| |
| |||||||
Log-Analyse und Auswertung: Ständig im TaskManager Audio.exe EMCO Malware DestroyerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
02.09.2017, 11:43
| #16 |
 |  Ständig im TaskManager Audio.exe EMCO Malware Destroyer Fixlog: Code:
ATTFilter Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version: 20-08-2017
durchgeführt von ktown (02-09-2017 12:33:44) Run:2
Gestartet von C:\Users\ktown\Downloads\Mods
Geladene Profile: ktown (Verfügbare Profile: ktown)
Start-Modus: Normal
==============================================
fixlist Inhalt:
*****************
closeprocesses:
folder: C:\Users\ktown\AppData\Local\Microsoft\Windows
cmd: type C:\Users\ktown\AppData\Local\VirtualStore\Windows\assembly\Desktop.ini
cmd: type C:\Users\ktown\AppData\Local\Temp\guid.bat
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Beschränkung <==== ACHTUNG
folder: C:\Users\ktown\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Startup: C:\Users\ktown\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2017-08-28] ()
C:\Users\ktown\Downloads\Mods\cdbxp_setup_4.5.7.6623.exe
2017-08-27 22:22 - 2017-08-28 16:25 - 000000000 ____D C:\Users\ktown\AppData\Roaming\tor
2017-08-27 22:21 - 2017-08-28 18:33 - 000000000 ____D C:\Users\ktown\AppData\Roaming\sound
2017-08-27 22:21 - 2017-08-28 18:33 - 000000000 ____D C:\Users\ktown\AppData\Roaming\Audio
emptytemp:
*****************
Prozesse erfolgreich geschlossen.
========================= folder: C:\Users\ktown\AppData\Local\Microsoft\Windows ========================
2017-08-25 21:12 - 2017-09-01 13:47 - 003670016 ____H () C:\Users\ktown\AppData\Local\Microsoft\Windows\UsrClass.dat
2017-08-25 21:12 - 2017-08-25 21:12 - 003166208 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1
2017-08-25 21:12 - 2017-08-25 21:12 - 001081344 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2
2017-08-25 21:12 - 2017-08-25 21:12 - 000065536 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\UsrClass.dat{0350d035-89c9-11e7-ba53-f832e4a07181}.TM.blf
2017-08-25 21:12 - 2017-08-25 21:12 - 000524288 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\UsrClass.dat{0350d035-89c9-11e7-ba53-f832e4a07181}.TMContainer00000000000000000001.regtrans-ms
2017-08-25 21:12 - 2017-08-25 21:12 - 000524288 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\UsrClass.dat{0350d035-89c9-11e7-ba53-f832e4a07181}.TMContainer00000000000000000002.regtrans-ms
2017-08-25 21:13 - 2017-08-25 21:13 - 000000000 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\WebCacheLock.dat
2017-08-28 00:07 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{024A0432-A804-47A4-8817-A9BEE06E8910}
2017-08-28 16:24 - 2017-08-31 18:11 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{032644B3-4DBF-404C-9DDB-ADE8247BA58D}
2017-08-28 00:07 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{07447B11-BD36-48EB-B4E9-E7F9BF5363B0}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{1070BD43-530B-4357-A9B8-3C56887B61F1}
2017-08-27 22:47 - 2017-08-27 22:47 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{122ACCD3-7873-4BC9-8D1A-A61542814B75}
2017-08-27 23:29 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{139558E7-CDC1-429B-9102-1262B97B7B85}
2017-08-27 22:55 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{17A3D445-3FD8-4749-B713-40D195E83059}
2017-08-27 23:01 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{1B6A2BD5-9186-40B7-AE0D-B50D1FF28920}
2017-08-27 22:54 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{1E9F4759-67BE-4C02-ACE4-74F62187D259}
2017-08-27 22:54 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{209CD171-D1F0-4F55-B654-41B51081028E}
2017-08-27 22:54 - 2017-08-28 18:33 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{23A1C90E-6B28-45F0-834B-28ACA2D2D339}
2017-08-27 22:54 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{2D494E5D-CB30-410A-8210-2A567D9ED826}
2017-08-27 23:01 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{2FD1294D-BEB5-4F29-9955-FD7329AE71D8}
2017-08-28 16:24 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{2FD7733B-8CF8-4F2B-8602-ED71387F0CE6}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{3152A6D8-F373-4EC6-8003-AFB5B6FFE3FE}
2017-08-27 22:21 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{40AB6665-68D5-496B-AFC0-BA8AF50C6919}
2017-08-27 22:51 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{4320DDD4-600C-4A45-8177-E4F360433D85}
2017-08-27 23:01 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{43D1CE4D-90A7-47A6-8548-0F746D5FD623}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{460E70F7-144D-4875-866B-C864BEC1AB98}
2017-08-27 23:30 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{46F48AEB-DB7C-47A0-B006-719CBDEF549D}
2017-08-27 22:55 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{482F908D-75BC-4E0F-AC08-29665CAA16CE}
2017-08-28 00:07 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{4B29994D-7D11-48AA-BBD7-3D6F5972EB8C}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{566E0DA9-203E-496C-A5B0-8C825F39E577}
2017-08-27 22:55 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{58155E36-DBC6-417A-BDFF-B16C171553CB}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{5A37934C-FFA9-4F56-80DF-9D31F8950B06}
2017-08-27 22:55 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{5B63FCA5-5390-4F9D-A526-003B8B356D4F}
2017-08-27 23:22 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{5D0BE935-AAA1-4756-B798-9E2F41396BAB}
2017-08-28 16:22 - 2017-08-28 16:23 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{5EB9B3AC-0160-42D7-AEC2-58385DDEFF67}
2017-08-27 22:54 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{6176FFB1-D968-4280-A148-EA629546F193}
2017-08-27 22:21 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{64CC78B0-D949-40FD-BA90-B2899E561F15}
2017-08-27 22:50 - 2017-08-27 22:50 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{66FCDB64-40FB-4956-A5F0-377A14EFF24D}
2017-08-27 22:54 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{6750A088-8B0E-4BD8-BD0E-86CC73025E01}
2017-08-27 22:59 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{68317946-D327-4210-817B-C0E827221C43}
2017-08-27 23:31 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{69CE8F0F-5B53-42AD-8F26-02722D10B41B}
2017-08-27 23:31 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{6B13E4C4-6BA4-429D-A987-432769D8414B}
2017-08-27 22:59 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{6B4EA066-4854-492E-840A-8C7C5736B832}
2017-08-27 22:56 - 2017-08-27 22:56 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{6B74B309-E7FD-4FD5-B22D-CA53E1B33B41}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{714C6B6F-2043-4925-A281-ABF548FD5CE4}
2017-08-27 23:31 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{73DC0E34-2888-41FC-B2AC-A86201DA0FAD}
2017-08-27 22:54 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{7BE4E157-B5F0-4B05-94E5-3862A9558DA8}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{80A045C6-8219-45AE-B9D1-F57E829472C5}
2017-08-27 23:02 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{832C6928-C980-4B4C-853C-1FC87E0E9032}
2017-08-27 23:01 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{8C851D31-2EDE-4F07-939D-5C8A5C69CDFF}
2017-08-27 23:02 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{8D3989AA-3322-4AB5-A14A-057BE8DF64FC}
2017-08-28 16:24 - 2017-08-28 18:33 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{8E73B611-6D21-4BA3-B993-163F23FD62A0}
2017-08-27 23:22 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{93822BC0-2749-4A82-B29A-CBEDE201C0DA}
2017-08-27 22:21 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{94EE25A4-3009-46F4-82A2-80EDFCF8540A}
2017-08-28 16:22 - 2017-08-28 16:23 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{976708A6-0B52-4144-BB35-50BB4B655C78}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{9B385A54-7A40-47F4-AEA3-1DA3D3F03849}
2017-08-27 22:55 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{A39D38FC-FBC7-48ED-882A-248539E8860C}
2017-08-27 22:51 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{A800E9B1-0658-4F46-9D76-93F432E60DEE}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{A8645507-B84A-4FD1-AC84-D7BEADA0C558}
2017-08-27 23:31 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{A91DDEBE-7B15-4F86-B500-257A1E332388}
2017-08-28 00:08 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{ADD3B04C-A1CD-403F-A495-4695B75F30FD}
2017-08-27 22:54 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{B5EBD04C-8CDA-40BC-9B77-9EBA379BF202}
2017-08-27 23:31 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{BA86BCA4-4096-428E-948B-1A43E316FCAD}
2017-08-28 16:22 - 2017-08-28 16:23 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{BBDC5531-D1EB-4C76-B6C0-76AC8435833D}
2017-08-27 22:59 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{BF496574-6A87-4920-8310-A54F8096DF51}
2017-08-28 16:24 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{C83EFF28-A57A-4BBC-B695-426178168753}
2017-08-28 16:05 - 2017-08-28 16:06 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{C8678A9A-48F2-4B55-BE16-354D909C3328}
2017-08-28 00:07 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{CBDFBAF8-299F-44AC-9DF3-F27FE98C7231}
2017-08-28 00:08 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{CD3229B0-A69D-42D9-8C04-C73C7F9A8120}
2017-08-27 22:59 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{CD5FC2EA-1F10-46B3-AB08-A3444A6F3E86}
2017-08-27 22:55 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{CEE6B822-FD7E-4EFB-A7C8-019D405FC2C4}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{D000F72B-49B8-4B73-A5C7-CD55D0A8DA8A}
2017-08-28 16:22 - 2017-08-28 16:23 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{D60CC88D-D1E0-4145-9F6E-76A5965EB182}
2017-08-27 22:21 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{D8A391E8-547D-4F60-A4C9-7ADB37D4BF81}
2017-08-27 23:31 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{D8FC2835-B597-4978-A0F5-F3C1E1D2FD2C}
2017-08-27 23:29 - 2017-08-28 18:33 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{DC41174F-1316-4C73-AF54-50FAC2A2B0E6}
2017-08-27 23:01 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{DD3F0BEA-6038-4E6A-92C6-012D40B65DEC}
2017-08-28 16:05 - 2017-08-28 16:06 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{E1D5BFD4-07D4-4193-9884-6744CF2F5BE4}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{E49E6D4F-E95C-4D0C-8E10-1FA6E9F8BB5F}
2017-08-27 23:01 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{ECF6E036-3732-40A8-9AC2-4FDCA292811E}
2017-08-27 23:30 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{EEF4FFCC-6844-428D-B69F-2AB0BAE9A03E}
2017-08-27 22:49 - 2017-08-27 22:49 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{EF5BA5D0-27CE-492C-BE7B-8F481583F185}
2017-08-27 22:47 - 2017-08-27 22:47 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{F96B83B8-2262-4431-991F-8DF1F5714B59}
2017-08-26 11:53 - 2017-08-26 11:53 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\0
2017-08-27 12:24 - 2017-08-27 12:24 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\1024
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\1031
2017-08-26 11:50 - 2017-08-26 11:50 - 000418356 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\1031\StructuredQuerySchema.bin
2017-08-26 13:13 - 2017-09-02 12:09 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\ActionCenterCache
2017-09-02 12:09 - 2017-08-26 12:44 - 000004107 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\ActionCenterCache\microsoft-skypeapp_kzf8qxf38zg5c-app_638_0.png
2017-08-26 11:50 - 2017-08-30 09:33 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\AppCache
2017-08-30 09:33 - 2017-08-30 09:33 - 000000000 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\AppCache\container.dat
2017-08-30 09:33 - 2017-08-30 09:33 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\AppCache\DDFDQL8I
2017-08-30 09:33 - 2017-08-30 09:33 - 000000000 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\AppCache\DDFDQL8I\container.dat
2017-08-25 21:13 - 2017-08-26 13:45 - 000000000 ___RD () C:\Users\ktown\AppData\Local\Microsoft\Windows\Application Shortcuts
2017-08-25 21:13 - 2017-08-26 13:45 - 000000174 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini
2017-08-25 21:15 - 2017-08-27 12:04 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\Burn
2017-08-25 21:15 - 2017-08-25 21:15 - 000000000 __RHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\Burn\Burn
2017-08-25 21:15 - 2017-08-25 21:15 - 000000174 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini
2017-08-27 12:04 - 2017-08-27 12:04 - 000000000 __RHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\Burn\Burn1
2017-08-27 12:04 - 2017-08-27 12:04 - 000000174 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini
2017-08-25 21:13 - 2017-09-02 12:08 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\Caches
2017-08-26 12:44 - 2017-08-28 18:07 - 000418392 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Caches\{1FC437C3-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000002.db
2017-09-02 12:08 - 2017-09-02 12:08 - 000319112 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x00000000000000c2.db
2017-09-01 11:00 - 2017-09-01 11:00 - 000156784 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000019.db
2017-09-01 13:47 - 2017-09-01 13:47 - 000099192 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001a.db
2017-08-25 21:16 - 2017-08-25 21:16 - 000016384 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
2017-08-25 21:13 - 2017-08-25 21:13 - 000016384 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Caches\cversions.3.db
2017-08-25 21:12 - 2017-03-18 23:03 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\CloudStore
2017-08-25 21:13 - 2017-08-28 18:10 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer
2017-08-25 21:13 - 2017-08-25 21:15 - 000524288 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl
2017-08-27 00:20 - 2017-09-02 12:08 - 000040960 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl
2017-08-28 18:10 - 2017-08-28 18:10 - 000000024 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db
2017-08-28 18:10 - 2017-08-28 18:10 - 003145728 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db
2017-08-28 18:10 - 2017-08-28 18:10 - 000000024 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db
2017-08-28 18:10 - 2017-08-28 19:15 - 002097152 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db
2017-08-28 18:10 - 2017-08-28 18:10 - 000000024 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db
2017-08-28 18:10 - 2017-08-28 18:10 - 006291456 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
2017-08-28 18:10 - 2017-08-28 18:10 - 007340032 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
2017-08-28 18:10 - 2017-08-28 18:10 - 000000024 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db
2017-08-28 18:10 - 2017-08-28 18:10 - 000000024 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db
2017-08-28 18:10 - 2017-08-28 18:10 - 000000024 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db
2017-08-28 18:10 - 2017-08-28 18:10 - 000000024 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db
2017-08-28 18:10 - 2017-09-01 13:34 - 000465552 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
2017-08-28 18:10 - 2017-08-28 18:10 - 000000024 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db
2017-08-28 18:10 - 2017-08-28 18:10 - 000000024 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db
2017-08-28 18:10 - 2017-08-28 18:10 - 000000024 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db
2017-08-25 21:14 - 2017-09-01 13:10 - 002097152 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db
2017-08-25 21:14 - 2017-08-28 18:10 - 001048576 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db
2017-08-25 21:14 - 2017-08-28 18:07 - 000000024 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db
2017-08-25 21:14 - 2017-08-28 18:07 - 001048576 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
2017-08-25 21:14 - 2017-08-30 09:38 - 001048576 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db
2017-08-25 21:14 - 2017-08-28 18:10 - 002097152 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db
2017-08-25 21:14 - 2017-08-28 18:07 - 001048576 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
2017-08-25 21:14 - 2017-09-01 13:45 - 002097152 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db
2017-08-25 21:14 - 2017-08-30 09:38 - 001048576 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db
2017-08-25 21:14 - 2017-08-28 18:07 - 000000024 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db
2017-08-25 21:14 - 2017-08-30 09:38 - 001048576 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db
2017-08-25 21:14 - 2017-08-28 20:10 - 000058320 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
2017-08-25 21:14 - 2017-08-28 18:07 - 000000024 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db
2017-08-25 21:14 - 2017-08-28 18:07 - 000000024 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db
2017-08-25 21:14 - 2017-08-28 18:07 - 000000024 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db
2017-08-25 21:16 - 2017-08-31 19:33 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\NotifyIcon
2017-08-29 21:55 - 2017-08-30 22:55 - 000000701 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Explorer\NotifyIcon\Microsoft.Explorer.Notification.{0A7B8388-5D8E-22DC-2DE3-0AE91C1C44F2}.png
2017-08-25 21:12 - 2017-03-18 23:03 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\GameExplorer
2017-08-25 21:12 - 2017-08-28 18:11 - 000000000 ___SD () C:\Users\ktown\AppData\Local\Microsoft\Windows\History
2017-08-28 18:11 - 2017-08-28 18:11 - 000000130 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\History\desktop.ini
2017-08-25 21:13 - 2017-09-02 12:32 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\History\History.IE5
2017-08-28 18:11 - 2017-08-28 18:11 - 000000000 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\History\History.IE5\container.dat
2017-08-28 00:16 - 2017-08-28 18:09 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017082120170828
2017-08-28 00:16 - 2017-08-28 18:11 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017082820170829
2017-08-28 18:11 - 2017-08-28 18:11 - 000000000 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017082820170829\container.dat
2017-08-29 15:31 - 2017-08-29 15:31 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017082920170830
2017-08-29 15:31 - 2017-08-29 15:31 - 000000000 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017082920170830\container.dat
2017-08-30 09:18 - 2017-08-30 09:18 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083020170831
2017-08-30 09:18 - 2017-08-30 09:18 - 000000000 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083020170831\container.dat
2017-08-31 14:26 - 2017-08-31 14:26 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901
2017-08-31 14:26 - 2017-08-31 14:26 - 000000000 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017083120170901\container.dat
2017-09-01 09:51 - 2017-09-01 09:51 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017090120170902
2017-09-01 09:51 - 2017-09-01 09:51 - 000000000 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017090120170902\container.dat
2017-09-02 12:32 - 2017-09-02 12:32 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017090220170903
2017-09-02 12:32 - 2017-09-02 12:32 - 000000000 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017090220170903\container.dat
2017-08-25 21:13 - 2017-08-29 20:39 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\History\Low
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\History\Low\History.IE5
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\History\Low\History.IE5\container.dat
2017-08-25 21:13 - 2017-08-29 20:39 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\IECompatCache
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\IECompatCache\container.dat
2017-08-25 21:13 - 2017-08-29 20:39 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\IECompatCache\Low
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\IECompatCache\Low\container.dat
2017-08-25 21:13 - 2017-08-29 20:39 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\IECompatUaCache
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\IECompatUaCache\container.dat
2017-08-25 21:13 - 2017-08-29 20:39 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\IECompatUaCache\Low
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\IECompatUaCache\Low\container.dat
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\IEDownloadHistory
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\IEDownloadHistory\container.dat
2017-08-25 21:12 - 2017-08-29 20:39 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache
2017-08-28 18:10 - 2017-08-28 18:10 - 000000128 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\counters2.dat
2017-08-28 18:10 - 2017-08-28 18:10 - 000000000 _SHDL () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Content.IE5
2017-08-28 18:10 - 2017-08-29 20:41 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE
2017-08-28 18:10 - 2017-08-28 18:10 - 000000000 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\container.dat
2017-08-29 15:24 - 2017-09-02 12:33 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\NBJP9SFO
2017-08-30 09:32 - 2017-08-30 09:32 - 000013905 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\NBJP9SFO\203[1]
2017-08-31 14:50 - 2017-08-31 14:50 - 000013905 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\NBJP9SFO\203[2]
2017-09-01 13:01 - 2017-09-01 13:01 - 000072527 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\NBJP9SFO\9NBLGGH1ZRPV[1].json
2017-08-29 20:39 - 2017-08-29 20:39 - 000032956 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\NBJP9SFO\favicon[1].ico
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\NBJP9SFO\favicon[1].png
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\NBJP9SFO\favicon[2].png
2017-08-29 20:39 - 2017-08-29 20:39 - 000090518 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\NBJP9SFO\known_providers_download_v1[1].xml
2017-08-30 20:21 - 2017-09-01 10:29 - 000000187 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\NBJP9SFO\lightshot[1].xml
2017-08-29 20:32 - 2017-08-29 20:32 - 000000139 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\NBJP9SFO\ShippedFlights[1].cache
2017-08-30 09:38 - 2017-08-30 09:38 - 000048143 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\NBJP9SFO\tmpldata[1]
2017-09-02 12:33 - 2017-09-02 12:33 - 000000011 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\NBJP9SFO\up64[2]
2017-09-01 13:23 - 2017-09-01 13:23 - 000011590 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\NBJP9SFO\vs[2].cache
2017-08-29 14:29 - 2017-08-30 20:21 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\Q51OAH2F
2017-08-29 20:33 - 2017-08-29 20:33 - 000001471 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\Q51OAH2F\CompatibilityList[1].cache
2017-08-29 20:32 - 2017-08-29 20:32 - 000010338 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\Q51OAH2F\dyntelconfig[1].cache
2017-08-29 20:43 - 2017-08-29 20:43 - 000003296 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\Q51OAH2F\dyntelconfig[2].cache
2017-08-29 20:32 - 2017-08-29 20:32 - 000000505 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\Q51OAH2F\Master[1].cache
2017-08-29 20:32 - 2017-08-29 20:32 - 000006494 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\Q51OAH2F\RemoteSettings_Common_15.0[1].cache
2017-08-29 20:39 - 2017-08-31 17:17 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\RBVY8F7U
2017-08-30 09:32 - 2017-08-30 09:32 - 000010532 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\RBVY8F7U\200[1]
2017-08-30 09:33 - 2017-08-30 09:33 - 000079107 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\RBVY8F7U\edgecompatviewlist[1].xml
2017-08-30 09:45 - 2017-08-30 09:45 - 000079107 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\RBVY8F7U\edgecompatviewlist[2].xml
2017-08-29 20:39 - 2017-08-29 20:39 - 000000300 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\RBVY8F7U\favicon[1].ico
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\RBVY8F7U\favicon[1].png
2017-08-29 20:39 - 2017-08-29 20:39 - 000017174 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\RBVY8F7U\favicon[2].ico
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\RBVY8F7U\favicon[2].png
2017-08-31 17:17 - 2017-08-31 17:17 - 000000139 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\RBVY8F7U\windows-app-web-link[1].json
2017-08-31 17:17 - 2017-08-31 17:17 - 000000963 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\IE\RBVY8F7U\windows-app-web-link[2].json
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low
2017-08-29 20:39 - 2017-08-29 20:39 - 000049120 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DAT
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 _SHDL () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\container.dat
2017-08-29 20:39 - 2017-08-29 20:44 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\ATC5QTQ6
2017-08-29 20:39 - 2017-08-29 20:39 - 000001348 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\ATC5QTQ6\1015730972[1].htm
2017-08-29 20:39 - 2017-08-29 20:39 - 000034500 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\ATC5QTQ6\fbevents[1].js
2017-08-29 20:39 - 2017-08-29 20:39 - 000000817 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\ATC5QTQ6\footer-bg-1sZLDumW[1].svg
2017-08-29 20:39 - 2017-08-29 20:39 - 000051089 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\ATC5QTQ6\jsll-4[1].js
2017-08-29 20:39 - 2017-08-29 20:39 - 000028315 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\ATC5QTQ6\latest[1].eot
2017-08-29 20:39 - 2017-08-29 20:39 - 000003079 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\ATC5QTQ6\ms-icons-v2[1].jpg
2017-08-29 20:39 - 2017-08-29 20:39 - 000002229 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\ATC5QTQ6\notosansjp[1].css
2017-08-29 20:39 - 2017-08-29 20:39 - 000002238 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\ATC5QTQ6\notosanssc[1].css
2017-08-29 20:39 - 2017-08-29 20:39 - 000000115 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\ATC5QTQ6\prebuilt[1].htm
2017-08-29 20:39 - 2017-08-29 20:39 - 000021314 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\ATC5QTQ6\products-icons[1].svg
2017-08-29 20:39 - 2017-08-29 20:39 - 000000044 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\ATC5QTQ6\tr[1].gif
2017-08-29 20:39 - 2017-08-29 20:39 - 000762315 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\ATC5QTQ6\vendor-e16b4de4[1].js
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DR49M29F
2017-08-29 20:39 - 2017-08-29 20:39 - 000161808 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DR49M29F\acquaint@2x-iQDFagDs[1].png
2017-08-29 20:39 - 2017-08-29 20:39 - 000000377 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DR49M29F\BizibleAcct[1].js
2017-08-29 20:39 - 2017-08-29 20:39 - 000013737 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DR49M29F\f[1].txt
2017-08-29 20:39 - 2017-08-29 20:39 - 000035047 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DR49M29F\latest[1].eot
2017-08-29 20:39 - 2017-08-29 20:39 - 000001569 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DR49M29F\linkid[1].js
2017-08-29 20:39 - 2017-08-29 20:39 - 000012487 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DR49M29F\ms[1].js
2017-08-29 20:39 - 2017-08-29 20:39 - 000034946 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DR49M29F\prebuilt[1].htm
2017-08-29 20:39 - 2017-08-29 20:39 - 000020103 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DR49M29F\sport-by9FYFi2[1].png
2017-08-29 20:39 - 2017-08-29 20:39 - 000076509 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DR49M29F\ws-ui-3cJvZ_2f[1].woff
2017-08-29 20:39 - 2017-08-29 20:39 - 000180080 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DR49M29F\ws-ui-light-1zr-aUMJ[1].woff
2017-08-29 20:39 - 2017-08-29 20:39 - 000193196 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DR49M29F\ws-ui-semibold-1iFJ2HVh[1].woff
2017-08-29 20:39 - 2017-08-29 20:39 - 000013348 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\DR49M29F\xamarin-crm-yRAsiCwY[1].png
2017-08-29 20:39 - 2017-08-29 20:44 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\GHSLD6RU
2017-08-29 20:39 - 2017-08-29 20:39 - 000012849 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\GHSLD6RU\5244a493c9b752f600000087[1].js
2017-08-29 20:39 - 2017-08-29 20:39 - 000223895 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\GHSLD6RU\8400156450[1].js
2017-08-29 20:39 - 2017-08-29 20:39 - 000041137 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\GHSLD6RU\871531639650731[1].js
2017-08-29 20:39 - 2017-08-29 20:39 - 000032959 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\GHSLD6RU\analytics[1].js
2017-08-29 20:39 - 2017-08-29 20:39 - 000065975 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\GHSLD6RU\gtm[1].js
2017-08-29 20:39 - 2017-08-29 20:39 - 000000794 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\GHSLD6RU\hexagon-1KGO_xDi[1].svg
2017-08-29 20:39 - 2017-08-29 20:39 - 000236483 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\GHSLD6RU\ms-edge-specs[1].jpg
2017-08-29 20:39 - 2017-08-29 20:39 - 000001208 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\GHSLD6RU\munchkin[1].js
2017-08-29 20:39 - 2017-08-29 20:39 - 000000155 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\GHSLD6RU\prebuilt[1].htm
2017-08-29 20:39 - 2017-08-29 20:39 - 000172016 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\GHSLD6RU\script[1].js
2017-08-29 20:39 - 2017-08-29 20:39 - 000119361 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\GHSLD6RU\style[1].css
2017-08-29 20:39 - 2017-08-29 20:39 - 000000044 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\GHSLD6RU\tr[1].gif
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\LQ0BQCE9
2017-08-29 20:39 - 2017-08-29 20:39 - 000001346 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\LQ0BQCE9\1015730972[1].htm
2017-08-29 20:39 - 2017-08-29 20:39 - 000094840 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\LQ0BQCE9\jquery-1.7.2.min[1].js
2017-08-29 20:39 - 2017-08-29 20:39 - 000003826 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\LQ0BQCE9\microsoft-logo-invert-TqcakxjU[1].svg
2017-08-29 20:39 - 2017-08-29 20:39 - 000029598 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\LQ0BQCE9\ms-edge-hero-v2[1].jpg
2017-08-29 20:39 - 2017-08-29 20:39 - 000005337 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\LQ0BQCE9\ms-logo[1].jpg
2017-08-29 20:39 - 2017-08-29 20:39 - 000007775 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\LQ0BQCE9\munchkin[1].js
2017-08-29 20:39 - 2017-08-29 20:39 - 000039336 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\LQ0BQCE9\my-shoppe-tDjOBjpA[1].png
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\LQ0BQCE9\pixel[1]
2017-08-29 20:39 - 2017-08-29 20:39 - 000003673 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\LQ0BQCE9\prebuilt-3t6lzMrL[1].css
2017-08-29 20:39 - 2017-08-29 20:39 - 000186918 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\LQ0BQCE9\template-4IeQvJe1[1].css
2017-08-29 20:39 - 2017-08-29 20:39 - 000078399 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\LQ0BQCE9\template-b1e0cbde[1].js
2017-08-29 20:39 - 2017-08-29 20:39 - 000003678 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Low\IE\LQ0BQCE9\xamarin-logo-3eAJQV2x[1].svg
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ___HD () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Virtualized
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Virtualized\C
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Virtualized\C\ProgramData
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Virtualized\C\ProgramData\NVIDIA Corporation
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Virtualized\C\ProgramData\NVIDIA Corporation\Drs
2017-08-29 20:39 - 2017-08-29 19:47 - 000000001 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Virtualized\C\ProgramData\NVIDIA Corporation\Drs\nvdrssel.bin
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Virtualized\C\ProgramData\NVIDIA Corporation\ShadowPlay
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Virtualized\C\Users
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Virtualized\C\Users\ktown
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Virtualized\C\Users\ktown\AppData
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Virtualized\C\Users\ktown\AppData\Local
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Virtualized\C\Users\ktown\AppData\Local\Microsoft
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Virtualized\C\Users\ktown\AppData\Local\Microsoft\Windows
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Virtualized\C\Users\ktown\AppData\Local\Microsoft\Windows\INetCache
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCache\Virtualized\C\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies
2017-08-25 21:12 - 2017-08-29 20:39 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies
2017-08-29 14:29 - 2017-08-29 14:29 - 000000114 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\6MZWCMQG.cookie
2017-08-29 14:29 - 2017-08-29 14:29 - 000000328 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\ALBJDMRY.cookie
2017-08-28 18:10 - 2017-08-28 18:10 - 000000000 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\container.dat
2017-08-29 15:24 - 2017-08-29 15:24 - 000000122 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\QWVPONIM.cookie
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\DNTException
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\DNTException\container.dat
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ___HD () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\DNTException\Low
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\Low
2017-08-29 20:39 - 2017-08-29 20:39 - 000000279 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\Low\07NS0QM8.cookie
2017-08-29 20:39 - 2017-08-29 20:39 - 000001100 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\Low\12HINYP0.cookie
2017-08-29 20:39 - 2017-08-29 20:39 - 000000090 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\Low\1617U04E.cookie
2017-08-29 20:39 - 2017-08-29 20:39 - 000000283 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\Low\30OQ8B12.cookie
2017-08-29 20:39 - 2017-08-29 20:39 - 000000377 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\Low\37QR3RAV.cookie
2017-08-29 20:39 - 2017-08-29 20:39 - 000000132 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\Low\9MQ1HT6G.cookie
2017-08-29 20:39 - 2017-08-29 20:39 - 000000669 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\Low\BORLN2BP.cookie
2017-08-29 20:39 - 2017-08-29 20:39 - 000000145 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\Low\C9QUFLDZ.cookie
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\Low\container.dat
2017-08-29 20:39 - 2017-08-29 20:39 - 000000110 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\Low\CS5LOJ3A.cookie
2017-08-29 20:39 - 2017-08-29 20:39 - 000000100 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\Low\LDKYEFZ6.cookie
2017-08-29 20:39 - 2017-08-29 20:39 - 000000104 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\Low\PU7Y625I.cookie
2017-08-29 20:39 - 2017-08-29 20:39 - 000000705 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\Low\UZ2EZ1EN.cookie
2017-08-29 20:39 - 2017-08-29 20:39 - 000000113 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\Low\V9Z6CRHP.cookie
2017-08-29 20:39 - 2017-08-29 20:39 - 000000108 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\Low\VZ9YWPPT.cookie
2017-08-29 20:39 - 2017-08-29 20:39 - 000000268 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\Low\XAU601P0.cookie
2017-08-29 20:39 - 2017-08-29 20:39 - 000000210 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\Low\YTUFXEZX.cookie
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\PrivacIE
2017-08-29 20:39 - 2017-08-29 20:39 - 000000000 ___HD () C:\Users\ktown\AppData\Local\Microsoft\Windows\INetCookies\PrivacIE\Low
2017-08-25 21:13 - 2017-08-26 11:49 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\Notifications
2017-08-25 21:13 - 2017-09-01 13:47 - 001048576 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db
2017-08-26 11:49 - 2017-09-02 12:08 - 000032768 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db-shm
2017-08-25 21:13 - 2017-09-02 12:31 - 001330792 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db-wal
2017-08-25 21:13 - 2017-09-02 12:08 - 000000000 ____H () C:\Users\ktown\AppData\Local\Microsoft\Windows\Notifications\WPNPRMRY.tmp
2017-08-25 21:13 - 2017-08-31 14:30 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\Notifications\wpnidm
2016-06-13 15:31 - 2016-06-13 15:31 - 000028383 ____N () C:\Users\ktown\AppData\Local\Microsoft\Windows\Notifications\wpnidm\294af3d2.jpg
2014-11-25 23:27 - 2014-11-25 23:27 - 000006475 ____N () C:\Users\ktown\AppData\Local\Microsoft\Windows\Notifications\wpnidm\2b67b297.jpg
2014-11-25 23:27 - 2014-11-25 23:27 - 000007127 ____N () C:\Users\ktown\AppData\Local\Microsoft\Windows\Notifications\wpnidm\4254396c.jpg
2014-11-25 23:27 - 2014-11-25 23:27 - 000008261 ____N () C:\Users\ktown\AppData\Local\Microsoft\Windows\Notifications\wpnidm\4464ab25.jpg
2014-11-25 23:27 - 2014-11-25 23:27 - 000005585 ____N () C:\Users\ktown\AppData\Local\Microsoft\Windows\Notifications\wpnidm\4683b0e5.jpg
2017-07-13 16:24 - 2017-07-13 16:24 - 000066446 ____N () C:\Users\ktown\AppData\Local\Microsoft\Windows\Notifications\wpnidm\5f02b56d.jpg
2014-11-25 23:27 - 2014-11-25 23:27 - 000004952 ____N () C:\Users\ktown\AppData\Local\Microsoft\Windows\Notifications\wpnidm\5fc0968a.jpg
2017-07-13 16:24 - 2017-07-13 16:24 - 000053310 ____N () C:\Users\ktown\AppData\Local\Microsoft\Windows\Notifications\wpnidm\63420817.jpg
2014-11-25 23:27 - 2014-11-25 23:27 - 000008396 ____N () C:\Users\ktown\AppData\Local\Microsoft\Windows\Notifications\wpnidm\6973a695.jpg
2014-11-25 23:27 - 2014-11-25 23:27 - 000009443 ____N () C:\Users\ktown\AppData\Local\Microsoft\Windows\Notifications\wpnidm\70af9816.jpg
2017-08-26 11:45 - 2017-08-26 11:45 - 000004555 ____N () C:\Users\ktown\AppData\Local\Microsoft\Windows\Notifications\wpnidm\7764210d.jpg
2014-11-25 23:27 - 2014-11-25 23:27 - 000009739 ____N () C:\Users\ktown\AppData\Local\Microsoft\Windows\Notifications\wpnidm\ae9fa87c.jpg
2016-04-27 09:45 - 2016-04-27 09:45 - 000048972 ____N () C:\Users\ktown\AppData\Local\Microsoft\Windows\Notifications\wpnidm\b6ed539b.jpg
2017-08-28 10:02 - 2017-08-28 10:02 - 000003747 ____N () C:\Users\ktown\AppData\Local\Microsoft\Windows\Notifications\wpnidm\bf3ae79.jpg
2017-08-31 06:16 - 2017-08-31 06:16 - 000003441 ____N () C:\Users\ktown\AppData\Local\Microsoft\Windows\Notifications\wpnidm\d8e51c8.jpg
2017-07-13 16:24 - 2017-07-13 16:24 - 000056762 ____N () C:\Users\ktown\AppData\Local\Microsoft\Windows\Notifications\wpnidm\d9bcf9e7.jpg
2017-08-29 12:45 - 2017-08-29 12:45 - 000004592 ____N () C:\Users\ktown\AppData\Local\Microsoft\Windows\Notifications\wpnidm\ef21e789.jpg
2017-08-25 21:15 - 2017-08-25 21:15 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PicturePassword
2017-08-26 23:22 - 2017-08-26 23:25 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PowerShell
2017-08-26 23:22 - 2017-08-26 23:52 - 000045998 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
2017-08-26 23:25 - 2017-09-01 13:42 - 000000064 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
2017-08-25 21:13 - 2017-08-26 23:05 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.0_neutral_neutral_cw5n1h2txyewy
2017-08-26 13:45 - 2017-08-26 13:45 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.15063.447_neutral_neutral_cw5n1h2txyewy
2017-08-26 14:24 - 2017-08-26 14:24 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\1742034116
2017-08-26 14:24 - 2017-08-26 14:24 - 000203584 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\1742034116\2548312375.pri
2017-08-26 13:45 - 2017-08-26 13:45 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\2045991972
2017-08-26 13:45 - 2017-08-26 13:45 - 000151992 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\2045991972\3600740613.pri
2017-08-26 23:05 - 2017-08-26 23:05 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\2117620423
2017-08-26 23:05 - 2017-08-26 23:05 - 000016128 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\2117620423\1755592438.pri
2017-08-26 13:45 - 2017-08-26 13:45 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\3329127440
2017-08-26 13:45 - 2017-08-26 13:45 - 000069408 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\3329127440\859778732.pri
2017-08-26 13:55 - 2017-08-26 13:55 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\3638200224
2017-08-26 13:55 - 2017-08-26 13:55 - 000457672 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\3638200224\2254494611.pri
2017-08-26 23:03 - 2017-08-26 23:03 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\3772836457
2017-08-26 23:03 - 2017-08-26 23:03 - 000043192 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\3772836457\1231558255.pri
2017-08-26 13:55 - 2017-08-26 13:55 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\3898115897
2017-08-26 13:55 - 2017-08-26 13:55 - 000043256 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\3898115897\2441655616.pri
2017-08-26 23:03 - 2017-08-26 23:03 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\4249408766
2017-08-26 23:03 - 2017-08-26 23:03 - 000006984 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\4249408766\3838406820.pri
2017-08-26 13:45 - 2017-08-26 13:45 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\814284900
2017-08-26 13:45 - 2017-08-26 13:45 - 000122752 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\814284900\1087846103.pri
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.15063.0_neutral_neutral_cw5n1h2txyewy
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\CortanaListenUIApp_10.0.15063.0_neutral__cw5n1h2txyewy
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\DesktopLearning_1000.15063.0.0_neutral__cw5n1h2txyewy
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\DesktopView_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.0_neutral_neutral_cw5n1h2txyewy
2017-08-26 13:45 - 2017-08-26 13:45 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.15063.332_neutral_neutral_cw5n1h2txyewy
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\EnvironmentsApp_10.0.15063.0_neutral__cw5n1h2txyewy
2017-08-26 11:51 - 2017-08-26 11:51 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\HoloCamera_1.0.0.5_neutral__cw5n1h2txyewy
2017-08-26 11:51 - 2017-08-26 11:51 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\HoloItemPlayerApp_1.0.0.2_neutral__cw5n1h2txyewy
2017-08-25 21:13 - 2017-08-25 21:13 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.AAD.BrokerPlugin_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy
2017-08-26 11:51 - 2017-08-26 11:51 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.AccountsControl_10.0.15063.0_neutral__cw5n1h2txyewy
2017-08-26 13:45 - 2017-08-26 13:45 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.AccountsControl_10.0.15063.447_neutral__cw5n1h2txyewy
2017-08-26 11:51 - 2017-08-26 11:51 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.BioEnrollment_10.0.15063.0_neutral__cw5n1h2txyewy
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.CredDialogHost_10.0.15063.0_neutral__cw5n1h2txyewy
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.LockApp_10.0.15063.0_neutral__cw5n1h2txyewy
2017-08-25 21:13 - 2017-08-25 21:13 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.PPIProjection_10.0.15063.0_neutral_neutral_cw5n1h2txyewy
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.Windows.Apprep.ChxApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.Windows.AssignedAccessLockApp_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy
2017-08-25 21:13 - 2017-08-25 21:13 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.Windows.CloudExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy
2017-08-25 21:13 - 2017-08-25 21:13 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.Windows.ContentDeliveryManager_10.0.15063.0_neutral_neutral_cw5n1h2txyewy
2017-08-25 21:13 - 2017-08-26 13:45 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy
2017-08-26 13:45 - 2017-08-26 13:45 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\814284900
2017-08-26 13:45 - 2017-08-26 13:45 - 000122752 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.Windows.Cortana_1.8.12.15063_neutral_neutral_cw5n1h2txyewy\814284900\1087846103.pri
2017-08-26 11:51 - 2017-08-26 11:51 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.Windows.HolographicFirstRun_10.0.15063.0_neutral_neutral_cw5n1h2txyewy
2017-08-26 11:51 - 2017-08-26 11:51 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.Windows.ModalSharePickerHost_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy
2017-08-26 11:51 - 2017-08-26 11:51 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.15063.0_neutral__cw5n1h2txyewy
2017-08-26 11:51 - 2017-08-26 11:51 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.15063.0_neutral__cw5n1h2txyewy
2017-08-26 11:51 - 2017-08-26 11:51 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.Windows.ParentalControls_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral__cw5n1h2txyewy
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.Windows.SecureAssessmentBrowser_10.0.15063.0_neutral_neutral_cw5n1h2txyewy
2017-08-25 21:13 - 2017-08-25 21:13 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.Windows.ShellExperienceHost_10.0.15063.0_neutral_neutral_cw5n1h2txyewy
2017-08-26 13:45 - 2017-08-26 13:45 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.Windows.ShellExperienceHost_10.0.15063.332_neutral_neutral_cw5n1h2txyewy
2017-08-26 11:51 - 2017-08-26 11:51 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.Windows.WindowPicker_10.0.15063.0_neutral__cw5n1h2txyewy
2017-08-26 13:45 - 2017-08-26 13:45 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.Windows.WindowPicker_10.0.15063.332_neutral__cw5n1h2txyewy
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Microsoft.XboxGameCallableUI_1000.15063.0.0_neutral_neutral_cw5n1h2txyewy
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\Windows.ContactSupport_10.0.15063.0_neutral_neutral_cw5n1h2txyewy
2017-08-25 21:13 - 2017-08-25 21:13 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\PRICache\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy
2017-08-25 21:13 - 2017-08-25 21:13 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\Ringtones
2017-08-25 21:13 - 2017-08-25 21:13 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\RoamingTiles
2017-08-25 21:14 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\Safety
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\Safety\apprep
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\Safety\apprep\local
2017-08-26 11:50 - 2017-08-30 21:05 - 000000488 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Safety\apprep\local\localConfiguration
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\Safety\apprep\remote
2017-08-26 11:50 - 2017-08-26 11:50 - 000000047 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Safety\apprep\remote\script-2
2017-08-26 11:50 - 2017-08-26 11:50 - 000008691 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Safety\apprep\remote\script-2_56495612140364035011802320767701983077
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\Safety\download
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\Safety\download\local
2017-08-26 11:50 - 2017-08-26 11:50 - 000000206 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Safety\download\local\localConfiguration
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\Safety\download\remote
2017-08-26 11:50 - 2017-08-26 11:50 - 000000047 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Safety\download\remote\script-2
2017-08-26 11:50 - 2017-08-26 11:50 - 000009962 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Safety\download\remote\script-2_98876692393377786403749733271473558496
2017-08-25 21:14 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\Safety\url
2017-08-25 21:14 - 2017-08-30 09:33 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\Safety\url\local
2017-08-25 21:14 - 2017-08-25 21:14 - 000000344 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Safety\url\local\cache
2017-08-25 21:14 - 2017-08-26 11:50 - 000000508 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Safety\url\local\localConfiguration
2017-08-30 09:33 - 2017-08-30 09:33 - 000000000 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Safety\url\local\wBx-LsBqJHgvLdgEg4oAhw==
2017-08-26 11:50 - 2017-08-26 11:50 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\Safety\url\remote
2017-08-26 11:50 - 2017-08-26 11:50 - 000000047 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Safety\url\remote\script-2
2017-08-26 11:50 - 2017-08-26 11:50 - 000009962 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Safety\url\remote\script-2_98876692393377786403749733271473558496
2017-08-25 21:13 - 2017-08-26 12:02 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync
2017-08-26 12:02 - 2017-09-02 12:12 - 000001177 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\wininet-internet-explorer.metadata
2017-08-25 21:14 - 2017-09-02 12:17 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\metastore
2017-08-25 21:14 - 2017-09-02 12:17 - 000008192 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\metastore\edb.chk
2017-08-25 21:14 - 2017-09-02 12:17 - 000524288 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\metastore\edb.log
2017-08-25 21:14 - 2017-09-01 10:58 - 000524288 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\metastore\edb00063.log
2017-08-25 21:14 - 2017-09-01 10:58 - 000524288 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\metastore\edb00064.log
2017-08-25 21:14 - 2017-09-02 12:17 - 000524288 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\metastore\edb00065.log
2017-08-25 21:14 - 2017-08-25 21:14 - 000524288 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\metastore\edbres00001.jrs
2017-08-25 21:14 - 2017-08-25 21:14 - 000524288 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\metastore\edbres00002.jrs
2017-08-25 21:14 - 2017-09-01 10:58 - 000524288 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\metastore\edbtmp.log
2017-08-25 21:14 - 2017-09-02 12:17 - 002228224 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\metastore\meta.edb
2017-08-25 21:14 - 2017-09-02 12:17 - 000016384 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\metastore\meta.jfm
2017-08-25 21:13 - 2017-08-25 21:13 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\remotemetastore
2017-08-25 21:13 - 2017-09-01 10:58 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\remotemetastore\v1
2017-08-25 21:13 - 2017-09-02 12:17 - 000008192 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\remotemetastore\v1\edb.chk
2017-08-25 21:13 - 2017-09-02 12:17 - 000524288 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\remotemetastore\v1\edb.log
2017-08-25 21:13 - 2017-08-30 23:04 - 000524288 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\remotemetastore\v1\edb00013.log
2017-08-25 21:13 - 2017-09-01 10:58 - 000524288 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\remotemetastore\v1\edb00014.log
2017-08-25 21:13 - 2017-09-01 10:58 - 000524288 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\remotemetastore\v1\edb00015.log
2017-08-25 21:13 - 2017-08-25 21:13 - 000524288 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\remotemetastore\v1\edbres00001.jrs
2017-08-25 21:13 - 2017-08-25 21:13 - 000524288 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\remotemetastore\v1\edbres00002.jrs
2017-08-25 21:13 - 2017-08-30 23:04 - 000524288 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\remotemetastore\v1\edbtmp.log
2017-08-25 21:13 - 2017-09-02 12:17 - 001441792 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\remotemetastore\v1\meta.edb
2017-08-25 21:13 - 2017-09-02 12:17 - 000016384 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\SettingSync\remotemetastore\v1\meta.jfm
2017-08-25 21:12 - 2017-03-18 23:03 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\Shell
2017-08-25 21:12 - 2017-03-18 23:01 - 000114227 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml
2017-08-25 21:12 - 2017-08-25 21:12 - 000000000 _SHDL () C:\Users\ktown\AppData\Local\Microsoft\Windows\Temporary Internet Files
2017-08-27 00:28 - 2017-08-27 00:28 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\Themes
2017-08-27 00:28 - 2017-08-31 14:21 - 000001941 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\Themes\Custom.theme
2017-08-25 21:13 - 2017-09-02 12:08 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\UPPS
2017-09-02 12:08 - 2017-09-02 12:08 - 000016148 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\UPPS\UPPS.bin
2017-08-25 21:13 - 2017-09-02 12:30 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\WebCache
2017-08-25 21:13 - 2017-09-02 12:31 - 000008192 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WebCache\V01.chk
2017-08-25 21:13 - 2017-09-02 12:33 - 000524288 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WebCache\V01.log
2017-08-25 21:13 - 2017-09-01 09:51 - 000524288 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WebCache\V0100022.log
2017-08-25 21:13 - 2017-09-01 13:19 - 000524288 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WebCache\V0100023.log
2017-08-25 21:13 - 2017-09-02 12:30 - 000524288 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WebCache\V0100024.log
2017-08-25 21:13 - 2017-08-25 21:13 - 000524288 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WebCache\V01res00001.jrs
2017-08-25 21:13 - 2017-08-25 21:13 - 000524288 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs
2017-08-25 21:13 - 2017-08-31 16:13 - 000524288 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log
2017-08-25 21:13 - 2017-09-02 12:33 - 044564480 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat
2017-08-25 21:13 - 2017-09-02 12:33 - 000016384 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm
2017-08-26 11:51 - 2017-08-26 11:51 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\WER
2017-08-26 11:51 - 2017-09-02 12:10 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\WER\ERC
2017-08-25 21:12 - 2017-03-18 23:03 - 000000000 ____D () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX
2017-08-25 21:12 - 2017-03-18 23:03 - 000000000 ___RD () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group1
2017-08-25 21:12 - 2017-03-18 22:58 - 000001109 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk
2017-08-25 21:12 - 2017-03-18 23:01 - 000000075 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini
2017-08-25 21:12 - 2017-03-18 23:03 - 000000000 ___RD () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group2
2017-08-25 21:12 - 2017-03-18 22:58 - 000001109 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk
2017-08-25 21:12 - 2017-03-18 22:58 - 000001109 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk
2017-08-25 21:12 - 2017-03-18 22:58 - 000001109 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk
2017-08-25 21:12 - 2017-03-18 22:58 - 000001492 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk
2017-08-25 21:12 - 2017-03-18 22:58 - 000001021 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk
2017-08-25 21:12 - 2017-03-18 23:01 - 000000325 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini
2017-08-25 21:12 - 2017-03-18 23:03 - 000000000 ___RD () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group3
2017-08-25 21:12 - 2017-03-18 22:58 - 000001015 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk
2017-08-25 21:12 - 2017-03-18 22:58 - 000001127 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk
2017-08-25 21:12 - 2017-03-18 22:58 - 000001059 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk
2017-08-25 21:12 - 2017-03-18 22:58 - 000001171 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk
2017-08-25 21:12 - 2017-03-18 22:58 - 000001015 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk
2017-08-25 21:12 - 2017-03-18 22:58 - 000001015 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk
2017-08-25 21:12 - 2017-03-18 22:58 - 000001582 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk
2017-08-25 21:12 - 2017-03-18 22:58 - 000001075 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk
2017-08-25 21:12 - 2017-03-18 22:58 - 000001576 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk
2017-08-25 21:12 - 2017-03-18 22:58 - 000001015 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk
2017-08-25 21:12 - 2017-03-18 22:58 - 000001578 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk
2017-08-25 21:12 - 2017-03-18 22:58 - 000001015 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk
2017-08-25 21:12 - 2017-03-18 22:58 - 000001578 _____ () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk
2017-08-25 21:12 - 2017-03-18 23:01 - 000000941 ___SH () C:\Users\ktown\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini
====== Ende von Folder: ======
========= type C:\Users\ktown\AppData\Local\VirtualStore\Windows\assembly\Desktop.ini =========
; ==++==
;
; Copyright (c) Microsoft Corporation. All rights reserved.
;
; ==--==
[.ShellClassInfo]
CLSID={1D2680C9-0E2A-469d-B787-065558BC7D43}
ConfirmFileOp=1
InfoTip=Contains application stability information.
========= Ende von CMD: =========
========= type C:\Users\ktown\AppData\Local\Temp\guid.bat =========
System64.exe --server zec.suprnova.cc --user Ratatouille.Rata --pass x --port 2142
========= Ende von CMD: =========
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => Schlüssel erfolgreich entfernt
========================= folder: C:\Users\ktown\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup ========================
2017-08-25 21:13 - 2017-08-26 13:45 - 000000174 ___SH () C:\Users\ktown\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
2017-08-28 20:21 - 2017-08-28 20:21 - 000000000 ___HD () C:\Users\ktown\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled
2017-08-28 20:18 - 2017-08-28 20:18 - 000001097 _____ () C:\Users\ktown\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled\MEGAsync.lnk
2017-08-27 23:09 - 2017-08-27 23:09 - 004155904 _____ (Axon Cable SIA) C:\Users\ktown\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled\program32.exe
====== Ende von Folder: ======
C:\Users\ktown\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled => erfolgreich verschoben
C:\Users\ktown\Downloads\Mods\cdbxp_setup_4.5.7.6623.exe => erfolgreich verschoben
C:\Users\ktown\AppData\Roaming\tor => erfolgreich verschoben
C:\Users\ktown\AppData\Roaming\sound => erfolgreich verschoben
C:\Users\ktown\AppData\Roaming\Audio => erfolgreich verschoben
=========== EmptyTemp: ==========
BITS transfer queue => 6578176 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 32083072 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 50288848 B
Edge => 8374095 B
Chrome => 568337339 B
Firefox => 0 B
Opera => 0 B
Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 1024 B
LocalService => 10610 B
NetworkService => 0 B
ktown => 163205952 B
RecycleBin => 0 B
EmptyTemp: => 790.5 MB temporäre Dateien entfernt.
================================
Das System musste neu gestartet werden.
==== Ende von Fixlog 12:34:26 ====
|
|
02.09.2017, 11:50
| #17 |
| | Ständig im TaskManager Audio.exe EMCO Malware Destroyer MBAM:
__________________Code:
ATTFilter Malwarebytes
www.malwarebytes.com
-Protokolldetails-
Scan-Datum: 02.09.17
Scan-Zeit: 12:36
Protokolldatei: 9f23bce3-8fca-11e7-b04d-f832e4a07181.json
Administrator: Ja
-Softwaredaten-
Version: 3.2.2.2018
Komponentenversion: 1.0.188
Version des Aktualisierungspakets: 1.0.2710
Lizenz: Testversion
-Systemdaten-
Betriebssystem: Windows 10 (Build 15063.540)
CPU: x64
Dateisystem: NTFS
Benutzer: DESKTOP-S8K03BB\ktown
-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Ergebnis: Abgeschlossen
Gescannte Objekte: 394881
Erkannte Bedrohungen: 0
(keine bösartigen Elemente erkannt)
In die Quarantäne verschobene Bedrohungen: 0
(keine bösartigen Elemente erkannt)
Abgelaufene Zeit: 3 Min., 26 Sek.
-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Erkennung
PUM: Erkennung
-Scan-Details-
Prozess: 0
(keine bösartigen Elemente erkannt)
Modul: 0
(keine bösartigen Elemente erkannt)
Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)
Registrierungswert: 0
(keine bösartigen Elemente erkannt)
Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)
Daten-Stream: 0
(keine bösartigen Elemente erkannt)
Ordner: 0
(keine bösartigen Elemente erkannt)
Datei: 0
(keine bösartigen Elemente erkannt)
Physischer Sektor: 0
(keine bösartigen Elemente erkannt)
(end)
Addition: Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 20-08-2017
durchgeführt von ktown (02-09-2017 12:42:03)
Gestartet von C:\Users\ktown\Downloads\Mods
Windows 10 Pro Version 1703 (X64) (2017-08-25 19:02:02)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-1757837757-2786829171-2820918412-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1757837757-2786829171-2820918412-503 - Limited - Disabled)
Gast (S-1-5-21-1757837757-2786829171-2820918412-501 - Limited - Disabled)
ktown (S-1-5-21-1757837757-2786829171-2820918412-1001 - Administrator - Enabled) => C:\Users\ktown
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: G DATA INTERNET SECURITY (Enabled - Up to date) {A9C56A9B-ECCD-57EA-78F6-92511DA1C885}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: G*DATA Personal Firewall (Enabled) {91FEEBBE-A6A2-56B2-53A9-3B64E3728FFE}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
.NET Core SDK 1.0.0 (x64) Installer (x64) (HKLM\...\{3A36F010-62C4-4173-9F25-257F1B0899DD}) (Version: 4.0.4911 - Microsoft Corporation) Hidden
.NET Core SDK 1.0.0 (x64) Installer (x64) (HKLM-x32\...\{c7c7d963-f622-455d-879a-7ffa111d1322}) (Version: 1.0.0 - Microsoft Corporation)
.NET Core SDK 1.1.0 (x64) (HKLM\...\{DF68596E-0F41-41CC-BAD9-9F30A9662D90}) (Version: 4.16.5124 - Microsoft Corporation) Hidden
.NET Core SDK 1.1.0 (x64) (HKLM-x32\...\{67d148ca-6fe2-47ec-bf5c-fbd64345d511}) (Version: 1.1.0 - Microsoft Corporation)
Active Directory Authentication Library für SQL Server (HKLM\...\{5AE8DFF5-F9A2-4B59-9875-45BFF82DC1DA}) (Version: 13.1.4001.0 - Microsoft Corporation) Hidden
Android SDK Tools (HKLM-x32\...\Android SDK Tools) (Version: 1.16 - Google Inc.)
Ansel (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Ansel) (Version: 385.41 - NVIDIA Corporation) Hidden
Application Verifier x64 External Package (HKLM\...\{2D7C1671-6F3D-2AA7-DAA3-91C96B60B919}) (Version: 10.1.15063.468 - Microsoft) Hidden
Blend for Visual Studio SDK for .NET 4.5 (HKLM-x32\...\{37E53780-3944-4A6A-842F-727128E8616E}) (Version: 3.0.40218.0 - Microsoft Corporation) Hidden
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.7.6623 - CDBurnerXP)
CherryPlayer (HKLM-x32\...\CherryPlayer) (Version: 2.4.6 - CherryPlayer)
ClickOnce Bootstrapper Package for Microsoft .NET Framework (HKLM-x32\...\{E598B692-764A-413C-8530-59163D6B4AE3}) (Version: 4.6.01590 - Microsoft Corporation) Hidden
ControlConsole API version 2.60 (HKLM-x32\...\{E6C0F5ED-B5EA-451D-8CB1-57902AA188DE}_is1) (Version: 2.60 - Enstone)
DevExpress Components 17.1 (HKLM-x32\...\DevExpress Components 17.1) (Version: 17.1.5 - Developer Express Inc.)
DevExpress DevExtreme 17.1 (HKLM-x32\...\DevExpress DevExtreme 17.1) (Version: 17.1.5 - Developer Express Inc.)
DiagnosticsHub_CollectionService (HKLM\...\{37385261-BB10-4DE0-8822-84E1C4997ED2}) (Version: 15.0.26730 - Microsoft Corporation) Hidden
Druckerdeinstallation für EPSON WF-2510 Series (HKLM\...\EPSON WF-2510 Series) (Version: - SEIKO EPSON Corporation)
Entity Framework 6.1.3 Tools for Visual Studio 15 (HKLM-x32\...\{F8C0447E-D45C-4E52-94E8-C6340AAC9DB8}) (Version: 6.1.60104.0 - Microsoft Corporation) Hidden
Epic Games Launcher Prerequisites (x64) (HKLM\...\{66C5838F-B854-4A55-89E6-A6138747A4DF}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
Epson FAX Utility (HKLM-x32\...\{0CBE6C93-CB2E-4378-91EE-12BE6D4E2E4A}) (Version: 1.60.00 - SEIKO EPSON CORPORATION)
Epson PC-FAX Driver (HKLM-x32\...\EPSON PC-FAX Driver 2) (Version: - )
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
Epson Software Updater (HKLM-x32\...\{B55DB65D-EF6E-4E04-89D5-B03603BF681B}) (Version: 4.4.5 - SEIKO EPSON CORPORATION)
FileZilla Client 3.27.1 (HKLM-x32\...\FileZilla Client) (Version: 3.27.1 - Tim Kosse)
G DATA INTERNET SECURITY (HKLM-x32\...\G DATA INTERNET SECURITY) (Version: 25.4.0.1 - G DATA Software AG)
Git version 2.10.2 (HKLM\...\Git_is1) (Version: 2.10.2 - The Git Development Community)
GitHub Desktop (HKU\S-1-5-21-1757837757-2786829171-2820918412-1001\...\GitHubDesktop) (Version: 0.8.0 - GitHub, Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 60.0.3112.113 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
Gtk# for .Net 2.12.26 (HKLM-x32\...\{BC25B808-A11C-4C9F-9C0A-6682E47AAB83}) (Version: 2.12.26 - Xamarin, Inc.)
icecap_collection_neutral (HKLM-x32\...\{743913D7-41D9-48C0-977D-FC87743A9BEC}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
icecap_collection_x64 (HKLM\...\{6BC73140-3CB6-486A-8350-BF35F54EFA19}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
icecap_collectionresources (HKLM-x32\...\{459CF809-89FA-424C-87E7-9269EBE1135B}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
icecap_collectionresources (HKLM-x32\...\{67941F0C-2930-4C3F-983C-1089D2759B42}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
icecap_collectionresourcesx64 (HKLM-x32\...\{304B71E2-BA3A-419C-B632-3DFBB4AFE42B}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
icecap_collectionresourcesx64 (HKLM-x32\...\{D76CFB83-E33A-47DD-A420-A6ACF82484CE}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
IIS 10.0 Express (HKLM\...\{A54DCC30-E1EA-4912-A7F9-6C5A3AF1FB3A}) (Version: 10.0.1738 - Microsoft Corporation)
IIS Express Application Compatibility Database for x64 (HKLM\...\{08274920-8908-45c2-9258-8ad67ff77b09}.sdb) (Version: - ) Hidden
IIS Express Application Compatibility Database for x86 (HKLM\...\{ad846bae-d44b-4722-abad-f7420e08bcd9}.sdb) (Version: - ) Hidden
Intellisense Lang Pack Mobile Extension SDK 10.0.15063.0 (HKLM-x32\...\{955DB066-D013-43F3-908C-CBC851E3D4FF}) (Version: 10.1.15063.468 - Microsoft Corporation) Hidden
IntelliTraceProfilerProxy (HKLM-x32\...\{0A2EDF2C-9A71-43D7-964A-696BB7CEAC65}) (Version: 15.0.25.0 - Microsoft Corporation) Hidden
Java SE Development Kit 8 Update 112 (HKLM-x32\...\{32A3A4F4-B792-11D6-A78A-00B0D0180112}) (Version: 8.0.1120.15 - Oracle Corporation)
Java SE Development Kit 8 Update 131 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180131}) (Version: 8.0.1310.11 - Oracle Corporation)
Java SE Development Kit 8 Update 131 (HKLM-x32\...\{32A3A4F4-B792-11D6-A78A-00B0D0180131}) (Version: 8.0.1310.11 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
Kits Configuration Installer (HKLM-x32\...\{1704C439-1501-3446-7932-33DA822E8597}) (Version: 10.1.15063.468 - Microsoft) Hidden
Kumulatives Microsoft .NET Framework Intellisense Pack für Visual Studio (Deutsch) (HKLM-x32\...\{91BF6CA6-F6AA-4639-944A-627B7D02567E}) (Version: 4.6.01604 - Microsoft Corporation) Hidden
Launcher Prerequisites (x64) (HKLM-x32\...\{c6c5a357-c7ca-4a5f-9789-3bb1af579253}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
Lightshot-5.4.0.10 (HKLM-x32\...\{30A5B3C9-2084-4063-A32A-628A98DE512B}_is1) (Version: 5.4.0.10 - Skillbrains)
Malwarebytes Version 3.2.2.2018 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.2.2.2018 - Malwarebytes)
MEGAsync (HKLM-x32\...\MEGAsync) (Version: - Mega Limited)
Microsoft Azure Authoring Tools - v2.9.5.3 (HKLM\...\{086C537B-DE1A-4A11-8441-6AAF076174B8}) (Version: 2.9.8699.20 - Microsoft Corporation)
Microsoft Azure Compute Emulator - v2.9.5.3 (HKLM\...\Microsoft Azure Compute Emulator - v2.9.5.3) (Version: 2.9.8699.20 - Microsoft Corporation)
Microsoft Azure Libraries for .NET – v2.9 (HKLM\...\{C5C91AA6-3E83-430E-8B7A-6B790083F28D}) (Version: 3.0.0127.060 - Microsoft Corporation)
Microsoft Azure Mobile App SDK V3.0 (HKLM-x32\...\{A1D5A2EC-1BB0-4ED6-97E6-F044400FAFFD}) (Version: 3.0.50407.0 - Microsoft Corporation)
Microsoft Azure PowerShell - September 2016 (HKLM-x32\...\{CB3F8A12-1570-4964-8206-17274AB9EF4D}) (Version: 2.1.0 - Microsoft Corporation)
Microsoft Azure Storage Emulator - v5.1 (HKLM-x32\...\Microsoft Azure Storage Emulator - v5.1) (Version: 5.1.1760.1722 - Microsoft Corporation)
Microsoft Azure Storage Tools - v5.2.0 (HKLM-x32\...\{89B7B8B5-CC31-4C78-8E83-1E5B9506C322}) (Version: 5.2.0.0 - Microsoft Corporation)
Microsoft Emulator - Windows 10.0.14393.0 (HKLM-x32\...\{a2e12a9b-231c-46d5-b7bb-334b22e63f67}) (Version: 10.1.14393.0 - Microsoft Corporation)
Microsoft Help Viewer 2.3 (HKLM-x32\...\Microsoft Help Viewer 2.3) (Version: 2.3.26730 - Microsoft Corporation)
Microsoft Help Viewer 2.3 Sprachpaket – DEU (HKLM-x32\...\Microsoft Help Viewer 2.3 Sprachpaket – DEU) (Version: 2.3.26730 - Microsoft Corporation)
Microsoft Identity Extensions (HKLM\...\{F99F24BF-0B90-463E-9658-3FD2EFC3C992}) (Version: 2.0.1459.0 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1757837757-2786829171-2820918412-1001\...\OneDriveSetup.exe) (Version: 17.3.6943.0625 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client (HKLM\...\{E9AD0F97-5DF2-4F5B-BC5B-F524D21BF165}) (Version: 11.3.6518.0 - Microsoft Corporation)
Microsoft SQL Server 2016 LocalDB (HKLM\...\{33B8D051-4DF5-4103-8FDB-8663E468A204}) (Version: 13.1.4001.0 - Microsoft Corporation)
Microsoft System CLR Types for SQL Server 2017 CTP2.1 (HKLM\...\{9BAD8F82-A221-42CE-AFF0-7CAB825790C9}) (Version: 14.0.600.250 - Microsoft Corporation)
Microsoft System CLR Types for SQL Server 2017 CTP2.1 (HKLM-x32\...\{F0DD1AA8-44D7-4ACE-AF65-7378EA5D884C}) (Version: 14.0.600.250 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2017 Redistributable (x64) - 14.10.25008 (HKLM-x32\...\{f1e7e313-06df-4c56-96a9-99fdfd149c51}) (Version: 14.10.25008.0 - Microsoft Corporation)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.10.25008 (HKLM-x32\...\{c239cea1-d49e-4e16-8e87-8c055765f7ec}) (Version: 14.10.25008.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2017 (HKLM\...\{6F320B93-EE3C-4826-85E0-ADF79F8D4C61}) (Version: 1.11.33287.817 - Microsoft Corporation)
Microsoft Visual Studio 2017 (HKLM-x32\...\{6F320B93-EE3C-4826-85E0-ADF79F8D4C61}) (Version: 1.5.30227.2 - Microsoft Corporation)
Microsoft Visual Studio Emulator for Android (HKLM-x32\...\{09a99ef7-bf11-413a-99a3-a77fd49c0d52}) (Version: 1.1.1207.2 - Microsoft Corporation)
Microsoft Web Deploy 3.6 (HKLM\...\{65C71B09-C33D-4F60-93EA-DF3AD1D40600}) (Version: 10.0.1981 - Microsoft Corporation)
MSI Development Tools (HKLM-x32\...\{E45B775D-8842-EC86-ED84-B740D52E6462}) (Version: 10.1.15063.468 - Microsoft Corporation) Hidden
Notepad++ (32-bit x86) (HKLM-x32\...\Notepad++) (Version: 7.5 - Notepad++ Team)
Nox APP Player (HKLM-x32\...\Nox) (Version: 5.0.0.1 - Duodian Technology Co. Ltd.)
NVIDIA 3D Vision Controller-Treiber 369.04 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 369.04 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 385.41 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 385.41 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.9.0.61 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.9.0.61 - NVIDIA Corporation)
NVIDIA Grafiktreiber 385.41 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 385.41 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.34.27 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.27 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.17.0524 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.17.0524 - NVIDIA Corporation)
Open XML SDK 2.5 for Microsoft Office (HKLM-x32\...\{3EA16E23-14D2-466A-8268-D7CD40DC46B6}) (Version: 2.5.5631 - Microsoft Corporation) Hidden
Paket zur Festlegung von Zielversionen für Microsoft .NET Framework 4.6.2 (Deutsch) (HKLM-x32\...\{7D6C6611-CDE8-4057-96DE-70BF41A7AB6C}) (Version: 4.6.01590 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7841 - Realtek Semiconductor Corp.)
SCE ProDG Debugger Documentation for PlayStation®3 v420.1.0 (HKLM-x32\...\{D7BF9F65-76E8-44BA-948A-875863CF3144}) (Version: 4.20.1 - Sony Computer Entertainment Ltd. / SN Systems Ltd.)
SCE ProDG Debugger for PlayStation®3 v420.1.0 (HKLM-x32\...\{6C8B2A8A-50E7-4D9F-80E7-94CBD6148FBB}) (Version: 4.20.1 - Sony Computer Entertainment Ltd. / SN Systems Ltd.)
SCE ProDG Target Manager Documentation for PlayStation®3 v420.1.0 (HKLM-x32\...\{6DDB0863-803D-4814-A39F-E395A5D4EE34}) (Version: 4.20.1 - Sony Computer Entertainment Ltd. / SN Systems Ltd.)
SCE ProDG Target Manager for PlayStation®3 v420.1.0 (HKLM-x32\...\{149E5890-9C43-4E68-92A3-5516705D1CAD}) (Version: 4.20.1 - Sony Computer Entertainment Ltd. / SN Systems Ltd.)
SN Systems SN Launcher v1.0.7.1 (HKLM-x32\...\{C72CA33A-AA67-4CB8-BD94-E2ABDED81173}) (Version: 1.0.7.1 - Sony Computer Entertainment Ltd. / SN Systems Ltd.)
sptools_Microsoft.VisualStudio.OfficeDeveloperTools.Msi (HKLM-x32\...\{72BA31CD-9667-422B-A8A4-65C248E06222}) (Version: 15.0.26501 - Microsoft Corporation) Hidden
sptools_Microsoft.VisualStudio.Vsto.Msi (HKLM-x32\...\{CD08D2FC-15E2-4B11-A824-091CD344612E}) (Version: 15.0.26417 - Microsoft Corporation) Hidden
sptools_Microsoft.VisualStudio.Vsto.Msi.Resources (HKLM-x32\...\{6F410B16-8B46-43AF-BC73-C43EE190BFA4}) (Version: 15.0.26417 - Microsoft Corporation) Hidden
sptools_Microsoft.VisualStudio.Vsto.Msi.Resources (HKLM-x32\...\{B837FCF6-9A51-44D6-95F9-F5C753019D53}) (Version: 15.0.26417 - Microsoft Corporation) Hidden
sptools_Microsoft.VisualStudio.Vsto.Msi.x64 (HKLM-x32\...\{F210BD01-6020-4406-AAE1-15B4D4C096C8}) (Version: 15.0.26417 - Microsoft Corporation) Hidden
TeamViewer 12 (HKLM-x32\...\TeamViewer) (Version: 12.0.82216 - TeamViewer)
TypeScript Power Tool (HKLM-x32\...\{5207E91E-2B03-42C0-89D0-F7B2082993C6}) (Version: 2.1.7.0 - Microsoft Corporation) Hidden
TypeScript Power Tool (HKLM-x32\...\{928F176B-50AF-404D-AD69-6FA3A7F45277}) (Version: 2.0.6.0 - Microsoft Corporation) Hidden
TypeScript SDK (HKLM-x32\...\{CFA1F87E-EF2B-4785-812C-4BEEA22CFD06}) (Version: 2.3.5.0 - Microsoft Corporation) Hidden
Unity (HKLM-x32\...\Unity) (Version: 5.6.3p1 - Unity Technologies ApS)
Universal CRT Extension SDK (HKLM-x32\...\{1FBCBC17-4527-2340-0832-B1D49C41FF67}) (Version: 10.0.26624 - Microsoft Corporation) Hidden
Universal CRT Extension SDK (HKLM-x32\...\{315BBDA9-CE84-D465-59F8-B9C765D953AC}) (Version: 10.1.10586.212 - Microsoft Corporation) Hidden
Universal CRT Extension SDK (HKLM-x32\...\{4E8F20FD-6BC7-B65C-D4F2-5D7CEDE3352E}) (Version: 10.1.14393.795 - Microsoft Corporation) Hidden
Universal CRT Extension SDK (HKLM-x32\...\{D23DC9CD-5870-9D26-5DE9-6273CAC7DD5B}) (Version: 10.1.15063.468 - Microsoft Corporation) Hidden
Universal CRT Headers Libraries and Sources (HKLM-x32\...\{233B73D9-650E-9CEC-1002-767C916C1B61}) (Version: 10.1.14393.795 - Microsoft Corporation) Hidden
Universal CRT Headers Libraries and Sources (HKLM-x32\...\{51523D5B-FC32-CAB4-E54E-E41C0E4C1726}) (Version: 10.1.15063.468 - Microsoft Corporation) Hidden
Universal CRT Headers Libraries and Sources (HKLM-x32\...\{8BFBEC30-33CC-13B4-849F-3B036F27466A}) (Version: 10.0.26624 - Microsoft Corporation) Hidden
Universal CRT Headers Libraries and Sources (HKLM-x32\...\{F4E7226B-6A1C-F4D6-1109-6E1CD5B3E633}) (Version: 10.1.10586.212 - Microsoft Corporation) Hidden
Universal CRT Redistributable (HKLM-x32\...\{573C4B4F-B9B9-28DA-0243-D118DD3EE574}) (Version: 10.1.15063.468 - Microsoft Corporation) Hidden
Universal CRT Tools x64 (HKLM\...\{3C75FFD3-00CF-1974-2935-7BED20381899}) (Version: 10.1.15063.468 - Microsoft Corporation) Hidden
Universal CRT Tools x86 (HKLM-x32\...\{812954B8-9658-EFE2-FB5F-B422048AA053}) (Version: 10.1.15063.468 - Microsoft Corporation) Hidden
Universal General MIDI DLS Extension SDK (HKLM-x32\...\{05086CEC-62C1-B12C-2FEC-C58E166FA7E8}) (Version: 10.1.15063.468 - Microsoft Corporation) Hidden
Universal General MIDI DLS Extension SDK (HKLM-x32\...\{6AFD985C-21B7-8F2D-86B2-19A0563A1195}) (Version: 10.0.26624 - Microsoft Corporation) Hidden
Universal General MIDI DLS Extension SDK (HKLM-x32\...\{AF5B9C51-F99A-59CC-70F5-214E9B535EE3}) (Version: 10.1.10586.212 - Microsoft Corporation) Hidden
Universal General MIDI DLS Extension SDK (HKLM-x32\...\{F2EB74A7-148A-8DC9-82A5-B5A88093EEC4}) (Version: 10.1.14393.795 - Microsoft Corporation) Hidden
Update for (KB2504637) (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}.KB2504637) (Version: 1 - Microsoft Corporation)
vcpp_crt.redist.clickonce (HKLM-x32\...\{177ED059-D367-4B1E-8511-295E5B62DBEF}) (Version: 14.11.25325 - Microsoft Corporation) Hidden
vcpp_crt.redist.clickonce (HKLM-x32\...\{C36E80D0-EED5-481F-9852-1EBB0DD122B6}) (Version: 14.11.25325 - Microsoft Corporation) Hidden
VirusTotal Uploader 2.2 (HKLM-x32\...\VTUploader) (Version: - )
VLC media player (HKLM\...\VLC media player) (Version: 2.2.6 - VideoLAN)
VS Immersive Activate Helper (HKLM-x32\...\{FD1039C3-228B-43BB-820A-ACAED580A9D5}) (Version: 16.0.71.0 - Microsoft Corporation) Hidden
VS JIT Debugger (HKLM\...\{75068E51-7C37-4003-84C2-C67461C8D60A}) (Version: 16.0.71.0 - Microsoft Corporation) Hidden
VS Script Debugging Common (HKLM\...\{A9ED1B56-3819-4B14-A929-89DD3E16E216}) (Version: 16.0.71.0 - Microsoft Corporation) Hidden
VS WCF Debugging (HKLM\...\{EF9A8134-DF80-46A8-85AF-7FBD1E848C12}) (Version: 16.0.71.0 - Microsoft Corporation) Hidden
vs_BlendMsi (HKLM-x32\...\{028492D7-855B-4018-B0A8-B5411EED541A}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_clickoncebootstrappermsi (HKLM-x32\...\{DCAD4F0C-21F2-4955-9C0A-2B7CEA610A74}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_clickoncebootstrappermsires (HKLM-x32\...\{C32010D8-3E5A-4E2F-874E-9AAEB2384006}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_clickoncesigntoolmsi (HKLM-x32\...\{440B670C-9862-487A-A381-57173D344039}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_codecoveragemsi (HKLM-x32\...\{4047FD10-8010-453A-A110-EA2CF71591B9}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_codeduitestframeworkmsi (HKLM-x32\...\{768725FE-C24E-4D48-BB07-6046761C2A00}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_communitymsi (HKLM-x32\...\{52100697-9C66-44F3-BA20-68F8148CDF9B}) (Version: 15.0.26711 - Microsoft Corporation) Hidden
vs_communitymsires (HKLM-x32\...\{40040E64-50EB-4FCF-B209-DA0B20821759}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_communitymsires (HKLM-x32\...\{5297D80E-CD92-48D8-9DB0-301AB3205772}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_cuitcommoncoremsi (HKLM-x32\...\{35804EBF-56A5-4847-848B-1A067AC6DE56}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_cuitextensionmsi (HKLM-x32\...\{C356AA66-C6D7-43C5-9D31-9D58DFB0FE2F}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_cuitextensionmsi_x64 (HKLM-x32\...\{EA12406A-8EED-49AB-A47B-FFA47D4F9ADE}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_devenvmsi (HKLM-x32\...\{BFFA2FFB-1095-4ADD-A352-368806D2412B}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_enterprisemsi (HKLM-x32\...\{6E0FB913-0E76-44B5-B0D4-2B71A7984BD2}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_feedbackclientmsi (HKLM-x32\...\{959DC3F5-5B3C-4194-81E4-F009F7C2605E}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_filehandler_amd64 (HKLM-x32\...\{DDEF2BD0-F728-4D04-A085-B5ACC9ADC311}) (Version: 15.0.26711 - Microsoft Corporation) Hidden
vs_filehandler_x86 (HKLM-x32\...\{2512A3CE-E1E4-46D5-8B40-28DA3AE2261E}) (Version: 15.0.26711 - Microsoft Corporation) Hidden
vs_FileTracker_Singleton (HKLM-x32\...\{384F31FB-B99D-48A7-9D72-E1FEBEC2201A}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_Graphics_Singletonx64 (HKLM\...\{134E1F55-10CB-4837-9F43-C8145933AA3E}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_Graphics_Singletonx86 (HKLM-x32\...\{5A528FAB-6AD3-4F9A-9A1C-566A5C02C3D6}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_helpconfigmsi (HKLM-x32\...\{62B7E0A7-6623-4C90-84DA-A321493EFE98}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_helpconfigmsi (HKLM-x32\...\{9C975D07-01C8-4EFF-95E3-0768063E4F27}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_labtestagentdeployermsi (HKLM-x32\...\{3AF048AA-9E41-4FA7-9BCA-D3B15EC5B2D4}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_loadtestexceladdinmsi (HKLM-x32\...\{0F880133-E9D3-4494-8B23-12D0A4B02EE1}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_loadtestexceladdinmsires (HKLM-x32\...\{F1D4ADA9-E24C-4942-A076-C5E7124FA2F7}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_microsofttestmanagermsi (HKLM-x32\...\{4F61F270-3E5D-4B62-AB5F-AA1B034A86C6}) (Version: 15.0.26730 - Microsoft Corporation) Hidden
vs_minshellinteropmsi (HKLM-x32\...\{D0772A03-7FC2-4B20-AC1F-B278299AA9C7}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_minshellmsi (HKLM-x32\...\{0F2742A7-6A64-46A2-94AE-22F19808BE2F}) (Version: 15.0.26711 - Microsoft Corporation) Hidden
vs_minshellmsires (HKLM-x32\...\{0D3A6730-43CE-4AF6-BDF7-4D0660296C60}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_minshellmsires (HKLM-x32\...\{6DFE6F8D-B61D-4348-AB70-4ABF1210DFD5}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_networkemulationmsi_x64 (HKLM-x32\...\{DC5A810D-6264-4280-8475-4CB6B36D84AE}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_professionalmsi (HKLM-x32\...\{C135A30B-7258-4E11-8660-87C5642A4AAE}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_SQLClickOnceBootstrappermsi (HKLM-x32\...\{5C682D5E-7168-47C6-87CD-53E2103B08AC}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_tipsmsi (HKLM-x32\...\{032E21D1-556F-49D6-9518-CF53202AF63B}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_webtestrecordermsi (HKLM-x32\...\{76181917-D381-4DA6-9ADE-9639C042F7F4}) (Version: 15.0.26711 - Microsoft Corporation) Hidden
vs_webtestrecordermsi_x64 (HKLM-x32\...\{9B5CDB0B-D416-44BE-A5C5-CAC36FF54C23}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
vs_webtestrecordermsires (HKLM-x32\...\{57C5E365-8E3B-47AB-A6D9-803C1AD76920}) (Version: 15.0.26621 - Microsoft Corporation) Hidden
Vulkan Run Time Libraries 1.0.51.0 (HKLM\...\VulkanRT1.0.51.0) (Version: 1.0.51.0 - LunarG, Inc.)
WhatsApp (HKU\S-1-5-21-1757837757-2786829171-2820918412-1001\...\WhatsApp) (Version: 0.2.5863 - WhatsApp)
WinAppDeploy (HKLM-x32\...\{1AD35036-0E71-1C38-E4F8-14F6ED75EA98}) (Version: 10.1.15063.468 - Microsoft Corporation) Hidden
WinAppDeploy (HKLM-x32\...\{C9966D24-DB2F-8514-EAA3-BEED85F3E166}) (Version: 10.1.14393.795 - Microsoft Corporation) Hidden
Windows 10 for Mobile Image - 10.0.14393.0 (HKLM-x32\...\{E6B9680D-DCAD-4211-939D-CA6701F2C5A0}) (Version: 10.1.14393.0 - Microsoft Corporation)
Windows SDK AddOn (HKLM-x32\...\{3BE62AA1-60B9-42EA-99BC-1A46B31C7E0C}) (Version: 10.1.0.0 - Microsoft Corporation)
Windows Software Development Kit - Windows 10.0.10586.212 (HKLM-x32\...\{43d9f43d-c90b-4fdf-9dfe-ecf9990bfa2a}) (Version: 10.1.10586.212 - Microsoft Corporation)
Windows Software Development Kit - Windows 10.0.14393.795 (HKLM-x32\...\{5eb6fbea-73ee-4a8e-9042-110704768d7f}) (Version: 10.1.14393.795 - Microsoft Corporation)
Windows Software Development Kit - Windows 10.0.15063.468 (HKLM-x32\...\{0a829ae9-ca13-4f58-a168-648e80cf6739}) (Version: 10.1.15063.468 - Microsoft Corporation)
Windows Software Development Kit - Windows 10.0.26624 (HKLM-x32\...\{e7a0c8b6-b0e9-41e2-8a0a-a6784f88d1d4}) (Version: 10.0.26624 - Microsoft Corporation)
WinRAR 5.50 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.50.0 - win.rar GmbH)
WinRT Intellisense Desktop - en-us (HKLM-x32\...\{3E1718A0-E5A4-04EB-E85C-DF94790FCCF4}) (Version: 10.1.15063.468 - Microsoft Corporation) Hidden
WinRT Intellisense Desktop - en-us (HKLM-x32\...\{A249F631-CEBC-EDCB-4C49-700E551E66CA}) (Version: 10.1.14393.795 - Microsoft Corporation) Hidden
WinRT Intellisense Desktop - Other Languages (HKLM-x32\...\{26FD6F7E-30DF-16AB-9F3B-2EC665C36498}) (Version: 10.1.15063.468 - Microsoft Corporation) Hidden
WinRT Intellisense Desktop - Other Languages (HKLM-x32\...\{E71CB7F1-3E88-4450-1764-B3CC1E205C4A}) (Version: 10.1.14393.795 - Microsoft Corporation) Hidden
WinRT Intellisense IoT - en-us (HKLM-x32\...\{B3E6FE24-A4E4-0454-5004-D8A3CCC9B0F6}) (Version: 10.1.15063.468 - Microsoft Corporation) Hidden
WinRT Intellisense IoT - en-us (HKLM-x32\...\{C49E6FDA-8196-0CAF-2CDD-CF1B0F4EA5AD}) (Version: 10.1.14393.795 - Microsoft Corporation) Hidden
WinRT Intellisense IoT - Other Languages (HKLM-x32\...\{33D11371-82A5-852B-CDE2-5528CE406151}) (Version: 10.1.14393.795 - Microsoft Corporation) Hidden
WinRT Intellisense IoT - Other Languages (HKLM-x32\...\{CC57D696-D6B5-DB4D-7ABC-C373CF7E6D73}) (Version: 10.1.15063.468 - Microsoft Corporation) Hidden
WinRT Intellisense PPI - en-us (HKLM-x32\...\{891DDA6A-C9D4-9C57-BC4E-B77CE28BAFC3}) (Version: 10.1.15063.468 - Microsoft Corporation) Hidden
WinRT Intellisense PPI - en-us (HKLM-x32\...\{FB431EE2-C835-6DE9-8DC3-C8FCDE028FE0}) (Version: 10.1.14393.795 - Microsoft Corporation) Hidden
WinRT Intellisense PPI - Other Languages (HKLM-x32\...\{C22B0226-A0C4-B973-C0BF-24A3D66B8C3E}) (Version: 10.1.15063.468 - Microsoft Corporation) Hidden
WinRT Intellisense PPI - Other Languages (HKLM-x32\...\{FB82399D-9C48-9AF5-DCA1-CFE61BCA70A6}) (Version: 10.1.14393.795 - Microsoft Corporation) Hidden
WinRT Intellisense UAP - en-us (HKLM-x32\...\{23909757-D6F0-7F7C-BD34-7E72BA9BD59C}) (Version: 10.1.14393.795 - Microsoft Corporation) Hidden
WinRT Intellisense UAP - en-us (HKLM-x32\...\{F3F1C906-9349-1B25-3680-65015218BD99}) (Version: 10.1.15063.468 - Microsoft Corporation) Hidden
WinRT Intellisense UAP - Other Languages (HKLM-x32\...\{CB8253BF-62B4-A504-7E06-BA102F48C02B}) (Version: 10.1.15063.468 - Microsoft Corporation) Hidden
WinRT Intellisense UAP - Other Languages (HKLM-x32\...\{D3A337CD-EA32-F4BA-03FA-825903190C92}) (Version: 10.1.14393.795 - Microsoft Corporation) Hidden
WinRT Intellisense Xbox Live Extension SDK - en-us (HKLM-x32\...\{74B9E6F9-1793-4E90-22A1-A42254D04453}) (Version: 10.1.10586.212 - Microsoft Corporation) Hidden
WinRT Intellisense Xbox Live Extension SDK - Other Languages (HKLM-x32\...\{1EE3550B-B5FB-B866-C153-1C609FBC1E89}) (Version: 10.1.10586.212 - Microsoft Corporation) Hidden
Workflow Manager Client 1.0 (HKLM\...\{69CD1F2D-DF68-4E23-9108-1B70783F2855}) (Version: 2.1.10525.2 - Microsoft Corporation) Hidden
Workflow Manager Client 1.0 (HKLM\...\{831D3854-30D1-4A11-927C-8E94B8091949}) (Version: 2.1.10525.2 - Microsoft Corporation) Hidden
Workflow Manager Tools 1.0 for Visual Studio (HKLM\...\{6B8CA6C8-47AE-450F-AD26-0B2133BFAAF7}) (Version: 2.1.10713.0 - Microsoft Corporation) Hidden
Workflow Manager Tools 1.0 for Visual Studio (HKLM\...\{7E351EBA-A063-4DE6-9F95-094883AAF7DA}) (Version: 2.1.10713.0 - Microsoft Corporation) Hidden
Xamarin PCL Profiles v1.0.9 (HKLM-x32\...\{5E6844AB-A867-419C-A376-B12B574AA5F7}) (Version: 1.0.9.0 - Xamarin) Hidden
Xamarin Profiler (HKLM-x32\...\{2CA1A69E-9A53-46D4-86EA-2EC6EC372B09}) (Version: 1.5.5.10 - Xamarin, Inc.) Hidden
Xamarin Remoted iOS Simulator (HKLM-x32\...\{15B5F198-5222-4397-975F-2F7D1F871D8C}) (Version: 1.1.0.77 - Xamarin) Hidden
Xamarin Workbooks and Inspector (HKLM-x32\...\{4C9771FB-6EB6-4E89-A2BE-BDE8B61C1BEC}) (Version: 1.2.2.9000 - Xamarin) Hidden
Xamarin.Bonjour v1.0.13 (HKLM-x32\...\{32B2DF61-DE93-4AF9-A7A6-79B03299A0AA}) (Version: 1.0.13.0 - Xamarin) Hidden
Xoreax IncrediBuild 8 (build 1854) (HKLM-x32\...\XoreaxIncrediBuild) (Version: - )
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-1757837757-2786829171-2820918412-1001_Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1757837757-2786829171-2820918412-1001_Classes\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1757837757-2786829171-2820918412-1001_Classes\CLSID\{00020422-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1757837757-2786829171-2820918412-1001_Classes\CLSID\{00020423-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1757837757-2786829171-2820918412-1001_Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1757837757-2786829171-2820918412-1001_Classes\CLSID\{00020425-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files (x86)\Notepad++\NppShell_06.dll [2017-08-15] ()
ContextMenuHandlers1: [AVK9CM] -> {CAF4C320-32F5-11D3-A222-004095200FF2} => C:\Program Files (x86)\G DATA\InternetSecurity\AVK\ShellExt64.dll [2017-06-08] (G DATA Software AG)
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2017-08-11] (Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2017-08-11] (Alexander Roshal)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-08-21] (Malwarebytes)
ContextMenuHandlers3: [Reisswolf] -> {1F0F1EE7-36B9-11D2-8985-0080ADA96E9B} => C:\Program Files (x86)\G DATA\InternetSecurity\Shredder\Reisswlf64.dll [2017-06-08] (G DATA Software AG)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\Windows\system32\nvshext.dll [2017-08-22] (NVIDIA Corporation)
ContextMenuHandlers6: [AVK9CM] -> {CAF4C320-32F5-11D3-A222-004095200FF2} => C:\Program Files (x86)\G DATA\InternetSecurity\AVK\ShellExt64.dll [2017-06-08] (G DATA Software AG)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-08-21] (Malwarebytes)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2017-08-11] (Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2017-08-11] (Alexander Roshal)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {056CD82D-89B6-4D4C-B91B-38D661E2686C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-08-26] (Google Inc.)
Task: {10DEB935-2553-4CD5-BE78-F3C734EDDFD4} - System32\Tasks\update-S-1-5-21-1757837757-2786829171-2820918412-1001 => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe [2017-04-12] (TODO: <Company name>)
Task: {36E0628E-619C-4FE8-9069-7750EE4B15BD} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-08-22] (NVIDIA Corporation)
Task: {3B489219-0C1E-40B1-9948-495CB6510001} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-08-22] (NVIDIA Corporation)
Task: {7E40D45F-B453-40D4-89E5-35ED42EF755F} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-08-22] (NVIDIA Corporation)
Task: {813D3130-0B01-48BE-B5DE-D295B81ABECD} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2017-08-22] (NVIDIA Corporation)
Task: {8555401C-A76C-408D-825C-25F21AF8A1AE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-08-26] (Google Inc.)
Task: {8B277C45-0054-4FED-9C55-920B6CF37316} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-08-22] (NVIDIA Corporation)
Task: {9BE2E280-4D48-4665-9B82-7FF7D60DA8C0} - System32\Tasks\update-sys => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe [2017-04-12] (TODO: <Company name>)
Task: {A0D10346-0A5B-4E4B-91BB-7DE293230A36} - System32\Tasks\Microsoft\VisualStudio\VSIX Auto Update 15.0.396 => C:\Program Files (x86)\Microsoft Visual Studio\2017\Enterprise\Common7\IDE\VSIXAutoUpdate.exe [2017-08-27] ()
Task: {C39C7B7B-8419-4450-B1E6-6CE0332122E2} - System32\Tasks\LaunchChromeTask111 => C:\Program Files\FileZilla FTP Client\FileZilla.exe [2017-08-14] (FileZilla Project)
Task: {C5D17547-ADFD-4D96-8BA1-AC9823B072BF} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-08-22] (NVIDIA Corporation)
Task: {E8596A42-A281-4E34-8489-C611F29AF541} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2017-08-22] (NVIDIA Corporation)
Task: {FB9DE70E-6056-4C77-8409-434AD5549F1B} - System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe [2017-08-22] (NVIDIA Corporation)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\Windows\Tasks\update-S-1-5-21-1757837757-2786829171-2820918412-1001.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
Task: C:\Windows\Tasks\update-sys.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
==================== Verknüpfungen & WMI ========================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
ShortcutWithArgument: C:\Users\ktown\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome-Apps\TwitchAlerts Stream Labels.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=kgmggmdngboajiakmbpdknfpdelbjbcg
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2017-08-25 21:13 - 2013-07-03 20:32 - 000936728 _____ () C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe
2017-08-28 18:20 - 2017-08-24 11:27 - 002264528 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2017-08-27 21:03 - 2017-08-22 03:01 - 001267320 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\libprotobuf.dll
2017-06-08 05:54 - 2017-06-08 05:54 - 000554984 _____ () C:\Program Files (x86)\Common Files\G Data\AVKProxy\PktIcpt2x64.dll
2017-03-18 22:58 - 2017-03-18 22:58 - 000138000 _____ () C:\Windows\SYSTEM32\inputhost.dll
2017-03-18 22:59 - 2017-03-20 06:43 - 001731072 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-08-26 12:13 - 2017-08-26 12:14 - 000074752 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.19.856.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-08-26 12:13 - 2017-08-26 12:14 - 000203264 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.19.856.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-08-26 12:13 - 2017-08-26 12:14 - 036162048 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.19.856.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-08-26 12:13 - 2017-08-26 12:14 - 002237952 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.19.856.0_x64__kzf8qxf38zg5c\skypert.dll
2017-08-26 11:51 - 2017-08-23 10:48 - 003824472 _____ () C:\Program Files (x86)\Google\Chrome\Application\60.0.3112.113\libglesv2.dll
2017-08-26 11:51 - 2017-08-23 10:48 - 000100184 _____ () C:\Program Files (x86)\Google\Chrome\Application\60.0.3112.113\libegl.dll
2017-08-25 21:13 - 2017-09-02 12:35 - 000026112 _____ () C:\Program Files (x86)\ASUS\AXSP\1.01.02\PEbiosinterface32.dll
2017-08-25 21:13 - 2013-07-03 20:32 - 000104448 _____ () C:\Program Files (x86)\ASUS\AXSP\1.01.02\ATKEX.dll
2017-08-27 21:03 - 2017-08-22 03:01 - 069807736 _____ () C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\libcef.dll
2017-08-27 21:03 - 2017-08-22 03:01 - 001040504 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\libprotobuf.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2017-03-18 23:03 - 2017-08-28 18:16 - 000000830 _____ C:\Windows\system32\Drivers\etc\hosts
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-1757837757-2786829171-2820918412-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: )
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
HKLM\...\StartupApproved\Run: => "SecurityHealth"
HKLM\...\StartupApproved\Run32: => "IncrediBuild Agent Monitor"
HKU\S-1-5-21-1757837757-2786829171-2820918412-1001\...\StartupApproved\Run: => "OneDrive"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [VIRT-REMOTEDESKTOP-In-TCP-NoScope] => (Allow) %systemroot%\system32\vmms.exe
FirewallRules: [VIRT-MIGL-In-TCP-NoScope] => (Allow) %systemroot%\system32\vmms.exe
==================== Wiederherstellungspunkte =========================
29-08-2017 14:03:48 Geplanter Prüfpunkt
31-08-2017 14:42:04 Windows Modules Installer
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (09/02/2017 12:33:39 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Users\ktown\Downloads\Mods\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_26002d27e7c744a2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.483_none_6dad63fefc436da8.manifest.
Error: (09/02/2017 12:20:38 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\xoreax\incredibuild\TestCRT80.exe".
Die abhängige Assemblierung "Microsoft.VC80.ATL,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/02/2017 12:20:38 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\xoreax\incredibuild\TestCRT90.exe".
Die abhängige Assemblierung "Microsoft.VC90.ATL,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.1"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/02/2017 12:20:08 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\Windows Kits\10\bin\10.0.15063.0\arm64\signtool.exe.Manifest".
Die abhängige Assemblierung "Microsoft.Windows.Build.Appx.AppxSip.dll,version="0.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/02/2017 12:20:08 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\Windows Kits\10\bin\10.0.15063.0\arm\signtool.exe.Manifest".
Die abhängige Assemblierung "Microsoft.Windows.Build.Signing.wintrust.dll,version="0.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/02/2017 12:19:21 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\redist\1033\vcredist_arm.exe".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="arm",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/02/2017 12:16:27 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\Windows Kits\10\bin\arm64\oleview.exe".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="arm64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/02/2017 12:16:27 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\Windows Kits\10\bin\arm64\filetypeverifier.exe".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="arm64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/02/2017 12:13:23 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\Windows Kits\10\bin\arm\signtool.exe.Manifest".
Die abhängige Assemblierung "Microsoft.Windows.Build.Appx.AppxSip.dll,version="0.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/02/2017 12:13:21 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\Windows Kits\10\bin\arm64\signtool.exe.Manifest".
Die abhängige Assemblierung "Microsoft.Windows.Build.Appx.AppxSip.dll,version="0.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Systemfehler:
=============
Error: (09/02/2017 12:35:18 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "CldFlt" wurde aufgrund folgenden Fehlers nicht gestartet:
Die Anforderung wird nicht unterstützt.
Error: (09/02/2017 12:34:14 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Search" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
Es wird bereits eine Instanz des Dienstes ausgeführt.
Error: (09/02/2017 12:33:44 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (09/02/2017 12:33:44 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Hyper-V-Hostserverdienst" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (09/02/2017 12:33:44 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Epson Scanner Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (09/02/2017 12:33:44 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Hyper-V-Verwaltung für virtuelle Computer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (09/02/2017 12:33:44 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "SQL Server VSS Writer" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (09/02/2017 12:33:44 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "NVIDIA Telemetry Container" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 1000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (09/02/2017 12:33:44 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "NVIDIA LocalSystem Container" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 6000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (09/02/2017 12:33:44 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "ASUS Com Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
CodeIntegrity:
===================================
Date: 2017-08-31 19:49:52.906
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume4\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.
Date: 2017-08-31 19:49:43.354
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume4\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.
Date: 2017-08-30 10:01:03.432
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume4\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.
Date: 2017-08-30 09:45:35.252
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume4\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.
Date: 2017-08-30 09:45:02.232
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume4\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.
Date: 2017-08-30 09:44:59.256
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume4\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.
Date: 2017-08-30 09:44:59.015
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume4\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.
Date: 2017-08-30 09:44:58.881
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume4\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements.
Date: 2017-08-30 09:33:26.940
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltDll64.dll that did not meet the Store signing level requirements.
Date: 2017-08-30 09:33:21.190
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltDll64.dll that did not meet the Store signing level requirements.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz
Prozentuale Nutzung des RAM: 22%
Installierter physikalischer RAM: 16318.38 MB
Verfügbarer physikalischer RAM: 12684.74 MB
Summe virtueller Speicher: 19262.38 MB
Verfügbarer virtueller Speicher: 15328.44 MB
==================== Laufwerke ================================
Drive c: () (Fixed) (Total:930.96 GB) (Free:757.05 GB) NTFS
Drive e: (D) (Fixed) (Total:931.51 GB) (Free:457.95 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 1870D584)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=42)
========================================================
Disk: 1 (Size: 931.5 GB) (Disk ID: 00000000)
Partition: GPT.
==================== Ende von Addition.txt ============================
|
|
03.09.2017, 06:20
| #18 |
| /// TB-Senior    | Ständig im TaskManager Audio.exe EMCO Malware Destroyer OK, sehr schön.
__________________Schritt 1: FRST-Fix Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter 2017-08-28 00:07 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{024A0432-A804-47A4-8817-A9BEE06E8910}
2017-08-28 16:24 - 2017-08-31 18:11 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{032644B3-4DBF-404C-9DDB-ADE8247BA58D}
2017-08-28 00:07 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{07447B11-BD36-48EB-B4E9-E7F9BF5363B0}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{1070BD43-530B-4357-A9B8-3C56887B61F1}
2017-08-27 22:47 - 2017-08-27 22:47 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{122ACCD3-7873-4BC9-8D1A-A61542814B75}
2017-08-27 23:29 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{139558E7-CDC1-429B-9102-1262B97B7B85}
2017-08-27 22:55 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{17A3D445-3FD8-4749-B713-40D195E83059}
2017-08-27 23:01 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{1B6A2BD5-9186-40B7-AE0D-B50D1FF28920}
2017-08-27 22:54 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{1E9F4759-67BE-4C02-ACE4-74F62187D259}
2017-08-27 22:54 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{209CD171-D1F0-4F55-B654-41B51081028E}
2017-08-27 22:54 - 2017-08-28 18:33 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{23A1C90E-6B28-45F0-834B-28ACA2D2D339}
2017-08-27 22:54 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{2D494E5D-CB30-410A-8210-2A567D9ED826}
2017-08-27 23:01 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{2FD1294D-BEB5-4F29-9955-FD7329AE71D8}
2017-08-28 16:24 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{2FD7733B-8CF8-4F2B-8602-ED71387F0CE6}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{3152A6D8-F373-4EC6-8003-AFB5B6FFE3FE}
2017-08-27 22:21 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{40AB6665-68D5-496B-AFC0-BA8AF50C6919}
2017-08-27 22:51 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{4320DDD4-600C-4A45-8177-E4F360433D85}
2017-08-27 23:01 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{43D1CE4D-90A7-47A6-8548-0F746D5FD623}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{460E70F7-144D-4875-866B-C864BEC1AB98}
2017-08-27 23:30 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{46F48AEB-DB7C-47A0-B006-719CBDEF549D}
2017-08-27 22:55 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{482F908D-75BC-4E0F-AC08-29665CAA16CE}
2017-08-28 00:07 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{4B29994D-7D11-48AA-BBD7-3D6F5972EB8C}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{566E0DA9-203E-496C-A5B0-8C825F39E577}
2017-08-27 22:55 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{58155E36-DBC6-417A-BDFF-B16C171553CB}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{5A37934C-FFA9-4F56-80DF-9D31F8950B06}
2017-08-27 22:55 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{5B63FCA5-5390-4F9D-A526-003B8B356D4F}
2017-08-27 23:22 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{5D0BE935-AAA1-4756-B798-9E2F41396BAB}
2017-08-28 16:22 - 2017-08-28 16:23 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{5EB9B3AC-0160-42D7-AEC2-58385DDEFF67}
2017-08-27 22:54 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{6176FFB1-D968-4280-A148-EA629546F193}
2017-08-27 22:21 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{64CC78B0-D949-40FD-BA90-B2899E561F15}
2017-08-27 22:50 - 2017-08-27 22:50 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{66FCDB64-40FB-4956-A5F0-377A14EFF24D}
2017-08-27 22:54 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{6750A088-8B0E-4BD8-BD0E-86CC73025E01}
2017-08-27 22:59 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{68317946-D327-4210-817B-C0E827221C43}
2017-08-27 23:31 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{69CE8F0F-5B53-42AD-8F26-02722D10B41B}
2017-08-27 23:31 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{6B13E4C4-6BA4-429D-A987-432769D8414B}
2017-08-27 22:59 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{6B4EA066-4854-492E-840A-8C7C5736B832}
2017-08-27 22:56 - 2017-08-27 22:56 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{6B74B309-E7FD-4FD5-B22D-CA53E1B33B41}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{714C6B6F-2043-4925-A281-ABF548FD5CE4}
2017-08-27 23:31 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{73DC0E34-2888-41FC-B2AC-A86201DA0FAD}
2017-08-27 22:54 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{7BE4E157-B5F0-4B05-94E5-3862A9558DA8}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{80A045C6-8219-45AE-B9D1-F57E829472C5}
2017-08-27 23:02 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{832C6928-C980-4B4C-853C-1FC87E0E9032}
2017-08-27 23:01 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{8C851D31-2EDE-4F07-939D-5C8A5C69CDFF}
2017-08-27 23:02 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{8D3989AA-3322-4AB5-A14A-057BE8DF64FC}
2017-08-28 16:24 - 2017-08-28 18:33 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{8E73B611-6D21-4BA3-B993-163F23FD62A0}
2017-08-27 23:22 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{93822BC0-2749-4A82-B29A-CBEDE201C0DA}
2017-08-27 22:21 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{94EE25A4-3009-46F4-82A2-80EDFCF8540A}
2017-08-28 16:22 - 2017-08-28 16:23 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{976708A6-0B52-4144-BB35-50BB4B655C78}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{9B385A54-7A40-47F4-AEA3-1DA3D3F03849}
2017-08-27 22:55 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{A39D38FC-FBC7-48ED-882A-248539E8860C}
2017-08-27 22:51 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{A800E9B1-0658-4F46-9D76-93F432E60DEE}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{A8645507-B84A-4FD1-AC84-D7BEADA0C558}
2017-08-27 23:31 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{A91DDEBE-7B15-4F86-B500-257A1E332388}
2017-08-28 00:08 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{ADD3B04C-A1CD-403F-A495-4695B75F30FD}
2017-08-27 22:54 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{B5EBD04C-8CDA-40BC-9B77-9EBA379BF202}
2017-08-27 23:31 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{BA86BCA4-4096-428E-948B-1A43E316FCAD}
2017-08-28 16:22 - 2017-08-28 16:23 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{BBDC5531-D1EB-4C76-B6C0-76AC8435833D}
2017-08-27 22:59 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{BF496574-6A87-4920-8310-A54F8096DF51}
2017-08-28 16:24 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{C83EFF28-A57A-4BBC-B695-426178168753}
2017-08-28 16:05 - 2017-08-28 16:06 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{C8678A9A-48F2-4B55-BE16-354D909C3328}
2017-08-28 00:07 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{CBDFBAF8-299F-44AC-9DF3-F27FE98C7231}
2017-08-28 00:08 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{CD3229B0-A69D-42D9-8C04-C73C7F9A8120}
2017-08-27 22:59 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{CD5FC2EA-1F10-46B3-AB08-A3444A6F3E86}
2017-08-27 22:55 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{CEE6B822-FD7E-4EFB-A7C8-019D405FC2C4}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{D000F72B-49B8-4B73-A5C7-CD55D0A8DA8A}
2017-08-28 16:22 - 2017-08-28 16:23 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{D60CC88D-D1E0-4145-9F6E-76A5965EB182}
2017-08-27 22:21 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{D8A391E8-547D-4F60-A4C9-7ADB37D4BF81}
2017-08-27 23:31 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{D8FC2835-B597-4978-A0F5-F3C1E1D2FD2C}
2017-08-27 23:29 - 2017-08-28 18:33 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{DC41174F-1316-4C73-AF54-50FAC2A2B0E6}
2017-08-27 23:01 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{DD3F0BEA-6038-4E6A-92C6-012D40B65DEC}
2017-08-28 16:05 - 2017-08-28 16:06 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{E1D5BFD4-07D4-4193-9884-6744CF2F5BE4}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{E49E6D4F-E95C-4D0C-8E10-1FA6E9F8BB5F}
2017-08-27 23:01 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{ECF6E036-3732-40A8-9AC2-4FDCA292811E}
2017-08-27 23:30 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{EEF4FFCC-6844-428D-B69F-2AB0BAE9A03E}
2017-08-27 22:49 - 2017-08-27 22:49 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{EF5BA5D0-27CE-492C-BE7B-8F481583F185}
2017-08-27 22:47 - 2017-08-27 22:47 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{F96B83B8-2262-4431-991F-8DF1F5714B59}
2017-08-28 16:05 - 2017-08-28 16:24 - 000000000 __SHD C:\ProgramData\picnic Wise
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 2: Beantworte meine Frage Läuft den System jetzt wieder normal oder gibt es noch Probleme bzw. Auffälligkeiten?
__________________ |
|
03.09.2017, 16:10
| #19 |
| | Ständig im TaskManager Audio.exe EMCO Malware Destroyer Fixlog: Code:
ATTFilter Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version: 20-08-2017
durchgeführt von ktown (03-09-2017 13:49:34) Run:3
Gestartet von C:\Users\ktown\Downloads\Mods
Geladene Profile: ktown (Verfügbare Profile: ktown)
Start-Modus: Normal
==============================================
fixlist Inhalt:
*****************
2017-08-28 00:07 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{024A0432-A804-47A4-8817-A9BEE06E8910}
2017-08-28 16:24 - 2017-08-31 18:11 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{032644B3-4DBF-404C-9DDB-ADE8247BA58D}
2017-08-28 00:07 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{07447B11-BD36-48EB-B4E9-E7F9BF5363B0}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{1070BD43-530B-4357-A9B8-3C56887B61F1}
2017-08-27 22:47 - 2017-08-27 22:47 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{122ACCD3-7873-4BC9-8D1A-A61542814B75}
2017-08-27 23:29 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{139558E7-CDC1-429B-9102-1262B97B7B85}
2017-08-27 22:55 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{17A3D445-3FD8-4749-B713-40D195E83059}
2017-08-27 23:01 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{1B6A2BD5-9186-40B7-AE0D-B50D1FF28920}
2017-08-27 22:54 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{1E9F4759-67BE-4C02-ACE4-74F62187D259}
2017-08-27 22:54 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{209CD171-D1F0-4F55-B654-41B51081028E}
2017-08-27 22:54 - 2017-08-28 18:33 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{23A1C90E-6B28-45F0-834B-28ACA2D2D339}
2017-08-27 22:54 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{2D494E5D-CB30-410A-8210-2A567D9ED826}
2017-08-27 23:01 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{2FD1294D-BEB5-4F29-9955-FD7329AE71D8}
2017-08-28 16:24 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{2FD7733B-8CF8-4F2B-8602-ED71387F0CE6}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{3152A6D8-F373-4EC6-8003-AFB5B6FFE3FE}
2017-08-27 22:21 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{40AB6665-68D5-496B-AFC0-BA8AF50C6919}
2017-08-27 22:51 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{4320DDD4-600C-4A45-8177-E4F360433D85}
2017-08-27 23:01 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{43D1CE4D-90A7-47A6-8548-0F746D5FD623}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{460E70F7-144D-4875-866B-C864BEC1AB98}
2017-08-27 23:30 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{46F48AEB-DB7C-47A0-B006-719CBDEF549D}
2017-08-27 22:55 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{482F908D-75BC-4E0F-AC08-29665CAA16CE}
2017-08-28 00:07 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{4B29994D-7D11-48AA-BBD7-3D6F5972EB8C}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{566E0DA9-203E-496C-A5B0-8C825F39E577}
2017-08-27 22:55 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{58155E36-DBC6-417A-BDFF-B16C171553CB}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{5A37934C-FFA9-4F56-80DF-9D31F8950B06}
2017-08-27 22:55 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{5B63FCA5-5390-4F9D-A526-003B8B356D4F}
2017-08-27 23:22 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{5D0BE935-AAA1-4756-B798-9E2F41396BAB}
2017-08-28 16:22 - 2017-08-28 16:23 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{5EB9B3AC-0160-42D7-AEC2-58385DDEFF67}
2017-08-27 22:54 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{6176FFB1-D968-4280-A148-EA629546F193}
2017-08-27 22:21 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{64CC78B0-D949-40FD-BA90-B2899E561F15}
2017-08-27 22:50 - 2017-08-27 22:50 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{66FCDB64-40FB-4956-A5F0-377A14EFF24D}
2017-08-27 22:54 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{6750A088-8B0E-4BD8-BD0E-86CC73025E01}
2017-08-27 22:59 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{68317946-D327-4210-817B-C0E827221C43}
2017-08-27 23:31 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{69CE8F0F-5B53-42AD-8F26-02722D10B41B}
2017-08-27 23:31 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{6B13E4C4-6BA4-429D-A987-432769D8414B}
2017-08-27 22:59 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{6B4EA066-4854-492E-840A-8C7C5736B832}
2017-08-27 22:56 - 2017-08-27 22:56 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{6B74B309-E7FD-4FD5-B22D-CA53E1B33B41}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{714C6B6F-2043-4925-A281-ABF548FD5CE4}
2017-08-27 23:31 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{73DC0E34-2888-41FC-B2AC-A86201DA0FAD}
2017-08-27 22:54 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{7BE4E157-B5F0-4B05-94E5-3862A9558DA8}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{80A045C6-8219-45AE-B9D1-F57E829472C5}
2017-08-27 23:02 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{832C6928-C980-4B4C-853C-1FC87E0E9032}
2017-08-27 23:01 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{8C851D31-2EDE-4F07-939D-5C8A5C69CDFF}
2017-08-27 23:02 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{8D3989AA-3322-4AB5-A14A-057BE8DF64FC}
2017-08-28 16:24 - 2017-08-28 18:33 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{8E73B611-6D21-4BA3-B993-163F23FD62A0}
2017-08-27 23:22 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{93822BC0-2749-4A82-B29A-CBEDE201C0DA}
2017-08-27 22:21 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{94EE25A4-3009-46F4-82A2-80EDFCF8540A}
2017-08-28 16:22 - 2017-08-28 16:23 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{976708A6-0B52-4144-BB35-50BB4B655C78}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{9B385A54-7A40-47F4-AEA3-1DA3D3F03849}
2017-08-27 22:55 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{A39D38FC-FBC7-48ED-882A-248539E8860C}
2017-08-27 22:51 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{A800E9B1-0658-4F46-9D76-93F432E60DEE}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{A8645507-B84A-4FD1-AC84-D7BEADA0C558}
2017-08-27 23:31 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{A91DDEBE-7B15-4F86-B500-257A1E332388}
2017-08-28 00:08 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{ADD3B04C-A1CD-403F-A495-4695B75F30FD}
2017-08-27 22:54 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{B5EBD04C-8CDA-40BC-9B77-9EBA379BF202}
2017-08-27 23:31 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{BA86BCA4-4096-428E-948B-1A43E316FCAD}
2017-08-28 16:22 - 2017-08-28 16:23 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{BBDC5531-D1EB-4C76-B6C0-76AC8435833D}
2017-08-27 22:59 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{BF496574-6A87-4920-8310-A54F8096DF51}
2017-08-28 16:24 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{C83EFF28-A57A-4BBC-B695-426178168753}
2017-08-28 16:05 - 2017-08-28 16:06 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{C8678A9A-48F2-4B55-BE16-354D909C3328}
2017-08-28 00:07 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{CBDFBAF8-299F-44AC-9DF3-F27FE98C7231}
2017-08-28 00:08 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{CD3229B0-A69D-42D9-8C04-C73C7F9A8120}
2017-08-27 22:59 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{CD5FC2EA-1F10-46B3-AB08-A3444A6F3E86}
2017-08-27 22:55 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{CEE6B822-FD7E-4EFB-A7C8-019D405FC2C4}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{D000F72B-49B8-4B73-A5C7-CD55D0A8DA8A}
2017-08-28 16:22 - 2017-08-28 16:23 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{D60CC88D-D1E0-4145-9F6E-76A5965EB182}
2017-08-27 22:21 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{D8A391E8-547D-4F60-A4C9-7ADB37D4BF81}
2017-08-27 23:31 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{D8FC2835-B597-4978-A0F5-F3C1E1D2FD2C}
2017-08-27 23:29 - 2017-08-28 18:33 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{DC41174F-1316-4C73-AF54-50FAC2A2B0E6}
2017-08-27 23:01 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{DD3F0BEA-6038-4E6A-92C6-012D40B65DEC}
2017-08-28 16:05 - 2017-08-28 16:06 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{E1D5BFD4-07D4-4193-9884-6744CF2F5BE4}
2017-08-27 22:56 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{E49E6D4F-E95C-4D0C-8E10-1FA6E9F8BB5F}
2017-08-27 23:01 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{ECF6E036-3732-40A8-9AC2-4FDCA292811E}
2017-08-27 23:30 - 2017-08-28 18:34 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{EEF4FFCC-6844-428D-B69F-2AB0BAE9A03E}
2017-08-27 22:49 - 2017-08-27 22:49 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{EF5BA5D0-27CE-492C-BE7B-8F481583F185}
2017-08-27 22:47 - 2017-08-27 22:47 - 000000000 __SHD () C:\Users\ktown\AppData\Local\Microsoft\Windows\{F96B83B8-2262-4431-991F-8DF1F5714B59}
2017-08-28 16:05 - 2017-08-28 16:24 - 000000000 __SHD C:\ProgramData\picnic Wise
*****************
C:\Users\ktown\AppData\Local\Microsoft\Windows\{024A0432-A804-47A4-8817-A9BEE06E8910} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{032644B3-4DBF-404C-9DDB-ADE8247BA58D} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{07447B11-BD36-48EB-B4E9-E7F9BF5363B0} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{1070BD43-530B-4357-A9B8-3C56887B61F1} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{122ACCD3-7873-4BC9-8D1A-A61542814B75} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{139558E7-CDC1-429B-9102-1262B97B7B85} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{17A3D445-3FD8-4749-B713-40D195E83059} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{1B6A2BD5-9186-40B7-AE0D-B50D1FF28920} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{1E9F4759-67BE-4C02-ACE4-74F62187D259} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{209CD171-D1F0-4F55-B654-41B51081028E} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{23A1C90E-6B28-45F0-834B-28ACA2D2D339} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{2D494E5D-CB30-410A-8210-2A567D9ED826} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{2FD1294D-BEB5-4F29-9955-FD7329AE71D8} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{2FD7733B-8CF8-4F2B-8602-ED71387F0CE6} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{3152A6D8-F373-4EC6-8003-AFB5B6FFE3FE} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{40AB6665-68D5-496B-AFC0-BA8AF50C6919} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{4320DDD4-600C-4A45-8177-E4F360433D85} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{43D1CE4D-90A7-47A6-8548-0F746D5FD623} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{460E70F7-144D-4875-866B-C864BEC1AB98} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{46F48AEB-DB7C-47A0-B006-719CBDEF549D} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{482F908D-75BC-4E0F-AC08-29665CAA16CE} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{4B29994D-7D11-48AA-BBD7-3D6F5972EB8C} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{566E0DA9-203E-496C-A5B0-8C825F39E577} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{58155E36-DBC6-417A-BDFF-B16C171553CB} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{5A37934C-FFA9-4F56-80DF-9D31F8950B06} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{5B63FCA5-5390-4F9D-A526-003B8B356D4F} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{5D0BE935-AAA1-4756-B798-9E2F41396BAB} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{5EB9B3AC-0160-42D7-AEC2-58385DDEFF67} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{6176FFB1-D968-4280-A148-EA629546F193} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{64CC78B0-D949-40FD-BA90-B2899E561F15} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{66FCDB64-40FB-4956-A5F0-377A14EFF24D} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{6750A088-8B0E-4BD8-BD0E-86CC73025E01} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{68317946-D327-4210-817B-C0E827221C43} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{69CE8F0F-5B53-42AD-8F26-02722D10B41B} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{6B13E4C4-6BA4-429D-A987-432769D8414B} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{6B4EA066-4854-492E-840A-8C7C5736B832} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{6B74B309-E7FD-4FD5-B22D-CA53E1B33B41} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{714C6B6F-2043-4925-A281-ABF548FD5CE4} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{73DC0E34-2888-41FC-B2AC-A86201DA0FAD} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{7BE4E157-B5F0-4B05-94E5-3862A9558DA8} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{80A045C6-8219-45AE-B9D1-F57E829472C5} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{832C6928-C980-4B4C-853C-1FC87E0E9032} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{8C851D31-2EDE-4F07-939D-5C8A5C69CDFF} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{8D3989AA-3322-4AB5-A14A-057BE8DF64FC} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{8E73B611-6D21-4BA3-B993-163F23FD62A0} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{93822BC0-2749-4A82-B29A-CBEDE201C0DA} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{94EE25A4-3009-46F4-82A2-80EDFCF8540A} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{976708A6-0B52-4144-BB35-50BB4B655C78} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{9B385A54-7A40-47F4-AEA3-1DA3D3F03849} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{A39D38FC-FBC7-48ED-882A-248539E8860C} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{A800E9B1-0658-4F46-9D76-93F432E60DEE} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{A8645507-B84A-4FD1-AC84-D7BEADA0C558} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{A91DDEBE-7B15-4F86-B500-257A1E332388} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{ADD3B04C-A1CD-403F-A495-4695B75F30FD} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{B5EBD04C-8CDA-40BC-9B77-9EBA379BF202} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{BA86BCA4-4096-428E-948B-1A43E316FCAD} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{BBDC5531-D1EB-4C76-B6C0-76AC8435833D} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{BF496574-6A87-4920-8310-A54F8096DF51} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{C83EFF28-A57A-4BBC-B695-426178168753} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{C8678A9A-48F2-4B55-BE16-354D909C3328} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{CBDFBAF8-299F-44AC-9DF3-F27FE98C7231} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{CD3229B0-A69D-42D9-8C04-C73C7F9A8120} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{CD5FC2EA-1F10-46B3-AB08-A3444A6F3E86} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{CEE6B822-FD7E-4EFB-A7C8-019D405FC2C4} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{D000F72B-49B8-4B73-A5C7-CD55D0A8DA8A} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{D60CC88D-D1E0-4145-9F6E-76A5965EB182} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{D8A391E8-547D-4F60-A4C9-7ADB37D4BF81} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{D8FC2835-B597-4978-A0F5-F3C1E1D2FD2C} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{DC41174F-1316-4C73-AF54-50FAC2A2B0E6} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{DD3F0BEA-6038-4E6A-92C6-012D40B65DEC} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{E1D5BFD4-07D4-4193-9884-6744CF2F5BE4} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{E49E6D4F-E95C-4D0C-8E10-1FA6E9F8BB5F} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{ECF6E036-3732-40A8-9AC2-4FDCA292811E} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{EEF4FFCC-6844-428D-B69F-2AB0BAE9A03E} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{EF5BA5D0-27CE-492C-BE7B-8F481583F185} => erfolgreich verschoben
C:\Users\ktown\AppData\Local\Microsoft\Windows\{F96B83B8-2262-4431-991F-8DF1F5714B59} => erfolgreich verschoben
C:\ProgramData\picnic Wise => erfolgreich verschoben
==== Ende von Fixlog 13:49:37 ====
Zu Schritt 2: Mein System läuft wieder stabil bzw ohne probleme bis auf das seit heute morgen sich im explorer folgender pfad öffnet C:\Users\ktown\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled So sieht das aus wenn ich den Pc hochfahre:  |
|
04.09.2017, 05:14
| #20 |
| /// TB-Senior | Ständig im TaskManager Audio.exe EMCO Malware Destroyer Der Ordner muss versteckt sein, dann wird er auch nicht mehr "gestartet". Das kannst du im Explorer oder über die Kommandozeile machen oder auch mit folgendem FRST-Fix: Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter cmd: attrib +h C:\Users\ktown\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
So weit ich das sehen kann, ist keine Malware mehr auf deinem System aktiv- Wenn du keine weiteren Probleme hast. sind wir hier fertig! Deine Logs sind sauber! Schritt 1: Aufräumen Die Reihenfolge ist hier entscheidend.
Abschluss: Tipps
Wenn du keine konkreten Fragen dazu mehr hast, wünsche ich dir noch ein angenehmes und malwarefreies Surfen! Du kannst uns noch etwas spenden oder hier Lob oder Kritik äußern. Andere Fragen sind in den entsprechenden Forenbereichen immer willkommen.
__________________ Zum Schutz vor Trojanerinnen und Femaleware ist bei einem aktuellen Windows 10 die Windows-Defenderin ausreichend. |
|
04.09.2017, 09:46
| #21 |
| | Ständig im TaskManager Audio.exe EMCO Malware Destroyer Hi, Erstmal danke für deine Hilfe! Die schritte habe ich ausgeführt und soweit keine Probleme mehr. Ich benutze G Data Internet Security (gekauft) ist G Data von eurer Seite denn zu empfehlen? Lg |
|
05.09.2017, 06:04
| #22 |
| /// TB-Senior | Ständig im TaskManager Audio.exe EMCO Malware Destroyer GData ist schon OK, nutze ruhig deine bezahlte Lizenz. Aber denke daran, dass ein Antivirusprogramm niemals alles finden kann. Also verdächtige exe-Dateien keinesfalls starten und sehen, was das AV macht (so wie du es während der Bereinigung einmal gekonnt hast), sondern lieber eine Woche liegen lassen und dann bei Virustotal hochladen.
__________________ Zum Schutz vor Trojanerinnen und Femaleware ist bei einem aktuellen Windows 10 die Windows-Defenderin ausreichend. |
|
05.09.2017, 08:31
| #23 |
| | Ständig im TaskManager Audio.exe EMCO Malware Destroyer Fixlog: Code:
ATTFilter Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version: 20-08-2017
durchgeführt von ktown (05-09-2017 09:30:18) Run:6
Gestartet von C:\Users\ktown\Downloads\Mods
Geladene Profile: ktown (Verfügbare Profile: ktown)
Start-Modus: Normal
==============================================
fixlist Inhalt:
*****************
cmd: attrib +h C:\Users\ktown\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled
*****************
========= attrib +h C:\Users\ktown\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled =========
Parameterformat falsch -
========= Ende von CMD: =========
==== Ende von Fixlog 09:30:18 ====
|
|
05.09.2017, 12:17
| #24 |
| /// TB-Senior | Ständig im TaskManager Audio.exe EMCO Malware Destroyer Oh, mein Fehler. So muss die Fixlist lauten. Code:
ATTFilter cmd: attrib +h "C:\Users\ktown\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled"
Ich dachte, das hättest du schon. Du schriebst, es liefe wieder alles normal.
__________________ Zum Schutz vor Trojanerinnen und Femaleware ist bei einem aktuellen Windows 10 die Windows-Defenderin ausreichend. |
|
05.09.2017, 14:26
| #25 |
| | Ständig im TaskManager Audio.exe EMCO Malware Destroyer Jetzt ist entgültig wieder alles normal danke dir |
|
| Themen zu Ständig im TaskManager Audio.exe EMCO Malware Destroyer |
| data, dateien, erfolglos, exe, exe dateien, folge, folgende, g data, installier, installiert, leute, malware, neu, nichts, schonmal, taskma, taskmanager, taskmgr, wenig, windows, windows 10 |
Linear-Darstellung
