)
R3 MBAMProtection; C:\Windows\system32\drivers\mbam.sys [45472 2017-07-22] (Malwarebytes)
R0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [253856 2017-07-22] (Malwarebytes)
R3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [93600 2017-07-22] (Malwarebytes)
S3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [9101016 2013-12-10] (Realtek Semiconductor Corp.)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [204944 2016-09-22] (Sandboxie Holdings, LLC)
S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1267544 2016-10-04] (Acronis International GmbH)
R2 tib_mounter; C:\Windows\system32\DRIVERS\tib_mounter.sys [212320 2016-10-04] (Acronis International GmbH)
S3 tnd; C:\Windows\system32\DRIVERS\tnd.sys [687968 2016-10-04] (Acronis International GmbH)
R2 virtual_file; C:\Windows\System32\DRIVERS\virtual_file.sys [331104 2016-10-04] (Acronis International GmbH)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [46600 2017-02-10] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [274776 2017-01-12] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [117592 2017-01-12] (Microsoft Corporation)
R3 WinDivert1.1; C:\Program Files\KMSpico\WinDivert.sys [35376 2016-09-30] (Basil Projects)
R3 *WIR*elessKeyboardFilter; C:\Windows\System32\drivers\*WIR*elessKeyboardFilter.sys [49896 2016-07-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-07-22 12:34 - 2017-07-22 12:34 - 00031240 _____ C:\Users\*WIR*\Desktop\FRST.txt
2017-07-22 12:32 - 2017-07-22 12:34 - 00000000 ____D C:\FRST
2017-07-22 10:53 - 2017-07-22 12:30 - 00000000 ____D C:\Users\*WIR*\Downloads\Scan and Repair u aufräumen - Mail-Adware-Troja-etc
2017-07-22 10:45 - 2017-07-22 10:45 - 02382336 _____ (Farbar) C:\Users\*WIR*\Desktop\FRST64.exe
2017-07-22 10:20 - 2017-07-22 10:20 - 00000000 __SHD C:\Users\*WIR*\Desktop\0K, this directory is for Ransomware detection (just leave it here)
2017-07-22 10:20 - 2017-07-22 10:20 - 00000000 ___HD C:\Users\*WIR*\Documents\Tcaches170
2017-07-22 10:20 - 2017-07-22 10:20 - 00000000 ___HD C:\Users\*WIR*\Documents\Afiles189
2017-07-22 10:18 - 2017-07-22 10:18 - 00529239 _____ C:\Users\Akzqngck\helpful counties sustain.xlsx
2017-07-22 10:18 - 2017-07-22 10:18 - 00526136 _____ C:\Users\uzds45i\precision.plays.verbal.reflects.xlsx
2017-07-22 10:18 - 2017-07-22 10:18 - 00227656 _____ C:\Users\uzds45i\KE2O3W.mdb
2017-07-22 10:18 - 2017-07-22 10:18 - 00208383 _____ C:\Users\Akzqngck\johnny-functional-questioning.mdb
2017-07-22 10:18 - 2017-07-22 10:18 - 00074374 _____ C:\Users\Akzqngck\produce.distinguish.weather.xls
2017-07-22 10:18 - 2017-07-22 10:18 - 00068240 _____ C:\Users\uzds45i\kneel mode pad.xls
2017-07-22 10:18 - 2017-07-22 10:18 - 00055800 _____ C:\Users\Akzqngck\3YSMD5nlHdT.pem
2017-07-22 10:18 - 2017-07-22 10:18 - 00050711 _____ C:\Users\uzds45i\racial-argue-golf.pem
2017-07-22 10:18 - 2017-07-22 10:18 - 00025161 _____ C:\Users\uzds45i\customerhimmeltafter.txt
2017-07-22 10:18 - 2017-07-22 10:18 - 00018505 _____ C:\Users\Akzqngck\inconsistent_shoot.sql
2017-07-22 10:18 - 2017-07-22 10:18 - 00017036 _____ C:\Users\uzds45i\actionssecretary.sql
2017-07-22 10:18 - 2017-07-22 10:18 - 00012341 _____ C:\Users\Akzqngck\aqVoUbN.txt
2017-07-22 10:18 - 2017-07-22 10:18 - 00000000 ___HD C:\Users\uzds45i
2017-07-22 10:18 - 2017-07-22 10:18 - 00000000 ___HD C:\Users\Akzqngck
2017-07-22 10:18 - 2017-07-22 10:18 - 00000000 ____D C:\yconfiguration54
2017-07-22 10:18 - 2017-07-22 10:18 - 00000000 ____D C:\ALvalue115
2017-07-21 22:10 - 2017-07-21 22:10 - 00000000 ____D C:\Users\*WIR*\AppData\Local\AviraSpeedup
2017-07-21 22:09 - 2017-07-21 22:09 - 00000000 ____D C:\Users\*WIR*\AppData\Local\Avira
2017-07-21 22:08 - 2017-07-22 10:23 - 00000000 ____D C:\Users\Public\Speedup Sessions
2017-07-21 21:57 - 2017-07-21 21:57 - 00000000 ____D C:\Users\*WIR*\AppData\Roaming\Opera Software
2017-07-21 21:57 - 2017-07-21 21:57 - 00000000 ____D C:\Users\*WIR*\AppData\Local\Opera Software
2017-07-21 21:55 - 2017-07-21 21:55 - 00000887 _____ C:\Users\Public\Desktop\VLC media player.lnk
2017-07-21 21:55 - 2017-07-21 21:55 - 00000000 ____D C:\Program Files\VideoLAN
2017-07-21 21:51 - 2017-07-21 21:51 - 00001055 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 12.lnk
2017-07-21 21:47 - 2017-07-21 21:47 - 00097856 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2017-07-21 21:47 - 2017-07-21 21:47 - 00000000 ____D C:\Program Files (x86)\Java
2017-07-21 21:40 - 2017-07-21 21:40 - 00000000 ____D C:\Program Files (x86)\IrfanView
2017-07-21 20:30 - 2017-07-21 20:30 - 00002384 _____ C:\Users\Pc\Downloads\PC-ausgelesen mit LicenseCrawler.txt
2017-07-21 18:14 - 2017-07-21 23:02 - 00000638 _____ C:\Windows\Tasks\TrackerAutoUpdate.job
2017-07-21 18:14 - 2017-07-21 18:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF-XChange PDF Viewer
2017-07-21 18:14 - 2017-07-21 18:14 - 00000000 ____D C:\Program Files\Tracker Software
2017-07-21 17:36 - 2017-07-22 10:22 - 00000000 ____D C:\Users\*WIR*\AppData\Roaming\Raptr
2017-07-21 17:36 - 2017-07-21 17:36 - 00002035 _____ C:\Users\Public\Desktop\Raptr.lnk
2017-07-21 17:36 - 2017-07-21 17:36 - 00000000 ____D C:\Users\*WIR*\AppData\Roaming\PlaysTV
2017-07-21 17:36 - 2017-07-21 17:36 - 00000000 ____D C:\Users\*WIR*\.QtWebEngineProcess
2017-07-21 17:36 - 2017-07-21 17:36 - 00000000 ____D C:\Users\*WIR*\.Plays.tv
2017-07-21 17:36 - 2017-07-21 17:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Raptr
2017-07-21 17:35 - 2017-07-21 17:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved
2017-07-21 17:33 - 2017-07-21 17:33 - 00000000 ____D C:\Users\Pc\AppData\Roaming\library_dir
2017-07-21 17:32 - 2017-07-21 17:33 - 00000000 ____D C:\Program Files (x86)\Raptr Inc
2017-07-21 17:31 - 2017-07-21 17:36 - 00000000 ____D C:\Users\Pc\AppData\Roaming\Raptr
2017-07-21 17:31 - 2017-07-21 17:33 - 00000000 ____D C:\Program Files (x86)\Raptr
2017-07-21 17:18 - 2017-07-21 17:18 - 00000000 ____D C:\Users\*WIR*\AppData\Roaming\PDF Architect 5
2017-07-21 17:18 - 2017-07-21 17:18 - 00000000 ____D C:\Program Files (x86)\PDF Architect 5 Manager
2017-07-21 17:18 - 2017-07-21 17:18 - 00000000 ____D C:\Program Files (x86)\PDF Architect 5
2017-07-21 17:17 - 2017-07-21 17:18 - 00000000 ____D C:\Program Files\PDF Architect 5
2017-07-21 17:17 - 2017-07-21 17:17 - 00000000 ____D C:\ProgramData\PDF Architect 5
2017-07-21 17:17 - 2017-07-21 17:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
2017-07-21 17:12 - 2017-07-21 17:12 - 00000000 ____D C:\ProgramData\TrueKey
2017-07-21 16:50 - 2017-07-21 16:52 - 00188352 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys
2017-07-21 16:49 - 2017-07-22 10:29 - 00093600 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2017-07-21 16:49 - 2017-07-22 10:20 - 00101784 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2017-07-21 16:49 - 2017-07-22 10:20 - 00045472 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-07-21 16:49 - 2017-07-22 10:19 - 00253856 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-07-21 16:49 - 2017-07-21 16:52 - 00001883 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-07-21 16:49 - 2017-07-21 16:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-07-21 16:49 - 2017-07-21 16:49 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-07-21 16:49 - 2017-07-21 16:49 - 00000000 ____D C:\Program Files\Malwarebytes
2017-07-21 16:49 - 2017-06-27 12:06 - 00077376 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-07-21 16:33 - 2017-07-21 16:33 - 00000000 ____D C:\Users\*WIR*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView
2017-07-21 16:25 - 2017-07-21 16:25 - 00000652 _____ C:\Users\Public\Desktop\iDA.lnk
2017-07-21 16:25 - 2017-07-21 16:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iDA
2017-07-21 16:25 - 2017-07-21 16:25 - 00000000 ____D C:\iDA
2017-07-21 16:09 - 2017-07-21 16:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2017-07-21 16:07 - 2017-07-21 16:12 - 00000000 ____D C:\Users\*WIR*\AppData\Local\WhatsApp
2017-07-21 16:02 - 2017-07-21 16:37 - 00000000 ____D C:\Program Files\Mozilla Firefox
2017-07-21 16:01 - 2017-07-22 11:21 - 00000000 ____D C:\Users\*WIR*\AppData\Roaming\Duplicati
2017-07-21 16:00 - 2017-07-21 16:00 - 00000000 ____D C:\ProgramData\Duplicati
2017-07-21 15:56 - 2017-07-21 15:56 - 00001988 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Duplicati 2.lnk
2017-07-21 15:56 - 2017-07-21 15:56 - 00001976 _____ C:\Users\Public\Desktop\Duplicati 2.lnk
2017-07-21 15:56 - 2017-07-21 15:56 - 00000000 ____D C:\Program Files\Duplicati 2
2017-07-21 15:55 - 2017-07-21 15:55 - 00000000 ____D C:\Users\*WIR*\AppData\Roaming\Cybereason
2017-07-21 15:55 - 2017-07-21 15:55 - 00000000 ____D C:\Users\*WIR*\AppData\Local\Cybereason
2017-07-21 15:55 - 2017-07-21 15:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cybereason RansomFree
2017-07-21 15:55 - 2017-07-21 15:55 - 00000000 ____D C:\ProgramData\Cybereason
2017-07-21 15:55 - 2017-07-21 15:55 - 00000000 ____D C:\Program Files (x86)\Cybereason
2017-07-21 15:54 - 2017-07-21 15:54 - 00001167 _____ C:\Users\Public\Desktop\CDBurnerXP.lnk
2017-07-21 15:54 - 2017-07-21 15:54 - 00001117 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2017-07-21 15:54 - 2017-07-21 15:54 - 00000000 ____D C:\Users\Pc\AppData\Roaming\Canneverbe Limited
2017-07-21 15:54 - 2017-07-21 15:54 - 00000000 ____D C:\Program Files (x86)\CDBurnerXP
2017-07-21 15:52 - 2017-07-21 15:52 - 00000000 ____D C:\ProgramData\ClassicShell
2017-07-21 15:51 - 2017-07-21 15:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Classic Shell
2017-07-21 15:51 - 2017-07-21 15:51 - 00000000 ____D C:\Program Files\Classic Shell
2017-07-21 15:10 - 2017-07-21 15:10 - 00000000 ____D C:\Users\*WIR*\AppData\Roaming\ATI
2017-07-21 15:10 - 2017-07-21 15:10 - 00000000 ____D C:\Users\*WIR*\AppData\Local\ATI
2017-07-21 13:54 - 2017-07-21 13:54 - 00000000 ___SD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.1.3
2017-07-21 13:44 - 2017-07-21 13:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2017-07-21 13:43 - 2017-07-21 13:43 - 00000000 ____D C:\ProgramData\AMD
2017-07-21 13:38 - 2017-07-21 13:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2017-07-21 13:38 - 2017-07-21 13:38 - 00000000 ____D C:\Program Files\7-Zip
2017-07-21 13:05 - 2017-07-21 13:05 - 00000000 ____D C:\Windows\system32\appmgmt
2017-07-21 12:46 - 2017-07-21 12:46 - 00001056 _____ C:\Users\Public\Desktop\Avira Phantom VPN.lnk
2017-07-21 12:44 - 2017-07-21 12:44 - 00002094 _____ C:\Users\Public\Desktop\Avira Software Updater.lnk
2017-07-20 20:47 - 2017-07-20 20:47 - 00001171 _____ C:\Users\Public\Desktop\True Key.lnk
2017-07-20 20:46 - 2017-06-30 03:27 - 00835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-07-20 20:46 - 2017-06-30 03:27 - 00177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-07-20 20:16 - 2017-04-22 00:53 - 00029376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aspnet_counters.dll
2017-07-20 20:16 - 2017-04-22 00:50 - 00030912 _____ (Microsoft Corporation) C:\Windows\system32\aspnet_counters.dll
2017-07-20 20:16 - 2017-04-22 00:50 - 00018592 _____ (Microsoft Corporation) C:\Windows\system32\msvcr100_clr0400.dll
2017-07-20 20:16 - 2017-04-11 21:27 - 00485576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp120_clr0400.dll
2017-07-20 20:16 - 2017-03-15 21:15 - 00690008 _____ (Microsoft Corporation) C:\Windows\system32\msvcp120_clr0400.dll
2017-07-20 20:15 - 2017-04-22 00:53 - 00018600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr100_clr0400.dll
2017-07-20 20:15 - 2017-04-11 21:27 - 00987840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr120_clr0400.dll
2017-07-20 20:15 - 2017-03-15 21:15 - 00993632 _____ (Microsoft Corporation) C:\Windows\system32\msvcr120_clr0400.dll
2017-07-20 17:39 - 2017-07-20 17:39 - 00000000 ____D C:\Windows\CSC
2017-07-20 16:14 - 2017-06-29 09:27 - 25734656 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-07-20 16:14 - 2017-06-29 09:02 - 00576512 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-07-20 16:14 - 2017-06-29 08:50 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-07-20 16:14 - 2017-06-29 08:44 - 05975552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-07-20 16:14 - 2017-06-29 08:23 - 20270592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-07-20 16:14 - 2017-06-29 08:23 - 00499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2017-07-20 16:14 - 2017-06-29 08:17 - 01033216 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2017-07-20 16:14 - 2017-06-29 08:13 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2017-07-20 16:14 - 2017-06-29 08:09 - 00806912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-07-20 16:14 - 2017-06-29 07:58 - 15253504 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-07-20 16:14 - 2017-06-29 07:53 - 03240960 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-07-20 16:14 - 2017-06-29 07:52 - 04549632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-07-20 16:14 - 2017-06-29 07:51 - 00880640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2017-07-20 16:14 - 2017-06-29 07:47 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2017-07-20 16:14 - 2017-06-29 07:43 - 13663744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-07-20 16:14 - 2017-06-29 07:41 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-07-20 16:14 - 2017-06-29 07:28 - 02767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-07-20 16:14 - 2017-06-29 07:24 - 01314816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-07-20 16:14 - 2017-06-27 17:29 - 07796736 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Data.Pdf.dll
2017-07-20 16:14 - 2017-06-27 17:29 - 07077376 _____ (Microsoft Corporation) C:\Windows\system32\glcndFilter.dll
2017-07-20 16:14 - 2017-06-27 17:26 - 05274112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\glcndFilter.dll
2017-07-20 16:14 - 2017-06-27 17:26 - 05268992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Data.Pdf.dll
2017-07-20 16:14 - 2017-06-22 17:22 - 04169216 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-07-20 16:14 - 2017-06-17 19:45 - 03631616 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2017-07-20 16:14 - 2017-06-17 19:34 - 02749952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2017-07-20 16:14 - 2017-06-17 19:05 - 01920000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2017-07-20 16:14 - 2017-06-16 01:02 - 00990040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2017-07-20 16:14 - 2017-06-15 16:45 - 07440728 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-07-20 16:14 - 2017-06-03 19:27 - 02346496 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2017-07-20 16:14 - 2017-06-03 19:03 - 01549312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2017-07-20 16:14 - 2017-05-14 23:19 - 01364040 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2017-07-20 16:14 - 2017-05-14 22:04 - 00315224 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2017-07-20 16:14 - 2017-05-14 22:03 - 00373080 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2017-07-20 16:14 - 2017-05-14 21:06 - 01737600 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-07-20 16:14 - 2017-05-14 21:06 - 01502000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2017-07-20 16:14 - 2017-05-12 19:16 - 01084928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2017-07-20 16:14 - 2017-05-12 19:13 - 01559552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2017-07-20 16:14 - 2017-05-12 05:58 - 01985536 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2017-07-20 16:14 - 2017-05-12 05:48 - 01377792 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2017-07-20 16:14 - 2017-05-12 05:18 - 03714560 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2017-07-20 16:14 - 2017-04-16 11:54 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-07-20 16:14 - 2017-04-16 11:51 - 02899456 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-07-20 16:14 - 2017-04-16 11:00 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-07-20 16:14 - 2017-04-16 11:00 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2017-07-20 16:14 - 2017-04-16 10:53 - 02290176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2017-07-20 16:14 - 2017-04-16 10:43 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-07-20 16:14 - 2017-04-16 10:40 - 00725504 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-07-20 16:14 - 2017-04-16 10:40 - 00378880 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-07-20 16:14 - 2017-04-16 10:37 - 02132992 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-07-20 16:14 - 2017-04-16 10:24 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2017-07-20 16:14 - 2017-04-16 10:22 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2017-07-20 16:14 - 2017-04-16 10:12 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2017-07-20 16:14 - 2017-04-16 10:10 - 00330752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2017-07-20 16:14 - 2017-04-16 10:08 - 02057216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2017-07-20 16:14 - 2017-04-16 10:02 - 00267776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincorlib.dll
2017-07-20 16:14 - 2017-04-10 01:00 - 01548640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2017-07-20 16:14 - 2017-03-03 18:11 - 01697792 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2017-07-20 16:14 - 2017-03-03 18:06 - 01501184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2017-07-20 16:14 - 2017-02-11 19:49 - 00269824 _____ (Microsoft Corporation) C:\Windows\system32\DafPrintProvider.dll
2017-07-20 16:14 - 2017-02-11 19:42 - 00204288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DafPrintProvider.dll
2017-07-20 16:14 - 2017-02-04 22:32 - 00251392 _____ (Microsoft Corporation) C:\Windows\system32\microsoft-windows-system-events.dll
2017-07-20 16:14 - 2017-02-04 22:30 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2017-07-20 16:14 - 2017-01-11 20:28 - 00422744 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\spaceport.sys
2017-07-20 16:14 - 2016-10-05 16:52 - 00513456 _____ C:\Windows\SysWOW64\locale.nls
2017-07-20 16:14 - 2016-10-05 16:52 - 00513456 _____ C:\Windows\system32\locale.nls
2017-07-20 16:13 - 2017-06-29 07:29 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-07-20 16:13 - 2017-06-29 07:23 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2017-07-20 16:13 - 2017-06-17 19:11 - 02551808 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2017-07-20 16:13 - 2017-06-15 16:45 - 01674520 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2017-07-20 16:13 - 2017-06-15 16:45 - 01534064 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2017-07-20 16:13 - 2017-06-15 16:45 - 01499920 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2017-07-20 16:13 - 2017-06-15 16:45 - 01370320 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2017-07-20 16:13 - 2017-06-12 03:06 - 00376672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
2017-07-20 16:13 - 2017-06-12 01:21 - 00590848 _____ (Microsoft Corporation) C:\Windows\system32\wvc.dll
2017-07-20 16:13 - 2017-06-12 00:43 - 00371200 _____ (Microsoft Corporation) C:\Windows\system32\msinfo32.exe
2017-07-20 16:13 - 2017-06-12 00:08 - 00358912 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll
2017-07-20 16:13 - 2017-06-12 00:00 - 00962560 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-07-20 16:13 - 2017-06-11 23:35 - 00325120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll
2017-07-20 16:13 - 2017-06-11 23:31 - 00781312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2017-07-20 16:13 - 2017-06-11 18:15 - 02013528 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2017-07-20 16:13 - 2017-06-06 23:52 - 03120640 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2017-07-20 16:13 - 2017-06-06 23:42 - 00925696 _____ (Microsoft Corporation) C:\Windows\system32\autoconv.exe
2017-07-20 16:13 - 2017-06-06 23:36 - 00168448 _____ (Microsoft Corporation) C:\Windows\system32\uudf.dll
2017-07-20 16:13 - 2017-06-06 23:35 - 00517120 _____ (Microsoft Corporation) C:\Windows\system32\uReFS.dll
2017-07-20 16:13 - 2017-06-06 22:11 - 00557568 _____ (Microsoft Corporation) C:\Windows\system32\untfs.dll
2017-07-20 16:13 - 2017-06-06 22:11 - 00220672 _____ (Microsoft Corporation) C:\Windows\system32\ifsutil.dll
2017-07-20 16:13 - 2017-06-06 22:08 - 02712576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2017-07-20 16:13 - 2017-06-06 22:03 - 00837632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autoconv.exe
2017-07-20 16:13 - 2017-06-06 21:57 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uudf.dll
2017-07-20 16:13 - 2017-06-06 21:56 - 00375296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uReFS.dll
2017-07-20 16:13 - 2017-06-06 21:02 - 00513536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\untfs.dll
2017-07-20 16:13 - 2017-06-06 21:02 - 00197120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ifsutil.dll
2017-07-20 16:13 - 2017-06-02 15:15 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2017-07-20 16:13 - 2017-06-02 15:12 - 00468992 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2017-07-20 16:13 - 2017-06-02 15:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2017-07-20 16:13 - 2017-06-02 15:06 - 01001984 _____ (Microsoft Corporation) C:\Windows\HelpPane.exe
2017-07-20 16:13 - 2017-06-02 15:01 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2017-07-20 16:13 - 2017-06-02 14:03 - 00903168 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2017-07-20 16:13 - 2017-06-02 13:25 - 00272896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2017-07-20 16:13 - 2017-06-02 13:24 - 00391680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2017-07-20 16:13 - 2017-06-02 13:17 - 00699392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2017-07-20 16:13 - 2017-06-02 12:43 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2017-07-20 16:13 - 2017-05-15 23:03 - 00379744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2017-07-20 16:13 - 2017-05-14 23:42 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2017-07-20 16:13 - 2017-05-14 21:13 - 00136904 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2017-07-20 16:13 - 2017-05-12 20:05 - 00035840 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2017-07-20 16:13 - 2017-05-12 18:51 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2017-07-20 16:13 - 2017-05-12 18:50 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2017-07-20 16:13 - 2017-05-12 18:48 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2017-07-20 16:13 - 2017-05-12 18:47 - 00726528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2017-07-20 16:13 - 2017-05-12 07:10 - 00044032 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2017-07-20 16:13 - 2017-05-12 05:11 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2017-07-20 16:13 - 2017-05-12 05:10 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2017-07-20 16:13 - 2017-05-12 05:07 - 00409088 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2017-07-20 16:13 - 2017-05-12 05:06 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2017-07-20 16:13 - 2017-05-12 05:04 - 00897024 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2017-07-20 16:13 - 2017-05-12 05:00 - 02240512 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2017-07-20 16:13 - 2017-05-12 02:36 - 22361848 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2017-07-20 16:13 - 2017-05-12 02:32 - 19788672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2017-07-20 16:13 - 2017-05-10 21:19 - 00101720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2017-07-20 16:13 - 2017-05-09 17:37 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\WSDApi.dll
2017-07-20 16:13 - 2017-05-09 17:35 - 00555520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSDApi.dll
2017-07-20 16:13 - 2017-05-09 17:28 - 00193024 _____ (Microsoft Corporation) C:\Windows\system32\DAFWSD.dll
2017-07-20 16:13 - 2017-05-09 17:12 - 00448576 _____ C:\Windows\system32\ApnDatabase.xml
2017-07-20 16:13 - 2017-05-06 19:45 - 01114624 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2017-07-20 16:13 - 2017-05-06 19:05 - 01094656 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2017-07-20 16:13 - 2017-05-06 19:04 - 00865792 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2017-07-20 16:13 - 2017-05-02 23:09 - 00686592 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2017-07-20 16:13 - 2017-05-02 23:08 - 00415744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2017-07-20 16:13 - 2017-05-02 23:08 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2017-07-20 16:13 - 2017-05-02 21:31 - 00329216 _____ (Microsoft Corporation) C:\Windows\system32\srvsvc.dll
2017-07-20 16:13 - 2017-05-02 21:31 - 00207360 _____ (Microsoft Corporation) C:\Windows\system32\smbwmiv2.dll
2017-07-20 16:13 - 2017-04-30 19:48 - 00080078 _____ C:\Windows\system32\normidna.nls
2017-07-20 16:13 - 2017-04-28 04:13 - 01292288 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2017-07-20 16:13 - 2017-04-28 04:11 - 01060352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2017-07-20 16:13 - 2017-04-16 13:23 - 02176584 _____ (Microsoft Corporation) C:\Windows\system32\combase.dll
2017-07-20 16:13 - 2017-04-16 13:23 - 01662096 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2017-07-20 16:13 - 2017-04-16 13:23 - 01063464 _____ (Microsoft Corporation) C:\Windows\system32\WinTypes.dll
2017-07-20 16:13 - 2017-04-16 13:18 - 01135288 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-07-20 16:13 - 2017-04-16 13:18 - 00803192 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2017-07-20 16:13 - 2017-04-16 12:07 - 01566032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\combase.dll
2017-07-20 16:13 - 2017-04-16 12:07 - 01213792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2017-07-20 16:13 - 2017-04-16 12:07 - 00548032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinTypes.dll
2017-07-20 16:13 - 2017-04-16 12:05 - 00612096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2017-07-20 16:13 - 2017-04-16 11:37 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2017-07-20 16:13 - 2017-04-16 11:16 - 00862720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2017-07-20 16:13 - 2017-04-16 11:10 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2017-07-20 16:13 - 2017-04-16 11:03 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-07-20 16:13 - 2017-04-16 11:02 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2017-07-20 16:13 - 2017-04-16 10:29 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2017-07-20 16:13 - 2017-04-16 10:23 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2017-07-20 16:13 - 2017-04-16 10:22 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2017-07-20 16:13 - 2017-04-10 01:00 - 00388448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2017-07-20 16:13 - 2017-04-06 20:37 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2017-07-20 16:13 - 2017-04-06 20:16 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\wpd_ci.dll
2017-07-20 16:13 - 2017-04-06 19:50 - 01436672 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-07-20 16:13 - 2017-04-06 19:46 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-07-20 16:13 - 2017-04-06 19:46 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2017-07-20 16:13 - 2017-04-06 19:35 - 01362432 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll
2017-07-20 16:13 - 2017-04-06 19:15 - 00358912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2017-07-20 16:13 - 2017-04-02 17:49 - 00186880 _____ (Microsoft Corporation) C:\Windows\system32\dpapisrv.dll
2017-07-20 16:13 - 2017-04-01 02:16 - 01968408 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2017-07-20 16:13 - 2017-04-01 00:59 - 01612504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2017-07-20 16:13 - 2017-03-13 19:38 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\wmitomi.dll
2017-07-20 16:13 - 2017-03-13 19:29 - 02609664 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2017-07-20 16:13 - 2017-03-13 19:13 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmitomi.dll
2017-07-20 16:13 - 2017-03-13 19:07 - 02170880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2017-07-20 16:13 - 2017-03-11 06:59 - 01763888 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2017-07-20 16:13 - 2017-03-11 06:56 - 01489608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2017-07-20 16:13 - 2017-03-11 02:38 - 00275800 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2017-07-20 16:13 - 2017-03-09 23:52 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\wisp.dll
2017-07-20 16:13 - 2017-03-09 22:17 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wisp.dll
2017-07-20 16:13 - 2017-03-04 19:37 - 03547648 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2017-07-20 16:13 - 2017-02-11 21:18 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\puiobj.dll
2017-07-20 16:13 - 2017-02-10 22:06 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-07-20 16:13 - 2017-02-10 17:37 - 00046600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2017-07-20 16:13 - 2017-02-09 17:59 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll
2017-07-20 16:13 - 2017-02-09 17:58 - 00499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll
2017-07-20 16:13 - 2017-02-04 20:51 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2017-07-20 16:13 - 2017-02-04 20:40 - 01754112 _____ (Microsoft Corporation) C:\Windows\system32\GdiPlus.dll
2017-07-20 16:13 - 2017-02-04 20:32 - 00584704 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2017-07-20 16:13 - 2017-02-04 20:10 - 01491456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GdiPlus.dll
2017-07-20 16:13 - 2017-02-04 20:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2017-07-20 16:13 - 2017-02-01 22:44 - 00201728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-07-20 16:13 - 2017-02-01 22:42 - 00401408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-07-20 16:13 - 2017-01-22 00:37 - 00567152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2017-07-20 16:13 - 2017-01-21 22:27 - 00756736 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-07-20 16:13 - 2017-01-21 22:22 - 00559104 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\csc.sys
2017-07-20 16:13 - 2017-01-21 21:40 - 00756736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2017-07-20 16:13 - 2017-01-19 05:18 - 01113944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2017-07-20 16:13 - 2017-01-18 17:35 - 00994760 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2017-07-20 16:13 - 2017-01-14 23:32 - 00955016 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4srcsnk.dll
2017-07-20 16:13 - 2017-01-14 22:18 - 00787688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll
2017-07-20 16:13 - 2017-01-14 20:49 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\wininit.exe
2017-07-20 16:13 - 2017-01-12 19:51 - 00274776 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2017-07-20 16:13 - 2017-01-12 19:51 - 00117592 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdNisDrv.sys
2017-07-20 16:13 - 2017-01-11 22:12 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\SessEnv.dll
2017-07-20 16:13 - 2017-01-11 18:09 - 00296960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SessEnv.dll
2017-07-20 16:13 - 2017-01-11 01:37 - 00138752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys
2017-07-20 16:13 - 2017-01-11 00:06 - 00840192 _____ (Microsoft Corporation) C:\Windows\system32\netlogon.dll
2017-07-20 16:13 - 2017-01-10 23:46 - 01388544 _____ (Microsoft Corporation) C:\Windows\system32\mispace.dll
2017-07-20 16:13 - 2017-01-10 22:20 - 00696832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netlogon.dll
2017-07-20 16:13 - 2017-01-10 22:09 - 01108480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mispace.dll
2017-07-20 16:13 - 2017-01-06 20:25 - 02513408 _____ (Microsoft Corporation) C:\Windows\system32\storagewmi.dll
2017-07-20 16:13 - 2017-01-06 20:04 - 01495552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\storagewmi.dll
2017-07-20 16:13 - 2016-12-25 04:14 - 00242176 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll
2017-07-20 16:13 - 2016-12-25 03:48 - 00158720 _____ (Microsoft Corporation) C:\Windows\system32\certprop.dll
2017-07-20 16:13 - 2016-12-25 03:19 - 00170496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll
2017-07-20 16:13 - 2016-12-25 02:39 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\ScDeviceEnum.dll
2017-07-20 16:13 - 2016-11-20 00:24 - 00152856 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-07-20 16:13 - 2016-11-19 20:22 - 00111104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2017-07-20 16:13 - 2016-11-13 00:06 - 00738104 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2017-07-20 16:13 - 2016-11-11 05:33 - 01541240 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2017-07-20 16:13 - 2016-11-09 20:25 - 01376768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2017-07-20 16:13 - 2016-11-05 20:57 - 03320320 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2017-07-20 16:13 - 2016-11-05 20:11 - 03606528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2017-07-20 16:13 - 2016-11-05 18:56 - 02778624 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2017-07-20 16:13 - 2016-11-05 18:46 - 02463744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2017-07-20 16:13 - 2016-10-13 00:11 - 00922968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\refs.sys
2017-07-20 16:13 - 2016-10-11 19:45 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\TpmTasks.dll
2017-07-20 16:13 - 2016-10-10 21:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cmimcext.sys
2017-07-20 16:13 - 2016-10-05 17:01 - 01200128 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Globalization.dll
2017-07-20 16:13 - 2016-10-05 17:00 - 00868864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Globalization.dll
2017-07-20 16:13 - 2016-10-05 17:00 - 00323072 _____ (Microsoft Corporation) C:\Windows\system32\GlobCollationHost.dll
2017-07-20 16:13 - 2016-10-05 07:15 - 00324896 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2017-07-20 16:13 - 2016-10-05 07:15 - 00245320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2017-07-20 16:13 - 2016-09-21 01:30 - 02462040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2017-07-20 16:13 - 2015-10-22 18:58 - 00200704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GlobCollationHost.dll
2017-07-20 16:12 - 2017-06-15 16:45 - 00086360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pdc.sys
2017-07-20 16:12 - 2017-06-12 00:25 - 00478720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wvc.dll
2017-07-20 16:12 - 2017-06-12 00:15 - 01436672 _____ (Microsoft Corporation) C:\Windows\system32\wdc.dll
2017-07-20 16:12 - 2017-06-12 00:07 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sysmon.ocx
2017-07-20 16:12 - 2017-06-11 23:58 - 00334336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msinfo32.exe
2017-07-20 16:12 - 2017-06-11 23:40 - 01323008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdc.dll
2017-07-20 16:12 - 2017-06-06 23:38 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\cnvfat.dll
2017-07-20 16:12 - 2017-06-06 23:36 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\convert.exe
2017-07-20 16:12 - 2017-06-06 22:13 - 00177664 _____ (Microsoft Corporation) C:\Windows\system32\ulib.dll
2017-07-20 16:12 - 2017-06-06 22:11 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\ufat.dll
2017-07-20 16:12 - 2017-06-06 22:11 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\uexfat.dll
2017-07-20 16:12 - 2017-06-06 21:59 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cnvfat.dll
2017-07-20 16:12 - 2017-06-06 21:03 - 00143360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ulib.dll
2017-07-20 16:12 - 2017-06-06 21:02 - 00106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ufat.dll
2017-07-20 16:12 - 2017-06-06 21:02 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uexfat.dll
2017-07-20 16:12 - 2017-06-01 00:20 - 00470360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2017-07-20 16:12 - 2017-05-16 01:09 - 00057688 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\stornvme.sys
2017-07-20 16:12 - 2017-05-15 22:58 - 00121184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tm.sys
2017-07-20 16:12 - 2017-05-09 17:29 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wsdchngr.dll
2017-07-20 16:12 - 2017-05-09 17:29 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\snmptrap.exe
2017-07-20 16:12 - 2017-05-09 17:28 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\wsdchngr.dll
2017-07-20 16:12 - 2017-05-06 19:41 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\rdsdwmdr.dll
2017-07-20 16:12 - 2017-05-02 21:41 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\sscore.dll
2017-07-20 16:12 - 2017-05-02 20:35 - 00031744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sscore.dll
2017-07-20 16:12 - 2017-04-09 23:40 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\winhvr.sys
2017-07-20 16:12 - 2017-04-09 23:39 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vmbkmclr.sys
2017-07-20 16:12 - 2017-04-09 23:37 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vmbusr.sys
2017-07-20 16:12 - 2017-04-09 22:00 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\vmbuspiper.dll
2017-07-20 16:12 - 2017-04-06 18:44 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\wpdbusenum.dll
2017-07-20 16:12 - 2017-03-13 19:25 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2017-07-20 16:12 - 2017-03-13 19:06 - 00236032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2017-07-20 16:12 - 2017-03-12 18:04 - 00033792 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\BasicRender.sys
2017-07-20 16:12 - 2017-03-04 22:24 - 00132096 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2017-07-20 16:12 - 2017-03-04 22:06 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2017-07-20 16:12 - 2017-03-04 21:15 - 00077824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\asycfilt.dll
2017-07-20 16:12 - 2017-03-03 18:10 - 00138752 _____ (Microsoft Corporation) C:\Windows\system32\mfmjpegdec.dll
2017-07-20 16:12 - 2017-03-03 18:04 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmjpegdec.dll
2017-07-20 16:12 - 2017-02-09 17:58 - 00252416 _____ (Microsoft Corporation) C:\Windows\system32\dnsrslvr.dll
2017-07-20 16:12 - 2017-02-04 20:53 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2017-07-20 16:12 - 2017-02-04 20:50 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\icm32.dll
2017-07-20 16:12 - 2017-02-04 20:19 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samlib.dll
2017-07-20 16:12 - 2017-02-04 20:17 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icm32.dll
2017-07-20 16:12 - 2017-01-21 22:27 - 00095232 _____ (Microsoft Corporation) C:\Windows\system32\auditpolmsg.dll
2017-07-20 16:12 - 2017-01-21 22:27 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-07-20 16:12 - 2017-01-21 21:40 - 00095232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpolmsg.dll
2017-07-20 16:12 - 2017-01-21 21:40 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2017-07-20 16:12 - 2017-01-18 17:34 - 00922432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2017-07-20 16:12 - 2017-01-12 18:03 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storvsp.sys
2017-07-20 16:12 - 2017-01-12 18:03 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vpcivsp.sys
2017-07-20 16:12 - 2016-12-25 04:21 - 00040960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\scfilter.sys
2017-07-20 16:12 - 2016-11-12 22:38 - 00613632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2017-07-20 16:12 - 2016-10-10 21:18 - 00069976 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-07-20 16:12 - 2016-10-09 17:17 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\ActionQueue.dll
2017-07-20 16:12 - 2016-10-09 17:08 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\shsetup.dll
2017-07-20 16:12 - 2016-10-09 17:08 - 00095232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shsetup.dll
2017-07-20 16:12 - 2015-02-03 02:53 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\winshfhc.dll
2017-07-20 16:12 - 2015-02-03 02:53 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winshfhc.dll
2017-07-20 16:02 - 2017-05-04 02:11 - 00103600 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2017-07-20 16:02 - 2017-05-03 16:43 - 01555968 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2017-07-20 16:02 - 2017-05-03 16:43 - 01206272 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2017-07-20 16:02 - 2017-05-03 16:43 - 00620544 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2017-07-20 16:02 - 2017-05-03 16:43 - 00535552 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2017-07-20 16:02 - 2017-05-03 16:43 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2017-07-20 16:02 - 2017-05-03 16:43 - 00311296 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2017-07-20 16:02 - 2017-05-03 16:43 - 00217088 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2017-07-20 16:02 - 2017-05-03 16:43 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2017-07-20 16:02 - 2016-06-03 20:11 - 00472576 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2017-07-20 15:55 - 2017-07-20 15:50 - 00060920 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avdevprot.sys
2017-07-20 15:49 - 2017-07-20 15:49 - 00001063 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera-Browser.lnk

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-07-22 12:24 - 2016-10-03 00:09 - 00000000 ____D C:\Users\*WIR*\AppData\Roaming\Skype
2017-07-22 11:52 - 2016-09-30 04:07 - 01733754 _____ C:\Windows\system32\PerfStringBackup.INI
2017-07-22 11:52 - 2016-09-29 20:09 - 00727586 _____ C:\Windows\system32\perfh007.dat
2017-07-22 11:52 - 2016-09-29 20:09 - 00151718 _____ C:\Windows\system32\perfc007.dat
2017-07-22 11:52 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\Inf
2017-07-22 11:44 - 2016-10-02 23:57 - 00000000 ____D C:\Users\*WIR*\AppData\Roaming\KeePass
2017-07-22 11:19 - 2016-10-02 15:49 - 00000000 ____D C:\Users\*WIR*\AppData\Local\ClassicShell
2017-07-22 10:40 - 2016-11-20 16:22 - 00000000 ____D C:\Users\*WIR*\AppData\LocalLow\Mozilla
2017-07-22 10:18 - 2013-08-22 17:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-07-21 23:02 - 2016-10-02 17:01 - 00000000 ____D C:\Program Files\PDFCreator
2017-07-21 23:02 - 2016-09-30 04:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-07-21 23:02 - 2013-08-22 17:44 - 00408176 _____ C:\Windows\system32\FNTCACHE.DAT
2017-07-21 22:08 - 2016-10-02 12:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2017-07-21 22:07 - 2016-10-02 12:14 - 00000000 ____D C:\ProgramData\Avira
2017-07-21 22:07 - 2016-10-02 12:14 - 00000000 ____D C:\Program Files (x86)\Avira
2017-07-21 21:59 - 2016-10-02 15:40 - 00000000 ____D C:\Users\*WIR*
2017-07-21 21:56 - 2016-09-30 04:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-07-21 21:52 - 2013-08-22 18:36 - 00000000 ____D C:\Windows\AppReadiness
2017-07-21 21:51 - 2016-10-03 00:34 - 00000000 ____D C:\Users\Pc\AppData\Roaming\TeamViewer
2017-07-21 21:51 - 2016-09-30 05:01 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2017-07-21 21:46 - 2016-09-29 19:39 - 00000000 ____D C:\ProgramData\Package Cache
2017-07-21 21:42 - 2016-10-02 18:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2017-07-21 21:42 - 2016-10-02 18:15 - 00000000 ____D C:\Program Files\FileZilla FTP Client
2017-07-21 21:40 - 2016-10-02 17:06 - 00000000 ____D C:\Users\Pc\AppData\Roaming\IrfanView
2017-07-21 21:39 - 2016-10-12 18:25 - 01485312 ___SH C:\Users\*WIR*\Downloads\Thumbs.db
2017-07-21 21:33 - 2016-09-29 19:36 - 00000000 ____D C:\AMD
2017-07-21 20:10 - 2016-10-02 15:40 - 00000000 ____D C:\Users\*WIR*\AppData\Local\Packages
2017-07-21 17:36 - 2013-08-22 18:36 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2017-07
         

Generell habe ich ein sauberes Backup des PCs (Win 8.1 pro), das ich auch gestern aufspielte

Und was sollen wir dann für dich tun, wenn du das saubere Backup schon zurückgespielt hast?

Nein, hab mich wohl falsch ausgedrückt.

Ich habe ein sauberes win als backup.

Dies könnte ich zwar aufspielen, wollte aber das infizierte erst einmal mit eurer hilfe untersuchung und evtl säubern.
Da ich den Fehler nirgend wo im Netz fand, dachte ich das wäre interessant.

Dies könnte ich zwar aufspielen,

Und warum tust du es nicht?

wollte aber das infizierte erst einmal mit eurer hilfe untersuchung und evtl säubern.

Wozu hast du dann das saubere Backup? Versteh ich nicht. Ist das zu alt?
Ich weiß auch nicht was wir jetzt noch machen sollen. Du hast das saubere Backup doch schon zurück gespielt, denn was soll das ich auch gestern aufspielte denn anderes heißen?

Warum machst du solchen wirren Angaben?

NEIN.

Ich hatte das backup, das saubere gestern aufgespielt.
danach war alles gut.
dann habe ich noch Software ud aktualisierungen hinzugefügt.
dabei hat sich dann irgend etwas mit instaliert, was die beschriebenen Probleme erzeugt hat.
Dieses (wohl) infizierte system läuft jetzt auf dem PC.

Dies würde ich gerne mit Hilfe bereinigen.

Warum schreibt man denn nicht gleich KLAR UND DEUTLICH, dass nach dem RESTORE was reinkam...

Ran by *WIR* (ATTENTION: The user is not administrator)

FRST und alle anderen Tool brauchen immer immer Adminrechte. Gib dem betroffenen User Adminrechte.

Und wir brauchen das Addition.txt Logfile.

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Nunja, ich meinte damit:

"Danach erneuerte/aktualisierte ich so einiges und spielte auch manches zusätzlich drauf"

wäre klar KLAR UND DEUTLICH gesagt gewesen, dass nach dem RESTORE was reinkam.

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-07-2017
Ran by *WIR* (22-07-2017 12:34:59)
Running from C:\Users\*WIR*\Desktop
Windows 8.1 Pro (Update) (X64) (2016-09-30 01:08:08)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-223189139-1834683237-3245993289-500 - Administrator - Disabled)
*WIR* (S-1-5-21-223189139-1834683237-3245993289-1002 - Limited - Enabled) => C:\Users\*WIR*
Guest (S-1-5-21-223189139-1834683237-3245993289-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-223189139-1834683237-3245993289-1005 - Limited - Enabled)
j**** (S-1-5-21-223189139-1834683237-3245993289-1003 - Limited - Enabled) => C:\Users\j*****
Pc (S-1-5-21-223189139-1834683237-3245993289-1001 - Administrator - Enabled) => C:\Users\Pc
test (S-1-5-21-223189139-1834683237-3245993289-1006 - Limited - Enabled) => C:\Users\test

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Enabled - Up to date) {B3F630BD-538D-1B4A-14FA-14B63235278F}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Avira Antivirus (Enabled - Up to date) {0897D159-75B7-14C4-2E4A-2FC449B26D32}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 16.04 (x64) (HKLM\...\7-Zip) (Version: 16.04 - Igor Pavlov)
Acronis True Image (HKLM-x32\...\{2D18E04C-2EFC-48C6-A17F-F53FC9D8564C}) (Version: 20.0.5554 - Acronis) Hidden
Acronis True Image (HKLM-x32\...\{2D18E04C-2EFC-48C6-A17F-F53FC9D8564C}Visible) (Version: 20.0.5554 - Acronis)
Acronis*Disk*Director*12 (HKLM-x32\...\{AE372858-B1BD-49EF-8308-648322846008}) (Version: 12.0.3270 - Acronis)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 17.009.20058 - Adobe Systems Incorporated)
Adobe Flash Player 23 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 23.0.0.207 - Adobe Systems Incorporated)
Amarok (remove only) (HKLM-x32\...\Amarok) (Version: 2.8.0 - KDE)
AMD Install Manager (HKLM\...\AMD Catalyst Install Manager) (Version: 9.0.000.4 - Advanced Micro Devices, Inc.)
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.28.28 - Avira Operations GmbH & Co. KG)
Avira Connect (HKLM-x32\...\{661C79C2-D156-419C-81CA-D1A2523B0841}) (Version: 1.2.91.10326 - Avira Operations GmbH & Co. KG) Hidden
Avira Connect (HKLM-x32\...\{dd9049b8-31d1-40bd-8c8c-97a7b087a78f}) (Version: 1.2.91.10326 - Avira Operations GmbH & Co. KG)
Avira Phantom VPN (HKLM-x32\...\Avira Phantom VPN) (Version: 2.8.4.30090 - Avira Operations GmbH & Co. KG)
Avira Software Updater (HKLM-x32\...\{A4DF9D2A-AB95-4F30-9CA4-2F49662BA39D}) (Version: 2.0.2.27024 - Avira Operations GmbH & Co. KG)
Avira System Speedup (HKLM-x32\...\Avira System Speedup_is1) (Version: 3.7.1.5481 - Avira Operations GmbH & Co. KG)
Catalyst Control Center Next Localization BR (HKLM\...\{585A6A74-1DED-8DA0-32F1-F5EFA485DFB1}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (HKLM\...\{A0649E20-C57C-DCFA-AE1B-1CE1CB9D98A8}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (HKLM\...\{35F79A5D-00E2-8C19-D929-2E85DEA4252D}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (HKLM\...\{2CEBB6AA-EC39-DFF2-1F5B-9A98301C4DAB}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (HKLM\...\{F05F0B6E-9999-55D0-C323-D06DF0E2B59F}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (HKLM\...\{CBABB5FD-BD69-8969-729A-5659E11D9518}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (HKLM\...\{98527BF3-A8E0-B8CF-7297-436B714FC576}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (HKLM\...\{D6CD1B25-53E6-C2F8-FA99-F89138A9C86F}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (HKLM\...\{487C3865-3005-F04A-FBA4-F4239E02A847}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (HKLM\...\{D80AD200-548C-B62B-32AE-BF3CD7AA7EA2}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (HKLM\...\{D21BFF5C-51AA-4C15-1C91-6A1087FDC373}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (HKLM\...\{04F0FFCB-D9A5-2332-2697-CA47C0424AF2}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (HKLM\...\{47F2FFDC-3D6A-CED6-0B54-6E7082D5B29B}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (HKLM\...\{5608D1B6-6483-9FA3-7297-C2CFC3FCE747}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (HKLM\...\{1FCA484A-5A9E-9C91-F050-257D1F311A0C}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (HKLM\...\{D8FB03AE-A326-0C12-AC47-B898FE73FA94}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (HKLM\...\{F7876D2E-CDCD-CE53-0E88-995B57A94B58}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (HKLM\...\{3BAB5AC8-EF35-FED0-BCEB-9306D05EDE1C}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (HKLM\...\{746E086C-023A-A79C-DBE1-062E773FF6C8}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (HKLM\...\{1C44BB26-1941-DB44-D5E8-C455F89EE6E6}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (HKLM\...\{BE7F26CB-6E91-7673-7130-80C36FBF13DE}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.7.6623 - CDBurnerXP)
Classic Shell (HKLM\...\{383BB30A-B4A7-4666-9A83-22CFA8640097}) (Version: 4.3.0 - IvoSoft)
Clementine (HKLM-x32\...\Clementine) (Version: 1.3.1 - Clementine)
Cybereason RansomFree 2.3.0.0 (HKLM-x32\...\{FF34E65D-8F07-4917-8B9D-FB7F17E2BC4E}) (Version: 2.3.0.0 - Cybereason Inc.)
D3DX10 (HKLM-x32\...\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden
Duplicati 2 (HKLM\...\{78C1C3B9-DD53-4591-8989-B8230B832E7F}) (Version: 2.0.0.7 - Duplicati Team)
E-POST (HKLM-x32\...\{bd26b861-41e4-4cd2-bfb7-771364f9c854}) (Version: 4.2.14.4214 - Deutsche Post AG)
E-POST Desktop App (HKLM-x32\...\{3942DC9A-56D4-439D-97CD-6D6C61E90E90}) (Version: 4.2.14.4214 - Deutsche Post AG) Hidden
E-POST MAILER Drucker (HKLM\...\{14DF717F-47D6-46E6-9120-30F4ED5AFDFC}) (Version: 4.2.9.4209 - Deutsche Post AG) Hidden
FileZilla Client 3.27.0.1 (HKLM-x32\...\FileZilla Client) (Version: 3.27.0.1 - Tim Kosse)
Fotogalerie (HKLM-x32\...\{41BF4A3B-D60A-4E92-883F-C88C8C157261}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
FXCM Trading Station (HKLM-x32\...\FXTS2) (Version:  - Forex Capital Markets, LLC ("FXCM LLC"))
FXFlat Meta Trader 4 (HKLM-x32\...\FXFlat Meta Trader 4) (Version: 6.00 - MetaQuotes Software Corp.)
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.14) (Version: 9.14 - Artifex Software Inc.)
HP ePrint SW (HKLM-x32\...\{5b1a1d22-bd59-44e0-a954-e2f18ec43a23}) (Version: 5.2.20454 - HP Inc.)
HP Officejet Pro 8600 - Grundlegende Software für das Gerät (HKLM\...\{D2D05FDB-4EDA-462D-8DB6-E0B9AD4FA25F}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Support Assistant (HKLM-x32\...\{56D27851-B9A6-430F-875A-E2D7A3802C7B}) (Version: 8.3.34.7 - HP Inc.)
HP Support Solutions Framework (HKLM-x32\...\{D549B5E2-DBE8-4190-ABA5-71106264398C}) (Version: 12.5.32.37 - HP Inc.)
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
iDA Version v2.32 (HKLM-x32\...\{5C08DD15-104A-449D-8461-BEDF717F27C1}_is1) (Version: v2.32 - Schmid IT-Management)
Intel Security True Key (HKLM\...\TrueKey) (Version: 4.19.108.1 - Intel Security)
IObit Uninstaller (HKLM-x32\...\IObitUninstall) (Version: 6.0.2.156 - IObit)
IrfanView 4.44 (32-bit) (HKLM-x32\...\IrfanView) (Version: 4.44 - Irfan Skiljan)
IrfanView 64 (remove only) (HKLM\...\IrfanView64) (Version: 4.42 - Irfan Skiljan)
Java 8 Update 141 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180141F0}) (Version: 8.0.1410.15 - Oracle Corporation)
KeePass Password Safe 2.36 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.36 - Dominik Reichl)
Malwarebytes Version 3.1.2.1733 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.1.2.1733 - Malwarebytes)
Manager (HKLM-x32\...\{8DED36D9-54D6-4127-A112-5A1BA1CDD66B}) (Version: 5.0.26.33533 - 2017 pdfforge GmbH. All rights reserved) Hidden
MetaTrader 4 (HKLM-x32\...\MetaTrader 4) (Version: 6.00 - MetaQuotes Software Corp.)
MetaTrader 5 (HKLM\...\MetaTrader 5) (Version: 5.00 - MetaQuotes Software Corp.)
Microsoft Office Home and Business 2013 - de-de (HKLM\...\HomeBusinessRetail - de-de) (Version: 15.0.4945.1001 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{3c3aafc8-d898-43ec-998f-965ffdae065a}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24212 (HKLM-x32\...\{462f63a8-6347-4894-a1b3-dbfe3a4c981d}) (Version: 14.0.24212.0 - Microsoft Corporation)
Microsoft Visual C++ 2017 Redistributable (x64) - 14.10.25017 (HKLM-x32\...\{e52a6842-b0ac-476e-b48f-378a97a67346}) (Version: 14.10.25017.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.60724 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.60724 - Microsoft Corporation)
Movie Maker (HKLM-x32\...\{70C91B91-61E8-4D06-86D6-A9DCC291983A}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{DD67BE4B-7E62-4215-AFA3-F123A800A389}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 54.0.1 (x64 de) (HKLM\...\Mozilla Firefox 54.0.1 (x64 de)) (Version: 54.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 52.2.1 - Mozilla)
Mozilla Thunderbird 52.2.1 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 52.2.1 (x86 de)) (Version: 52.2.1 - Mozilla)
Office 15 Click-to-Run Extensibility Component (HKLM\...\{90150000-008C-0000-1000-0000000FF1CE}) (Version: 15.0.4945.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (HKLM\...\{90150000-007E-0000-1000-0000000FF1CE}) (Version: 15.0.4945.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (HKLM\...\{90150000-008C-0407-1000-0000000FF1CE}) (Version: 15.0.4945.1001 - Microsoft Corporation) Hidden
OpenOffice 4.1.3 (HKLM-x32\...\{8D5FCC56-BB9F-4122-923C-71753F50F6F5}) (Version: 4.13.9783 - Apache Software Foundation)
OpenOffice 4.1.3 Language Pack (German) (HKLM-x32\...\{F656568B-DF59-4EA8-997F-4E293ABC0ABF}) (Version: 4.13.9783 - Apache Software Foundation)
Opera Stable 46.0.2597.57 (HKLM-x32\...\Opera 46.0.2597.57) (Version: 46.0.2597.57 - Opera Software)
PDF Architect 5 Create Module (HKLM\...\{0E25DE98-E56E-4259-B554-F1360BB2DC22}) (Version: 5.0.28.34044 - pdfforge GmbH) Hidden
PDF Architect 5 Edit Module (HKLM\...\{EE01D8D7-2DD0-4C43-BF42-D9C8FC8DAE99}) (Version: 5.0.28.34044 - pdfforge GmbH) Hidden
PDF Architect 5 View Module (HKLM\...\{4DC94B75-B036-474D-8AC8-E2D055C95FBD}) (Version: 5.0.28.34044 - pdfforge GmbH) Hidden
PDF24 Creator 7.9.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.5.3 - pdfforge GmbH)
PDFsam Basic (HKLM-x32\...\{AE22AC64-691E-4D7E-99CC-C517AE7F5F7D}) (Version: 3.20.2.0 - Andrea Vacondio)
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.318.1 - Tracker Software Products Ltd)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9.141.259 - Google, Inc.)
Raptr (HKLM-x32\...\Raptr) (Version: 5.2.10-r123135-release - Raptr, Inc)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7541 - Realtek Semiconductor Corp.)
Realtek PC Camera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10253 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.53 - Piriform)
Sandboxie 5.14 (64-bit) (HKLM\...\Sandboxie) (Version: 5.14 - Sandboxie Holdings, LLC)
Skype Click to Call (HKLM-x32\...\{873F8E7C-10E6-449F-BD7E-5FBA7C8E1C9B}) (Version: 8.5.0.9167 - Microsoft Corporation)
Skype™ 7.38 (HKLM-x32\...\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.38.101 - Skype Technologies S.A.)
Synology Assistant (remove only) (HKLM-x32\...\Synology Assistant) (Version:  - )
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.19 - TeamSpeak Systems GmbH)
TeamViewer 12 (HKLM-x32\...\TeamViewer) (Version: 12.0.78716 - TeamViewer)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: 5.5.0.0 - Elaborate Bytes)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.6 - VideoLAN)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
VobSub v2.23 (Remove Only) (HKLM-x32\...\VobSub) (Version:  - )
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinRAR 5.40 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
XAMPP (HKLM-x32\...\xampp) (Version: 5.6.24-1 - Bitnami)
XMedia Recode Version 3.3.5.8 (HKLM-x32\...\{DDA3C325-47B2-4730-9672-BF3771C08799}_is1) (Version: 3.3.5.8 - XMedia Recode)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-223189139-1834683237-3245993289-1002_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\*WIR*\AppData\Local\Microsoft\OneDrive\17.3.6917.0607\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-223189139-1834683237-3245993289-1002_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\*WIR*\AppData\Local\Microsoft\OneDrive\17.3.6917.0607\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-223189139-1834683237-3245993289-1002_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\*WIR*\AppData\Local\Microsoft\OneDrive\17.3.6917.0607\amd64\FileSyncShell64.dll => No File
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers: [1_EPMInConflictHandler] -> {188FBECF-3754-4767-94ED-E06FF03C57DE} => C:\Windows\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [1_EPMInProgressHandler] -> {EF1FAD52-44AF-4B92-8462-048F036E16A9} => C:\Windows\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [1_EPMInSyncHandler] -> {85837018-AB69-4BD9-95D3-0DDCDE2EA467} => C:\Windows\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2016-08-09] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2016-08-09] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2016-08-09] (Acronis)
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)
ContextMenuHandlers01: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers01: [IObitUnstaler] -> {B19ED566-D419-470b-B111-3C89040BC027} => C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMenuRight.dll [2016-05-23] (IObit)
ContextMenuHandlers01: [PDFArchitect5_ManagerExt] -> {00B7B69F-6774-4906-9C7F-7D117A3644A9} => C:\Program Files\PDF Architect 5\creator-context-menu.dll [2017-07-05] (pdfforge GmbH)
ContextMenuHandlers01: [PDFCreator.ShellContextMenu] -> {d9cea52e-100d-4159-89ea-76e845bc13e1} => C:\Windows\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)
ContextMenuHandlers01: [Shell Extension for Malware scanning] -> {45AC2688-0253-4ED8-97DE-B5370FA7D48A} => C:\Program Files (x86)\Avira\Antivirus\shlext64.dll [2017-07-20] (Avira Operations GmbH & Co. KG)
ContextMenuHandlers01: [SystemSpeedupFilesMenu] -> {ef263503-8f0e-3e6a-ae2e-fe0b4b441d52} => C:\Windows\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)
ContextMenuHandlers01: [VersionsPageShellExt] -> {9E42900A-85F9-4E67-9778-575FBBA0A81C} =>  -> No File
ContextMenuHandlers01: [VirtualCloneDrive] -> {B7056B8E-4F99-44f8-8CBD-282390FE5428} => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\ElbyVCDShell.dll [2009-12-14] (Elaborate Bytes AG)
ContextMenuHandlers01: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-15] (Alexander Roshal)
ContextMenuHandlers01: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} =>  -> No File
ContextMenuHandlers02: [VirtualCloneDrive] -> {B7056B8E-4F99-44f8-8CBD-282390FE5428} => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\ElbyVCDShell.dll [2009-12-14] (Elaborate Bytes AG)
ContextMenuHandlers03: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-05-09] (Malwarebytes)
ContextMenuHandlers04: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers04: [IObitUnstaler] -> {B19ED566-D419-470b-B111-3C89040BC027} => C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMenuRight.dll [2016-05-23] (IObit)
ContextMenuHandlers04: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-06] (Piriform Ltd)
ContextMenuHandlers04: [SystemSpeedupFoldersMenu] -> {3d52b24d-33bb-3895-99ea-a0156f24a3f9} => C:\Windows\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)
ContextMenuHandlers05: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\atiacm64.dll [2015-08-04] (Advanced Micro Devices, Inc.)
ContextMenuHandlers05: [SystemSpeedupDesktopMenu] -> {cefaf456-bc17-3f4b-b7d9-75070925911b} => C:\Windows\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)
ContextMenuHandlers06: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers06: [IObitUnstaler] -> {B19ED566-D419-470b-B111-3C89040BC027} => C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMenuRight.dll [2016-05-23] (IObit)
ContextMenuHandlers06: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-05-09] (Malwarebytes)
ContextMenuHandlers06: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-06] (Piriform Ltd)
ContextMenuHandlers06: [Shell Extension for Malware scanning] -> {45AC2688-0253-4ED8-97DE-B5370FA7D48A} => C:\Program Files (x86)\Avira\Antivirus\shlext64.dll [2017-07-20] (Avira Operations GmbH & Co. KG)
ContextMenuHandlers06: [StartMenuExt] -> {E595F05F-903F-4318-8B0A-7F633B520D2B} => C:\Windows\system32\StartMenuHelper64.dll [2016-07-30] (IvoSoft)
ContextMenuHandlers06: [VersionsPageShellExt] -> {9E42900A-85F9-4E67-9778-575FBBA0A81C} =>  -> No File
ContextMenuHandlers06: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-15] (Alexander Roshal)
ContextMenuHandlers06: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} =>  -> No File

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\TrackerAutoUpdate.job => C:\Program Files\Tracker Software\Update\TrackerUpdate.exe-CheckUpdate(Tracker Software Products (Canada) Ltd.Kee
Task: C:\Windows\Tasks\Uninstaller_SkipUac_Pc.job => 

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


Shortcut: C:\Users\*WIR*\Desktop\System\DSM in Browser.lnk -> C:\Program Files\001-Erweiterte-Batchdateien\Synology-in-Browser.bat ()
Shortcut: C:\Users\*WIR*\Desktop\System\DSM-Laufwerke einbinden.lnk -> C:\Program Files\001-Erweiterte-Batchdateien\Serverlaufwerke-einbinden.bat ()
Shortcut: C:\Users\*WIR*\Desktop\System\DSM-Note Station starten.lnk -> C:\Program Files\001-Erweiterte-Batchdateien\DSM-Note Station-in-Browser.bat ()
Shortcut: C:\Users\*WIR*\Desktop\Media\DSM Audiostation-in-Browser.bat.lnk -> C:\Program Files\001-Erweiterte-Batchdateien\DSM Audiostation-in-Browser.bat ()
Shortcut: C:\Users\*WIR*\Desktop\Media\DSM Videostation-in-Browser.bat.lnk -> C:\Program Files\001-Erweiterte-Batchdateien\DSM Videostation-in-Browser.bat ()
Shortcut: C:\Users\*WIR*\Desktop\Media\DSM-Photo Station starten.lnk -> C:\Program Files\001-Erweiterte-Batchdateien\DSM-Photo Station-in-Browser starten.bat ()

==================== Loaded Modules (Whitelisted) ==============

2017-07-19 19:18 - 2017-07-19 19:18 - 00076456 _____ () C:\Program Files\FileZilla FTP Client\fzshellext_64.dll
2015-06-25 16:34 - 2015-06-25 16:34 - 00014336 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick.2\qtquick2plugin.dll
2015-06-25 16:37 - 2015-06-25 16:37 - 00739840 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-06-25 16:35 - 2015-06-25 16:35 - 00014336 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Window.2\windowplugin.dll
2015-06-25 16:38 - 2015-06-25 16:38 - 00071168 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Layouts\qquicklayoutsplugin.dll
2015-06-25 15:53 - 2015-06-25 15:53 - 00011776 _____ () C:\Program Files\AMD\CNext\CNext\libEGL.dll
2015-06-25 15:51 - 2015-06-25 15:51 - 02013696 _____ () C:\Program Files\AMD\CNext\CNext\libGLESv2.dll
2016-09-13 17:18 - 2016-09-13 17:18 - 00585240 _____ () C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
2017-07-21 11:28 - 2017-07-21 11:28 - 00402624 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream64.dll
2016-09-13 18:12 - 2016-09-13 18:12 - 04654664 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
2015-08-04 00:25 - 2015-08-04 00:25 - 00102400 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Proxy.Native.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 16:25 - 2013-08-22 16:25 - 00000824 _____ C:\Windows\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-223189139-1834683237-3245993289-1002\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg
DNS Servers: 192.168.10.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Off)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

HKLM\...\StartupApproved\StartupFolder: => "E-POST CLOUD.lnk"
HKLM\...\StartupApproved\StartupFolder: => "E-POST MAILER.lnk"
HKLM\...\StartupApproved\Run32: => "AcronisTibMounterMonitor"
HKLM\...\StartupApproved\Run32: => "KeePass 2 PreLoad"
HKLM\...\StartupApproved\Run32: => "VirtualCloneDrive"
HKU\S-1-5-21-223189139-1834683237-3245993289-1002\...\StartupApproved\Run: => "HP Officejet Pro 8600 (NET)"
HKU\S-1-5-21-223189139-1834683237-3245993289-1002\...\StartupApproved\Run: => "GIMP Updater"
HKU\S-1-5-21-223189139-1834683237-3245993289-1002\...\StartupApproved\Run: => "SandboxieControl"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{82A41A2F-BAD1-42F4-8166-B0A79D15237B}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{C235C3AE-8152-4078-BEC0-043846B20EAC}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{928896D1-3F58-4562-AA8B-92DB1D74A572}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{FFF6EF8C-DEA9-4137-B361-672177C3204D}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{9598FF41-3952-4731-99BD-4E82DEF005DE}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{DC9C5AF8-9151-4BD6-8810-BD39E41F0C21}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{916920ED-4BAD-4319-BA34-75A642497048}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{641363CD-48A1-4086-A194-4D1BFC434051}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{F13C49C9-B927-4652-A067-F2A71B92C300}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{51A161A2-8ADE-4BA1-95A1-626843273E32}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{5D3DF93E-E118-418B-886E-E73CD90C36FD}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{4DFA0802-E1CD-47A5-84F2-4DCF7CAA3E5D}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [TCP Query User{559D20C9-B379-4123-B378-7B8434500F76}C:\program files (x86)\synology\assistant\dsassistant.exe] => (Allow) C:\program files (x86)\synology\assistant\dsassistant.exe
FirewallRules: [UDP Query User{E7D2FEC7-E169-4BCB-9AB2-1934F2265D59}C:\program files (x86)\synology\assistant\dsassistant.exe] => (Allow) C:\program files (x86)\synology\assistant\dsassistant.exe
FirewallRules: [{80B837C3-05D8-4461-A067-8B624E8C054E}] => (Block) C:\program files (x86)\synology\assistant\dsassistant.exe
FirewallRules: [{F36CF667-2855-4043-B3B7-89567B1267A7}] => (Block) C:\program files (x86)\synology\assistant\dsassistant.exe
FirewallRules: [{C558AD57-96EE-4381-8139-18D626A641F0}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{97E6CC6B-42EE-4DF2-A2C3-C56D0B8431A8}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{2B337169-769E-4881-9834-D65B81D86331}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{BFBAF6D6-6FFD-4EA6-B758-358A5DC37BA5}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{B66C9F11-02C0-4654-AF48-0A30F9A65FCD}] => (Allow) C:\Program Files\MetaTrader 5\metatester64.exe
FirewallRules: [{B2059CEA-82EB-46BC-82B9-6048413F6300}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\4.0.3\DriverBooster.exe
FirewallRules: [{01DC5DA7-3F73-44EE-9F78-565D1FF4A6E2}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\4.0.3\DriverBooster.exe
FirewallRules: [{D1F591F9-C05C-4ABB-B4BE-36BE422945FE}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\4.0.3\DBDownloader.exe
FirewallRules: [{DDB444CF-3DA5-4DD4-972F-78C39F325507}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\4.0.3\DBDownloader.exe
FirewallRules: [{BF573C01-DAE9-471A-86D6-BC53824FE0FF}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\4.0.3\AutoUpdate.exe
FirewallRules: [{576EB0D0-84A9-4282-99D5-DA35D9C368FF}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\4.0.3\AutoUpdate.exe
FirewallRules: [{CC4290F2-CA10-4257-93AC-A70F15D2E23B}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\bin\FaxApplications.exe
FirewallRules: [{63BB95EC-651A-40A1-8D71-FE4E8079CF76}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\bin\DigitalWizards.exe
FirewallRules: [{6959027B-E56D-463C-B4A4-85A3382FBCEC}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\bin\SendAFax.exe
FirewallRules: [{B5A12CB2-B6A4-442B-9278-C09BA9E6F1B7}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\Bin\DeviceSetup.exe
FirewallRules: [{14133C9E-649F-409B-97AD-A88BD5D447FE}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe
FirewallRules: [{CF6428AB-AE12-4BC2-B8CF-BDF801638748}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{66E8777E-329B-4EFA-926C-634F654862C7}] => (Allow) C:\Program Files\FreeDownloadManager.ORG\Free Download Manager\fdm.exe
FirewallRules: [{27AB9154-4656-4166-AD17-F1B8A9CE6103}] => (Allow) C:\Program Files\FreeDownloadManager.ORG\Free Download Manager\fdm.exe
FirewallRules: [TCP Query User{AC1529C9-D1E3-40E9-97F2-E920DFFA2B69}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{3AD795F1-D9E7-40D6-A2C6-5FD1E01C36A8}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{476C6B89-AB1B-4AB8-A25D-4B96DB24620E}C:\users\pc\appdata\local\temp\7zs2241\enterprisedu.exe] => (Allow) C:\users\pc\appdata\local\temp\7zs2241\enterprisedu.exe
FirewallRules: [UDP Query User{5C368C4A-DEF8-4B40-A180-CA31CF7030C0}C:\users\pc\appdata\local\temp\7zs2241\enterprisedu.exe] => (Allow) C:\users\pc\appdata\local\temp\7zs2241\enterprisedu.exe
FirewallRules: [{A65269C2-EB0E-4235-AE77-19DE4F099B2E}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{CFDB8E32-773B-4E09-85FC-F8CB542CBEE4}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\Infrastructure\mms_mini.exe
FirewallRules: [{DBA0D921-40D1-480A-B52D-9CE6B8807C63}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\MobileBackupServer\mobile_backup_server.exe
FirewallRules: [{C55C871A-9A74-4B2F-945E-15DA98A7C5F0}] => (Allow) C:\Program Files (x86)\Acronis\TrueImageHome\mobile_backup_status_server.exe
FirewallRules: [{DC40FB4D-816D-4D64-B6D8-8B4C3DDC2760}] => (Allow) LPort=1688
FirewallRules: [{6F2B2AF2-B981-4F72-A86C-3715B3BEFBEA}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [TCP Query User{E2E4D0FD-53A4-416E-89D5-46A95CE8FD1E}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [UDP Query User{C8D4EBA8-C10D-4B00-B63A-D59B5AD96C32}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [TCP Query User{58B1A33B-B8A4-40ED-9A55-4C69823EC87C}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
FirewallRules: [UDP Query User{37409734-6E64-41B9-A329-D15B116F9819}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
FirewallRules: [{EEF79074-ECAA-4FB2-AF5E-35C28E7D2347}] => (Allow) LPort=1688
FirewallRules: [{189E7579-E4D2-4D12-BBC6-21BCFC3D3034}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{DD4E26E5-3A66-44DF-9402-B464F4FEB5DE}] => (Allow) LPort=2869
FirewallRules: [{EF8A7079-E24A-4335-AB31-8F752EA23F1F}] => (Allow) LPort=1900
FirewallRules: [{FC497AF5-9AFE-4FFB-AABF-B57BD9881257}] => (Allow) C:\Program Files (x86)\Opera\46.0.2597.57\opera.exe
FirewallRules: [TCP Query User{918905B2-10F9-4F62-9FE3-FE48A5987865}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{F09408DF-89D6-4CFE-A5AC-1164C79F6DCE}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{DB42AC57-EF6A-401E-86AE-5AB008492991}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{16101CF1-C822-4AB0-A05E-14B3A5AB21FD}] => (Allow) C:\Program Files (x86)\Raptr Inc\Raptr\raptr.exe
FirewallRules: [{6B6C94CD-F96F-4DBE-A1F8-7FAA1EFB0368}] => (Allow) C:\Program Files (x86)\Raptr Inc\Raptr\raptr.exe
FirewallRules: [{D1DF1A36-E93B-4D50-80B2-2E61EF3DF7A8}] => (Allow) C:\Program Files (x86)\Raptr Inc\Raptr\raptr_im.exe
FirewallRules: [{89D15F90-6E40-4CE4-A8F3-AA9774256B5D}] => (Allow) C:\Program Files (x86)\Raptr Inc\Raptr\raptr_im.exe
FirewallRules: [{BC9E082D-123C-49D3-8995-82DD96E198A8}] => (Allow) C:\Program Files (x86)\Raptr Inc\PlaysTV\playstv.exe
FirewallRules: [{3C56AAE3-4636-4C40-9A10-BA26CE5FA4D1}] => (Allow) C:\Program Files (x86)\Raptr Inc\PlaysTV\playstv.exe
FirewallRules: [{B8478DB8-6042-48DA-AE43-0AA98EC4CFDB}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{6257AE2E-EB5E-42D6-9E43-651EEA231E06}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{FE7C408D-ED2D-494F-948D-CC26654025DC}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{D7023797-98A7-4DAE-87AA-86C65F07BA67}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe

==================== Restore Points =========================

ATTENTION: System Restore is disabled
Check "winmgmt" service or repair WMI.


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/22/2017 12:00:23 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "I:\Scan and Repair u aufräumen - Mail-Adware-Troja-etc\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.

Error: (07/22/2017 12:00:18 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Users\*WIR*\Downloads\Scan and Repair u aufräumen - Mail-Adware-Troja-etc\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.

Error: (07/22/2017 11:18:35 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Service_KMS.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.IO.IOException
   bei System.IO.__Error.WinIOError(Int32, System.String)
   bei System.IO.FileStream.Init(System.String, System.IO.FileMode, System.IO.FileAccess, Int32, Boolean, System.IO.FileShare, Int32, System.IO.FileOptions, SECURITY_ATTRIBUTES, System.String, Boolean, Boolean, Boolean)
   bei System.IO.FileStream..ctor(System.String, System.IO.FileMode, System.IO.FileAccess, System.IO.FileShare, Int32, System.IO.FileOptions, System.String, Boolean, Boolean, Boolean)
   bei System.IO.StreamWriter.CreateFile(System.String, Boolean, Boolean)
   bei System.IO.StreamWriter..ctor(System.String, Boolean, System.Text.Encoding, Int32, Boolean)
   bei System.IO.StreamWriter..ctor(System.String, Boolean, System.Text.Encoding)
   bei System.IO.File.InternalAppendAllText(System.String, System.String, System.Text.Encoding)
   bei Service_KMS.Logging.FileLogger.LogMessage(System.String)
   bei Service_KMS.Service.ScheduledTask()
   bei Service_KMS.Service.TaskLoop()
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   bei System.Threading.ThreadHelper.ThreadStart()

Error: (07/22/2017 11:17:07 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Users\*WIR*\Downloads\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.

Error: (07/22/2017 11:17:07 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Users\*WIR*\Downloads\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.

Error: (07/22/2017 10:20:13 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Service_KMS.exe, Version: 11.0.0.0, Zeitstempel: 0x52a8d15d
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0x00000000
Fehleroffset: 0x00007ffb04090668
ID des fehlerhaften Prozesses: 0xab8
Startzeit der fehlerhaften Anwendung: 0x01d302babaef1531
Pfad der fehlerhaften Anwendung: C:\Program Files\KMSpico\Service_KMS.exe
Pfad des fehlerhaften Moduls: unknown
Berichtskennung: 3399d0a0-6eae-11e7-82a7-7824afd93019
Vollständiger Name des fehlerhaften Pakets: 
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (07/21/2017 11:06:09 PM) (Source: Perflib) (EventID: 1023) (User: )
Description: Die erweiterbare Leistungsindikator-DLL rdyboost kann nicht geladen werden. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Windows-Fehlercode.

Error: (07/21/2017 11:05:58 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: Die Open-Prozedur für den Dienst "BITS" in der DLL "C:\Windows\System32\bitsperf.dll" war nicht erfolgreich. Die Leistungsdaten für diesen Dienst sind nicht verfügbar. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Fehlercode.

Error: (07/21/2017 11:05:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Service_KMS.exe, Version: 11.0.0.0, Zeitstempel: 0x52a8d15d
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0x00000000
Fehleroffset: 0x00007ffe8e550668
ID des fehlerhaften Prozesses: 0xad0
Startzeit der fehlerhaften Anwendung: 0x01d3025c6152da68
Pfad der fehlerhaften Anwendung: C:\Program Files\KMSpico\Service_KMS.exe
Pfad des fehlerhaften Moduls: unknown
Berichtskennung: f1ca1c0c-6e4f-11e7-82a6-7824afd93019
Vollständiger Name des fehlerhaften Pakets: 
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (07/21/2017 09:46:39 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Users\CODODE~1\AppData\Local\Temp\{3c3aafc8-d898-43ec-998f-965ffdae065a}\.be\vcredist_x64.exe -q -burn.elevated BurnPipe.{FDDD190D-7283-4423-849D-31FA07A22B31} {CE849FAB-AA21-487E-B6A3-DE3BEC01B162} 5820; Beschreibung = Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501; Fehler = 0x80070422).


System errors:
=============
Error: (07/22/2017 11:18:37 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Service KMSELDI" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/22/2017 10:18:34 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Seagate Scheduler2 Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
Das System kann die angegebene Datei nicht finden.

Error: (07/22/2017 10:18:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Service Installer TrueKey" wurde aufgrund folgenden Fehlers nicht gestartet: 
Das System kann die angegebene Datei nicht finden.

Error: (07/22/2017 10:18:10 AM) (Source: Microsoft-Windows-Directory-Services-SAM) (EventID: 16953) (User: NT-AUTORITÄT)
Description: Fehler "126" beim Laden der Kennwortbenachrichtigungs-DLL ""C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter"". Stellen Sie sicher, dass der in der Registrierung definierte DLL-Pfad "HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages" sich auf einen korrekten und absoluten Pfad (<Laufwerk>:\<Pfad>\<Dateiname>.<Erw.>) bezieht und nicht auf einen relativen oder ungültigen Pfad. Wenn der DLL-Pfad falsch ist, stellen Sie sicher, dass sich alle Hilfsdateien im gleichen Verzeichnis befinden und dass das Systemkonto sowohl auf den DLL-Pfad als auch die Hilfsdateien Lesezugriff hat.  Wenden Sie sich an den Anbieter der Benachrichtigungs-DLL, um weitere Unterstützung zu erhalten. Weitere Informationen finden Sie im Internet unter "hxxp://go.microsoft.com/fwlink/?LinkId=245898".

Error: (07/21/2017 11:20:36 PM) (Source: SbieDrv) (EventID: 1412) (User: )
Description: SBIE1412 Im Text: [DefaultBox] \??\%SystemDrive%\Sandbox\%USER%\%SANDBOX%

Error: (07/21/2017 11:20:36 PM) (Source: SbieDrv) (EventID: 1406) (User: )
Description: SBIE1406 Falsche oder ungültige Erweiterung für SystemDrive: [C0000189]

Error: (07/21/2017 11:05:06 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: Der Server "{DDCFD26B-FEED-44CD-B71D-79487D2E5E5A}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (07/21/2017 11:03:11 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Seagate Scheduler2 Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
Das System kann die angegebene Datei nicht finden.

Error: (07/21/2017 11:03:06 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Service Installer TrueKey" wurde aufgrund folgenden Fehlers nicht gestartet: 
Das System kann die angegebene Datei nicht finden.

Error: (07/21/2017 11:02:50 PM) (Source: Microsoft-Windows-Directory-Services-SAM) (EventID: 16953) (User: NT-AUTORITÄT)
Description: Fehler "126" beim Laden der Kennwortbenachrichtigungs-DLL ""C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter"". Stellen Sie sicher, dass der in der Registrierung definierte DLL-Pfad "HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages" sich auf einen korrekten und absoluten Pfad (<Laufwerk>:\<Pfad>\<Dateiname>.<Erw.>) bezieht und nicht auf einen relativen oder ungültigen Pfad. Wenn der DLL-Pfad falsch ist, stellen Sie sicher, dass sich alle Hilfsdateien im gleichen Verzeichnis befinden und dass das Systemkonto sowohl auf den DLL-Pfad als auch die Hilfsdateien Lesezugriff hat.  Wenden Sie sich an den Anbieter der Benachrichtigungs-DLL, um weitere Unterstützung zu erhalten. Weitere Informationen finden Sie im Internet unter "hxxp://go.microsoft.com/fwlink/?LinkId=245898".


==================== Memory info =========================== 

Processor: AMD Athlon(tm) II X4 640 Processor
Percentage of memory in use: 28%
Total physical RAM: 12204.32 MB
Available physical RAM: 8675.74 MB
Total Virtual: 14060.32 MB
Available Virtual: 9045.41 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.42 GB) (Free:403.49 GB) NTFS
Drive m: () (Network) (Total:1829.25 GB) (Free:798.98 GB) 
Drive n: () (Network) (Total:1829.25 GB) (Free:798.98 GB) 
Drive o: () (Network) (Total:1829.25 GB) (Free:798.98 GB) 
Drive p: () (Network) (Total:1829.25 GB) (Free:798.98 GB) 
Drive q: () (Network) (Total:1829.25 GB) (Free:798.98 GB) 
Drive r: () (Network) (Total:1829.25 GB) (Free:798.98 GB) 
Drive s: () (Network) (Total:1829.25 GB) (Free:798.98 GB) 
Drive t: () (Network) (Total:1829.25 GB) (Free:798.98 GB) 
Drive u: () (Network) (Total:1829.25 GB) (Free:798.98 GB) 
Drive v: () (Network) (Total:1829.25 GB) (Free:798.98 GB) 
Drive w: () (Network) (Total:1829.25 GB) (Free:798.98 GB) 
Drive x: () (Network) (Total:1829.25 GB) (Free:798.98 GB) 
Drive y: () (Network) (Total:1829.25 GB) (Free:798.98 GB) 
Drive z: () (Network) (Total:1829.25 GB) (Free:798.98 GB) 

==================== MBR & Partition Table ==================

==================== End of Addition.txt ============================
         

Malwarebytes

-Protokolldetails-
Scan-Datum: 22.07.17
Scan-Zeit: 13:09
Protokolldatei: Bericht Malwarebytes.txt
Administrator: Nein

-Softwaredaten-
Version: 3.1.2.1733
Komponentenversion: 1.0.160
Version des Aktualisierungspakets: 1.0.2414
Lizenz: Testversion

-Systemdaten-
Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Pc-Pc\C*****

-Scan-Ãœbersicht-
Scan-Typ: Bedrohungs-Scan
Ergebnis: Abgeschlossen
Gescannte Objekte: 476393
Erkannte Bedrohungen: 0
(keine bösartigen Elemente erkannt)
In die Quarantäne verschobene Bedrohungen: 0
(keine bösartigen Elemente erkannt)
Abgelaufene Zeit: 13 Min., 18 Sek.

-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

-Scan-Details-
Prozess: 0
(keine bösartigen Elemente erkannt)

Modul: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)

Registrierungswert: 0
(keine bösartigen Elemente erkannt)

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Daten-Stream: 0
(keine bösartigen Elemente erkannt)

Ordner: 0
(keine bösartigen Elemente erkannt)

Datei: 0
(keine bösartigen Elemente erkannt)

Physischer Sektor: 0
(keine bösartigen Elemente erkannt)


(end)
         

Free Antivirus
Erstellungsdatum der Reportdatei: Samstag, 22. Juli 2017  13:05


Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer   : Free
Seriennummer   : 0000149996-AVHOE-0000001
Plattform      : Windows 8.1 Pro
Windowsversion : (plain)  [6.3.9600]
Boot Modus     : Normal gebootet
Benutzername   : SYSTEM
Computername   : PC-PC

Versionsinformationen:
build.dat      : 15.0.28.28    108724 Bytes  04.07.2017 13:28:00
AVSCAN.EXE     : 15.0.28.21   1558488 Bytes  20.07.2017 12:49:35
AVSCANRC.DLL   : 15.0.28.14     73768 Bytes  20.07.2017 12:49:35
LUKE.DLL       : 15.0.28.17     82144 Bytes  20.07.2017 12:50:01
AVSCPLR.DLL    : 15.0.28.21    156376 Bytes  20.07.2017 12:49:36
REPAIR.DLL     : 15.0.28.21    689944 Bytes  20.07.2017 12:49:34
repair.rdf     : 1.0.29.24    2690074 Bytes  20.07.2017 12:54:36
AVREG.DLL      : 15.0.28.17    455608 Bytes  20.07.2017 12:49:34
avlode.dll     : 15.0.28.23    867056 Bytes  20.07.2017 12:49:33
avlode.rdf     : 14.0.5.130    168771 Bytes  20.07.2017 12:54:36
XBV00006.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:50
XBV00007.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:50
XBV00008.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:50
XBV00009.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:50
XBV00010.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:50
XBV00011.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:50
XBV00012.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:50
XBV00013.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:51
XBV00014.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:51
XBV00015.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:51
XBV00016.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:51
XBV00017.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:51
XBV00018.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:51
XBV00019.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:51
XBV00020.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:51
XBV00021.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:51
XBV00022.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:52
XBV00023.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:52
XBV00024.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:52
XBV00025.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:52
XBV00026.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:52
XBV00027.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:52
XBV00028.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:52
XBV00029.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:52
XBV00030.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:52
XBV00031.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:52
XBV00032.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:52
XBV00033.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:53
XBV00034.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:53
XBV00035.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:53
XBV00036.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:53
XBV00037.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:53
XBV00038.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:54
XBV00039.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:54
XBV00040.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:54
XBV00041.VDF   : 8.14.1.166      2048 Bytes  25.04.2017 12:53:54
XBV00123.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:16
XBV00124.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:16
XBV00125.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:16
XBV00126.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:16
XBV00127.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:16
XBV00128.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:16
XBV00129.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:16
XBV00130.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:16
XBV00131.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:16
XBV00132.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:16
XBV00133.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:16
XBV00134.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:16
XBV00135.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:16
XBV00136.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:17
XBV00137.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:18
XBV00138.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:18
XBV00139.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:18
XBV00140.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:18
XBV00141.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:19
XBV00142.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:19
XBV00143.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:20
XBV00144.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:20
XBV00145.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:21
XBV00146.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:22
XBV00147.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:22
XBV00148.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:22
XBV00149.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:22
XBV00150.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:22
XBV00151.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:23
XBV00152.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:23
XBV00153.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:23
XBV00154.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:23
XBV00155.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:23
XBV00156.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:23
XBV00157.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00158.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00159.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00160.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00161.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00162.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00163.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00164.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00165.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00166.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00167.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00168.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00169.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00170.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00171.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00172.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00173.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00174.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00175.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00176.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00177.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00178.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00179.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00180.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:24
XBV00181.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00182.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00183.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00184.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00185.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00186.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00187.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00188.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00189.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00190.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00191.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00192.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00193.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00194.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00195.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00196.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00197.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00198.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00199.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00200.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00201.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00202.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00203.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00204.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00205.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00206.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00207.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:25
XBV00208.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00209.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00210.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00211.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00212.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00213.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00214.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00215.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00216.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00217.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00218.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00219.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00220.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00221.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00222.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00223.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00224.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00225.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00226.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00227.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00228.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00229.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00230.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00231.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00232.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00233.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00234.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:26
XBV00235.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:27
XBV00236.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:27
XBV00237.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:27
XBV00238.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:27
XBV00239.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:27
XBV00240.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:27
XBV00241.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:27
XBV00242.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:27
XBV00243.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:27
XBV00244.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:27
XBV00245.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:27
XBV00246.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:27
XBV00247.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:27
XBV00248.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:27
XBV00249.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:27
XBV00250.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:27
XBV00251.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:27
XBV00252.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:27
XBV00253.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:27
XBV00254.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:27
XBV00255.VDF   : 8.14.17.36      2048 Bytes  13.07.2017 12:54:27
XBV00000.VDF   : 7.14.1.132  155588096 Bytes  25.04.2017 12:53:20
XBV00001.VDF   : 7.14.1.133      2048 Bytes  25.04.2017 12:53:22
XBV00002.VDF   : 7.14.1.134      2048 Bytes  25.04.2017 12:53:22
XBV00003.VDF   : 8.14.8.104  12961280 Bytes  21.05.2017 12:53:38
XBV00004.VDF   : 8.14.13.24   5747200 Bytes  18.06.2017 12:53:44
XBV00005.VDF   : 8.14.17.36   5194752 Bytes  13.07.2017 12:53:50
XBV00042.VDF   : 8.14.17.38     18432 Bytes  13.07.2017 12:53:54
XBV00043.VDF   : 8.14.17.50    137728 Bytes  14.07.2017 12:53:54
XBV00044.VDF   : 8.14.17.58      2048 Bytes  14.07.2017 12:53:54
XBV00045.VDF   : 8.14.17.64     17920 Bytes  14.07.2017 12:53:54
XBV00046.VDF   : 8.14.17.70     13824 Bytes  14.07.2017 12:53:54
XBV00047.VDF   : 8.14.17.76      2048 Bytes  14.07.2017 12:53:54
XBV00048.VDF   : 8.14.17.82   1463808 Bytes  14.07.2017 12:53:56
XBV00049.VDF   : 8.14.17.92     58368 Bytes  14.07.2017 12:53:56
XBV00050.VDF   : 8.14.17.98     18944 Bytes  14.07.2017 12:53:56
XBV00051.VDF   : 8.14.17.104    17920 Bytes  14.07.2017 12:53:56
XBV00052.VDF   : 8.14.17.106     9728 Bytes  14.07.2017 12:53:56
XBV00053.VDF   : 8.14.17.108    26624 Bytes  14.07.2017 12:53:56
XBV00054.VDF   : 8.14.17.130   157696 Bytes  15.07.2017 12:53:57
XBV00055.VDF   : 8.14.17.140  1463296 Bytes  15.07.2017 12:53:58
XBV00056.VDF   : 8.14.17.150    26624 Bytes  15.07.2017 12:53:58
XBV00057.VDF   : 8.14.17.160    19456 Bytes  15.07.2017 12:53:58
XBV00058.VDF   : 8.14.17.170    26112 Bytes  15.07.2017 12:53:58
XBV00059.VDF   : 8.14.17.172   128512 Bytes  16.07.2017 12:53:58
XBV00060.VDF   : 8.14.17.174    22016 Bytes  16.07.2017 12:53:58
XBV00061.VDF   : 8.14.17.176    17408 Bytes  16.07.2017 12:53:59
XBV00062.VDF   : 8.14.17.178  1463296 Bytes  16.07.2017 12:54:00
XBV00063.VDF   : 8.14.17.180    13824 Bytes  16.07.2017 12:54:00
XBV00064.VDF   : 8.14.17.182    95744 Bytes  17.07.2017 12:54:00
XBV00065.VDF   : 8.14.17.184     8704 Bytes  17.07.2017 12:54:00
XBV00066.VDF   : 8.14.17.186  1463808 Bytes  17.07.2017 12:54:02
XBV00067.VDF   : 8.14.17.188    16384 Bytes  17.07.2017 12:54:02
XBV00068.VDF   : 8.14.17.190     7680 Bytes  17.07.2017 12:54:02
XBV00069.VDF   : 8.14.17.194    16896 Bytes  17.07.2017 12:54:02
XBV00070.VDF   : 8.14.17.196    11264 Bytes  17.07.2017 12:54:03
XBV00071.VDF   : 8.14.17.198  1463808 Bytes  17.07.2017 12:54:05
XBV00072.VDF   : 8.14.17.200    26112 Bytes  17.07.2017 12:54:06
XBV00073.VDF   : 8.14.17.204    44544 Bytes  17.07.2017 12:54:06
XBV00074.VDF   : 8.14.17.206    22016 Bytes  17.07.2017 12:54:06
XBV00075.VDF   : 8.14.17.208     8192 Bytes  17.07.2017 12:54:06
XBV00076.VDF   : 8.14.17.212    92160 Bytes  18.07.2017 12:54:06
XBV00077.VDF   : 8.14.17.214    12288 Bytes  18.07.2017 12:54:06
XBV00078.VDF   : 8.14.17.216    22528 Bytes  18.07.2017 12:54:06
XBV00079.VDF   : 8.14.17.218  1463296 Bytes  18.07.2017 12:54:08
XBV00080.VDF   : 8.14.17.220    31744 Bytes  18.07.2017 12:54:08
XBV00081.VDF   : 8.14.17.222     6144 Bytes  18.07.2017 12:54:08
XBV00082.VDF   : 8.14.17.224  1463808 Bytes  18.07.2017 12:54:09
XBV00083.VDF   : 8.14.17.236    31232 Bytes  18.07.2017 12:54:09
XBV00084.VDF   : 8.14.17.244    11264 Bytes  18.07.2017 12:54:09
XBV00085.VDF   : 8.14.17.252    13312 Bytes  18.07.2017 12:54:09
XBV00086.VDF   : 8.14.18.6     116224 Bytes  19.07.2017 12:54:10
XBV00087.VDF   : 8.14.18.8      11264 Bytes  19.07.2017 12:54:10
XBV00088.VDF   : 8.14.18.10     14848 Bytes  19.07.2017 12:54:10
XBV00089.VDF   : 8.14.18.12     22528 Bytes  19.07.2017 12:54:10
XBV00090.VDF   : 8.14.18.14     14848 Bytes  19.07.2017 12:54:10
XBV00091.VDF   : 8.14.18.16   1463296 Bytes  19.07.2017 12:54:11
XBV00092.VDF   : 8.14.18.22     34816 Bytes  19.07.2017 12:54:11
XBV00093.VDF   : 8.14.18.24     13824 Bytes  19.07.2017 12:54:11
XBV00094.VDF   : 8.14.18.26   1463808 Bytes  19.07.2017 12:54:13
XBV00095.VDF   : 8.14.18.28     29184 Bytes  19.07.2017 12:54:13
XBV00096.VDF   : 8.14.18.30     12288 Bytes  19.07.2017 12:54:13
XBV00097.VDF   : 8.14.18.34    128000 Bytes  20.07.2017 12:54:13
XBV00098.VDF   : 8.14.18.36     14848 Bytes  20.07.2017 12:54:13
XBV00099.VDF   : 8.14.18.38      8192 Bytes  20.07.2017 12:54:14
XBV00100.VDF   : 8.14.18.42   1463808 Bytes  20.07.2017 12:54:15
XBV00101.VDF   : 8.14.18.44     26112 Bytes  20.07.2017 12:54:15
XBV00102.VDF   : 8.14.18.46     16384 Bytes  20.07.2017 08:26:59
XBV00103.VDF   : 8.14.18.48   1463296 Bytes  20.07.2017 08:27:00
XBV00104.VDF   : 8.14.18.50     22016 Bytes  20.07.2017 08:27:00
XBV00105.VDF   : 8.14.18.52   1463808 Bytes  20.07.2017 08:27:01
XBV00106.VDF   : 8.14.18.54     20992 Bytes  20.07.2017 08:27:01
XBV00107.VDF   : 8.14.18.56      7680 Bytes  20.07.2017 08:27:01
XBV00108.VDF   : 8.14.18.58      8192 Bytes  20.07.2017 08:27:02
XBV00109.VDF   : 8.14.18.62     96768 Bytes  21.07.2017 08:27:02
XBV00110.VDF   : 8.14.18.64      2048 Bytes  21.07.2017 08:27:02
XBV00111.VDF   : 8.14.18.66   1463296 Bytes  21.07.2017 10:27:26
XBV00112.VDF   : 8.14.18.68     24064 Bytes  21.07.2017 10:27:26
XBV00113.VDF   : 8.14.18.70     24064 Bytes  21.07.2017 12:26:54
XBV00114.VDF   : 8.14.18.72     17408 Bytes  21.07.2017 12:26:54
XBV00115.VDF   : 8.14.18.74   1463296 Bytes  21.07.2017 16:26:57
XBV00116.VDF   : 8.14.18.76     40448 Bytes  21.07.2017 16:26:57
XBV00117.VDF   : 8.14.18.78     13824 Bytes  21.07.2017 16:26:57
XBV00118.VDF   : 8.14.18.80     13824 Bytes  21.07.2017 18:26:56
XBV00119.VDF   : 8.14.18.82     13312 Bytes  21.07.2017 18:26:56
XBV00120.VDF   : 8.14.18.84     14848 Bytes  21.07.2017 07:28:32
XBV00121.VDF   : 8.14.18.86     16896 Bytes  21.07.2017 07:28:32
XBV00122.VDF   : 8.14.18.92    109568 Bytes  22.07.2017 09:28:30
LOCAL001.VDF   : 8.14.18.92  186957312 Bytes  22.07.2017 09:28:55
Engineversion  : 8.3.44.104
AEBB.DLL       : 8.1.3.0        59296 Bytes  25.08.2016 13:12:33
AECORE.DLL     : 8.3.12.8      262328 Bytes  20.07.2017 12:54:27
AECRYPTO.DLL   : 8.2.1.0       129904 Bytes  14.10.2016 10:55:22
AEDROID.DLL    : 8.4.3.392    2746280 Bytes  16.11.2016 14:22:00
AEEMU.DLL      : 8.1.3.8       404328 Bytes  25.08.2016 13:12:33
AEEXP.DLL      : 8.4.4.26      353752 Bytes  20.07.2017 12:54:34
AEGEN.DLL      : 8.1.8.322     678648 Bytes  20.07.2017 12:54:28
AEHELP.DLL     : 8.3.2.12      284584 Bytes  20.07.2017 12:54:28
AEHEUR.DLL     : 8.1.4.2952  11184320 Bytes  20.07.2017 12:54:31
AELIBINF.DLL   : 8.2.1.4        68464 Bytes  25.08.2016 13:12:33
AEMOBILE.DLL   : 8.1.18.4      346872 Bytes  20.07.2017 12:54:35
AEOFFICE.DLL   : 8.3.7.4       614096 Bytes  20.07.2017 12:54:32
AEPACK.DLL     : 8.4.2.70      835856 Bytes  20.07.2017 12:54:32
AERDL.DLL      : 8.2.2.36      835848 Bytes  20.07.2017 12:54:33
AESBX.DLL      : 8.2.22.10    1665568 Bytes  20.07.2017 12:54:34
AESCN.DLL      : 8.3.4.8       152768 Bytes  20.07.2017 12:54:33
AESCRIPT.DLL   : 8.3.2.182     906504 Bytes  20.07.2017 12:54:34
AEVDF.DLL      : 8.3.3.4       142184 Bytes  25.08.2016 13:12:33
AVWINLL.DLL    : 15.0.28.14     37448 Bytes  20.07.2017 12:49:28
AVPREF.DLL     : 15.0.28.14     63920 Bytes  20.07.2017 12:49:34
AVREP.DLL      : 15.0.28.14    234888 Bytes  20.07.2017 12:49:34
AVARKT.DLL     : 15.0.28.14    241096 Bytes  20.07.2017 12:49:30
SQLITE3.DLL    : 15.0.28.14    473256 Bytes  20.07.2017 12:50:06
AVSMTP.DLL     : 15.0.28.14     90392 Bytes  20.07.2017 12:49:37
NETNT.DLL      : 15.0.28.14     26568 Bytes  20.07.2017 12:50:01
CommonImageRc.dll: 15.0.28.14   3878048 Bytes  20.07.2017 12:49:29
CommonTextRc.dll: 15.0.28.14     82080 Bytes  20.07.2017 12:49:29

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Schnelle Prüfung
Konfigurationsdatei...................: C:\Program Files (x86)\Avira\Antivirus\quicksysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: Interaktiv
Sekundäre Aktion......................: Ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Prüfe alle Dateien....................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Abweichende Archivtypen...............: +, +, +, +, +, +, +, +, 
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Auszulassende Dateien.................: 
Abweichende Gefahrenkategorien........: +APPL,+GAME,+JOKE,+SPR,

Beginn des Suchlaufs: Samstag, 22. Juli 2017  13:05

Der Suchlauf über die Bootsektoren wird begonnen:

Der Suchlauf nach versteckten Objekten wird begonnen.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'dwm.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'atiesrxx.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '93' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '166' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'atieclxx.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '90' Modul(e) wurden durchsucht
Durchsuche Prozess 'SbieSvc.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '91' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'winwfpmonitor.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '80' Modul(e) wurden durchsucht
Durchsuche Prozess 'schedul2.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'afcdpsrv.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'Fuel.Service.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '126' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.VpnService.exe' - '83' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.SoftwareUpdater.ServiceHost.exe' - '135' Modul(e) wurden durchsucht
Durchsuche Prozess 'OfficeClickToRun.exe' - '91' Modul(e) wurden durchsucht
Durchsuche Prozess 'CybereasonRansomFreeServiceHost.exe' - '100' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'dashost.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'app_updater.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'DTSU2PAuSrv64.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'LiveUpdate.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'creator-ws.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'Architect Manager.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.SystemSpeedup.SpeedupService.exe' - '135' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'TeamViewer_Service.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'McAfee.TrueKey.Service.exe' - '139' Modul(e) wurden durchsucht
Durchsuche Prozess 'McTkSchedulerService.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'UsbClientService.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.ServiceHost.exe' - '111' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamservice.exe' - '101' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'WUDFHost.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'WUDFHost.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.SystemSpeedup.UI.Systray.exe' - '120' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhostex.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'CybereasonRansomFree.exe' - '115' Modul(e) wurden durchsucht
Durchsuche Prozess 'TeamViewer.exe' - '96' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '272' Modul(e) wurden durchsucht
Durchsuche Prozess 'DllHost.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'ClassicStartMenu.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'tv_w32.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'tv_x64.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'cnext.exe' - '111' Modul(e) wurden durchsucht
Durchsuche Prozess 'RtkNGUI64.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'RAVBg64.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'schedhlp.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamtray.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'Skype.exe' - '183' Modul(e) wurden durchsucht
Durchsuche Prozess 'Duplicati.GUI.TrayIcon.exe' - '81' Modul(e) wurden durchsucht
Durchsuche Prozess 'ONENOTEM.EXE' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'TrueImageMonitor.exe' - '96' Modul(e) wurden durchsucht
Durchsuche Prozess 'pdf24.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'MOM.exe' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'CCC.exe' - '228' Modul(e) wurden durchsucht
Durchsuche Prozess 'raptr.exe' - '154' Modul(e) wurden durchsucht
Durchsuche Prozess 'raptr_im.exe' - '105' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.Systray.exe' - '128' Modul(e) wurden durchsucht
Durchsuche Prozess 'HPSupportSolutionsFrameworkService.exe' - '85' Modul(e) wurden durchsucht
Durchsuche Prozess 'raptr_ep64.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'mobile_backup_server.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'mobile_backup_status_server.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'syncagentsrv.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '148' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'AutoPico.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'notepad.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'notepad.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '122' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbam.exe' - '106' Modul(e) wurden durchsucht
Durchsuche Prozess 'WORDPAD.EXE' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '15' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '36' Modul(e) wurden durchsucht

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Datei wurde im Zwischenspeicher in 'C:\Windows\SysWOW64\xvidvfw.dll' gefunden; der Scan Cloud-Sicherheit wurde übersprungen. SHA256 = F8FC29DA0EF241D04D50E39FAD030F56CBE16BDFA3635D74F1A3A1CDBF6F7B30
Die Datei wurde im Zwischenspeicher in 'C:\Program Files (x86)\Clementine\Uninstall.exe' gefunden; der Scan Cloud-Sicherheit wurde übersprungen. SHA256 = F9E5BD518C97C168D96B393D8DBC397C9583872C315C18954E030DDFEAF56012
Die Datei wurde im Zwischenspeicher in 'C:\Program Files\KMSpico\Service_KMS.exe' gefunden; der Scan Cloud-Sicherheit wurde übersprungen. SHA256 = 3656E89F194BD27CD67D4F06A4A01E005F129E77E478F953AC1DE53D168CD9A9
Die Registry wurde durchsucht ( '16597' Dateien ).



Ende des Suchlaufs: Samstag, 22. Juli 2017  13:23
Benötigte Zeit: 17:31 Minute(n)

Der Suchlauf wurde vollständig durchgeführt.

   1944 Verzeichnisse wurden überprüft
  18469 Dateien wurden geprüft
      0 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      0 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
  18469 Dateien ohne Befall
    362 Archive wurden durchsucht
      0 Warnungen
      0 Hinweise
 234509 Objekte wurden beim Rootkitscan durchsucht
      0 Versteckte Objekte wurden gefunden
         

OK Verstanden.
Jetzt nochmal mit admin-rechten



FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 18-07-2017
Ran by Pc (administrator) on PC-PC (22-07-2017 21:27:44)
Running from I:\Scan and Repair u aufräumen - Mail-Adware-Troja-etc
Loaded Profiles: Pc & Codo der III &  (Available Profiles: Pc & Codo der III & janka & test)
Platform: Windows 8.1 Pro (Update) (X64) Language: Englisch (Vereinigte Staaten)
Internet Explorer Version 11 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe
() C:\Program Files\FreeDownloadManager.ORG\Free Download Manager\winwfpmonitor.exe
() C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
() C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\SoftwareUpdater\Avira.SoftwareUpdater.ServiceHost.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Cybereason) C:\Program Files (x86)\Cybereason\RansomFree\CybereasonRansomFreeServiceHost.exe
(Digital Wave Ltd.) C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe
(DTS, Inc) C:\Program Files\Realtek\Audio\HDA\DTSU2PAuSrv64.exe
(IObit) C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe
(pdfforge GmbH) C:\Program Files\PDF Architect 5\creator-ws.exe
(© pdfforge GmbH.) C:\Program Files (x86)\PDF Architect 5 Manager\PDF Architect 5\Architect Manager.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.SpeedupService.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(McAfee, Inc.) C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe
(McAfee, Inc.) C:\Program Files\TrueKey\McTkSchedulerService.exe
() C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.Systray.exe
(Cybereason) C:\Program Files (x86)\Cybereason\RansomFree\CybereasonRansomFree.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\cnext.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Duplicati Team) C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
() C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr Inc\Raptr\raptr.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr Inc\Raptr\raptr_im.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Raptr Inc.) C:\Program Files (x86)\Raptr Inc\Raptr\raptr_ep64.exe
(Acronis International GmbH) C:\Program Files (x86)\Common Files\Acronis\MobileBackupServer\mobile_backup_server.exe
() C:\Program Files (x86)\Acronis\TrueImageHome\mobile_backup_status_server.exe
() C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
() C:\Program Files\KMSpico\AutoPico.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\cnext.exe [4926664 2016-02-26] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [Seagate Scheduler2 Service] => "C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedhlp.exe"
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8484056 2015-06-12] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_DTS] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1393880 2015-04-28] (Realtek Semiconductor)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [585240 2016-09-13] ()
HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [163800 2016-07-30] (IvoSoft)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [3146704 2017-05-09] (Malwarebytes)
HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [425352 2016-06-03] (Acronis International GmbH)
HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [97512 2017-06-13] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [918008 2017-07-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [3191728 2017-06-09] (Dominik Reichl)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [4654664 2016-09-13] ()
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [210432 2016-07-05] (Geek Software GmbH)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr Inc\Raptr\raptrstub.exe [58584 2017-05-30] (Raptr, Inc)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-07-12] (Oracle Corporation)
HKLM-x32\...\Run: [Avira System Speedup User Starter] => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe [66656 2017-06-28] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130903917\Control Panel\Desktop\\SCRNSAVE.EXE -> 
HKU\S-1-5-21-223189139-1834683237-3245993289-1001\...\Run: [Viber] => C:\Users\Pc\AppData\Local\Viber\Viber.exe [776400 2015-02-25] ()
HKU\S-1-5-21-223189139-1834683237-3245993289-1001\...\Run: [Google Update] => C:\Users\Pc\AppData\Local\Google\Update\1.3.33.5\GoogleUpdateCore.exe [601168 2017-07-20] (Google Inc.)
HKU\S-1-5-21-223189139-1834683237-3245993289-1001\...\Run: [updater] => "C:\Users\Pc\AppData\Local\Temp\MUpdater.exe" startup <==== ATTENTION
HKU\S-1-5-21-223189139-1834683237-3245993289-1001\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [798352 2016-09-22] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-223189139-1834683237-3245993289-1001\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-223189139-1834683237-3245993289-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27784672 2017-06-27] (Skype Technologies S.A.)
HKU\S-1-5-21-223189139-1834683237-3245993289-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130904677\...\Run: [Viber] => C:\Users\Pc\AppData\Local\Viber\Viber.exe [776400 2015-02-25] ()
HKU\S-1-5-21-223189139-1834683237-3245993289-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130904677\...\Run: [Google Update] => C:\Users\Pc\AppData\Local\Google\Update\1.3.33.5\GoogleUpdateCore.exe [601168 2017-07-20] (Google Inc.)
HKU\S-1-5-21-223189139-1834683237-3245993289-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130904677\...\Run: [updater] => "C:\Users\Pc\AppData\Local\Temp\MUpdater.exe" startup <==== ATTENTION
HKU\S-1-5-21-223189139-1834683237-3245993289-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130904677\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [798352 2016-09-22] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-223189139-1834683237-3245993289-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130904677\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-223189139-1834683237-3245993289-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130904677\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27784672 2017-06-27] (Skype Technologies S.A.)
HKU\S-1-5-21-223189139-1834683237-3245993289-1002\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-223189139-1834683237-3245993289-1002\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27784672 2017-06-27] (Skype Technologies S.A.)
HKU\S-1-5-21-223189139-1834683237-3245993289-1002\...\Run: [GIMP Updater] => C:\Users\Codo der III\AppData\Roaming\GIMP Updater\Updater.exe [227488 2016-10-09] ()
HKU\S-1-5-21-223189139-1834683237-3245993289-1002\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [798352 2016-09-22] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-223189139-1834683237-3245993289-1002\...\Run: [GoogleChromeAutoLaunch_E702579D22BBCD5513EBCBD038CBA7E5] => "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window /prefetch:5
HKU\S-1-5-21-223189139-1834683237-3245993289-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130905270\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-223189139-1834683237-3245993289-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130905270\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27784672 2017-06-27] (Skype Technologies S.A.)
HKU\S-1-5-21-223189139-1834683237-3245993289-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130905270\...\Run: [GIMP Updater] => C:\Users\Codo der III\AppData\Roaming\GIMP Updater\Updater.exe [227488 2016-10-09] ()
HKU\S-1-5-21-223189139-1834683237-3245993289-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130905270\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [798352 2016-09-22] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-223189139-1834683237-3245993289-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130905270\...\Run: [GoogleChromeAutoLaunch_E702579D22BBCD5513EBCBD038CBA7E5] => "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window /prefetch:5
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE -> 
Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter "C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Duplicati 2.lnk [2017-07-21]
ShortcutTarget: Duplicati 2.lnk -> C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe (Duplicati Team)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\E-POST CLOUD.lnk [2016-10-02]
ShortcutTarget: E-POST CLOUD.lnk -> C:\Program Files (x86)\E-POST\EPostCloud.exe (Deutsche Post AG)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\E-POST MAILER.lnk [2016-10-02]
ShortcutTarget: E-POST MAILER.lnk -> C:\Program Files (x86)\E-POST\EpostMailer.exe (Deutsche Post AG))
Startup: C:\Users\Codo der III\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2016-11-23]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2016-10-04]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
BootExecute: autocheck autochk * auto_reactivate C:\bootwiz\asrm.bin

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\..\Interfaces\{CFEF567D-2932-4AFD-94FE-266AF7F6A876}: [NameServer] 192.168.10.1

Internet Explorer:
==================
HKU\S-1-5-21-223189139-1834683237-3245993289-1002\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/el-gr/?ocid=iehp
HKU\S-1-5-21-223189139-1834683237-3245993289-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130905270\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/el-gr/?ocid=iehp
HKU\S-1-5-21-223189139-1834683237-3245993289-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130907468\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/el-gr/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-223189139-1834683237-3245993289-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-223189139-1834683237-3245993289-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130905270 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: True Key Helper -> {0F4B8786-5502-4803-8EBC-F652A1153BB6} -> C:\Program Files\Intel Security\True Key\MSIE\truekey_ie64.dll [2017-06-26] (Intel Security)
BHO: No Name -> {13D67BB7-DB5F-48AA-884D-7A5D94168509} -> No File
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
BHO-x32: True Key Helper -> {0F4B8786-5502-4803-8EBC-F652A1153BB6} -> C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2017-06-26] (Intel Security)
BHO-x32: No Name -> {13D67BB7-DB5F-48AA-884D-7A5D94168509} -> No File
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\OCHelper.dll [2017-07-21] (Microsoft Corporation)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_141\bin\ssv.dll [2017-07-21] (Oracle Corporation)
BHO-x32: PDF Architect 5 Helper -> {AEA429F3-D2D4-4BD7-A03E-5357DA017733} -> C:\Program Files (x86)\PDF Architect 5\creator-ie-helper.dll [2017-07-05] (pdfforge GmbH)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\GROOVEEX.DLL [2017-07-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_141\bin\jp2ssv.dll [2017-07-21] (Oracle Corporation)
Toolbar: HKLM - True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie64.dll [2017-06-26] (Intel Security)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
Toolbar: HKLM-x32 - True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2017-06-26] (Intel Security)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)
Toolbar: HKLM-x32 - PDF Architect 5 Toolbar - {84F23192-A475-4038-B5C0-8584777F2DF4} - C:\Program Files (x86)\PDF Architect 5\creator-ie-plugin.dll [2017-07-05] (pdfforge GmbH)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2016-10-06] (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\MSOSB.DLL [2016-10-06] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\3y6dcfu2.default [2016-10-29]
FF Homepage: Mozilla\Firefox\Profiles\3y6dcfu2.default -> hxxps://www.google.de/?gws_rd=ssl
FF Extension: (Avira Browser Safety) - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\3y6dcfu2.default\Extensions\abs@avira.com [2016-10-02]
FF Extension: (QuickFox Notes) - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\3y6dcfu2.default\Extensions\amin.eft_bmnotes@gmail.com [2016-10-02]
FF Extension: (Xmarks) - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\3y6dcfu2.default\Extensions\foxmarks@kei.com [2016-10-02]
FF Extension: (Awesome Screenshot - Capture, Annotate & More) - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\3y6dcfu2.default\Extensions\jid0-GXjLLfbCoAx0LcltEdFrEkQdQPI@jetpack.xpi [2016-10-02]
FF Extension: (DuckDuckGo Plus) - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\3y6dcfu2.default\Extensions\jid1-ZAdIEUB7XOzOJw@jetpack.xpi [2016-10-02]
FF Extension: (Multi Links Plus) - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\3y6dcfu2.default\Extensions\multilinksplus@hugsmile.eu.xpi [2016-10-02]
FF Extension: (Session Sync) - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\3y6dcfu2.default\Extensions\session-sync@gabrielivanica.com.xpi [2016-10-02]
FF Extension: (TodoFox) - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\3y6dcfu2.default\Extensions\todofox@sdlm.be.xpi [2016-10-02]
FF Extension: (NoScript) - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\3y6dcfu2.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2016-10-02]
FF Extension: (Video DownloadHelper) - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\3y6dcfu2.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2016-10-02]
FF Extension: (Adblock Plus) - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\3y6dcfu2.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-10-02]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_23_0_0_207.dll [2016-11-13] ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2016-09-21] (Tracker Software Products (Canada) Ltd.)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2016-10-06] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.2.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: PDF Architect 5 -> C:\Program Files\PDF Architect 5\np-previewer.dll [2017-07-05] (pdfforge GmbH)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_207.dll [2016-11-13] ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2016-09-21] (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-10-13] (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.141.2 -> C:\Program Files (x86)\Java\jre1.8.0_141\bin\dtplugin\npDeployJava1.dll [2017-07-21] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.141.2 -> C:\Program Files (x86)\Java\jre1.8.0_141\bin\plugin2\npjp2.dll [2017-07-21] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\NPSPWRAP.DLL [2016-10-06] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.2.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-07-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-223189139-1834683237-3245993289-1001: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2016-09-21] (Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\S-1-5-21-223189139-1834683237-3245993289-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Pc\AppData\Local\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-07-20] (Google Inc.)
FF Plugin HKU\S-1-5-21-223189139-1834683237-3245993289-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Pc\AppData\Local\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-07-20] (Google Inc.)
FF Plugin HKU\S-1-5-21-223189139-1834683237-3245993289-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130904677: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2016-09-21] (Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\S-1-5-21-223189139-1834683237-3245993289-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130904677: @tools.google.com/Google Update;version=3 -> C:\Users\Pc\AppData\Local\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-07-20] (Google Inc.)
FF Plugin HKU\S-1-5-21-223189139-1834683237-3245993289-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130904677: @tools.google.com/Google Update;version=9 -> C:\Users\Pc\AppData\Local\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-07-20] (Google Inc.)

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [caljgklbbfbcjjanaijlacgncafpegll] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [ipmkfpcnmccejididiaagpgchgjfajgp] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [caljgklbbfbcjjanaijlacgncafpegll] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ipmkfpcnmccejididiaagpgchgjfajgp] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AcrSch2Svc; C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe [1276216 2016-09-13] ()
R2 afcdpsrv; C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [6086232 2016-10-04] ()
R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-08-04] (Advanced Micro Devices, Inc.) [File not signed]
S2 AntiVirMailService; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [1128432 2017-07-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\Antivirus\sched.exe [490968 2017-07-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [490968 2017-07-20] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [1524216 2017-07-20] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [377976 2017-06-13] (Avira Operations GmbH & Co. KG)
R2 AviraPhantomVPN; C:\Program Files (x86)\Avira\VPN\Avira.VpnService.exe [335088 2017-06-23] (Avira Operations GmbH & Co. KG)
R2 AviraUpdaterService; C:\Program Files (x86)\Avira\SoftwareUpdater\Avira.SoftwareUpdater.ServiceHost.exe [100816 2017-04-21] (Avira Operations GmbH & Co. KG)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [3042544 2017-03-14] (Microsoft Corporation)
R2 CybereasonRansomFree; C:\Program Files (x86)\Cybereason\RansomFree\CybereasonRansomFreeServiceHost.exe [19344 2017-06-28] (Cybereason)
R2 DigitalWave.Update.Service; C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe [437224 2016-10-27] (Digital Wave Ltd.)
R2 DTSAudioSvc; C:\Program Files\Realtek\Audio\HDA\DTSU2PAuSrv64.exe [240576 2013-10-07] (DTS, Inc)
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [29728 2016-08-15] (HP Inc.)
R2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [3046688 2016-07-29] (IObit)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4470736 2017-05-09] (Malwarebytes)
S4 mmsminisrv; C:\Program Files (x86)\Common Files\Acronis\Infrastructure\mms_mini.exe [4692840 2016-08-15] (Acronis International GmbH)
R2 mobile_backup_server; C:\Program Files (x86)\Common Files\Acronis\MobileBackupServer\mobile_backup_server.exe [7717528 2016-07-18] (Acronis International GmbH)
R2 mobile_backup_status_server; C:\Program Files (x86)\Acronis\TrueImageHome\mobile_backup_status_server.exe [1510712 2016-09-13] ()
S3 PDF Architect 5; C:\Program Files\PDF Architect 5\ws.exe [2709176 2017-07-05] (pdfforge GmbH)
S3 PDF Architect 5 CrashHandler; C:\Program Files\PDF Architect 5\crash-handler-ws.exe [1051312 2017-07-05] (pdfforge GmbH)
R2 PDF Architect 5 Creator; C:\Program Files\PDF Architect 5\creator-ws.exe [859312 2017-07-05] (pdfforge GmbH)
R2 PDF Architect 5 Manager; C:\Program Files (x86)\PDF Architect 5 Manager\PDF Architect 5\Architect Manager.exe [985848 2017-05-16] (© pdfforge GmbH.)
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [197264 2016-09-22] (Sandboxie Holdings, LLC)
S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [1050904 2013-12-12] () [File not signed]
R2 SpeedupService; C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.SpeedupService.exe [74800 2017-06-28] (Avira Operations GmbH & Co. KG)
R2 syncagentsrv; C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe [9729272 2016-08-11] ()
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [10885360 2017-05-31] (TeamViewer GmbH)
R2 TrueKey; C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe [1001920 2017-06-26] (McAfee, Inc.)
R2 TrueKeyScheduler; C:\Program Files\TrueKey\McTkSchedulerService.exe [16928 2017-06-26] (McAfee, Inc.)
S3 TrueKeyServiceHelper; C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe [87760 2017-06-26] (McAfee, Inc.)
R2 UsbClientService; C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [248840 2016-03-18] () [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [361824 2017-01-12] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [119872 2017-01-12] (Microsoft Corporation)
S2 InstallerService; C:\Program Files\TrueKey\Mcafee.TrueKey.InstallerService.exe -originalversion 4.4.127.0 [X]
S2 SgtSch2Svc; "C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedul2.exe" [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [23240 2016-02-26] (Advanced Micro Devices, Inc.)
R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R0 asstahci64; C:\Windows\System32\drivers\asstahci64.sys [88936 2016-10-02] (Asmedia Technology)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [102400 2016-02-26] (Advanced Micro Devices)
R0 avdevprot; C:\Windows\System32\DRIVERS\avdevprot.sys [60920 2017-07-20] (Avira Operations GmbH & Co. KG)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [167504 2017-07-20] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [164824 2017-07-20] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [44488 2017-07-20] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [88488 2017-07-20] (Avira Operations GmbH & Co. KG)
S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd.)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77376 2017-06-27] ()
R0 file_tracker; C:\Windows\System32\DRIVERS\file_tracker.sys [375136 2016-10-04] (Acronis International GmbH)
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [27552 2016-10-02] (REALiX(tm))
R0 MBAMChameleon; C:\Windows\System32\drivers\MBAMChameleon.sys [188352 2017-07-21] (Malwarebytes)
R3 MBAMFarflt; C:\Windows\system32\drivers\farflt.sys [101784 2017-07-22] (Malwarebytes)
R3 MBAMProtection; C:\Windows\system32\drivers\mbam.sys [45472 2017-07-22] (Malwarebytes)
R0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [253856 2017-07-22] (Malwarebytes)
R3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [93600 2017-07-22] (Malwarebytes)
S3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [9101016 2013-12-10] (Realtek Semiconductor Corp.)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [204944 2016-09-22] (Sandboxie Holdings, LLC)
S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd.)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1267544 2016-10-04] (Acronis International GmbH)
R2 tib_mounter; C:\Windows\system32\DRIVERS\tib_mounter.sys [212320 2016-10-04] (Acronis International GmbH)
S3 tnd; C:\Windows\system32\DRIVERS\tnd.sys [687968 2016-10-04] (Acronis International GmbH)
R2 virtual_file; C:\Windows\System32\DRIVERS\virtual_file.sys [331104 2016-10-04] (Acronis International GmbH)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [46600 2017-02-10] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [274776 2017-01-12] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [117592 2017-01-12] (Microsoft Corporation)
R3 WinDivert1.1; C:\Program Files\KMSpico\WinDivert.sys [35376 2016-09-30] (Basil Projects)
R3 WirelessKeyboardFilter; C:\Windows\System32\drivers\WirelessKeyboardFilter.sys [49896 2016-07-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-07-22 21:26 - 2017-07-22 21:26 - 00000000 ____D C:\Users\Pc\AppData\Roaming\PlaysTV
2017-07-22 21:26 - 2017-07-22 21:26 - 00000000 ____D C:\Users\Pc\AppData\Local\Opera Software
2017-07-22 21:25 - 2017-07-22 21:26 - 00000000 ____D C:\Users\Pc\AppData\Roaming\Duplicati
2017-07-22 21:25 - 2017-07-22 21:25 - 00000000 __SHD C:\Users\Pc\Desktop\0K, this directory is for Ransomware detection (just leave it here)
2017-07-22 21:25 - 2017-07-22 21:25 - 00000000 ___HD C:\Users\Pc\Documents\Quse158
2017-07-22 21:25 - 2017-07-22 21:25 - 00000000 ___HD C:\Users\Pc\Documents\Agimages122
2017-07-22 21:25 - 2017-07-22 21:25 - 00000000 ____D C:\Users\Pc\AppData\Roaming\Cybereason
2017-07-22 21:25 - 2017-07-22 21:25 - 00000000 ____D C:\Users\Pc\AppData\Local\Cybereason
2017-07-22 21:25 - 2017-07-22 21:25 - 00000000 ____D C:\Users\Pc\AppData\Local\Avira
2017-07-22 16:23 - 2017-07-22 16:23 - 00000000 ____D C:\Users\Codo der III\Downloads\DS - Systemkonfig
2017-07-22 16:21 - 2017-07-22 18:45 - 00000000 ____D C:\Users\Codo der III\Downloads\PICS v Handy-Samsung
2017-07-22 15:37 - 2017-07-22 15:37 - 00000000 ____D C:\Windows\LastGood
2017-07-22 14:00 - 2017-07-22 14:00 - 00000000 ____D C:\AdwCleaner
2017-07-22 12:32 - 2017-07-22 21:27 - 00000000 ____D C:\FRST
2017-07-22 10:53 - 2017-07-22 12:30 - 00000000 ____D C:\Users\Codo der III\Downloads\Scan and Repair u aufräumen - Mail-Adware-Troja-etc
2017-07-22 10:45 - 2017-07-22 10:45 - 02382336 _____ (Farbar) C:\Users\Codo der III\Desktop\FRST64.exe
2017-07-22 10:20 - 2017-07-22 10:20 - 00000000 __SHD C:\Users\Codo der III\Desktop\0K, this directory is for Ransomware detection (just leave it here)
2017-07-22 10:20 - 2017-07-22 10:20 - 00000000 ___HD C:\Users\Codo der III\Documents\Tcaches170
2017-07-22 10:20 - 2017-07-22 10:20 - 00000000 ___HD C:\Users\Codo der III\Documents\Afiles189
2017-07-22 10:18 - 2017-07-22 10:18 - 00529239 _____ C:\Users\Akzqngck\helpful counties sustain.xlsx
2017-07-22 10:18 - 2017-07-22 10:18 - 00526136 _____ C:\Users\uzds45i\precision.plays.verbal.reflects.xlsx
2017-07-22 10:18 - 2017-07-22 10:18 - 00227656 _____ C:\Users\uzds45i\KE2O3W.mdb
2017-07-22 10:18 - 2017-07-22 10:18 - 00208383 _____ C:\Users\Akzqngck\johnny-functional-questioning.mdb
2017-07-22 10:18 - 2017-07-22 10:18 - 00074374 _____ C:\Users\Akzqngck\produce.distinguish.weather.xls
2017-07-22 10:18 - 2017-07-22 10:18 - 00068240 _____ C:\Users\uzds45i\kneel mode pad.xls
2017-07-22 10:18 - 2017-07-22 10:18 - 00055800 _____ C:\Users\Akzqngck\3YSMD5nlHdT.pem
2017-07-22 10:18 - 2017-07-22 10:18 - 00050711 _____ C:\Users\uzds45i\racial-argue-golf.pem
2017-07-22 10:18 - 2017-07-22 10:18 - 00025161 _____ C:\Users\uzds45i\customerhimmeltafter.txt
2017-07-22 10:18 - 2017-07-22 10:18 - 00018505 _____ C:\Users\Akzqngck\inconsistent_shoot.sql
2017-07-22 10:18 - 2017-07-22 10:18 - 00017036 _____ C:\Users\uzds45i\actionssecretary.sql
2017-07-22 10:18 - 2017-07-22 10:18 - 00012341 _____ C:\Users\Akzqngck\aqVoUbN.txt
2017-07-22 10:18 - 2017-07-22 10:18 - 00000000 ___HD C:\Users\uzds45i
2017-07-22 10:18 - 2017-07-22 10:18 - 00000000 ___HD C:\Users\Akzqngck
2017-07-22 10:18 - 2017-07-22 10:18 - 00000000 ____D C:\yconfiguration54
2017-07-22 10:18 - 2017-07-22 10:18 - 00000000 ____D C:\ALvalue115
2017-07-21 22:14 - 2017-07-21 22:14 - 00002384 _____ C:\Users\Pc\Documents\PC-ausgelesen mit LicenseCrawler.txt
2017-07-21 22:10 - 2017-07-21 22:10 - 00000000 ____D C:\Users\Codo der III\AppData\Local\AviraSpeedup
2017-07-21 22:09 - 2017-07-21 22:09 - 00000000 ____D C:\Windows\System32\Tasks\Avira
2017-07-21 22:09 - 2017-07-21 22:09 - 00000000 ____D C:\Users\Codo der III\AppData\Local\Avira
2017-07-21 22:08 - 2017-07-22 21:26 - 00000000 ____D C:\Users\Public\Speedup Sessions
2017-07-21 22:08 - 2017-07-21 22:08 - 00003658 _____ C:\Windows\System32\Tasks\AviraSystemSpeedupUpdate
2017-07-21 21:57 - 2017-07-21 21:57 - 00000000 ____D C:\Users\Codo der III\AppData\Roaming\Opera Software
2017-07-21 21:57 - 2017-07-21 21:57 - 00000000 ____D C:\Users\Codo der III\AppData\Local\Opera Software
2017-07-21 21:55 - 2017-07-21 21:55 - 00000887 _____ C:\Users\Public\Desktop\VLC media player.lnk
2017-07-21 21:55 - 2017-07-21 21:55 - 00000000 ____D C:\Program Files\VideoLAN
2017-07-21 21:51 - 2017-07-21 21:51 - 00001055 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 12.lnk
2017-07-21 21:47 - 2017-07-21 21:47 - 00097856 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2017-07-21 21:47 - 2017-07-21 21:47 - 00000000 ____D C:\Program Files (x86)\Java
2017-07-21 21:40 - 2017-07-21 21:40 - 00001902 _____ C:\Users\Pc\Desktop\IrfanView Thumbnails.lnk
2017-07-21 21:40 - 2017-07-21 21:40 - 00001010 _____ C:\Users\Pc\Desktop\IrfanView.lnk
2017-07-21 21:40 - 2017-07-21 21:40 - 00000000 ____D C:\Program Files (x86)\IrfanView
2017-07-21 20:30 - 2017-07-21 20:30 - 00002384 _____ C:\Users\Pc\Downloads\PC-ausgelesen mit LicenseCrawler.txt
2017-07-21 18:14 - 2017-07-21 23:02 - 00000638 _____ C:\Windows\Tasks\TrackerAutoUpdate.job
2017-07-21 18:14 - 2017-07-21 18:14 - 00003120 _____ C:\Windows\System32\Tasks\TrackerAutoUpdate
2017-07-21 18:14 - 2017-07-21 18:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF-XChange PDF Viewer
2017-07-21 18:14 - 2017-07-21 18:14 - 00000000 ____D C:\Program Files\Tracker Software
2017-07-21 17:36 - 2017-07-22 10:22 - 00000000 ____D C:\Users\Codo der III\AppData\Roaming\Raptr
2017-07-21 17:36 - 2017-07-21 17:36 - 00002035 _____ C:\Users\Public\Desktop\Raptr.lnk
2017-07-21 17:36 - 2017-07-21 17:36 - 00000000 ____D C:\Users\Codo der III\AppData\Roaming\PlaysTV
2017-07-21 17:36 - 2017-07-21 17:36 - 00000000 ____D C:\Users\Codo der III\.QtWebEngineProcess
2017-07-21 17:36 - 2017-07-21 17:36 - 00000000 ____D C:\Users\Codo der III\.Plays.tv
2017-07-21 17:36 - 2017-07-21 17:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Raptr
2017-07-21 17:35 - 2017-07-21 17:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved
2017-07-21 17:33 - 2017-07-21 17:33 - 00000000 ____D C:\Users\Pc\AppData\Roaming\library_dir
2017-07-21 17:32 - 2017-07-21 17:33 - 00000000 ____D C:\Program Files (x86)\Raptr Inc
2017-07-21 17:31 - 2017-07-22 21:26 - 00000000 ____D C:\Users\Pc\AppData\Roaming\Raptr
2017-07-21 17:31 - 2017-07-21 17:33 - 00000000 ____D C:\Program Files (x86)\Raptr
2017-07-21 17:18 - 2017-07-21 17:18 - 00000000 ____D C:\Users\Pc\AppData\Local\PDFCreator
2017-07-21 17:18 - 2017-07-21 17:18 - 00000000 ____D C:\Users\Codo der III\AppData\Roaming\PDF Architect 5
2017-07-21 17:18 - 2017-07-21 17:18 - 00000000 ____D C:\Program Files (x86)\PDF Architect 5 Manager
2017-07-21 17:18 - 2017-07-21 17:18 - 00000000 ____D C:\Program Files (x86)\PDF Architect 5
2017-07-21 17:17 - 2017-07-21 17:18 - 00000000 ____D C:\Program Files\PDF Architect 5
2017-07-21 17:17 - 2017-07-21 17:17 - 00000000 ____D C:\Users\Pc\Documents\PDF Architect
2017-07-21 17:17 - 2017-07-21 17:17 - 00000000 ____D C:\ProgramData\PDF Architect 5
2017-07-21 17:17 - 2017-07-21 17:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
2017-07-21 17:12 - 2017-07-21 17:12 - 00000000 ____D C:\ProgramData\TrueKey
2017-07-21 16:50 - 2017-07-21 16:52 - 00188352 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys
2017-07-21 16:49 - 2017-07-22 17:29 - 00093600 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2017-07-21 16:49 - 2017-07-22 10:20 - 00101784 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2017-07-21 16:49 - 2017-07-22 10:20 - 00045472 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-07-21 16:49 - 2017-07-22 10:19 - 00253856 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-07-21 16:49 - 2017-07-21 16:52 - 00001883 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-07-21 16:49 - 2017-07-21 16:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-07-21 16:49 - 2017-07-21 16:49 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-07-21 16:49 - 2017-07-21 16:49 - 00000000 ____D C:\Program Files\Malwarebytes
2017-07-21 16:49 - 2017-06-27 12:06 - 00077376 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-07-21 16:33 - 2017-07-21 16:33 - 00000000 ____D C:\Users\Codo der III\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView
2017-07-21 16:25 - 2017-07-21 16:25 - 00000652 _____ C:\Users\Public\Desktop\iDA.lnk
2017-07-21 16:25 - 2017-07-21 16:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iDA
2017-07-21 16:25 - 2017-07-21 16:25 - 00000000 ____D C:\iDA
2017-07-21 16:09 - 2017-07-21 16:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2017-07-21 16:07 - 2017-07-21 16:12 - 00000000 ____D C:\Users\Codo der III\AppData\Local\WhatsApp
2017-07-21 16:02 - 2017-07-21 16:37 - 00000000 ____D C:\Program Files\Mozilla Firefox
2017-07-21 16:01 - 2017-07-22 11:21 - 00000000 ____D C:\Users\Codo der III\AppData\Roaming\Duplicati
2017-07-21 16:00 - 2017-07-21 16:00 - 00000000 ____D C:\ProgramData\Duplicati
2017-07-21 15:56 - 2017-07-21 15:56 - 00001988 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Duplicati 2.lnk
2017-07-21 15:56 - 2017-07-21 15:56 - 00001976 _____ C:\Users\Public\Desktop\Duplicati 2.lnk
2017-07-21 15:56 - 2017-07-21 15:56 - 00000000 ____D C:\Program Files\Duplicati 2
2017-07-21 15:55 - 2017-07-21 15:55 - 00003992 _____ C:\Windows\System32\Tasks\Cybereason RansomFree Keepalive
2017-07-21 15:55 - 2017-07-21 15:55 - 00003098 _____ C:\Windows\System32\Tasks\Cybereason RansomFree Autostart
2017-07-21 15:55 - 2017-07-21 15:55 - 00000000 ____D C:\Users\Codo der III\AppData\Roaming\Cybereason
2017-07-21 15:55 - 2017-07-21 15:55 - 00000000 ____D C:\Users\Codo der III\AppData\Local\Cybereason
2017-07-21 15:55 - 2017-07-21 15:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cybereason RansomFree
2017-07-21 15:55 - 2017-07-21 15:55 - 00000000 ____D C:\ProgramData\Cybereason
2017-07-21 15:55 - 2017-07-21 15:55 - 00000000 ____D C:\Program Files (x86)\Cybereason
2017-07-21 15:54 - 2017-07-21 15:54 - 00001167 _____ C:\Users\Public\Desktop\CDBurnerXP.lnk
2017-07-21 15:54 - 2017-07-21 15:54 - 00001117 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2017-07-21 15:54 - 2017-07-21 15:54 - 00000000 ____D C:\Users\Pc\AppData\Roaming\Canneverbe Limited
2017-07-21 15:54 - 2017-07-21 15:54 - 00000000 ____D C:\Program Files (x86)\CDBurnerXP
2017-07-21 15:52 - 2017-07-21 15:52 - 00000000 ____D C:\ProgramData\ClassicShell
2017-07-21 15:51 - 2017-07-21 15:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Classic Shell
2017-07-21 15:51 - 2017-07-21 15:51 - 00000000 ____D C:\Program Files\Classic Shell
2017-07-21 15:35 - 2017-07-21 15:35 - 00000000 ____D C:\Users\Pc\Desktop\OpenOffice 4.1.3 Language Pack (German) Installation Files
2017-07-21 15:10 - 2017-07-21 15:10 - 00000000 ____D C:\Users\Codo der III\AppData\Roaming\ATI
2017-07-21 15:10 - 2017-07-21 15:10 - 00000000 ____D C:\Users\Codo der III\AppData\Local\ATI
2017-07-21 13:54 - 2017-07-21 13:54 - 00000000 ___SD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.1.3
2017-07-21 13:45 - 2017-07-21 13:45 - 00000000 ____D C:\Users\Pc\Desktop\OpenOffice 4.1.3 (de) Installation Files
2017-07-21 13:44 - 2017-07-21 13:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2017-07-21 13:43 - 2017-07-21 13:43 - 00000000 ____D C:\ProgramData\AMD
2017-07-21 13:38 - 2017-07-21 13:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2017-07-21 13:38 - 2017-07-21 13:38 - 00000000 ____D C:\Program Files\7-Zip
2017-07-21 13:05 - 2017-07-21 13:05 - 00000000 ____D C:\Windows\system32\appmgmt
2017-07-21 12:46 - 2017-07-21 12:46 - 00001056 _____ C:\Users\Public\Desktop\Avira Phantom VPN.lnk
2017-07-21 12:44 - 2017-07-21 12:44 - 00002094 _____ C:\Users\Public\Desktop\Avira Software Updater.lnk
2017-07-20 20:47 - 2017-07-20 20:47 - 00001171 _____ C:\Users\Public\Desktop\True Key.lnk
2017-07-20 20:46 - 2017-06-30 03:27 - 00835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-07-20 20:46 - 2017-06-30 03:27 - 00177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-07-20 20:16 - 2017-04-22 00:53 - 00029376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aspnet_counters.dll
2017-07-20 20:16 - 2017-04-22 00:50 - 00030912 _____ (Microsoft Corporation) C:\Windows\system32\aspnet_counters.dll
2017-07-20 20:16 - 2017-04-22 00:50 - 00018592 _____ (Microsoft Corporation) C:\Windows\system32\msvcr100_clr0400.dll
2017-07-20 20:16 - 2017-04-11 21:27 - 00485576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp120_clr0400.dll
2017-07-20 20:16 - 2017-03-15 21:15 - 00690008 _____ (Microsoft Corporation) C:\Windows\system32\msvcp120_clr0400.dll
2017-07-20 20:15 - 2017-04-22 00:53 - 00018600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr100_clr0400.dll
2017-07-20 20:15 - 2017-04-11 21:27 - 00987840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr120_clr0400.dll
2017-07-20 20:15 - 2017-03-15 21:15 - 00993632 _____ (Microsoft Corporation) C:\Windows\system32\msvcr120_clr0400.dll
2017-07-20 17:39 - 2017-07-20 17:39 - 00000000 ____D C:\Windows\CSC
2017-07-20 16:14 - 2017-06-29 09:27 - 25734656 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-07-20 16:14 - 2017-06-29 09:02 - 00576512 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-07-20 16:14 - 2017-06-29 08:50 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-07-20 16:14 - 2017-06-29 08:44 - 05975552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-07-20 16:14 - 2017-06-29 08:23 - 20270592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-07-20 16:14 - 2017-06-29 08:23 - 00499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2017-07-20 16:14 - 2017-06-29 08:17 - 01033216 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2017-07-20 16:14 - 2017-06-29 08:13 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2017-07-20 16:14 - 2017-06-29 08:09 - 00806912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-07-20 16:14 - 2017-06-29 07:58 - 15253504 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-07-20 16:14 - 2017-06-29 07:53 - 03240960 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-07-20 16:14 - 2017-06-29 07:52 - 04549632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-07-20 16:14 - 2017-06-29 07:51 - 00880640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2017-07-20 16:14 - 2017-06-29 07:47 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2017-07-20 16:14 - 2017-06-29 07:43 - 13663744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-07-20 16:14 - 2017-06-29 07:41 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-07-20 16:14 - 2017-06-29 07:28 - 02767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-07-20 16:14 - 2017-06-29 07:24 - 01314816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-07-20 16:14 - 2017-06-27 17:29 - 07796736 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Data.Pdf.dll
2017-07-20 16:14 - 2017-06-27 17:29 - 07077376 _____ (Microsoft Corporation) C:\Windows\system32\glcndFilter.dll
2017-07-20 16:14 - 2017-06-27 17:26 - 05274112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\glcndFilter.dll
2017-07-20 16:14 - 2017-06-27 17:26 - 05268992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Data.Pdf.dll
2017-07-20 16:14 - 2017-06-22 17:22 - 04169216 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-07-20 16:14 - 2017-06-17 19:45 - 03631616 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2017-07-20 16:14 - 2017-06-17 19:34 - 02749952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2017-07-20 16:14 - 2017-06-17 19:05 - 01920000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2017-07-20 16:14 - 2017-06-16 01:02 - 00990040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2017-07-20 16:14 - 2017-06-15 16:45 - 07440728 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-07-20 16:14 - 2017-06-03 19:27 - 02346496 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2017-07-20 16:14 - 2017-06-03 19:03 - 01549312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2017-07-20 16:14 - 2017-05-14 23:19 - 01364040 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2017-07-20 16:14 - 2017-05-14 22:04 - 00315224 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2017-07-20 16:14 - 2017-05-14 22:03 - 00373080 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2017-07-20 16:14 - 2017-05-14 21:06 - 01737600 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-07-20 16:14 - 2017-05-14 21:06 - 01502000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2017-07-20 16:14 - 2017-05-12 19:16 - 01084928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2017-07-20 16:14 - 2017-05-12 19:13 - 01559552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2017-07-20 16:14 - 2017-05-12 05:58 - 01985536 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2017-07-20 16:14 - 2017-05-12 05:48 - 01377792 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2017-07-20 16:14 - 2017-05-12 05:18 - 03714560 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2017-07-20 16:14 - 2017-04-16 11:54 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-07-20 16:14 - 2017-04-16 11:51 - 02899456 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-07-20 16:14 - 2017-04-16 11:00 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-07-20 16:14 - 2017-04-16 11:00 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2017-07-20 16:14 - 2017-04-16 10:53 - 02290176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2017-07-20 16:14 - 2017-04-16 10:43 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-07-20 16:14 - 2017-04-16 10:40 - 00725504 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-07-20 16:14 - 2017-04-16 10:40 - 00378880 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-07-20 16:14 - 2017-04-16 10:37 - 02132992 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-07-20 16:14 - 2017-04-16 10:24 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2017-07-20 16:14 - 2017-04-16 10:22 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2017-07-20 16:14 - 2017-04-16 10:12 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2017-07-20 16:14 - 2017-04-16 10:10 - 00330752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2017-07-20 16:14 - 2017-04-16 10:08 - 02057216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2017-07-20 16:14 - 2017-04-16 10:02 - 00267776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincorlib.dll
2017-07-20 16:14 - 2017-04-10 01:00 - 01548640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2017-07-20 16:14 - 2017-03-03 18:11 - 01697792 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2017-07-20 16:14 - 2017-03-03 18:06 - 01501184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2017-07-20 16:14 - 2017-02-11 19:49 - 00269824 _____ (Microsoft Corporation) C:\Windows\system32\DafPrintProvider.dll
2017-07-20 16:14 - 2017-02-11 19:42 - 00204288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DafPrintProvider.dll
2017-07-20 16:14 - 2017-02-04 22:32 - 00251392 _____ (Microsoft Corporation) C:\Windows\system32\microsoft-windows-system-events.dll
2017-07-20 16:14 - 2017-02-04 22:30 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2017-07-20 16:14 - 2017-01-11 20:28 - 00422744 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\spaceport.sys
2017-07-20 16:14 - 2016-10-05 16:52 - 00513456 _____ C:\Windows\SysWOW64\locale.nls
2017-07-20 16:14 - 2016-10-05 16:52 - 00513456 _____ C:\Windows\system32\locale.nls
2017-07-20 16:13 - 2017-06-29 07:29 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-07-20 16:13 - 2017-06-29 07:23 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2017-07-20 16:13 - 2017-06-17 19:11 - 02551808 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2017-07-20 16:13 - 2017-06-15 16:45 - 01674520 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2017-07-20 16:13 - 2017-06-15 16:45 - 01534064 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2017-07-20 16:13 - 2017-06-15 16:45 - 01499920 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2017-07-20 16:13 - 2017-06-15 16:45 - 01370320 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2017-07-20 16:13 - 2017-06-12 03:06 - 00376672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
2017-07-20 16:13 - 2017-06-12 01:21 - 00590848 _____ (Microsoft Corporation) C:\Windows\system32\wvc.dll
2017-07-20 16:13 - 2017-06-12 00:43 - 00371200 _____ (Microsoft Corporation) C:\Windows\system32\msinfo32.exe
2017-07-20 16:13 - 2017-06-12 00:08 - 00358912 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll
2017-07-20 16:13 - 2017-06-12 00:00 - 00962560 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-07-20 16:13 - 2017-06-11 23:35 - 00325120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll
2017-07-20 16:13 - 2017-06-11 23:31 - 00781312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2017-07-20 16:13 - 2017-06-11 18:15 - 02013528 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2017-07-20 16:13 - 2017-06-06 23:52 - 03120640 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2017-07-20 16:13 - 2017-06-06 23:42 - 00925696 _____ (Microsoft Corporation) C:\Windows\system32\autoconv.exe
2017-07-20 16:13 - 2017-06-06 23:36 - 00168448 _____ (Microsoft Corporation) C:\Windows\system32\uudf.dll
2017-07-20 16:13 - 2017-06-06 23:35 - 00517120 _____ (Microsoft Corporation) C:\Windows\system32\uReFS.dll
2017-07-20 16:13 - 2017-06-06 22:11 - 00557568 _____ (Microsoft Corporation) C:\Windows\system32\untfs.dll
2017-07-20 16:13 - 2017-06-06 22:11 - 00220672 _____ (Microsoft Corporation) C:\Windows\system32\ifsutil.dll
2017-07-20 16:13 - 2017-06-06 22:08 - 02712576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2017-07-20 16:13 - 2017-06-06 22:03 - 00837632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autoconv.exe
2017-07-20 16:13 - 2017-06-06 21:57 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uudf.dll
2017-07-20 16:13 - 2017-06-06 21:56 - 00375296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uReFS.dll
2017-07-20 16:13 - 2017-06-06 21:02 - 00513536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\untfs.dll
2017-07-20 16:13 - 2017-06-06 21:02 - 00197120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ifsutil.dll
2017-07-20 16:13 - 2017-06-02 15:15 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2017-07-20 16:13 - 2017-06-02 15:12 - 00468992 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2017-07-20 16:13 - 2017-06-02 15:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2017-07-20 16:13 - 2017-06-02 15:06 - 01001984 _____ (Microsoft Corporation) C:\Windows\HelpPane.exe
2017-07-20 16:13 - 2017-06-02 15:01 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2017-07-20 16:13 - 2017-06-02 14:03 - 00903168 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2017-07-20 16:13 - 2017-06-02 13:25 - 00272896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2017-07-20 16:13 - 2017-06-02 13:24 - 00391680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2017-07-20 16:13 - 2017-06-02 13:17 - 00699392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2017-07-20 16:13 - 2017-06-02 12:43 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2017-07-20 16:13 - 2017-05-15 23:03 - 00379744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2017-07-20 16:13 - 2017-05-14 23:42 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2017-07-20 16:13 - 2017-05-14 21:13 - 00136904 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2017-07-20 16:13 - 2017-05-12 20:05 - 00035840 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2017-07-20 16:13 - 2017-05-12 18:51 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2017-07-20 16:13 - 2017-05-12 18:50 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2017-07-20 16:13 - 2017-05-12 18:48 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2017-07-20 16:13 - 2017-05-12 18:47 - 00726528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2017-07-20 16:13 - 2017-05-12 07:10 - 00044032 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2017-07-20 16:13 - 2017-05-12 05:11 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2017-07-20 16:13 - 2017-05-12 05:10 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2017-07-20 16:13 - 2017-05-12 05:07 - 00409088 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2017-07-20 16:13 - 2017-05-12 05:06 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2017-07-20 16:13 - 2017-05-12 05:04 - 00897024 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2017-07-20 16:13 - 2017-05-12 05:00 - 02240512 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2017-07-20 16:13 - 2017-05-12 02:36 - 22361848 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2017-07-20 16:13 - 2017-05-12 02:32 - 19788672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2017-07-20 16:13 - 2017-05-10 21:19 - 00101720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2017-07-20 16:13 - 2017-05-09 17:37 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\WSDApi.dll
2017-07-20 16:13 - 2017-05-09 17:35 - 00555520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSDApi.dll
2017-07-20 16:13 - 2017-05-09 17:28 - 00193024 _____ (Microsoft Corporation) C:\Windows\system32\DAFWSD.dll
2017-07-20 16:13 - 2017-05-09 17:12 - 00448576 _____ C:\Windows\system32\ApnDatabase.xml
2017-07-20 16:13 - 2017-05-06 19:45 - 01114624 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2017-07-20 16:13 - 2017-05-06 19:05 - 01094656 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2017-07-20 16:13 - 2017-05-06 19:04 - 00865792 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2017-07-20 16:13 - 2017-05-02 23:09 - 00686592 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2017-07-20 16:13 - 2017-05-02 23:08 - 00415744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2017-07-20 16:13 - 2017-05-02 23:08 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2017-07-20 16:13 - 2017-05-02 21:31 - 00329216 _____ (Microsoft Corporation) C:\Windows\system32\srvsvc.dll
2017-07-20 16:13 - 2017-05-02 21:31 - 00207360 _____ (Microsoft Corporation) C:\Windows\system32\smbwmiv2.dll
2017-07-20 16:13 - 2017-04-30 19:48 - 00080078 _____ C:\Windows\system32\normidna.nls
2017-07-20 16:13 - 2017-04-28 04:13 - 01292288 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2017-07-20 16:13 - 2017-04-28 04:11 - 01060352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2017-07-20 16:13 - 2017-04-16 13:23 - 02176584 _____ (Microsoft Corporation) C:\Windows\system32\combase.dll
2017-07-20 16:13 - 2017-04-16 13:23 - 01662096 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2017-07-20 16:13 - 2017-04-16 13:23 - 01063464 _____ (Microsoft Corporation) C:\Windows\system32\WinTypes.dll
2017-07-20 16:13 - 2017-04-16 13:18 - 01135288 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-07-20 16:13 - 2017-04-16 13:18 - 00803192 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2017-07-20 16:13 - 2017-04-16 12:07 - 01566032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\combase.dll
2017-07-20 16:13 - 2017-04-16 12:07 - 01213792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2017-07-20 16:13 - 2017-04-16 12:07 - 00548032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinTypes.dll
2017-07-20 16:13 - 2017-04-16 12:05 - 00612096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2017-07-20 16:13 - 2017-04-16 11:37 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2017-07-20 16:13 - 2017-04-16 11:16 - 00862720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2017-07-20 16:13 - 2017-04-16 11:10 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2017-07-20 16:13 - 2017-04-16 11:03 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-07-20 16:13 - 2017-04-16 11:02 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2017-07-20 16:13 - 2017-04-16 10:29 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2017-07-20 16:13 - 2017-04-16 10:23 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2017-07-20 16:13 - 2017-04-16 10:22 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2017-07-20 16:13 - 2017-04-10 01:00 - 00388448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2017-07-20 16:13 - 2017-04-06 20:37 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2017-07-20 16:13 - 2017-04-06 20:16 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\wpd_ci.dll
2017-07-20 16:13 - 2017-04-06 19:50 - 01436672 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-07-20 16:13 - 2017-04-06 19:46 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-07-20 16:13 - 2017-04-06 19:46 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2017-07-20 16:13 - 2017-04-06 19:35 - 01362432 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll
2017-07-20 16:13 - 2017-04-06 19:15 - 00358912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2017-07-20 16:13 - 2017-04-02 17:49 - 00186880 _____ (Microsoft Corporation) C:\Windows\system32\dpapisrv.dll
2017-07-20 16:13 - 2017-04-01 02:16 - 01968408 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2017-07-20 16:13 - 2017-04-01 00:59 - 01612504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2017-07-20 16:13 - 2017-03-13 19:38 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\wmitomi.dll
2017-07-20 16:13 - 2017-03-13 19:29 - 02609664 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2017-07-20 16:13 - 2017-03-13 19:13 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmitomi.dll
2017-07-20 16:13 - 2017-03-13 19:07 - 02170880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2017-07-20 16:13 - 2017-03-11 06:59 - 01763888 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2017-07-20 16:13 - 2017-03-11 06:56 - 01489608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2017-07-20 16:13 - 2017-03-11 02:38 - 00275800 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2017-07-20 16:13 - 2017-03-09 23:52 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\wisp.dll
2017-07-20 16:13 - 2017-03-09 22:17 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wisp.dll
2017-07-20 16:13 - 2017-03-04 19:37 - 03547648 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2017-07-20 16:13 - 2017-02-11 21:18 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\puiobj.dll
2017-07-20 16:13 - 2017-02-10 22:06 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-07-20 16:13 - 2017-02-10 17:37 - 00046600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2017-07-20 16:13 - 2017-02-09 17:59 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll
2017-07-20 16:13 - 2017-02-09 17:58 - 00499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll
2017-07-20 16:13 - 2017-02-04 20:51 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2017-07-20 16:13 - 2017-02-04 20:40 - 01754112 _____ (Microsoft Corporation) C:\Windows\system32\GdiPlus.dll
2017-07-20 16:13 - 2017-02-04 20:32 - 00584704 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2017-07-20 16:13 - 2017-02-04 20:10 - 01491456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GdiPlus.dll
2017-07-20 16:13 - 2017-02-04 20:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2017-07-20 16:13 - 2017-02-01 22:44 - 00201728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-07-20 16:13 - 2017-02-01 22:42 - 00401408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-07-20 16:13 - 2017-01-22 00:37 - 00567152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2017-07-20 16:13 - 2017-01-21 22:27 - 00756736 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-07-20 16:13 - 2017-01-21 22:22 - 00559104 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\csc.sys
2017-07-20 16:13 - 2017-01-21 21:40 - 00756736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2017-07-20 16:13 - 2017-01-19 05:18 - 01113944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2017-07-20 16:13 - 2017-01-18 17:35 - 00994760 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2017-07-20 16:13 - 2017-01-14 23:32 - 00955016 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4srcsnk.dll
2017-07-20 16:13 - 2017-01-14 22:18 - 00787688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll
2017-07-20 16:13 - 2017-01-14 20:49 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\wininit.exe
2017-07-20 16:13 - 2017-01-12 19:51 - 00274776 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2017-07-20 16:13 - 2017-01-12 19:51 - 00117592 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdNisDrv.sys
2017-07-20 16:13 - 2017-01-11 22:12 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\SessEnv.dll
2017-07-20 16:13 - 2017-01-11 18:09 - 00296960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SessEnv.dll
2017-07-20 16:13 - 2017-01-11 01:37 - 00138752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys
2017-07-20 16:13 - 2017-01-11 00:06 - 00840192 _____ (Microsoft Corporation) C:\Windows\system32\netlogon.dll
2017-07-20 16:13 - 2017-01-10 23:46 - 01388544 _____ (Microsoft Corporation) C:\Windows\system32\mispace.dll
2017-07-20 16:13 - 2017-01-10 22:20 - 00696832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netlogon.dll
2017-07-20 16:13 - 2017-01-10 22:09 - 01108480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mispace.dll
2017-07-20 16:13 - 2017-01-06 20:25 - 02513408 _____ (Microsoft Corporation) C:\Windows\system32\storagewmi.dll
2017-07-20 16:13 - 2017-01-06 20:04 - 01495552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\storagewmi.dll
2017-07-20 16:13 - 2016-12-25 04:14 - 00242176 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll
2017-07-20 16:13 - 2016-12-25 03:48 - 00158720 _____ (Microsoft Corporation) C:\Windows\system32\certprop.dll
2017-07-20 16:13 - 2016-12-25 03:19 - 00170496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll
2017-07-20 16:13 - 2016-12-25 02:39 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\ScDeviceEnum.dll
2017-07-20 16:13 - 2016-11-20 00:24 - 00152856 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-07-20 16:13 - 2016-11-19 20:22 - 00111104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2017-07-20 16:13 - 2016-11-13 00:06 - 00738104 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2017-07-20 16:13 - 2016-11-11 05:33 - 01541240 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2017-07-20 16:13 - 2016-11-09 20:25 - 01376768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2017-07-20 16:13 - 2016-11-05 20:57 - 03320320 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2017-07-20 16:13 - 2016-11-05 20:11 - 03606528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2017-07-20 16:13 - 2016-11-05 18:56 - 02778624 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2017-07-20 16:13 - 2016-11-05 18:46 - 02463744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2017-07-20 16:13 - 2016-10-13 00:11 - 00922968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\refs.sys
2017-07-20 16:13 - 2016-10-11 19:45 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\TpmTasks.dll
2017-07-20 16:13 - 2016-10-10 21:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cmimcext.sys
2017-07-20 16:13 - 2016-10-05 17:01 - 01200128 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Globalization.dll
2017-07-20 16:13 - 2016-10-05 17:00 - 00868864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Globalization.dll
2017-07-20 16:13 - 2016-10-05 17:00 - 00323072 _____ (Microsoft Corporation) C:\Windows\system32\GlobCollationHost.dll
2017-07-20 16:13 - 2016-10-05 07:15 - 00324896 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2017-07-20 16:13 - 2016-10-05 07:15 - 00245320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2017-07-20 16:13 - 2016-09-21 01:30 - 02462040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2017-07-20 16:13 - 2015-10-22 18:58 - 00200704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GlobCollationHost.dll
2017-07-20 16:12 - 2017-06-15 16:45 - 00086360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pdc.sys
2017-07-20 16:12 - 2017-06-12 00:25 - 00478720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wvc.dll
2017-07-20 16:12 - 2017-06-12 00:15 - 01436672 _____ (Microsoft Corporation) C:\Windows\system32\wdc.dll
2017-07-20 16:12 - 2017-06-12 00:07 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sysmon.ocx
2017-07-20 16:12 - 2017-06-11 23:58 - 00334336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msinfo32.exe
2017-07-20 16:12 - 2017-06-11 23:40 - 01323008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdc.dll
2017-07-20 16:12 - 2017-06-06 23:38 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\cnvfat.dll
2017-07-20 16:12 - 2017-06-06 23:36 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\convert.exe
2017-07-20 16:12 - 2017-06-06 22:13 - 00177664 _____ (Microsoft Corporation) C:\Windows\system32\ulib.dll
2017-07-20 16:12 - 2017-06-06 22:11 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\ufat.dll
2017-07-20 16:12 - 2017-06-06 22:11 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\uexfat.dll
2017-07-20 16:12 - 2017-06-06 21:59 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cnvfat.dll
2017-07-20 16:12 - 2017-06-06 21:03 - 00143360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ulib.dll
2017-07-20 16:12 - 2017-06-06 21:02 - 00106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ufat.dll
2017-07-20 16:12 - 2017-06-06 21:02 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uexfat.dll
2017-07-20 16:12 - 2017-06-01 00:20 - 00470360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2017-07-20 16:12 - 2017-05-16 01:09 - 00057688 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\stornvme.sys
2017-07-20 16:12 - 2017-05-15 22:58 - 00121184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tm.sys
2017-07-20 16:12 - 2017-05-09 17:29 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wsdchngr.dll
2017-07-20 16:12 - 2017-05-09 17:29 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\snmptrap.exe
2017-07-20 16:12 - 2017-05-09 17:28 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\wsdchngr.dll
2017-07-20 16:12 - 2017-05-06 19:41 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\rdsdwmdr.dll
2017-07-20 16:12 - 2017-05-02 21:41 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\sscore.dll
2017-07-20 16:12 - 2017-05-02 20:35 - 00031744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sscore.dll
2017-07-20 16:12 - 2017-04-09 23:40 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\winhvr.sys
2017-07-20 16:12 - 2017-04-09 23:39 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vmbkmclr.sys
2017-07-20 16:12 - 2017-04-09 23:37 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vmbusr.sys
2017-07-20 16:12 - 2017-04-09 22:00 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\vmbuspiper.dll
2017-07-20 16:12 - 2017-04-06 18:44 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\wpdbusenum.dll
2017-07-20 16:12 - 2017-03-13 19:25 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2017-07-20 16:12 - 2017-03-13 19:06 - 00236032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2017-07-20 16:12 - 2017-03-12 18:04 - 00033792 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\BasicRender.sys
2017-07-20 16:12 - 2017-03-04 22:24 - 00132096 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2017-07-20 16:12 - 2017-03-04 22:06 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2017-07-20 16:12 - 2017-03-04 21:15 - 00077824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\asycfilt.dll
2017-07-20 16:12 - 2017-03-03 18:10 - 00138752 _____ (Microsoft Corporation) C:\Windows\system32\mfmjpegdec.dll
2017-07-20 16:12 - 2017-03-03 18:04 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmjpegdec.dll
2017-07-20 16:12 - 2017-02-09 17:58 - 00252416 _____ (Microsoft Corporation) C:\Windows\system32\dnsrslvr.dll
2017-07-20 16:12 - 2017-02-04 20:53 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2017-07-20 16:12 - 2017-02-04 20:50 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\icm32.dll
2017-07-20 16:12 - 2017-02-04 20:19 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samlib.dll
2017-07-20 16:12 - 2017-02-04 20:17 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icm32.dll
2017-07-20 16:12 - 2017-01-21 22:27 - 00095232 _____ (Microsoft Corporation) C:\Windows\system32\auditpolmsg.dll
2017-07-20 16:12 - 2017-01-21 22:27 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-07-20 16:12 - 2017-01-21 21:40 - 00095232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpolmsg.dll
2017-07-20 16:12 - 2017-01-21 21:40 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2017-07-20 16:12 - 2017-01-18 17:34 - 00922432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2017-07-20 16:12 - 2017-01-12 18:03 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storvsp.sys
2017-07-20 16:12 - 2017-01-12 18:03 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vpcivsp.sys
2017-07-20 16:12 - 2016-12-25 04:21 - 00040960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\scfilter.sys
2017-07-20 16:12 - 2016-11-12 22:38 - 00613632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2017-07-20 16:12 - 2016-10-10 21:18 - 00069976 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-07-20 16:12 - 2016-10-09 17:17 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\ActionQueue.dll
2017-07-20 16:12 - 2016-10-09 17:08 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\shsetup.dll
2017-07-20 16:12 - 2016-10-09 17:08 - 00095232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shsetup.dll
2017-07-20 16:12 - 2015-02-03 02:53 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\winshfhc.dll
2017-07-20 16:12 - 2015-02-03 02:53 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winshfhc.dll
2017-07-20 16:02 - 2017-05-04 02:11 - 00103600 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2017-07-20 16:02 - 2017-05-03 16:43 - 01555968 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2017-07-20 16:02 - 2017-05-03 16:43 - 01206272 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2017-07-20 16:02 - 2017-05-03 16:43 - 00620544 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2017-07-20 16:02 - 2017-05-03 16:43 - 00535552 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2017-07-20 16:02 - 2017-05-03 16:43 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2017-07-20 16:02 - 2017-05-03 16:43 - 00311296 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2017-07-20 16:02 - 2017-05-03 16:43 - 00217088 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2017-07-20 16:02 - 2017-05-03 16:43 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2017-07-20 16:02 - 2016-06-03 20:11 - 00472576 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2017-07-20 15:55 - 2017-07-20 15:50 - 00060920 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avdevprot.sys
2017-07-20 15:49 - 2017-07-20 15:49 - 00001063 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera-Browser.lnk

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-07-22 21:27 - 2016-10-03 00:09 - 00000000 ____D C:\Users\Codo der III\AppData\Roaming\Skype
2017-07-22 21:26 - 2016-09-30 05:02 - 00000000 ____D C:\Users\Pc\AppData\Roaming\Skype
2017-07-22 21:25 - 2016-10-02 15:49 - 00000000 ____D C:\Users\Codo der III\AppData\Local\ClassicShell
2017-07-22 21:25 - 2016-09-30 05:07 - 00000000 ____D C:\Users\Pc\AppData\Local\ClassicShell
2017-07-22 17:06 - 2016-10-12 17:56 - 00003946 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{4872BCC3-B662-404F-AE9B-DEF038586401}
2017-07-22 16:25 - 2016-10-12 18:25 - 01533440 ___SH C:\Users\Codo der III\Downloads\Thumbs.db
2017-07-22 16:25 - 2016-10-07 19:17 - 00000000 ____D C:\Users\Codo der III\AppData\Roaming\vlc
2017-07-22 15:45 - 2016-09-30 04:07 - 01733754 _____ C:\Windows\system32\PerfStringBackup.INI
2017-07-22 15:45 - 2016-09-29 20:09 - 00727586 _____ C:\Windows\system32\perfh007.dat
2017-07-22 15:45 - 2016-09-29 20:09 - 00151718 _____ C:\Windows\system32\perfc007.dat
2017-07-22 15:45 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\Inf
2017-07-22 14:23 - 2016-12-15 09:58 - 00071168 ___SH C:\Users\Codo der III\Desktop\Thumbs.db
2017-07-22 14:03 - 2016-10-26 14:30 - 00000000 ____D C:\Users\Pc\AppData\Local\CrashDumps
2017-07-22 12:06 - 2016-10-02 15:46 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-223189139-1834683237-3245993289-1002
2017-07-22 11:44 - 2016-10-02 23:57 - 00000000 ____D C:\Users\Codo der III\AppData\Roaming\KeePass
2017-07-22 10:40 - 2016-11-20 16:22 - 00000000 ____D C:\Users\Codo der III\AppData\LocalLow\Mozilla
2017-07-22 10:18 - 2013-08-22 17:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-07-21 23:02 - 2016-10-02 17:01 - 00000000 ____D C:\Program Files\PDFCreator
2017-07-21 23:02 - 2016-09-30 04:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-07-21 23:02 - 2013-08-22 17:44 - 00408176 _____ C:\Windows\system32\FNTCACHE.DAT
2017-07-21 22:08 - 2016-10-02 12:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2017-07-21 22:07 - 2016-10-02 12:14 - 00000000 ____D C:\ProgramData\Avira
2017-07-21 22:07 - 2016-10-02 12:14 - 00000000 ____D C:\Program Files (x86)\Avira
2017-07-21 21:59 - 2016-10-02 15:40 - 00000000 ____D C:\Users\Codo der III
2017-07-21 21:56 - 2016-09-30 04:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-07-21 21:52 - 2013-08-22 18:36 - 00000000 ____D C:\Windows\AppReadiness
2017-07-21 21:51 - 2016-10-03 00:34 - 00000000 ____D C:\Users\Pc\AppData\Roaming\TeamViewer
2017-07-21 21:51 - 2016-09-30 05:01 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2017-07-21 21:46 - 2016-09-29 19:39 - 00000000 ____D C:\ProgramData\Package Cache
2017-07-21 21:42 - 2016-10-02 18:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2017-07-21 21:42 - 2016-10-02 18:15 - 00000000 ____D C:\Program Files\FileZilla FTP Client
2017-07-21 21:40 - 2016-10-02 17:06 - 00000000 ____D C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView
2017-07-21 21:40 - 2016-10-02 17:06 - 00000000 ____D C:\Users\Pc\AppData\Roaming\IrfanView
2017-07-21 21:33 - 2016-09-29 19:36 - 00000000 ____D C:\AMD
2017-07-21 20:10 - 2016-10-02 15:40 - 00000000 ____D C:\Users\Codo der III\AppData\Local\Packages
2017-07-21 17:36 - 2013-08-22 18:36 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2017-07-21 17:23 - 2016-10-02 23:27 - 00001221 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2017-07-21 17:22 - 2016-11-05 11:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2017-07-21 17:11 - 2016-10-26 14:30 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2017-07-21 16:46 - 2016-10-05 15:33 - 00000000 ____D C:\Users\Codo der III\AppData\Local\CrashDumps
2017-07-21 16:33 - 2016-10-02 18:39 - 00001129 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass 2.lnk
2017-07-21 16:33 - 2016-10-02 18:39 - 00000000 ____D C:\Program Files (x86)\KeePass Password Safe 2
2017-07-21 16:21 - 2016-10-02 22:37 - 00000000 ____D C:\Program Files (x86)\Google
2017-07-21 16:21 - 2016-09-30 05:01 - 00003902 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{296EC02D-DF2C-4598-A64A-2809DDDFD683}
2017-07-21 16:12 - 2016-12-10 13:47 - 00000000 ____D C:\Users\Codo der III\AppData\Roaming\WhatsApp
2017-07-21 16:12 - 2016-12-10 13:47 - 00000000 ____D C:\Users\Codo der III\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WhatsApp
2017-07-21 16:09 - 2016-09-30 05:02 - 00000000 ___RD C:\Program Files (x86)\Skype
2017-07-21 16:09 - 2016-09-30 05:02 - 00000000 ____D C:\ProgramData\Skype
2017-07-21 16:08 - 2016-12-10 13:41 - 00000000 ____D C:\Users\Codo der III\AppData\Local\SquirrelTemp
2017-07-21 15:35 - 2016-10-02 18:12 - 00000000 ____D C:\Program Files (x86)\OpenOffice 4
2017-07-21 15:10 - 2016-10-02 15:41 - 00000000 ____D C:\Users\Codo der III\AppData\Local\AMD
2017-07-21 13:44 - 2016-09-29 19:42 - 00000000 ____D C:\Users\Pc\AppData\Local\AMD
2017-07-21 13:43 - 2016-09-30 05:18 - 00000000 ____D C:\Program Files\AMD
2017-07-21 13:43 - 2016-09-29 19:41 - 00000000 ____D C:\Program Files (x86)\AMD
2017-07-21 13:34 - 2013-08-22 18:36 - 00000000 ____D C:\Windows\rescache
2017-07-21 13:29 - 2016-09-29 19:29 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2017-07-21 11:40 - 2013-08-22 18:36 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-07-21 11:38 - 2016-10-04 09:27 - 00000000 ____D C:\Program Files\Microsoft Office 15
2017-07-21 11:17 - 2016-09-29 19:46 - 00000000 ____D C:\ProgramData\McAfee
2017-07-21 11:16 - 2016-09-29 19:29 - 00000000 ____D C:\Program Files\TrueKey
2017-07-20 21:03 - 2016-09-29 19:29 - 00004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2017-07-20 20:47 - 2016-09-29 19:47 - 00001185 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\True Key.lnk
2017-07-20 20:45 - 2016-09-29 19:46 - 00000000 ____D C:\Program Files\Common Files\McAfee
2017-07-20 20:44 - 2016-10-02 17:24 - 00000000 ____D C:\ProgramData\ProductData
2017-07-20 20:40 - 2013-08-22 16:25 - 00524288 ___SH C:\Windows\system32\config\BBI
2017-07-20 20:38 - 2016-10-04 14:20 - 00000000 ____D C:\Windows\system32\appraiser
2017-07-20 20:38 - 2013-08-22 18:36 - 00000000 ___RD C:\Windows\ToastData
2017-07-20 20:38 - 2013-08-22 18:36 - 00000000 ____D C:\Windows\PolicyDefinitions
2017-07-20 20:38 - 2013-08-22 18:36 - 00000000 ____D C:\Program Files\Windows Defender
2017-07-20 20:38 - 2013-08-22 18:36 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2017-07-20 20:38 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\system32\oobe
2017-07-20 20:37 - 2016-10-02 13:49 - 00000000 ____D C:\Windows\system32\MRT
2017-07-20 20:25 - 2016-10-02 13:49 - 135225752 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-07-20 20:22 - 2013-08-22 18:20 - 00000000 ____D C:\Windows\CbsTemp
2017-07-20 18:40 - 2016-10-02 13:08 - 00000000 ____D C:\ProgramData\Acronis
2017-07-20 16:26 - 2016-09-30 04:14 - 00003596 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-223189139-1834683237-3245993289-1001
2017-07-20 16:21 - 2016-09-30 05:04 - 00002430 _____ C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-07-20 16:21 - 2016-09-30 05:04 - 00002422 _____ C:\Users\Pc\Desktop\Google Chrome.lnk
2017-07-20 16:16 - 2013-08-22 18:36 - 00000000 ___HD C:\Program Files\WindowsApps
2017-07-20 16:14 - 2016-09-30 05:03 - 00003712 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-223189139-1834683237-3245993289-1001UA
2017-07-20 16:14 - 2016-09-30 05:03 - 00003440 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-223189139-1834683237-3245993289-1001Core
2017-07-20 15:50 - 2016-10-05 19:30 - 00038048 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avusbflt.sys
2017-07-20 15:50 - 2016-10-02 12:18 - 00167504 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2017-07-20 15:50 - 2016-10-02 12:18 - 00164824 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2017-07-20 15:50 - 2016-10-02 12:18 - 00088488 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2017-07-20 15:50 - 2016-10-02 12:18 - 00044488 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2017-07-20 15:49 - 2016-10-08 04:20 - 00003862 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1475889635
2017-07-20 15:49 - 2016-10-08 04:20 - 00000000 ____D C:\Program Files (x86)\Opera
2017-07-20 15:43 - 2016-10-02 17:22 - 00002874 _____ C:\Windows\System32\Tasks\Driver Booster SkipUAC (Pc)
2017-07-20 15:42 - 2016-10-02 17:22 - 00000000 ____D C:\ProgramData\IObit
2017-07-20 15:41 - 2016-10-26 14:27 - 00000000 ____D C:\Users\Pc\AppData\Roaming\DVDVideoSoft
2017-07-20 15:40 - 2016-09-30 04:09 - 00000000 ____D C:\Users\Pc

==================== Files in the root of some directories =======

2016-10-29 15:56 - 1998-04-04 02:15 - 0207872 _____ (Magenta ltd) C:\Program Files (x86)\Polylex.exe
2016-10-02 18:36 - 2016-10-02 18:36 - 0000057 _____ () C:\ProgramData\Ament.ini
2016-10-02 16:59 - 2016-10-02 16:59 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some files in TEMP:
====================
2017-07-21 16:06 - 2017-07-21 16:07 - 58740704 _____ (Skype Technologies S.A.) C:\Users\Codo der III\AppData\Local\Temp\SkypeSetup.exe
2017-07-21 17:33 - 2017-07-21 17:35 - 116694048 _____ () C:\Users\Pc\AppData\Local\Temp\playstv_patch.exe
2017-07-21 17:31 - 2017-07-21 17:32 - 59621016 _____ () C:\Users\Pc\AppData\Local\Temp\raptrpatch.exe
2017-07-21 17:31 - 2017-07-21 17:31 - 0221632 _____ () C:\Users\Pc\AppData\Local\Temp\raptr_stub.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-07-21 12:07

==================== End of FRST.txt ============================
         

--- --- ---

--- --- ---

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-07-2017
Ran by Pc (22-07-2017 21:28:50)
Running from I:\Scan and Repair u aufräumen - Mail-Adware-Troja-etc
Windows 8.1 Pro (Update) (X64) (2016-09-30 01:08:08)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-223189139-1834683237-3245993289-500 - Administrator - Disabled)
Codo der III (S-1-5-21-223189139-1834683237-3245993289-1002 - Limited - Enabled) => C:\Users\Codo der III
Guest (S-1-5-21-223189139-1834683237-3245993289-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-223189139-1834683237-3245993289-1005 - Limited - Enabled)
janka (S-1-5-21-223189139-1834683237-3245993289-1003 - Limited - Enabled) => C:\Users\janka
Pc (S-1-5-21-223189139-1834683237-3245993289-1001 - Administrator - Enabled) => C:\Users\Pc
test (S-1-5-21-223189139-1834683237-3245993289-1006 - Limited - Enabled) => C:\Users\test

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Enabled - Up to date) {B3F630BD-538D-1B4A-14FA-14B63235278F}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Avira Antivirus (Enabled - Up to date) {0897D159-75B7-14C4-2E4A-2FC449B26D32}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 16.04 (x64) (HKLM\...\7-Zip) (Version: 16.04 - Igor Pavlov)
Acronis True Image (HKLM-x32\...\{2D18E04C-2EFC-48C6-A17F-F53FC9D8564C}) (Version: 20.0.5554 - Acronis) Hidden
Acronis True Image (HKLM-x32\...\{2D18E04C-2EFC-48C6-A17F-F53FC9D8564C}Visible) (Version: 20.0.5554 - Acronis)
Acronis*Disk*Director*12 (HKLM-x32\...\{AE372858-B1BD-49EF-8308-648322846008}) (Version: 12.0.3270 - Acronis)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 17.009.20058 - Adobe Systems Incorporated)
Adobe Flash Player 23 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 23.0.0.207 - Adobe Systems Incorporated)
Amarok (remove only) (HKLM-x32\...\Amarok) (Version: 2.8.0 - KDE)
AMD Install Manager (HKLM\...\AMD Catalyst Install Manager) (Version: 9.0.000.4 - Advanced Micro Devices, Inc.)
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.28.28 - Avira Operations GmbH & Co. KG)
Avira Connect (HKLM-x32\...\{661C79C2-D156-419C-81CA-D1A2523B0841}) (Version: 1.2.91.10326 - Avira Operations GmbH & Co. KG) Hidden
Avira Connect (HKLM-x32\...\{dd9049b8-31d1-40bd-8c8c-97a7b087a78f}) (Version: 1.2.91.10326 - Avira Operations GmbH & Co. KG)
Avira Phantom VPN (HKLM-x32\...\Avira Phantom VPN) (Version: 2.8.4.30090 - Avira Operations GmbH & Co. KG)
Avira Software Updater (HKLM-x32\...\{A4DF9D2A-AB95-4F30-9CA4-2F49662BA39D}) (Version: 2.0.2.27024 - Avira Operations GmbH & Co. KG)
Avira System Speedup (HKLM-x32\...\Avira System Speedup_is1) (Version: 3.7.1.5481 - Avira Operations GmbH & Co. KG)
Catalyst Control Center Next Localization BR (HKLM\...\{585A6A74-1DED-8DA0-32F1-F5EFA485DFB1}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (HKLM\...\{A0649E20-C57C-DCFA-AE1B-1CE1CB9D98A8}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (HKLM\...\{35F79A5D-00E2-8C19-D929-2E85DEA4252D}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (HKLM\...\{2CEBB6AA-EC39-DFF2-1F5B-9A98301C4DAB}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (HKLM\...\{F05F0B6E-9999-55D0-C323-D06DF0E2B59F}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (HKLM\...\{CBABB5FD-BD69-8969-729A-5659E11D9518}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (HKLM\...\{98527BF3-A8E0-B8CF-7297-436B714FC576}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (HKLM\...\{D6CD1B25-53E6-C2F8-FA99-F89138A9C86F}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (HKLM\...\{487C3865-3005-F04A-FBA4-F4239E02A847}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (HKLM\...\{D80AD200-548C-B62B-32AE-BF3CD7AA7EA2}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (HKLM\...\{D21BFF5C-51AA-4C15-1C91-6A1087FDC373}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (HKLM\...\{04F0FFCB-D9A5-2332-2697-CA47C0424AF2}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (HKLM\...\{47F2FFDC-3D6A-CED6-0B54-6E7082D5B29B}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (HKLM\...\{5608D1B6-6483-9FA3-7297-C2CFC3FCE747}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (HKLM\...\{1FCA484A-5A9E-9C91-F050-257D1F311A0C}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (HKLM\...\{D8FB03AE-A326-0C12-AC47-B898FE73FA94}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (HKLM\...\{F7876D2E-CDCD-CE53-0E88-995B57A94B58}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (HKLM\...\{3BAB5AC8-EF35-FED0-BCEB-9306D05EDE1C}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (HKLM\...\{746E086C-023A-A79C-DBE1-062E773FF6C8}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (HKLM\...\{1C44BB26-1941-DB44-D5E8-C455F89EE6E6}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (HKLM\...\{BE7F26CB-6E91-7673-7130-80C36FBF13DE}) (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.7.6623 - CDBurnerXP)
Classic Shell (HKLM\...\{383BB30A-B4A7-4666-9A83-22CFA8640097}) (Version: 4.3.0 - IvoSoft)
Clementine (HKLM-x32\...\Clementine) (Version: 1.3.1 - Clementine)
Cybereason RansomFree 2.3.0.0 (HKLM-x32\...\{FF34E65D-8F07-4917-8B9D-FB7F17E2BC4E}) (Version: 2.3.0.0 - Cybereason Inc.)
D3DX10 (HKLM-x32\...\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden
Duplicati 2 (HKLM\...\{78C1C3B9-DD53-4591-8989-B8230B832E7F}) (Version: 2.0.0.7 - Duplicati Team)
E-POST (HKLM-x32\...\{bd26b861-41e4-4cd2-bfb7-771364f9c854}) (Version: 4.2.14.4214 - Deutsche Post AG)
E-POST Desktop App (HKLM-x32\...\{3942DC9A-56D4-439D-97CD-6D6C61E90E90}) (Version: 4.2.14.4214 - Deutsche Post AG) Hidden
E-POST MAILER Drucker (HKLM\...\{14DF717F-47D6-46E6-9120-30F4ED5AFDFC}) (Version: 4.2.9.4209 - Deutsche Post AG) Hidden
FileZilla Client 3.27.0.1 (HKLM-x32\...\FileZilla Client) (Version: 3.27.0.1 - Tim Kosse)
Fotogalerie (HKLM-x32\...\{41BF4A3B-D60A-4E92-883F-C88C8C157261}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
FXCM Trading Station (HKLM-x32\...\FXTS2) (Version:  - Forex Capital Markets, LLC ("FXCM LLC"))
FXFlat Meta Trader 4 (HKLM-x32\...\FXFlat Meta Trader 4) (Version: 6.00 - MetaQuotes Software Corp.)
Google Chrome (HKU\S-1-5-21-223189139-1834683237-3245993289-1001\...\Google Chrome) (Version: 59.0.3071.115 - Google Inc.)
Google Chrome (HKU\S-1-5-21-223189139-1834683237-3245993289-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130904677\...\Google Chrome) (Version: 59.0.3071.115 - Google Inc.)
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.14) (Version: 9.14 - Artifex Software Inc.)
HP ePrint SW (HKLM-x32\...\{5b1a1d22-bd59-44e0-a954-e2f18ec43a23}) (Version: 5.2.20454 - HP Inc.)
HP Officejet Pro 8600 - Grundlegende Software für das Gerät (HKLM\...\{D2D05FDB-4EDA-462D-8DB6-E0B9AD4FA25F}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Support Assistant (HKLM-x32\...\{56D27851-B9A6-430F-875A-E2D7A3802C7B}) (Version: 8.3.34.7 - HP Inc.)
HP Support Solutions Framework (HKLM-x32\...\{D549B5E2-DBE8-4190-ABA5-71106264398C}) (Version: 12.5.32.37 - HP Inc.)
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
iDA Version v2.32 (HKLM-x32\...\{5C08DD15-104A-449D-8461-BEDF717F27C1}_is1) (Version: v2.32 - Schmid IT-Management)
Intel Security True Key (HKLM\...\TrueKey) (Version: 4.19.108.1 - Intel Security)
IObit Uninstaller (HKLM-x32\...\IObitUninstall) (Version: 6.0.2.156 - IObit)
IrfanView 4.44 (32-bit) (HKLM-x32\...\IrfanView) (Version: 4.44 - Irfan Skiljan)
IrfanView 64 (remove only) (HKLM\...\IrfanView64) (Version: 4.42 - Irfan Skiljan)
Java 8 Update 141 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180141F0}) (Version: 8.0.1410.15 - Oracle Corporation)
KeePass Password Safe 2.36 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.36 - Dominik Reichl)
Malwarebytes Version 3.1.2.1733 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.1.2.1733 - Malwarebytes)
Manager (HKLM-x32\...\{8DED36D9-54D6-4127-A112-5A1BA1CDD66B}) (Version: 5.0.26.33533 - 2017 pdfforge GmbH. All rights reserved) Hidden
MetaTrader 4 (HKLM-x32\...\MetaTrader 4) (Version: 6.00 - MetaQuotes Software Corp.)
MetaTrader 5 (HKLM\...\MetaTrader 5) (Version: 5.00 - MetaQuotes Software Corp.)
Microsoft Office Home and Business 2013 - de-de (HKLM\...\HomeBusinessRetail - de-de) (Version: 15.0.4945.1001 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-223189139-1834683237-3245993289-1001\...\SkyDriveSetup.exe) (Version: 16.4.6012.0828 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-223189139-1834683237-3245993289-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130904677\...\SkyDriveSetup.exe) (Version: 16.4.6012.0828 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{3c3aafc8-d898-43ec-998f-965ffdae065a}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24212 (HKLM-x32\...\{462f63a8-6347-4894-a1b3-dbfe3a4c981d}) (Version: 14.0.24212.0 - Microsoft Corporation)
Microsoft Visual C++ 2017 Redistributable (x64) - 14.10.25017 (HKLM-x32\...\{e52a6842-b0ac-476e-b48f-378a97a67346}) (Version: 14.10.25017.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.60724 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.60724 - Microsoft Corporation)
Movie Maker (HKLM-x32\...\{70C91B91-61E8-4D06-86D6-A9DCC291983A}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{DD67BE4B-7E62-4215-AFA3-F123A800A389}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 54.0.1 (x64 de) (HKLM\...\Mozilla Firefox 54.0.1 (x64 de)) (Version: 54.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 52.2.1 - Mozilla)
Mozilla Thunderbird 52.2.1 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 52.2.1 (x86 de)) (Version: 52.2.1 - Mozilla)
Office 15 Click-to-Run Extensibility Component (HKLM\...\{90150000-008C-0000-1000-0000000FF1CE}) (Version: 15.0.4945.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (HKLM\...\{90150000-007E-0000-1000-0000000FF1CE}) (Version: 15.0.4945.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (HKLM\...\{90150000-008C-0407-1000-0000000FF1CE}) (Version: 15.0.4945.1001 - Microsoft Corporation) Hidden
OpenOffice 4.1.3 (HKLM-x32\...\{8D5FCC56-BB9F-4122-923C-71753F50F6F5}) (Version: 4.13.9783 - Apache Software Foundation)
OpenOffice 4.1.3 Language Pack (German) (HKLM-x32\...\{F656568B-DF59-4EA8-997F-4E293ABC0ABF}) (Version: 4.13.9783 - Apache Software Foundation)
Opera Stable 46.0.2597.57 (HKLM-x32\...\Opera 46.0.2597.57) (Version: 46.0.2597.57 - Opera Software)
PDF Architect 5 Create Module (HKLM\...\{0E25DE98-E56E-4259-B554-F1360BB2DC22}) (Version: 5.0.28.34044 - pdfforge GmbH) Hidden
PDF Architect 5 Edit Module (HKLM\...\{EE01D8D7-2DD0-4C43-BF42-D9C8FC8DAE99}) (Version: 5.0.28.34044 - pdfforge GmbH) Hidden
PDF Architect 5 View Module (HKLM\...\{4DC94B75-B036-474D-8AC8-E2D055C95FBD}) (Version: 5.0.28.34044 - pdfforge GmbH) Hidden
PDF24 Creator 7.9.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.5.3 - pdfforge GmbH)
PDFsam Basic (HKLM-x32\...\{AE22AC64-691E-4D7E-99CC-C517AE7F5F7D}) (Version: 3.20.2.0 - Andrea Vacondio)
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.318.1 - Tracker Software Products Ltd)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9.141.259 - Google, Inc.)
Raptr (HKLM-x32\...\Raptr) (Version: 5.2.10-r123135-release - Raptr, Inc)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7541 - Realtek Semiconductor Corp.)
Realtek PC Camera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10253 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.53 - Piriform)
Sandboxie 5.14 (64-bit) (HKLM\...\Sandboxie) (Version: 5.14 - Sandboxie Holdings, LLC)
Skype Click to Call (HKLM-x32\...\{873F8E7C-10E6-449F-BD7E-5FBA7C8E1C9B}) (Version: 8.5.0.9167 - Microsoft Corporation)
Skype™ 7.38 (HKLM-x32\...\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.38.101 - Skype Technologies S.A.)
Synology Assistant (remove only) (HKLM-x32\...\Synology Assistant) (Version:  - )
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.19 - TeamSpeak Systems GmbH)
TeamViewer 12 (HKLM-x32\...\TeamViewer) (Version: 12.0.78716 - TeamViewer)
Viber (HKU\S-1-5-21-223189139-1834683237-3245993289-1001\...\Viber) (Version: 5.0.1.42 - Viber Media Inc)
Viber (HKU\S-1-5-21-223189139-1834683237-3245993289-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130904677\...\Viber) (Version: 5.0.1.42 - Viber Media Inc)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: 5.5.0.0 - Elaborate Bytes)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.6 - VideoLAN)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
VobSub v2.23 (Remove Only) (HKLM-x32\...\VobSub) (Version:  - )
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinRAR 5.40 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
XAMPP (HKLM-x32\...\xampp) (Version: 5.6.24-1 - Bitnami)
XMedia Recode Version 3.3.5.8 (HKLM-x32\...\{DDA3C325-47B2-4730-9672-BF3771C08799}_is1) (Version: 3.3.5.8 - XMedia Recode)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-223189139-1834683237-3245993289-1001_Classes\CLSID\{144DF3B2-2402-47AE-9583-5A045929A8D4}\InprocServer32 -> C:\Users\Pc\AppData\Local\Google\Update\1.3.33.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-223189139-1834683237-3245993289-1001_Classes\CLSID\{59B55F04-DE14-4BB8-92FF-C4A22EF2E5F4}\InprocServer32 -> C:\Users\Pc\AppData\Local\Google\Update\1.3.31.5\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-223189139-1834683237-3245993289-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Pc\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-223189139-1834683237-3245993289-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Pc\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-223189139-1834683237-3245993289-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Pc\AppData\Local\Google\Update\1.3.33.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-223189139-1834683237-3245993289-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Pc\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-223189139-1834683237-3245993289-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Pc\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\amd64\FileSyncApi64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-223189139-1834683237-3245993289-1002_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\Codo der III\AppData\Local\Microsoft\OneDrive\17.3.6917.0607\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-223189139-1834683237-3245993289-1002_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\Codo der III\AppData\Local\Microsoft\OneDrive\17.3.6917.0607\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-223189139-1834683237-3245993289-1002_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\Codo der III\AppData\Local\Microsoft\OneDrive\17.3.6917.0607\amd64\FileSyncShell64.dll => No File
ShellIconOverlayIdentifiers: [1_EPMInConflictHandler] -> {188FBECF-3754-4767-94ED-E06FF03C57DE} => C:\Windows\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [1_EPMInProgressHandler] -> {EF1FAD52-44AF-4B92-8462-048F036E16A9} => C:\Windows\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [1_EPMInSyncHandler] -> {85837018-AB69-4BD9-95D3-0DDCDE2EA467} => C:\Windows\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2016-08-09] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2016-08-09] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2016-08-09] (Acronis)
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)
ContextMenuHandlers01: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers01: [IObitUnstaler] -> {B19ED566-D419-470b-B111-3C89040BC027} => C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMenuRight.dll [2016-05-23] (IObit)
ContextMenuHandlers01: [PDFArchitect5_ManagerExt] -> {00B7B69F-6774-4906-9C7F-7D117A3644A9} => C:\Program Files\PDF Architect 5\creator-context-menu.dll [2017-07-05] (pdfforge GmbH)
ContextMenuHandlers01: [PDFCreator.ShellContextMenu] -> {d9cea52e-100d-4159-89ea-76e845bc13e1} => C:\Windows\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)
ContextMenuHandlers01: [Shell Extension for Malware scanning] -> {45AC2688-0253-4ED8-97DE-B5370FA7D48A} => C:\Program Files (x86)\Avira\Antivirus\shlext64.dll [2017-07-20] (Avira Operations GmbH & Co. KG)
ContextMenuHandlers01: [SystemSpeedupFilesMenu] -> {ef263503-8f0e-3e6a-ae2e-fe0b4b441d52} => C:\Windows\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)
ContextMenuHandlers01: [VersionsPageShellExt] -> {9E42900A-85F9-4E67-9778-575FBBA0A81C} =>  -> No File
ContextMenuHandlers01: [VirtualCloneDrive] -> {B7056B8E-4F99-44f8-8CBD-282390FE5428} => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\ElbyVCDShell.dll [2009-12-14] (Elaborate Bytes AG)
ContextMenuHandlers01: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-15] (Alexander Roshal)
ContextMenuHandlers01: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} =>  -> No File
ContextMenuHandlers02: [VirtualCloneDrive] -> {B7056B8E-4F99-44f8-8CBD-282390FE5428} => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\ElbyVCDShell.dll [2009-12-14] (Elaborate Bytes AG)
ContextMenuHandlers03: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-05-09] (Malwarebytes)
ContextMenuHandlers04: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers04: [IObitUnstaler] -> {B19ED566-D419-470b-B111-3C89040BC027} => C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMenuRight.dll [2016-05-23] (IObit)
ContextMenuHandlers04: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-06] (Piriform Ltd)
ContextMenuHandlers04: [SystemSpeedupFoldersMenu] -> {3d52b24d-33bb-3895-99ea-a0156f24a3f9} => C:\Windows\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)
ContextMenuHandlers05: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\atiacm64.dll [2015-08-04] (Advanced Micro Devices, Inc.)
ContextMenuHandlers05: [SystemSpeedupDesktopMenu] -> {cefaf456-bc17-3f4b-b7d9-75070925911b} => C:\Windows\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)
ContextMenuHandlers06: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers06: [IObitUnstaler] -> {B19ED566-D419-470b-B111-3C89040BC027} => C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMenuRight.dll [2016-05-23] (IObit)
ContextMenuHandlers06: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-05-09] (Malwarebytes)
ContextMenuHandlers06: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-06] (Piriform Ltd)
ContextMenuHandlers06: [Shell Extension for Malware scanning] -> {45AC2688-0253-4ED8-97DE-B5370FA7D48A} => C:\Program Files (x86)\Avira\Antivirus\shlext64.dll [2017-07-20] (Avira Operations GmbH & Co. KG)
ContextMenuHandlers06: [StartMenuExt] -> {E595F05F-903F-4318-8B0A-7F633B520D2B} => C:\Windows\system32\StartMenuHelper64.dll [2016-07-30] (IvoSoft)
ContextMenuHandlers06: [VersionsPageShellExt] -> {9E42900A-85F9-4E67-9778-575FBBA0A81C} =>  -> No File
ContextMenuHandlers06: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-15] (Alexander Roshal)
ContextMenuHandlers06: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} =>  -> No File

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {069830EF-82C9-4054-B935-50A0ADB92D57} - System32\Tasks\{DF690902-76F7-4CBD-977F-2E5BC7829662} => C:\Windows\system32\pcalua.exe -a "\\192.168.10.20\010 - Aktuelle Daten\software\AISuite\S1.03.15\AsusSetup.exe" -d "\\192.168.10.20\010 - Aktuelle Daten\software\AISuite\S1.03.15"
Task: {1B763361-3652-49F0-89A5-0469AF82860D} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-04-25] (Adobe Systems Incorporated)
Task: {1E82D59B-AA87-48C2-B0F0-9B74430CC567} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2016-07-04] (HP Inc.)
Task: {1F68D8A0-68C4-4358-8935-CE8D388573B3} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-223189139-1834683237-3245993289-1001UA => C:\Users\Pc\AppData\Local\Google\Update\GoogleUpdate.exe [2016-09-30] (Google Inc.)
Task: {490AD355-C1E6-4CE6-AC6B-61D736A154B5} - System32\Tasks\Uninstaller_SkipUac_Pc => C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe [2016-08-30] (IObit)
Task: {4FA26459-CA8A-4B0D-9F1E-41F6B5209A59} - System32\Tasks\Avira\System Speedup\TestScheduler => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe [2017-06-28] (Avira Operations GmbH & Co. KG)
Task: {5EDC6304-6E5B-4D8D-9BAA-4DC21CDF0B71} - System32\Tasks\Opera scheduled Autoupdate 1475889635 => C:\Program Files (x86)\Opera\launcher.exe [2017-07-18] (Opera Software)
Task: {5F914685-9250-4235-BB80-DD025F6B0336} - System32\Tasks\Driver Booster Scheduler => C:\Program Files (x86)\IObit\Driver Booster\4.0.3\Scheduler.exe [2016-09-20] (IObit)
Task: {6243F29E-1071-417E-817D-57A7FD1B55A1} - System32\Tasks\Cybereason RansomFree Autostart => C:\Program Files (x86)\Cybereason\RansomFree\CybereasonRansomFree.exe [2017-06-28] (Cybereason)
Task: {65CEC36B-E59A-4781-8B64-A20074358705} - System32\Tasks\AviraSystemSpeedupUpdate => C:\ProgramData\Avira\SystemSpeedup\Update\avira_speedup_setup_update.exe [2017-07-21] (Avira Operations GmbH & Co. KG                              )
Task: {6868D7ED-7ACB-495F-93C2-9957ACFC0AAE} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-223189139-1834683237-3245993289-1001Core => C:\Users\Pc\AppData\Local\Google\Update\GoogleUpdate.exe [2016-09-30] (Google Inc.)
Task: {72E5932B-D3E2-41CF-A437-A7BA9DB505B1} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2017-04-11] (Microsoft Corporation)
Task: {802EBBB6-3087-4E66-BDF8-0BBD3EC10974} - System32\Tasks\Driver Booster SkipUAC (Pc) => C:\Program Files (x86)\IObit\Driver Booster\4.0.3\DriverBooster.exe [2016-09-22] (IObit)
Task: {952159BC-6C57-418D-9027-C9E87B4BEC22} - System32\Tasks\FreeDownloadManagerNetworkMonitor => C:\Program Files\FreeDownloadManager.ORG\Free Download Manager\winwfpmonitor.exe [2016-09-09] ()
Task: {953A1CC3-56FA-41B0-9917-D0CF2B615476} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2017-04-11] (Microsoft Corporation)
Task: {97633A75-A6DB-42EB-9F7E-C687893B254C} - System32\Tasks\TrackerAutoUpdate => C:\Program Files\Tracker Software\Update\TrackerUpdate.exe [2016-09-21] (Tracker Software Products (Canada) Ltd.)
Task: {976F33D3-AB6B-4F53-A7E1-95EC863A2F4B} - System32\Tasks\HPEA3JOBS => C:\Program [Argument = Files\HP\HP ePrint\hpeprint.exe /CheckJobs]
Task: {AD6A0A15-86F2-4594-8006-F18879D9C6FC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-08-03] (HP Inc.)
Task: {B352DB4C-C7F5-4ED7-B1B5-7B6AAAD5B4F8} - System32\Tasks\Cybereason RansomFree Keepalive => C:\Program Files (x86)\Cybereason\RansomFree\CybereasonRansomFree.exe [2017-06-28] (Cybereason)
Task: {C21A06CA-D5EB-470A-BA16-2F1C607D493E} - System32\Tasks\McAfee Remediation (Prepare) => C:\Program Files\Common Files\AV\McAfee Anti-Virus And Anti-Spyware\upgrade.exe [2016-12-15] (McAfee, Inc.)
Task: {CB50C349-DDB2-4FE8-BDA3-741CB25566B4} - System32\Tasks\AutoPico Daily Restart => C:\Program Files\KMSpico\AutoPico.exe [2013-12-12] ()
Task: {CC6299CF-5AFA-42B5-9BD6-0469C46C41F9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-08-23] (HP Inc.)
Task: {D07FD053-C362-4C89-B0FC-5FF6D05E8638} - System32\Tasks\AMD Updater => C:\Program Files\AMD\CIM\\Bin64\InstallManagerApp.exe [2016-09-16] (Advanced Micro Devices, Inc.)
Task: {D4F974A9-C2C9-4024-951D-67A35F9481DA} - System32\Tasks\Avira\System Speedup\SpeedupSysTray => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.Systray.exe [2017-06-28] (Avira Operations GmbH & Co. KG)
Task: {F02EC719-6D81-4D53-8347-D59F79A6D83C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Opt-in For HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF_Utils.exe [2016-08-23] (HP Inc.)
Task: {F3E0C105-71F0-41DC-AF7F-88EDE11492B9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-08-23] (HP Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\TrackerAutoUpdate.job => C:\Program Files\Tracker Software\Update\TrackerUpdate.exe-CheckUpdate(Tracker Software Products (Canada) Ltd.Kee
Task: C:\Windows\Tasks\Uninstaller_SkipUac_Pc.job => C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


==================== Loaded Modules (Whitelisted) ==============

2016-10-03 00:35 - 2017-05-31 17:02 - 00020208 _____ () C:\Windows\system32\spool\PRTPROCS\x64\TeamViewer_PrintProcessor.dll
2016-10-02 18:53 - 2016-09-09 19:01 - 00849408 _____ () C:\Program Files\FreeDownloadManager.ORG\Free Download Manager\winwfpmonitor.exe
2016-10-02 18:54 - 2016-09-09 19:00 - 00029696 _____ () C:\Program Files\FreeDownloadManager.ORG\Free Download Manager\WinDivert.dll
2016-09-13 17:36 - 2016-09-13 17:36 - 01276216 _____ () C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
2016-10-04 21:56 - 2016-10-04 21:56 - 06086232 _____ () C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
2016-10-04 15:14 - 2017-01-17 04:25 - 00117440 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2016-03-18 08:41 - 2016-03-18 08:41 - 00248840 _____ () C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
2017-07-21 16:49 - 2017-06-27 12:06 - 02260432 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2017-07-19 19:18 - 2017-07-19 19:18 - 00076456 _____ () C:\Program Files\FileZilla FTP Client\fzshellext_64.dll
2015-06-25 16:34 - 2015-06-25 16:34 - 00014336 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick.2\qtquick2plugin.dll
2015-06-25 16:37 - 2015-06-25 16:37 - 00739840 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-06-25 16:35 - 2015-06-25 16:35 - 00014336 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Window.2\windowplugin.dll
2015-06-25 16:38 - 2015-06-25 16:38 - 00071168 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Layouts\qquicklayoutsplugin.dll
2015-06-25 15:53 - 2015-06-25 15:53 - 00011776 _____ () C:\Program Files\AMD\CNext\CNext\libEGL.dll
2015-06-25 15:51 - 2015-06-25 15:51 - 02013696 _____ () C:\Program Files\AMD\CNext\CNext\libGLESv2.dll
2016-09-13 17:18 - 2016-09-13 17:18 - 00585240 _____ () C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
2017-07-21 11:28 - 2017-07-21 11:28 - 00402624 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream64.dll
2016-09-13 18:12 - 2016-09-13 18:12 - 04654664 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
2015-08-04 00:25 - 2015-08-04 00:25 - 00102400 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2016-09-13 17:33 - 2016-09-13 17:33 - 01510712 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\mobile_backup_status_server.exe
2016-08-11 14:29 - 2016-08-11 14:29 - 09729272 _____ () C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
2016-09-30 04:05 - 2013-12-12 01:59 - 01051416 _____ () C:\Program Files\KMSpico\AutoPico.exe
2016-09-30 04:05 - 2016-09-30 04:05 - 00016896 _____ () C:\Program Files\KMSpico\WinDivert.dll
2016-10-26 14:30 - 2016-08-31 19:56 - 00114664 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\zlib1.dll
2016-10-26 14:30 - 2016-10-27 13:31 - 00108008 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_filesystem-vc120-mt-1_56.dll
2016-10-26 14:30 - 2016-10-27 13:31 - 00024040 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_system-vc120-mt-1_56.dll
2016-10-26 14:30 - 2016-10-27 13:31 - 00048104 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_date_time-vc120-mt-1_56.dll
2016-10-02 17:32 - 2016-06-14 16:35 - 00625440 _____ () C:\Program Files (x86)\IObit\LiveUpdate\ProductStatistics.dll
2017-06-20 11:28 - 2017-06-20 11:28 - 01997792 ____R () C:\Program Files (x86)\Skype\Phone\skypert.dll
2016-09-13 17:17 - 2016-09-13 17:17 - 06068656 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\qt_resources.dll
2016-08-15 11:28 - 2016-08-15 11:28 - 00129968 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\afcdpapi.dll
2016-09-13 18:07 - 2016-09-13 18:07 - 20652632 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\ti_managers.dll
2016-09-13 17:18 - 2016-09-13 17:18 - 00390576 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\resource.dll
2016-08-03 15:47 - 2016-08-03 15:47 - 00685488 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\sqlite3.dll
2016-09-13 17:17 - 2016-09-13 17:17 - 00048560 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\rpc_client.dll
2016-08-11 14:14 - 2016-08-11 14:14 - 00248752 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\sync_agent_api.dll
2016-06-14 17:24 - 2016-06-14 17:24 - 00444336 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\ulxmlrpcpp.dll
2016-06-22 09:16 - 2016-06-22 09:16 - 00115632 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\expat.dll
2015-05-08 04:37 - 2015-05-08 04:37 - 00087040 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\_ctypes.pyd
2015-05-08 04:37 - 2015-05-08 04:37 - 00043008 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\_socket.pyd
2015-05-08 04:37 - 2015-05-08 04:37 - 00805376 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\_ssl.pyd
2015-05-08 04:39 - 2015-05-08 04:39 - 05812736 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\PyQt4.QtGui.pyd
2017-05-04 22:01 - 2017-05-04 22:01 - 00067584 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\sip.pyd
2015-05-08 04:39 - 2015-05-08 04:39 - 01662464 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\PyQt4.QtCore.pyd
2015-05-08 04:39 - 2015-05-08 04:39 - 00494592 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\PyQt4.QtNetwork.pyd
2015-05-08 04:39 - 2015-05-08 04:39 - 00096256 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\win32api.pyd
2015-05-08 04:38 - 2015-05-08 04:38 - 00110592 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\pywintypes26.dll
2015-05-08 04:37 - 2015-05-08 04:37 - 00010240 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\select.pyd
2015-05-08 04:37 - 2015-05-08 04:37 - 00356864 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\_hashlib.pyd
2015-05-08 04:39 - 2015-05-08 04:39 - 00036352 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\win32process.pyd
2015-05-08 04:39 - 2015-05-08 04:39 - 00111104 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\win32file.pyd
2015-05-08 04:37 - 2015-05-08 04:37 - 00044544 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\_sqlite3.pyd
2015-05-08 04:49 - 2015-05-08 04:49 - 00417501 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\sqlite3.dll
2015-05-08 04:39 - 2015-05-08 04:39 - 00167936 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\win32gui.pyd
2015-05-08 04:39 - 2015-05-08 04:39 - 00313856 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\PyQt4.QtWebKit.pyd
2015-05-08 04:37 - 2015-05-08 04:37 - 00127488 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\pyexpat.pyd
2015-05-08 04:37 - 2015-05-08 04:37 - 00009216 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\winsound.pyd
2015-11-14 00:59 - 2015-11-14 00:59 - 00113171 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\libvlc.dll
2015-11-14 00:59 - 2015-11-14 00:59 - 02396691 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\libvlccore.dll
2015-05-08 04:37 - 2015-05-08 04:37 - 00583680 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\unicodedata.pyd
2015-05-08 04:37 - 2015-05-08 04:37 - 00324608 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\PIL._imaging.pyd
2015-11-14 00:58 - 2015-11-14 00:58 - 00271872 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\amd_ags.dll
2015-05-08 04:39 - 2015-05-08 04:39 - 00141312 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\gobject._gobject.pyd
2017-05-04 20:33 - 2017-05-04 20:33 - 02717595 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\heliotrope._purple.pyd
2015-05-08 04:49 - 2015-05-08 04:49 - 01213633 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\libxml2-2.dll
2015-05-08 04:55 - 2015-05-08 04:55 - 00055808 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\zlib1.dll
2015-05-08 04:49 - 2015-05-08 04:49 - 00495680 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\plugins\libaim.dll
2015-05-08 04:49 - 2015-05-08 04:49 - 01183699 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\liboscar.dll
2015-05-08 04:49 - 2015-05-08 04:49 - 00483306 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\plugins\libicq.dll
2015-05-08 04:49 - 2015-05-08 04:49 - 00655356 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\plugins\libirc.dll
2015-05-08 04:49 - 2015-05-08 04:49 - 01306387 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\plugins\libmsn.dll
2015-05-08 04:49 - 2015-05-08 04:49 - 00565461 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\plugins\libxmpp.dll
2015-05-08 04:49 - 2015-05-08 04:49 - 01640221 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\libjabber.dll
2015-05-08 04:49 - 2015-05-08 04:49 - 00506276 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\plugins\libyahoo.dll
2015-05-08 04:49 - 2015-05-08 04:49 - 01053730 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\libymsg.dll
2015-05-08 04:49 - 2015-05-08 04:49 - 00497782 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\plugins\libyahoojp.dll
2015-05-08 04:49 - 2015-05-08 04:49 - 00603326 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\plugins\ssl-nss.dll
2015-05-08 04:49 - 2015-05-08 04:49 - 00474199 _____ () C:\Program Files (x86)\Raptr Inc\Raptr\plugins\ssl.dll
2016-06-22 11:27 - 2016-06-22 11:27 - 00217008 _____ () C:\Program Files (x86)\Common Files\Acronis\MobileBackupServer\pcs_io.dll
2016-07-02 21:30 - 2016-07-02 21:30 - 00376240 _____ () C:\Program Files (x86)\Common Files\Acronis\MobileBackupServer\archive3.dll
2016-03-09 10:28 - 2016-03-09 10:28 - 00042416 _____ () C:\Program Files (x86)\Common Files\Acronis\MobileBackupServer\winpthreads4.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 16:25 - 2013-08-22 16:25 - 00000824 _____ C:\Windows\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-223189139-1834683237-3245993289-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
HKU\S-1-5-21-223189139-1834683237-3245993289-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130904677\Control Panel\Desktop\\Wallpaper -> C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
HKU\S-1-5-21-223189139-1834683237-3245993289-1002\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg
HKU\S-1-5-21-223189139-1834683237-3245993289-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130905270\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg
HKU\S-1-5-21-223189139-1834683237-3245993289-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130906620\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg
HKU\S-1-5-21-223189139-1834683237-3245993289-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130907468\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg
DNS Servers: 192.168.10.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Off)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

HKLM\...\StartupApproved\StartupFolder: => "E-POST CLOUD.lnk"
HKLM\...\StartupApproved\StartupFolder: => "E-POST MAILER.lnk"
HKLM\...\StartupApproved\Run32: => "AcronisTibMounterMonitor"
HKLM\...\StartupApproved\Run32: => "KeePass 2 PreLoad"
HKLM\...\StartupApproved\Run32: => "VirtualCloneDrive"
HKU\S-1-5-21-223189139-1834683237-3245993289-1001\...\StartupApproved\Run: => "CCleaner Monitoring"
HKU\S-1-5-21-223189139-1834683237-3245993289-1001\...\StartupApproved\Run: => "Google Update"
HKU\S-1-5-21-223189139-1834683237-3245993289-1001\...\StartupApproved\Run: => "Viber"
HKU\S-1-5-21-223189139-1834683237-3245993289-1001\...\StartupApproved\Run: => "SandboxieControl"
HKU\S-1-5-21-223189139-1834683237-3245993289-1001\...\StartupApproved\Run: => "updater"
HKU\S-1-5-21-223189139-1834683237-3245993289-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130904677\...\StartupApproved\Run: => "CCleaner Monitoring"
HKU\S-1-5-21-223189139-1834683237-3245993289-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130904677\...\StartupApproved\Run: => "Google Update"
HKU\S-1-5-21-223189139-1834683237-3245993289-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130904677\...\StartupApproved\Run: => "Viber"
HKU\S-1-5-21-223189139-1834683237-3245993289-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130904677\...\StartupApproved\Run: => "SandboxieControl"
HKU\S-1-5-21-223189139-1834683237-3245993289-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130904677\...\StartupApproved\Run: => "updater"
HKU\S-1-5-21-223189139-1834683237-3245993289-1002\...\StartupApproved\Run: => "HP Officejet Pro 8600 (NET)"
HKU\S-1-5-21-223189139-1834683237-3245993289-1002\...\StartupApproved\Run: => "GIMP Updater"
HKU\S-1-5-21-223189139-1834683237-3245993289-1002\...\StartupApproved\Run: => "SandboxieControl"
HKU\S-1-5-21-223189139-1834683237-3245993289-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130905270\...\StartupApproved\Run: => "HP Officejet Pro 8600 (NET)"
HKU\S-1-5-21-223189139-1834683237-3245993289-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130905270\...\StartupApproved\Run: => "GIMP Updater"
HKU\S-1-5-21-223189139-1834683237-3245993289-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07222017130905270\...\StartupApproved\Run: => "SandboxieControl"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{82A41A2F-BAD1-42F4-8166-B0A79D15237B}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{C235C3AE-8152-4078-BEC0-043846B20EAC}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{928896D1-3F58-4562-AA8B-92DB1D74A572}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{FFF6EF8C-DEA9-4137-B361-672177C3204D}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{9598FF41-3952-4731-99BD-4E82DEF005DE}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{DC9C5AF8-9151-4BD6-8810-BD39E41F0C21}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{916920ED-4BAD-4319-BA34-75A642497048}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{641363CD-48A1-4086-A194-4D1BFC434051}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{F13C49C9-B927-4652-A067-F2A71B92C300}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{51A161A2-8ADE-4BA1-95A1-626843273E32}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{5D3DF93E-E118-418B-886E-E73CD90C36FD}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{4DFA0802-E1CD-47A5-84F2-4DCF7CAA3E5D}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [TCP Query User{559D20C9-B379-4123-B378-7B8434500F76}C:\program files (x86)\synology\assistant\dsassistant.exe] => (Allow) C:\program files (x86)\synology\assistant\dsassistant.exe
FirewallRules: [UDP Query User{E7D2FEC7-E169-4BCB-9AB2-1934F2265D59}C:\program files (x86)\synology\assistant\dsassistant.exe] => (Allow) C:\program files (x86)\synology\assistant\dsassistant.exe
FirewallRules: [{80B837C3-05D8-4461-A067-8B624E8C054E}] => (Block) C:\program files (x86)\synology\assistant\dsassistant.exe
FirewallRules: [{F36CF667-2855-4043-B3B7-89567B1267A7}] => (Block) C:\program files (x86)\synology\assistant\dsassistant.exe
FirewallRules: [{C558AD57-96EE-4381-8139-18D626A641F0}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{97E6CC6B-42EE-4DF2-A2C3-C56D0B8431A8}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{2B337169-769E-4881-9834-D65B81D86331}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{BFBAF6D6-6FFD-4EA6-B758-358A5DC37BA5}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{B66C9F11-02C0-4654-AF48-0A30F9A65FCD}] => (Allow) C:\Program Files\MetaTrader 5\metatester64.exe
FirewallRules: [{B2059CEA-82EB-46BC-82B9-6048413F6300}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\4.0.3\DriverBooster.exe
FirewallRules: [{01DC5DA7-3F73-44EE-9F78-565D1FF4A6E2}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\4.0.3\DriverBooster.exe
FirewallRules: [{D1F591F9-C05C-4ABB-B4BE-36BE422945FE}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\4.0.3\DBDownloader.exe
FirewallRules: [{DDB444CF-3DA5-4DD4-972F-78C39F325507}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\4.0.3\DBDownloader.exe
FirewallRules: [{BF573C01-DAE9-471A-86D6-BC53824FE0FF}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\4.0.3\AutoUpdate.exe
FirewallRules: [{576EB0D0-84A9-4282-99D5-DA35D9C368FF}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\4.0.3\AutoUpdate.exe
FirewallRules: [{CC4290F2-CA10-4257-93AC-A70F15D2E23B}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\bin\FaxApplications.exe
FirewallRules: [{63BB95EC-651A-40A1-8D71-FE4E8079CF76}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\bin\DigitalWizards.exe
FirewallRules: [{6959027B-E56D-463C-B4A4-85A3382FBCEC}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\bin\SendAFax.exe
FirewallRules: [{B5A12CB2-B6A4-442B-9278-C09BA9E6F1B7}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\Bin\DeviceSetup.exe
FirewallRules: [{14133C9E-649F-409B-97AD-A88BD5D447FE}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe
FirewallRules: [{CF6428AB-AE12-4BC2-B8CF-BDF801638748}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{66E8777E-329B-4EFA-926C-634F654862C7}] => (Allow) C:\Program Files\FreeDownloadManager.ORG\Free Download Manager\fdm.exe
FirewallRules: [{27AB9154-4656-4166-AD17-F1B8A9CE6103}] => (Allow) C:\Program Files\FreeDownloadManager.ORG\Free Download Manager\fdm.exe
FirewallRules: [TCP Query User{AC1529C9-D1E3-40E9-97F2-E920DFFA2B69}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{3AD795F1-D9E7-40D6-A2C6-5FD1E01C36A8}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{476C6B89-AB1B-4AB8-A25D-4B96DB24620E}C:\users\pc\appdata\local\temp\7zs2241\enterprisedu.exe] => (Allow) C:\users\pc\appdata\local\temp\7zs2241\enterprisedu.exe
FirewallRules: [UDP Query User{5C368C4A-DEF8-4B40-A180-CA31CF7030C0}C:\users\pc\appdata\local\temp\7zs2241\enterprisedu.exe] => (Allow) C:\users\pc\appdata\local\temp\7zs2241\enterprisedu.exe
FirewallRules: [{A65269C2-EB0E-4235-AE77-19DE4F099B2E}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{CFDB8E32-773B-4E09-85FC-F8CB542CBEE4}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\Infrastructure\mms_mini.exe
FirewallRules: [{DBA0D921-40D1-480A-B52D-9CE6B8807C63}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\MobileBackupServer\mobile_backup_server.exe
FirewallRules: [{C55C871A-9A74-4B2F-945E-15DA98A7C5F0}] => (Allow) C:\Program Files (x86)\Acronis\TrueImageHome\mobile_backup_status_server.exe
FirewallRules: [{DC40FB4D-816D-4D64-B6D8-8B4C3DDC2760}] => (Allow) LPort=1688
FirewallRules: [{6F2B2AF2-B981-4F72-A86C-3715B3BEFBEA}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [TCP Query User{E2E4D0FD-53A4-416E-89D5-46A95CE8FD1E}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [UDP Query User{C8D4EBA8-C10D-4B00-B63A-D59B5AD96C32}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [TCP Query User{58B1A33B-B8A4-40ED-9A55-4C69823EC87C}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
FirewallRules: [UDP Query User{37409734-6E64-41B9-A329-D15B116F9819}C:\xampp\mysql\bin\mysqld.exe] => (Allow) C:\xampp\mysql\bin\mysqld.exe
FirewallRules: [{EEF79074-ECAA-4FB2-AF5E-35C28E7D2347}] => (Allow) LPort=1688
FirewallRules: [{189E7579-E4D2-4D12-BBC6-21BCFC3D3034}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{DD4E26E5-3A66-44DF-9402-B464F4FEB5DE}] => (Allow) LPort=2869
FirewallRules: [{EF8A7079-E24A-4335-AB31-8F752EA23F1F}] => (Allow) LPort=1900
FirewallRules: [{FC497AF5-9AFE-4FFB-AABF-B57BD9881257}] => (Allow) C:\Program Files (x86)\Opera\46.0.2597.57\opera.exe
FirewallRules: [TCP Query User{918905B2-10F9-4F62-9FE3-FE48A5987865}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{F09408DF-89D6-4CFE-A5AC-1164C79F6DCE}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{DB42AC57-EF6A-401E-86AE-5AB008492991}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{16101CF1-C822-4AB0-A05E-14B3A5AB21FD}] => (Allow) C:\Program Files (x86)\Raptr Inc\Raptr\raptr.exe
FirewallRules: [{6B6C94CD-F96F-4DBE-A1F8-7FAA1EFB0368}] => (Allow) C:\Program Files (x86)\Raptr Inc\Raptr\raptr.exe
FirewallRules: [{D1DF1A36-E93B-4D50-80B2-2E61EF3DF7A8}] => (Allow) C:\Program Files (x86)\Raptr Inc\Raptr\raptr_im.exe
FirewallRules: [{89D15F90-6E40-4CE4-A8F3-AA9774256B5D}] => (Allow) C:\Program Files (x86)\Raptr Inc\Raptr\raptr_im.exe
FirewallRules: [{BC9E082D-123C-49D3-8995-82DD96E198A8}] => (Allow) C:\Program Files (x86)\Raptr Inc\PlaysTV\playstv.exe
FirewallRules: [{3C56AAE3-4636-4C40-9A10-BA26CE5FA4D1}] => (Allow) C:\Program Files (x86)\Raptr Inc\PlaysTV\playstv.exe
FirewallRules: [{B8478DB8-6042-48DA-AE43-0AA98EC4CFDB}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{6257AE2E-EB5E-42D6-9E43-651EEA231E06}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{FE7C408D-ED2D-494F-948D-CC26654025DC}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{D7023797-98A7-4DAE-87AA-86C65F07BA67}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe

==================== Restore Points =========================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/22/2017 09:27:16 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "I:\Scan and Repair u aufräumen - Mail-Adware-Troja-etc\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.

Error: (07/22/2017 09:17:39 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "F:\Scan and Repair u aufräumen - Mail-Adware-Troja-etc\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.

Error: (07/22/2017 08:40:25 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Users\Codo der III\Downloads\Scan and Repair u aufräumen - Mail-Adware-Troja-etc\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.

Error: (07/22/2017 04:28:24 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Users\Codo der III\Downloads\Scan and Repair u aufräumen - Mail-Adware-Troja-etc\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.

Error: (07/22/2017 03:49:18 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "I:\Scan and Repair u aufräumen - Mail-Adware-Troja-etc\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.

Error: (07/22/2017 03:49:13 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "F:\Scan and Repair u aufräumen - Mail-Adware-Troja-etc\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.

Error: (07/22/2017 02:03:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: AdwCleaner_7.0.0.0.exe, Version: 7.0.0.0, Zeitstempel: 0x596d30ca
Name des fehlerhaften Moduls: AdwCleaner_7.0.0.0.exe, Version: 7.0.0.0, Zeitstempel: 0x596d30ca
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000e9da0
ID des fehlerhaften Prozesses: 0xbd4
Startzeit der fehlerhaften Anwendung: 0x01d302d9b1f7d31c
Pfad der fehlerhaften Anwendung: I:\Scan and Repair u aufräumen - Mail-Adware-Troja-etc\AdwCleaner_7.0.0.0.exe
Pfad des fehlerhaften Moduls: I:\Scan and Repair u aufräumen - Mail-Adware-Troja-etc\AdwCleaner_7.0.0.0.exe
Berichtskennung: 6118592c-6ecd-11e7-82a7-7824afd93019
Vollständiger Name des fehlerhaften Pakets: 
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (07/22/2017 12:00:23 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "I:\Scan and Repair u aufräumen - Mail-Adware-Troja-etc\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.

Error: (07/22/2017 12:00:18 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Users\Codo der III\Downloads\Scan and Repair u aufräumen - Mail-Adware-Troja-etc\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.

Error: (07/22/2017 11:18:35 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Service_KMS.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.IO.IOException
   bei System.IO.__Error.WinIOError(Int32, System.String)
   bei System.IO.FileStream.Init(System.String, System.IO.FileMode, System.IO.FileAccess, Int32, Boolean, System.IO.FileShare, Int32, System.IO.FileOptions, SECURITY_ATTRIBUTES, System.String, Boolean, Boolean, Boolean)
   bei System.IO.FileStream..ctor(System.String, System.IO.FileMode, System.IO.FileAccess, System.IO.FileShare, Int32, System.IO.FileOptions, System.String, Boolean, Boolean, Boolean)
   bei System.IO.StreamWriter.CreateFile(System.String, Boolean, Boolean)
   bei System.IO.StreamWriter..ctor(System.String, Boolean, System.Text.Encoding, Int32, Boolean)
   bei System.IO.StreamWriter..ctor(System.String, Boolean, System.Text.Encoding)
   bei System.IO.File.InternalAppendAllText(System.String, System.String, System.Text.Encoding)
   bei Service_KMS.Logging.FileLogger.LogMessage(System.String)
   bei Service_KMS.Service.ScheduledTask()
   bei Service_KMS.Service.TaskLoop()
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   bei System.Threading.ThreadHelper.ThreadStart()


System errors:
=============
Error: (07/22/2017 02:57:13 PM) (Source: DCOM) (EventID: 10010) (User: Pc-Pc)
Description: Der Server "{BF6C1E47-86EC-4194-9CE5-13C15DCB2001}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (07/22/2017 11:18:37 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Service KMSELDI" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/22/2017 10:18:34 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Seagate Scheduler2 Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
Das System kann die angegebene Datei nicht finden.

Error: (07/22/2017 10:18:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Service Installer TrueKey" wurde aufgrund folgenden Fehlers nicht gestartet: 
Das System kann die angegebene Datei nicht finden.

Error: (07/22/2017 10:18:10 AM) (Source: Microsoft-Windows-Directory-Services-SAM) (EventID: 16953) (User: NT-AUTORITÄT)
Description: Fehler "126" beim Laden der Kennwortbenachrichtigungs-DLL ""C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter"". Stellen Sie sicher, dass der in der Registrierung definierte DLL-Pfad "HKLM\System\CurrentControlSet\Control\Lsa\Notification Packages" sich auf einen korrekten und absoluten Pfad (<Laufwerk>:\<Pfad>\<Dateiname>.<Erw.>) bezieht und nicht auf einen relativen oder ungültigen Pfad. Wenn der DLL-Pfad falsch ist, stellen Sie sicher, dass sich alle Hilfsdateien im gleichen Verzeichnis befinden und dass das Systemkonto sowohl auf den DLL-Pfad als auch die Hilfsdateien Lesezugriff hat.  Wenden Sie sich an den Anbieter der Benachrichtigungs-DLL, um weitere Unterstützung zu erhalten. Weitere Informationen finden Sie im Internet unter "hxxp://go.microsoft.com/fwlink/?LinkId=245898".

Error: (07/21/2017 11:20:36 PM) (Source: SbieDrv) (EventID: 1412) (User: )
Description: SBIE1412 Im Text: [DefaultBox] \??\%SystemDrive%\Sandbox\%USER%\%SANDBOX%

Error: (07/21/2017 11:20:36 PM) (Source: SbieDrv) (EventID: 1406) (User: )
Description: SBIE1406 Falsche oder ungültige Erweiterung für SystemDrive: [C0000189]

Error: (07/21/2017 11:05:06 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: Der Server "{DDCFD26B-FEED-44CD-B71D-79487D2E5E5A}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (07/21/2017 11:03:11 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Seagate Scheduler2 Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
Das System kann die angegebene Datei nicht finden.

Error: (07/21/2017 11:03:06 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Service Installer TrueKey" wurde aufgrund folgenden Fehlers nicht gestartet: 
Das System kann die angegebene Datei nicht finden.


==================== Memory info =========================== 

Processor: AMD Athlon(tm) II X4 640 Processor
Percentage of memory in use: 33%
Total physical RAM: 12204.32 MB
Available physical RAM: 8150.61 MB
Total Virtual: 14060.32 MB
Available Virtual: 8122.3 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.42 GB) (Free:400.05 GB) NTFS
Drive i: (GELB 16GB) (Removable) (Total:15.01 GB) (Free:12.93 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: DB3D10F8)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.4 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 15 GB) (Disk ID: 00000000)

Partition: GPT.

==================== End of Addition.txt ============================
         

Hatte FRST dieses Mal nicht vom Desktop aus gestartet. Geht es dennoch?

mbam jetzt auch nochmals mit admin-rechten:

Malwarebytes
www.malwarebytes.com

-Protokolldetails-
Scan-Datum: 22.07.17
Scan-Zeit: 22:02
Protokolldatei: 
Administrator: Nein

-Softwaredaten-
Version: 3.1.2.1733
Komponentenversion: 1.0.160
Version des Aktualisierungspakets: 1.0.2417
Lizenz: Testversion

-Systemdaten-
Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Pc-Pc\Codo der III

-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Ergebnis: Abgeschlossen
Gescannte Objekte: 476894
Erkannte Bedrohungen: 0
(keine bösartigen Elemente erkannt)
In die Quarantäne verschobene Bedrohungen: 0
(keine bösartigen Elemente erkannt)
Abgelaufene Zeit: 11 Min., 30 Sek.

-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

-Scan-Details-
Prozess: 0
(keine bösartigen Elemente erkannt)

Modul: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)

Registrierungswert: 0
(keine bösartigen Elemente erkannt)

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Daten-Stream: 0
(keine bösartigen Elemente erkannt)

Ordner: 0
(keine bösartigen Elemente erkannt)

Datei: 0
(keine bösartigen Elemente erkannt)

Physischer Sektor: 0
(keine bösartigen Elemente erkannt)


(end)
         

Gut. Es kam aber erst so rüber, als hättest du ein sauberes Backup zurückgespielt und dann die Frage, dass man das bereinigen was vorher noch war. Es hätte gereicht wenn du geschrieben hättest, dass du nach ein paar Setups diesen und jeden Befall hast, das mit dem Backup&Restore zu erwähnen hat doch nur Verwirrung gestiftet.

Warum postest du Log von Malwarebyte sund Avir aohne Funde? Gab es keine Funde?

Leider hat es mir den Lap ebenso befallen.

Sry aber sowas stört mich einfach. Da werden nur Dinge beobachtet, die man nicht kennt. Sonst aber keine Funde, trotzdem wird gleich immer ein Befall herbeigeredet. Ach und übrigens:

S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe

Ist ein bekannter Windows und Office Crack.

Lesestoff:
Illegale Software: Cracks, Keygens und Co

Bitte lesen => http://www.trojaner-board.de/95393-c...-software.html

Es geht weiter wenn du alles Illegale entfernt hast.

Bei wiederholten Crack/Keygen Verstößen behalte ich es mir vor, den Support einzustellen, d.h. Hilfe nur noch bei der Datensicherung und Neuinstallation des Betriebssystems.

Ja, hätte ich mich aufs wesentliche beschränken sollen.

Warum postest du Log von Malwarebyte sund Avir aohne Funde? Gab es keine Funde?

Richtig. Es gab keine.

Sry aber sowas stört mich einfach. Da werden nur Dinge beobachtet, die man nicht kennt. Sonst aber keine Funde, trotzdem wird gleich immer ein Befall herbeigeredet.

OK, wo du recht hast ....... Auf dem Laptop beobachtete ich das gleiche Verhalten. OHNE zu wissen was es ist oder bedeutet.

Service_KMS.exe
Ist ein bekannter Windows und Office Crack.

Ich lebe auf Kreta und habe mir hier, letztes Jahr, vom Fachhändler vor Ort das Win8 auf den PC machen lassen. Da hoffe ich jetzt ich habe ne legale Version. Allerdings ist hier iwi eh alles (anscheinend) etwas anders.

Mein Office habe ich seit 2010 LEGAL - bei meinem lieben ARLT-Händler in Heidelberg gekauft.

Muss ich das Kmspico händisch entfernen, oder gibt es da ein Programm?

Sollte der Händler das windows tatsächlich mit kmspico frei geschaltet haben - läuft es dann, nach dem entfernen von kmspico, noch?
Oder muss ich da jetzt, vor dem entfernen, erst einmal vorsorgen und mir noch eine Version kaufen gehen?

FRST-Fix

Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft!

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

closeprocesses:
FirewallRules: [{82A41A2F-BAD1-42F4-8166-B0A79D15237B}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{C235C3AE-8152-4078-BEC0-043846B20EAC}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{928896D1-3F58-4562-AA8B-92DB1D74A572}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{FFF6EF8C-DEA9-4137-B361-672177C3204D}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{9598FF41-3952-4731-99BD-4E82DEF005DE}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{DC9C5AF8-9151-4BD6-8810-BD39E41F0C21}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{5D3DF93E-E118-418B-886E-E73CD90C36FD}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{4DFA0802-E1CD-47A5-84F2-4DCF7CAA3E5D}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{2B337169-769E-4881-9834-D65B81D86331}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{BFBAF6D6-6FFD-4EA6-B758-358A5DC37BA5}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
R3 WinDivert1.1; C:\Program Files\KMSpico\WinDivert.sys [35376 2016-09-30] (Basil Projects)
C:\Program Files\KMSpico
emptytemp:
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Als FRST fertig war, beendete es Firefox.
Den geforderten Neustrt habe ich noch nicht gemacht.

Nachtrag: Neustrt nun doch durchgeführt.

Fix result of Farbar Recovery Scan Tool (x64) Version: 23-07-2017
Ran by Pc (24-07-2017 08:01:34) Run:1
Running from C:\Users\Codo der III\Desktop
Loaded Profiles: Pc & Codo der III (Available Profiles: Pc & Codo der III & janka & test)
Boot Mode: Normal
==============================================

fixlist content:
*****************
closeprocesses:
FirewallRules: [{82A41A2F-BAD1-42F4-8166-B0A79D15237B}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{C235C3AE-8152-4078-BEC0-043846B20EAC}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{928896D1-3F58-4562-AA8B-92DB1D74A572}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{FFF6EF8C-DEA9-4137-B361-672177C3204D}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{9598FF41-3952-4731-99BD-4E82DEF005DE}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{DC9C5AF8-9151-4BD6-8810-BD39E41F0C21}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{5D3DF93E-E118-418B-886E-E73CD90C36FD}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{4DFA0802-E1CD-47A5-84F2-4DCF7CAA3E5D}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{2B337169-769E-4881-9834-D65B81D86331}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{BFBAF6D6-6FFD-4EA6-B758-358A5DC37BA5}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
R3 WinDivert1.1; C:\Program Files\KMSpico\WinDivert.sys [35376 2016-09-30] (Basil Projects)
C:\Program Files\KMSpico
emptytemp:
*****************

Processes closed successfully.
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{82A41A2F-BAD1-42F4-8166-B0A79D15237B} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{C235C3AE-8152-4078-BEC0-043846B20EAC} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{928896D1-3F58-4562-AA8B-92DB1D74A572} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{FFF6EF8C-DEA9-4137-B361-672177C3204D} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{9598FF41-3952-4731-99BD-4E82DEF005DE} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{DC9C5AF8-9151-4BD6-8810-BD39E41F0C21} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{5D3DF93E-E118-418B-886E-E73CD90C36FD} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{4DFA0802-E1CD-47A5-84F2-4DCF7CAA3E5D} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{2B337169-769E-4881-9834-D65B81D86331} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{BFBAF6D6-6FFD-4EA6-B758-358A5DC37BA5} => value removed successfully
WinDivert1.1 => Unable to stop service.
HKLM\System\CurrentControlSet\Services\WinDivert1.1 => key removed successfully
WinDivert1.1 => service removed successfully
C:\Program Files\KMSpico => moved successfully

=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 28883756 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 52320725 B
Edge => 0 B
Chrome => 0 B
Firefox => 1441792 B
Opera => 20586459 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 128 B
LocalService => 6044284 B
NetworkService => 0 B
Pc => 228766227 B
Codo der III => 146336726 B
janka => 6112 B
test => 76202 B

RecycleBin => 2857864 B
EmptyTemp: => 472.7 MB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 08:01:54 ====
         

Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

• Starte bitte die mbar.exe.
• Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
• Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
• Klicke auf den CleanUp Button und erlaube den Neustart.
• Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
• Nach dem Neustart starte die mbar.exe erneut.
• Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

• Starte bitte die mbar.exe.
• Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
• Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
• Klicke auf den CleanUp Button und erlaube den Neustart.
• Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
• Nach dem Neustart starte die mbar.exe erneut.
• Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.