BFE Dienst startet nicht mehr / Fehler 5 Zugriff verweigert

OTL logfile created on: 22.08.2018 14:15:03 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Administration
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.18893)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,81 Gb Total Physical Memory | 6,05 Gb Available Physical Memory | 77,49% Memory free
15,61 Gb Paging File | 13,84 Gb Available in Paging File | 88,65% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,40 Gb Total Space | 344,94 Gb Free Space | 74,12% Space Free | Partition Type: NTFS
Drive F: | 931,51 Gb Total Space | 71,03 Gb Free Space | 7,63% Space Free | Partition Type: NTFS
Drive S: | 931,51 Gb Total Space | 71,03 Gb Free Space | 7,63% Space Free | Partition Type: NTFS
Drive V: | 931,51 Gb Total Space | 71,03 Gb Free Space | 7,63% Space Free | Partition Type: NTFS
 
Computer Name: MAIL-PC | User Name: Mail | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Administration\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Allway Sync\Bin\SyncService.exe ()
PRC - C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe (Vodafone)
PRC - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe (Brother Industries, Ltd.)
PRC - C:\Program Files (x86)\Browny02\BrYNSvc.exe (Brother Industries, Ltd.)
PRC - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Kalenderchen\Kalenderchen.exe (Daniel Manger Software)
PRC - C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
PRC - C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe (Nuance Communications, Inc.)
PRC - C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe (Nuance Communications, Inc.)
PRC - c:\Adobe\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe ()
PRC - c:\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe (Adobe Systems Incorporated)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\c12a5b330a8af694275ee7ecfd94a5ff\IAStorUtil.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\4251adc2fe4f647248c5374ca4eb4d3d\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\4ea97ae445cc4ce417b396037cd49621\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\223c5897d6951604bb47b2f3e4107a92\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\da8fcb66ca8545ea716eb35e6f616d9b\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\acc8d28267bf62dcb63dfe037b81f87b\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\f9e46bc6657bf3e8fc1964b7b303f88b\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\e45cf03d42149d19daffb3e0a5c61a68\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\ec41de2e3566623aff984d2e53e870ae\IAStorCommon.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (IEEtwCollectorService) -- C:\Windows\SysNative\IEEtwCollector.exe (Microsoft Corporation)
SRV:64bit: - (DiagTrack) -- C:\Windows\SysNative\diagtrack.dll (Microsoft Corporation)
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (igfxCUIService1.0.0.0) -- C:\Windows\SysNative\igfxCUIService.exe (Intel Corporation)
SRV:64bit: - (AppleChargerSrv) -- C:\Windows\SysNative\AppleChargerSrv.exe ()
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (TeamViewer) -- C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FileOpenManager) -- C:\Programme\FileOpen\Services\FileOpenManager64.exe (FileOpen Systems Inc.)
SRV - (FLEXnet Licensing Service 64) -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe (Acresso Software Inc.)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (BotkindSyncService) -- C:\Program Files (x86)\Allway Sync\Bin\SyncService.exe ()
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (VmbService) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe (Vodafone)
SRV - (BrYNSvc) -- C:\Program Files (x86)\Browny02\BrYNSvc.exe (Brother Industries, Ltd.)
SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (jhi_service) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Intel Corporation)
SRV - (Intel(R) -- C:\Programme\Intel\iCLS Client\HeciServer.exe (Intel(R) Corporation)
SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (Canon Driver Information Assist Service) -- C:\Programme\Canon\DIAS\CnxDIAS.exe (CANON INC.)
SRV - (PDFProFiltSrvPP) -- C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe (Nuance Communications, Inc.)
SRV - (Adobe Version Cue CS2) -- c:\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe (Adobe Systems Incorporated)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (GeneStor) -- C:\Windows\SysNative\drivers\GeneStor.sys (GenesysLogic)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (Disc Soft Ltd)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (usb_rndisx) -- C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation)
DRV:64bit: - (adp3132) -- C:\Windows\SysNative\drivers\adp3132.sys (Adaptec, Inc.)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (iusb3xhc) -- C:\Windows\SysNative\drivers\iusb3xhc.sys (Intel Corporation)
DRV:64bit: - (iusb3hub) -- C:\Windows\SysNative\drivers\iusb3hub.sys (Intel Corporation)
DRV:64bit: - (iusb3hcs) -- C:\Windows\SysNative\drivers\iusb3hcs.sys (Intel Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (AppleCharger) -- C:\Windows\SysNative\drivers\AppleCharger.sys ()
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) -- C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (StillCam) -- C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1786823318-2106405980-1418230006-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
IE - HKU\S-1-5-21-1786823318-2106405980-1418230006-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-1786823318-2106405980-1418230006-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = D4 BD A7 6E 38 E9 CF 01  [binary data]
IE - HKU\S-1-5-21-1786823318-2106405980-1418230006-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1786823318-2106405980-1418230006-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02
IE - HKU\S-1-5-21-1786823318-2106405980-1418230006-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.countryCode: "DE"
FF - prefs.js..browser.search.highlightCount: 2
FF - prefs.js..browser.search.region: "DE"
FF - prefs.js..browser.search.widget.inNavBar: true
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_29_0_0_113.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=11.181.2: C:\Program Files\Java\jre1.8.0_181\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=11.181.2: C:\Program Files\Java\jre1.8.0_181\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_29_0_0_113.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1229199.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Mail\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 61.0.2\extensions\\Components: C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\COMPONENTS
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 61.0.2\extensions\\Plugins: C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\PLUGINS
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 52.9.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 52.9.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
 
[2014.10.16 14:01:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mail\AppData\Roaming\mozilla\Extensions
[2017.11.23 09:44:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mail\AppData\Roaming\mozilla\SystemExtensionsDev
[2017.10.18 16:41:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mail\AppData\Roaming\mozilla\Firefox\Profiles\yqfrr0rv.default\browser-extension-data
[2017.10.18 16:41:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mail\AppData\Roaming\mozilla\Firefox\Profiles\yqfrr0rv.default\browser-extension-data\light_plugin_F6F079488B53499DB99380A7E11A93F6@kaspersky.com
[2017.10.10 08:03:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mail\AppData\Roaming\mozilla\Firefox\Profiles\yqfrr0rv.default\browser-extension-data\screenshots@mozilla.org
[2017.11.23 09:44:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mail\AppData\Roaming\mozilla\Firefox\Profiles\yqfrr0rv.default\extensions
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.8.0_181\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre1.8.0_181\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (PlusIEEventHelper Class) - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Adobe Version Cue CS2] c:\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe (Adobe Sytems Incorporated)
O4 - HKLM..\Run: [BrStsMon00] C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [ControlCenter4] C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe (Intel Corporation)
O4 - HKLM..\Run: [IMSS] C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe (Intel Corporation)
O4 - HKLM..\Run: [IndexSearch] C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDF5 Registry Controller] C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDFHook] C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PPort12reminder] C:\Program Files (x86)\Nuance\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [USB3MON] C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Intel Corporation)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1786823318-2106405980-1418230006-1000..\Run: [DMS-Kalenderchen] C:\Program Files (x86)\Kalenderchen\Kalenderchen.exe (Daniel Manger Software)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Mail\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mailkonto Info.lnk = C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe (Mozilla Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-1786823318-2106405980-1418230006-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: In vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1B260890-405C-4702-A07E-6C99AAA3302F}: DhcpNameServer = 192.168.9.1 192.168.9.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CDE92871-4AE4-42B5-9334-5885C63DD0CB}: NameServer = 192.168.168.180,8.8.8.8
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2014.10.17 13:43:49 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2016.02.21 16:14:51 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{4d4d623e-5527-11e4-b90a-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{4d4d623e-5527-11e4-b90a-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Run.exe
O33 - MountPoints2\{7354e118-5833-11e4-927d-902b349f0c86}\Shell - "" = AutoRun
O33 - MountPoints2\{7354e118-5833-11e4-927d-902b349f0c86}\Shell\AutoRun\command - "" = J:\start.exe
O33 - MountPoints2\{c1972bb2-1b51-11e7-9a3b-902b349f0c86}\Shell - "" = AutoRun
O33 - MountPoints2\{c1972bb2-1b51-11e7-9a3b-902b349f0c86}\Shell\AutoRun\command - "" = E:\HiSuiteDownLoader.exe
O33 - MountPoints2\{df0e3fd8-0490-11e7-98d0-902b349f0c86}\Shell - "" = AutoRun
O33 - MountPoints2\{df0e3fd8-0490-11e7-98d0-902b349f0c86}\Shell\AutoRun\command - "" = G:\iLinker.exe
O33 - MountPoints2\{fd188953-f27d-11e6-8fd6-902b349f0c86}\Shell - "" = AutoRun
O33 - MountPoints2\{fd188953-f27d-11e6-8fd6-902b349f0c86}\Shell\AutoRun\command - "" = G:\HiSuiteDownLoader.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2018.08.22 14:16:33 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Mail\Desktop\OTL.exe
[2018.08.22 13:51:45 | 000,000,000 | ---D | C] -- C:\FRST
[2018.08.22 13:49:59 | 000,000,000 | ---D | C] -- C:\ProgramData\s42s
[2018.08.22 13:47:24 | 000,000,000 | ---D | C] -- C:\ProgramData\sr4
[2018.08.22 13:47:23 | 000,000,000 | ---D | C] -- C:\ProgramData\s4ts
[2018.08.22 13:45:42 | 000,000,000 | ---D | C] -- C:\ProgramData\s444
[2018.08.22 13:45:42 | 000,000,000 | ---D | C] -- C:\ProgramData\s3gc
[2018.08.22 13:45:41 | 000,000,000 | ---D | C] -- C:\ProgramData\s2l4
[2018.08.22 12:49:26 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2018.08.22 12:16:12 | 000,000,000 | ---D | C] -- C:\ProgramData\s7p0
[2018.08.22 12:12:56 | 000,000,000 | ---D | C] -- C:\ProgramData\s4hs
[2018.08.22 12:12:55 | 000,000,000 | ---D | C] -- C:\ProgramData\s6qg
[2018.08.22 12:11:10 | 000,000,000 | ---D | C] -- C:\ProgramData\s5r8
[2018.08.22 12:11:10 | 000,000,000 | ---D | C] -- C:\ProgramData\s4so
[2018.08.22 12:11:10 | 000,000,000 | ---D | C] -- C:\ProgramData\s4nk
[2018.08.15 16:31:46 | 000,000,000 | ---D | C] -- C:\ProgramData\s4vs
[2018.08.15 16:28:07 | 000,000,000 | ---D | C] -- C:\ProgramData\s5f0
[2018.08.15 16:28:07 | 000,000,000 | ---D | C] -- C:\ProgramData\s58o
[2018.08.15 16:25:56 | 000,000,000 | ---D | C] -- C:\ProgramData\s374
[2018.08.15 16:25:55 | 000,000,000 | ---D | C] -- C:\ProgramData\s4m8
[2018.08.15 16:25:55 | 000,000,000 | ---D | C] -- C:\ProgramData\s3as
[2018.08.15 15:04:47 | 000,000,000 | ---D | C] -- C:\ProgramData\s48g
[2018.08.15 15:01:34 | 000,000,000 | ---D | C] -- C:\ProgramData\s5h8
[2018.08.15 15:01:33 | 000,000,000 | ---D | C] -- C:\ProgramData\s15k
[2018.08.15 14:59:52 | 000,000,000 | ---D | C] -- C:\ProgramData\s5dk
[2018.08.15 14:59:52 | 000,000,000 | ---D | C] -- C:\ProgramData\s510
[2018.08.15 14:59:51 | 000,000,000 | ---D | C] -- C:\ProgramData\s56g
[2018.08.14 12:56:43 | 000,000,000 | ---D | C] -- C:\ProgramData\s1os
[2018.08.14 12:56:42 | 000,000,000 | ---D | C] -- C:\ProgramData\s5ig
[2018.08.14 12:56:42 | 000,000,000 | ---D | C] -- C:\ProgramData\s3gs
[2018.08.13 16:55:35 | 000,000,000 | ---D | C] -- C:\ProgramData\s56k
[2018.08.13 16:36:46 | 000,000,000 | ---D | C] -- C:\ProgramData\s3h8
[2018.08.13 16:36:42 | 000,000,000 | ---D | C] -- C:\ProgramData\s5vo
[2018.08.13 16:36:41 | 000,000,000 | ---D | C] -- C:\ProgramData\s5fk
[2018.08.13 16:36:41 | 000,000,000 | ---D | C] -- C:\ProgramData\s2hk
[2018.08.13 16:11:06 | 000,000,000 | ---D | C] -- C:\ProgramData\s330
[2018.08.13 16:11:06 | 000,000,000 | ---D | C] -- C:\ProgramData\s21o
[2018.08.13 16:11:06 | 000,000,000 | ---D | C] -- C:\ProgramData\s1nc
[2018.08.10 14:34:57 | 000,000,000 | ---D | C] -- C:\ProgramData\s14c
[2018.08.10 14:31:13 | 000,000,000 | ---D | C] -- C:\ProgramData\s6pg
[2018.08.10 14:31:12 | 000,000,000 | ---D | C] -- C:\ProgramData\s594
[2018.08.10 14:29:06 | 000,000,000 | ---D | C] -- C:\ProgramData\s3nc
[2018.08.10 14:29:05 | 000,000,000 | ---D | C] -- C:\ProgramData\s1jo
[2018.08.10 14:29:05 | 000,000,000 | ---D | C] -- C:\ProgramData\s14g
[2018.08.09 13:30:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2018.08.03 07:28:22 | 000,000,000 | ---D | C] -- C:\Program Files\Google
 
========== Files - Modified Within 30 Days ==========
 
[2018.08.22 14:18:01 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Mail\Desktop\OTL.exe
[2018.08.22 13:50:01 | 003,561,351 | ---- | M] () -- C:\Users\Mail\Desktop\GSI6_MAIL-PC_Mail_08_22_2018_13_45_44.zip
[2018.08.22 13:39:22 | 000,030,784 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2018.08.22 13:39:22 | 000,030,784 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2018.08.22 13:35:13 | 001,619,284 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2018.08.22 13:35:13 | 000,699,092 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2018.08.22 13:35:13 | 000,653,930 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2018.08.22 13:35:13 | 000,149,232 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2018.08.22 13:35:13 | 000,121,802 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2018.08.22 13:30:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2018.08.22 13:30:42 | 1991,954,431 | -HS- | M] () -- C:\hiberfil.sys
[2018.08.22 12:31:16 | 000,026,114 | ---- | M] () -- C:\Users\Mail\Desktop\bfe22082018.reg
[2018.08.10 14:31:21 | 000,031,585 | ---- | M] () -- C:\Users\Mail\Desktop\Fehlermeldung 10082018.jpg
[2018.08.09 13:29:45 | 000,110,968 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2018.08.03 07:28:23 | 000,002,164 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth Pro.lnk
[2018.08.02 07:40:17 | 000,029,012 | ---- | M] () -- C:\Users\Mail\Desktop\Unbenannt.JPG
 
========== Files Created - No Company Name ==========
 
[2018.08.22 13:49:59 | 003,561,351 | ---- | C] () -- C:\Users\Mail\Desktop\GSI6_MAIL-PC_Mail_08_22_2018_13_45_44.zip
[2018.08.22 12:31:16 | 000,026,114 | ---- | C] () -- C:\Users\Mail\Desktop\bfe22082018.reg
[2018.08.21 14:27:24 | 000,004,344 | ---- | C] () -- C:\Users\Mail\Desktop\w7-bfe-service.reg
[2018.08.10 14:31:21 | 000,031,585 | ---- | C] () -- C:\Users\Mail\Desktop\Fehlermeldung 10082018.jpg
[2018.08.03 07:28:23 | 000,002,176 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth Pro.lnk
[2018.08.03 07:28:23 | 000,002,164 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth Pro.lnk
[2018.08.02 07:40:16 | 000,029,012 | ---- | C] () -- C:\Users\Mail\Desktop\Unbenannt.JPG
[2017.09.04 15:18:42 | 000,518,144 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2016.11.23 14:48:03 | 000,000,260 | ---- | C] () -- C:\Windows\SHISETUP.SYS
[2016.11.23 14:37:06 | 000,000,120 | ---- | C] () -- C:\Windows\SysWow64\winsusrx.dll
[2016.11.23 14:37:04 | 000,000,264 | ---- | C] () -- C:\Windows\SysWow64\winsusrm.dll
[2016.11.23 14:36:44 | 000,000,252 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2016.04.05 13:29:01 | 000,002,246 | -H-- | C] () -- C:\Users\Mail\Default.rdp
[2016.02.20 23:56:30 | 000,007,609 | ---- | C] () -- C:\Users\Mail\AppData\Local\Resmon.ResmonCfg
[2005.12.09 04:52:18 | 000,000,060 | R--- | C] () -- C:\Program Files (x86)\BRINST.INI
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2018.01.01 04:18:30 | 014,183,936 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2018.01.01 04:00:12 | 012,880,384 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2015.03.31 08:45:47 | 000,000,000 | ---D | M] -- C:\Users\Mail\AppData\Roaming\AMD
[2016.04.11 08:32:21 | 000,000,000 | ---D | M] -- C:\Users\Mail\AppData\Roaming\Autodesk
[2016.09.21 14:36:47 | 000,000,000 | ---D | M] -- C:\Users\Mail\AppData\Roaming\ControlCenter4
[2014.10.20 17:00:00 | 000,000,000 | ---D | M] -- C:\Users\Mail\AppData\Roaming\DAEMON Tools Lite
[2014.12.18 15:55:35 | 000,000,000 | ---D | M] -- C:\Users\Mail\AppData\Roaming\FileMaker
[2017.05.29 09:30:26 | 000,000,000 | ---D | M] -- C:\Users\Mail\AppData\Roaming\FileOpen
[2017.05.19 12:22:11 | 000,000,000 | ---D | M] -- C:\Users\Mail\AppData\Roaming\Hard Disk Sentinel
[2014.11.10 11:37:11 | 000,000,000 | ---D | M] -- C:\Users\Mail\AppData\Roaming\ImgBurn
[2015.01.29 14:28:45 | 000,000,000 | ---D | M] -- C:\Users\Mail\AppData\Roaming\Kalenderchen
[2016.03.10 16:16:31 | 000,000,000 | ---D | M] -- C:\Users\Mail\AppData\Roaming\KeePass
[2014.10.20 15:21:53 | 000,000,000 | ---D | M] -- C:\Users\Mail\AppData\Roaming\Nuance
[2016.05.27 11:01:46 | 000,000,000 | ---D | M] -- C:\Users\Mail\AppData\Roaming\Opera
[2014.10.16 14:03:45 | 000,000,000 | ---D | M] -- C:\Users\Mail\AppData\Roaming\Opera Software
[2015.07.21 14:40:09 | 000,000,000 | ---D | M] -- C:\Users\Mail\AppData\Roaming\PC-FAX TX
[2015.01.14 09:02:29 | 000,000,000 | ---D | M] -- C:\Users\Mail\AppData\Roaming\PDF Architect 2
[2016.06.24 08:29:45 | 000,000,000 | ---D | M] -- C:\Users\Mail\AppData\Roaming\SketchUp
[2017.09.18 15:16:37 | 000,000,000 | ---D | M] -- C:\Users\Mail\AppData\Roaming\TeamViewer
[2014.11.10 14:02:28 | 000,000,000 | ---D | M] -- C:\Users\Mail\AppData\Roaming\Thunderbird
[2016.06.24 08:46:45 | 000,000,000 | ---D | M] -- C:\Users\Mail\AppData\Roaming\Trimble Connect for SketchUp
[2014.10.27 14:50:19 | 000,000,000 | ---D | M] -- C:\Users\Mail\AppData\Roaming\Unity
[2016.05.25 07:58:55 | 000,000,000 | ---D | M] -- C:\Users\Mail\AppData\Roaming\Vodafone
[2014.10.20 15:21:56 | 000,000,000 | ---D | M] -- C:\Users\Mail\AppData\Roaming\Zeon
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 953 bytes -> C:\Users\Mail\Desktop\***********.eml:OECustomProperty
@Alternate Data Stream - 602 bytes -> C:\Users\Mail\Desktop\***********.eml:OECustomProperty
@Alternate Data Stream - 1431 bytes -> C:\Users\Mail\Desktop\***********.eml:OECustomProperty
@Alternate Data Stream - 1025 bytes -> C:\Users\Mail\Desktop\***********.eml:OECustomProperty

< End of report >