Trojaner-Board - xxx ist keine zulässige Win32 Anwendung

hier ein frisches FRST logfile:

Code:

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:11-10-2015 01

durchgeführt von admin (Administrator) auf PC (11-10-2015 17:38:19)

Gestartet von C:\Users\admin\Desktop

Geladene Profile: admin (Verfügbare Profile: admin)

Platform: Windows 7 Ultimate Service Pack 1 (X64) Sprache: Deutsch (Deutschland)

Internet Explorer Version 11 (Standard-Browser: FF)

Start-Modus: Normal

Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Prozesse (Nicht auf der Ausnahmeliste) =================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe

(Prolific Technology Inc.) C:\Windows\SysWOW64\IoctlSvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe

(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe

(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe

(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe

() C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe

(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe

(Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe

(Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe

(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe

(Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Nicht auf der Ausnahmeliste) ===========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
 

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1793736 2015-05-19] (NVIDIA Corporation)

HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1427648 2015-08-07] (COMODO)

HKLM-x32\...\Run: [vmware-tray.exe] => C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe [114368 2015-07-01] (VMware, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [597552 2015-08-04] (Oracle Corporation)

HKLM\...\RunOnce: [*EmptyTemp] => cmd /c rd /q/s C:\FRST\Temp

HKLM-x32\...\RunOnce: [{f255478c-ebfa-426d-a975-4a8d1f9432a4}] => C:\ProgramData\Package Cache\{f255478c-ebfa-426d-a975-4a8d1f9432a4}\vs_langpack.exe [1016624 2015-08-15] (Microsoft Corporation)

HKU\S-1-5-21-560193511-1957534509-1735208640-1001\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe [152872 2015-05-19] (Nero AG)

HKU\S-1-5-21-560193511-1957534509-1735208640-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8322328 2015-06-24] (Piriform Ltd)

HKU\S-1-5-21-560193511-1957534509-1735208640-1001\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [787592 2015-10-11] (Sandboxie Holdings, LLC)

HKU\S-1-5-21-560193511-1957534509-1735208640-1001\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [4468056 2015-09-13] (Disc Soft Ltd)

HKU\S-1-5-21-560193511-1957534509-1735208640-1001\...\MountPoints2: E - E:\vs_professional.exe

HKU\S-1-5-21-560193511-1957534509-1735208640-1001\...\MountPoints2: {e0cb1ec8-5a55-11e5-a0fc-005056c00008} - E:\setup.exe
 

==================== Internet (Nicht auf der Ausnahmeliste) ====================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
 

Winsock: Catalog5 08 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL Keine Datei 

Winsock: Catalog5 09 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL Keine Datei 

Winsock: Catalog9 12  Keine Datei 

Winsock: Catalog5-x64 08 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL Keine Datei 

Winsock: Catalog5-x64 09 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL Keine Datei 

Winsock: Catalog9-x64 12  Keine Datei 

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Tcpip\..\Interfaces\{92F26E54-F45F-436B-AB09-400A4B3518BA}: [DhcpNameServer] 192.168.1.1
 

Internet Explorer:

==================

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG

HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG

HKU\S-1-5-21-560193511-1957534509-1735208640-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com

HKU\S-1-5-21-560193511-1957534509-1735208640-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_60\bin\ssv.dll [2015-10-08] (Oracle Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_60\bin\jp2ssv.dll [2015-10-08] (Oracle Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\ssv.dll [2015-10-08] (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\jp2ssv.dll [2015-10-08] (Oracle Corporation)

StartMenuInternet: IEXPLORE.EXE - iexplore.exe
 

FireFox:

========

FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\tjc4nckf.default

FF Homepage: www.google.de

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_185.dll [2015-10-08] ()

FF Plugin: @java.com/DTPlugin,version=11.60.2 -> C:\Program Files\Java\jre1.8.0_60\bin\dtplugin\npDeployJava1.dll [2015-10-08] (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=11.60.2 -> C:\Program Files\Java\jre1.8.0_60\bin\plugin2\npjp2.dll [2015-10-08] (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_185.dll [2015-10-08] ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll [2015-07-23] (Adobe Systems, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=11.60.2 -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\dtplugin\npDeployJava1.dll [2015-10-08] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.60.2 -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\plugin2\npjp2.dll [2015-10-08] (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin-x32: @videolan.org/vlc,version=2.0.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2012-07-19] (VideoLAN)

FF Extension: Kein Name - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\tjc4nckf.default\Extensions\trash [2015-10-07]

StartMenuInternet: FIREFOX.EXE - firefox.exe
 

==================== Dienste (Nicht auf der Ausnahmeliste) ========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

"BFE" => Dienst konnte nicht entsperrt werden. <===== ACHTUNG
 

U2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [5542472 2015-09-08] (COMODO)

U2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

U3 c2wts; C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe [15768 2015-07-21] (Microsoft Corporation)

U3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2265792 2015-08-07] (COMODO)

U3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe [1268568 2015-09-13] (Disc Soft Ltd)

U3 fussvc; C:\Program Files (x86)\Windows Kits\8.1\App Certification Kit\fussvc.exe [142336 2015-07-21] (Microsoft Corporation) [Datei ist nicht signiert]

U4 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-09-15] (Malwarebytes Corporation)

U2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-09-15] (Malwarebytes Corporation)

U3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [275752 2015-05-19] (Nero AG)

U2 PLFlash DeviceIoControl Service; C:\Windows\SysWOW64\IoctlSvc.exe [81920 2015-05-19] (Prolific Technology Inc.) [Datei ist nicht signiert]

U2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [177800 2015-10-11] (Sandboxie Holdings, LLC)

U3 Te.Service; C:\Program Files (x86)\Windows Kits\8.1\Testing\Runtimes\TAEF\Wex.Services.exe [119808 2015-07-21] (Microsoft Corporation) [Datei ist nicht signiert]

U2 VMwareHostd; C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe [12732608 2015-07-01] ()

U3 VsEtwService120; C:\Program Files\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe [89232 2015-07-21] (Microsoft Corporation)
 

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

U1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [21184 2015-08-05] (COMODO)

U1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [806032 2015-08-05] (COMODO)

U1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [45856 2015-08-05] (COMODO)

U3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2015-09-13] (Disc Soft Ltd)

U3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)

U1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [105096 2015-08-05] (COMODO)

U3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [109272 2015-10-08] (Malwarebytes)

U3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-09-15] (Malwarebytes Corporation)

U3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-09-15] (Malwarebytes Corporation)

U3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()

U3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2015-07-29] (NVIDIA Corporation)

U3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [191624 2015-09-21] (Sandboxie Holdings, LLC)

U0 sptd; C:\Windows\System32\Drivers\sptd.sys [381608 2015-09-13] (Duplex Secure Ltd.)

U2 VMparport; C:\Windows\system32\drivers\VMparport.sys [31936 2015-05-31] (VMware, Inc.)

U0 vsock; C:\Windows\System32\drivers\vsock.sys [76480 2015-05-21] (VMware, Inc.)

U2 vstor2-mntapi20-shared; C:\Windows\SysWow64\drivers\vstor2-mntapi20-shared.sys [33872 2013-08-28] (VMware, Inc.)

S5 BFE;  <===== ACHTUNG: Gesperrter Dienst

U3 athr; system32\DRIVERS\athrx.sys [X]

U3 VGPU; System32\drivers\rdvgkmd.sys [X]
 

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
 

==================== Ein Monat: Erstellte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2015-10-11 17:37 - 2015-10-11 17:37 - 02195456 _____ (Farbar) C:\Users\admin\Desktop\FRST64.exe

2015-10-11 17:29 - 2015-10-11 17:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie

2015-10-08 20:52 - 2015-10-09 20:59 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2015-10-08 08:44 - 2015-10-08 08:44 - 00000000 ____D C:\Users\admin\AppData\LocalLow\Temp

2015-10-08 01:01 - 2015-10-08 01:02 - 00006183 _____ C:\Users\admin\Desktop\FSS.txt

2015-10-08 00:51 - 2015-10-08 00:51 - 00003160 _____ C:\Windows\System32\Tasks\SidebarExecute

2015-10-08 00:19 - 2015-10-08 00:19 - 00000000 _____ C:\Windows\SysWOW64\REN722.tmp

2015-10-07 18:19 - 2015-10-08 00:18 - 00000000 ____D C:\Program Files\Java

2015-10-07 18:19 - 2015-10-08 00:16 - 00110688 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll

2015-10-07 18:19 - 2015-10-07 18:19 - 00000000 ____D C:\ProgramData\Sun

2015-10-07 18:18 - 2015-10-08 00:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2015-10-07 18:10 - 2015-10-07 18:10 - 00000000 _____ C:\Windows\SysWOW64\REND2E8.tmp

2015-10-07 17:49 - 2015-10-07 17:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2015-10-07 17:48 - 2015-10-07 17:48 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2015-10-07 17:48 - 2015-10-07 17:48 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2015-10-07 17:47 - 2015-10-07 17:47 - 00000000 ____D C:\Windows\SysWOW64\Adobe

2015-10-07 17:46 - 2015-10-10 18:47 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-10-07 17:46 - 2015-10-08 19:47 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-10-07 17:40 - 2015-10-07 17:40 - 00961192 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00883712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00064352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00062304 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00022368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00020832 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00019808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00019808 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00016224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00016224 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00015712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00015712 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00013664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-eventing-provider-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-eventing-provider-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll

2015-10-07 17:40 - 2015-10-07 17:40 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll

2015-10-07 14:32 - 2015-10-07 14:42 - 00001079 _____ C:\Users\admin\Desktop\Age of Empires II HD.lnk

2015-10-07 14:32 - 2015-10-07 14:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Age of Empires II HD

2015-10-07 14:30 - 2015-10-11 17:36 - 00000000 ____D C:\Program Files (x86)\Age of Empires II HD

2015-10-07 14:25 - 2015-10-07 14:25 - 04033440 _____ (Intel Corporation) C:\Windows\SysWOW64\libmmd.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 03477818 _____ (Red Hat) C:\Windows\SysWOW64\cygwin1.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 01260544 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\SysWOW64\libeay32.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 01198049 _____ C:\Windows\unins001.exe

2015-10-07 14:25 - 2015-10-07 14:25 - 01070232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscomctl.ocx

2015-10-07 14:25 - 2015-10-07 14:25 - 01060864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 01055676 _____ (Free Software Foundation) C:\Windows\SysWOW64\libiconv2.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 01054208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71u.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 01024000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc70.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 01017344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc70u.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00935632 _____ (Microsoft Corporation) C:\Windows\system\vb40016.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00799568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdia100.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00722192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vb40032.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00660120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscomct2.ocx

2015-10-07 14:25 - 2015-10-07 14:25 - 00617896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.ocx

2015-10-07 14:25 - 2015-10-07 14:25 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00487424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp70.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00456008 _____ (AutoIt Team) C:\Windows\SysWOW64\autoitx3.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00445016 _____ (Creative Labs) C:\Windows\SysWOW64\wrap_oal.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00444328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshflxgd.ocx

2015-10-07 14:25 - 2015-10-07 14:25 - 00416408 _____ (Microsoft Corporation ) C:\Windows\SysWOW64\comct332.ocx

2015-10-07 14:25 - 2015-10-07 14:25 - 00398416 _____ (Microsoft Corporation) C:\Windows\system\vbrun300.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00356992 _____ (Microsoft Corporation) C:\Windows\system\vbrun200.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00344064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00339968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr70.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00295936 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\SysWOW64\ssleay32.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00295936 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\SysWOW64\libssl32.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00279192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdatgrd.ocx

2015-10-07 14:25 - 2015-10-07 14:25 - 00271264 _____ C:\Windows\system\vbrun100.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00259736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msflxgrd.ocx

2015-10-07 14:25 - 2015-10-07 14:25 - 00253080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdatlst.ocx

2015-10-07 14:25 - 2015-10-07 14:25 - 00222360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tabctl32.ocx

2015-10-07 14:25 - 2015-10-07 14:25 - 00219288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\richtx32.ocx

2015-10-07 14:25 - 2015-10-07 14:25 - 00218776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dblist32.ocx

2015-10-07 14:25 - 2015-10-07 14:25 - 00212112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mci32.ocx

2015-10-07 14:25 - 2015-10-07 14:25 - 00210944 _____ C:\Windows\system\msvcrt10.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00179352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmask32.ocx

2015-10-07 14:25 - 2015-10-07 14:25 - 00170920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comct232.ocx

2015-10-07 14:25 - 2015-10-07 14:25 - 00163480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comdlg32.ocx

2015-10-07 14:25 - 2015-10-07 14:25 - 00162304 _____ C:\Windows\SysWOW64\libpng13.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00138752 _____ C:\Windows\SysWOW64\libpng15.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00131728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msinet.ocx

2015-10-07 14:25 - 2015-10-07 14:25 - 00131072 _____ (Sereby Corporation) C:\Windows\SysWOW64\AiORuntimes.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00130712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msstdfmt.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00127640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswinsck.ocx

2015-10-07 14:25 - 2015-10-07 14:25 - 00119960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscomm32.ocx

2015-10-07 14:25 - 2015-10-07 14:25 - 00109144 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\Windows\SysWOW64\openal32.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00108696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msstkprp.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00107520 _____ C:\Windows\SysWOW64\zlib1.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00104088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\picclp32.ocx

2015-10-07 14:25 - 2015-10-07 14:25 - 00103424 _____ (GNU <www.gnu.org>) C:\Windows\SysWOW64\libintl3.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00090112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\atl71.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\atl70.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00084624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sysinfo.ocx

2015-10-07 14:25 - 2015-10-07 14:25 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71DEU.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71ITA.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71FRA.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71ESP.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc70ITA.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc70FRA.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc70ESP.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc70DEU.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71ENU.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc70ENU.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00054784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvci70.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00053248 _____ (Adobe Systems, Incorporated) C:\Windows\system\plugin.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00049152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71KOR.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00049152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71JPN.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00049152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc70KOR.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00049152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc70JPN.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00045056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71CHT.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00045056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc70CHT.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00040960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71CHS.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00040960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc70CHS.dll

2015-10-07 14:25 - 2015-10-07 14:25 - 00010806 _____ C:\Windows\unins001.dat

2015-10-07 14:22 - 2015-10-07 14:24 - 00002793 _____ C:\Windows\unins000.dat

2015-10-07 14:22 - 2015-10-07 14:22 - 01199175 _____ C:\Windows\unins000.exe

2015-10-07 14:10 - 2015-10-07 14:44 - 00055419 _____ C:\Windows\DirectX.log

2015-10-07 13:34 - 2015-10-07 13:35 - 00080794 _____ C:\Users\admin\Desktop\Addition.txt

2015-10-07 13:33 - 2015-10-11 17:38 - 00013700 _____ C:\Users\admin\Desktop\FRST.txt

2015-09-23 03:28 - 2015-09-23 03:28 - 00000000 ____D C:\Program Files (x86)\Workflow Manager Tools

2015-09-23 03:27 - 2015-09-23 03:27 - 00000000 ____D C:\Program Files (x86)\Microsoft Web Tools

2015-09-23 03:26 - 2015-09-23 03:26 - 00000000 ____D C:\ProgramData\NuGet

2015-09-23 03:26 - 2015-09-23 03:26 - 00000000 ____D C:\Program Files (x86)\NuGet

2015-09-19 19:56 - 2015-10-08 19:03 - 00000000 ____D C:\Users\admin\AppData\LocalLow\BitTorrent

2015-09-16 22:59 - 2015-09-16 22:59 - 00002105 _____ C:\Users\admin\Desktop\Gothic II spielen.lnk

2015-09-16 04:54 - 2015-09-16 04:54 - 00000000 ____D C:\Users\admin\AppData\Roaming\Zombi

2015-09-16 04:54 - 2015-09-16 04:54 - 00000000 ____D C:\Users\admin\AppData\Roaming\Zombi

2015-09-16 04:28 - 2015-09-16 04:30 - 00000000 ____D C:\Program Files (x86)\Zombies

2015-09-16 04:17 - 2015-09-16 04:17 - 00001140 _____ C:\Users\admin\Desktop\Zombi.lnk

2015-09-16 01:38 - 2015-09-16 01:38 - 00001294 _____ C:\Users\admin\Desktop\Continue installation .lnk

2015-09-14 20:50 - 2015-09-14 20:50 - 00000000 ___SD C:\ComboFix

2015-09-14 20:50 - 2015-09-14 20:50 - 00000000 ___SD C:\ComboFix

2015-09-14 20:48 - 2015-09-14 20:50 - 00000000 ____D C:\Qoobox

2015-09-14 20:48 - 2015-09-14 20:50 - 00000000 ____D C:\Qoobox

2015-09-14 20:48 - 2015-09-14 20:48 - 00000000 ____D C:\Windows\erdnt

2015-09-14 20:48 - 2015-09-14 20:48 - 00000000 ____D C:\Windows\erdnt

2015-09-13 23:53 - 2015-09-16 22:47 - 00000000 ____D C:\Users\admin\AppData\Local\8930

2015-09-13 23:53 - 2015-09-13 23:53 - 00000350 _____ C:\Windows\Tasks\AmiUpdXp.job

2015-09-13 23:35 - 2015-10-11 17:33 - 00002800 _____ C:\Windows\setupact.log

2015-09-13 23:35 - 2015-09-13 23:35 - 00000000 _____ C:\Windows\setuperr.log

2015-09-13 23:34 - 2015-10-09 20:59 - 00098112 _____ C:\Windows\PFRO.log

2015-09-13 23:12 - 2015-09-13 23:12 - 00000000 ____D C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft

2015-09-13 23:10 - 2015-09-13 23:10 - 00000000 ____D C:\Users\admin\AppData\Local\Disc_Soft_Ltd

2015-09-13 23:01 - 2015-09-13 23:01 - 00381608 _____ (Duplex Secure Ltd.) C:\Windows\system32\Drivers\sptd.sys

2015-09-13 23:00 - 2015-09-13 23:00 - 00000000 ____D C:\Users\Public\Documents\Daemon Tools Images

2015-09-13 23:00 - 2015-09-13 23:00 - 00000000 ____D C:\Users\Public\Documents\Daemon Tools Images

2015-09-13 23:00 - 2015-09-13 23:00 - 00000000 ____D C:\ProgramData\Documents\Daemon Tools Images

2015-09-13 22:54 - 2015-09-13 22:58 - 00000000 ____D C:\Users\admin\AppData\Roaming\DAEMON Tools Lite

2015-09-13 22:54 - 2015-09-13 22:56 - 00000000 ____D C:\Program Files\DAEMON Tools Lite

2015-09-13 22:54 - 2015-09-13 22:55 - 00030264 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtlitescsibus.sys

2015-09-13 22:54 - 2015-09-13 22:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite

2015-09-13 22:54 - 2015-09-13 22:54 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite

2015-09-13 22:48 - 2015-09-13 22:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IsoBuster

2015-09-13 22:48 - 2015-09-13 22:48 - 00000000 ____D C:\Program Files (x86)\IsoBuster
 

==================== Ein Monat: Geänderte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2015-10-11 17:37 - 2015-06-24 03:15 - 01872302 _____ C:\Windows\system32\Drivers\fvstore.dat

2015-10-11 17:33 - 2015-06-24 01:08 - 00000000 ____D C:\ProgramData\VMware

2015-10-11 17:33 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-10-11 17:32 - 2015-06-24 01:52 - 01474832 _____ C:\Windows\system32\Drivers\sfi.dat

2015-10-11 17:32 - 2009-07-14 06:45 - 00037264 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-10-11 17:32 - 2009-07-14 06:45 - 00037264 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-10-11 17:29 - 2015-06-25 04:16 - 00000000 ____D C:\Users\admin\Desktop\Sachen

2015-10-11 17:19 - 2015-06-25 02:04 - 00001710 _____ C:\Windows\Sandboxie.ini

2015-10-09 21:03 - 2015-05-19 18:24 - 00000000 ___SD C:\Windows\system32\GWX

2015-10-09 00:00 - 2015-05-19 18:24 - 00000000 ___SD C:\Windows\SysWOW64\GWX

2015-10-08 21:25 - 2015-09-03 22:20 - 00000000 ____D C:\Users\admin\AppData\Local\JDownloader 2.0

2015-10-08 20:52 - 2015-06-24 02:14 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-10-08 20:50 - 2015-06-24 02:14 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-10-08 19:47 - 2015-05-19 19:47 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-10-08 19:47 - 2015-05-19 19:47 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-10-08 19:03 - 2015-05-19 19:37 - 00000000 ____D C:\Users\admin\AppData\Roaming\BitTorrent

2015-10-08 08:27 - 2015-08-20 16:39 - 00000000 ____D C:\Users\admin\Downloads\DZ

2015-10-08 05:55 - 2015-05-23 18:32 - 00000000 ____D C:\Users\admin\AppData\Roaming\vlc

2015-10-08 03:57 - 2015-05-30 18:09 - 00000000 ____D C:\Program Files (x86)\Lee_

2015-10-08 02:35 - 2015-08-04 13:08 - 00000000 ____D C:\Tor Browser

2015-10-08 01:02 - 2011-04-12 09:43 - 00649288 _____ C:\Windows\system32\perfh007.dat

2015-10-08 01:02 - 2011-04-12 09:43 - 00132904 _____ C:\Windows\system32\perfc007.dat

2015-10-08 01:02 - 2009-07-14 07:13 - 01527502 _____ C:\Windows\system32\PerfStringBackup.INI

2015-10-08 00:59 - 2015-05-19 14:14 - 00059616 _____ C:\Users\admin\AppData\Local\GDIPFONTCACHEV1.DAT

2015-10-08 00:59 - 2015-05-19 14:14 - 00059616 _____ C:\Users\admin\AppData\Local\GDIPFONTCACHEV1.DAT

2015-10-08 00:58 - 2009-07-14 06:45 - 00270720 _____ C:\Windows\system32\FNTCACHE.DAT

2015-10-08 00:57 - 2015-05-19 13:21 - 00000000 ____D C:\Windows\CSC

2015-10-08 00:48 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD

2015-10-08 00:46 - 2009-07-14 04:34 - 00000439 _____ C:\Windows\win.ini

2015-10-08 00:22 - 2015-05-30 20:06 - 00000000 ____D C:\ProgramData\Oracle

2015-10-08 00:19 - 2015-05-30 21:01 - 00000000 ____D C:\Program Files (x86)\Java

2015-10-08 00:17 - 2015-05-30 21:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit

2015-10-07 23:30 - 2015-06-25 23:14 - 00000000 ____D C:\FRST

2015-10-07 18:09 - 2015-09-02 17:03 - 00000000 ____D C:\Users\admin\.oracle_jre_usage

2015-10-07 18:09 - 2015-09-02 17:03 - 00000000 ____D C:\Users\admin\.oracle_jre_usage

2015-10-07 17:47 - 2015-05-19 19:47 - 00000000 ____D C:\Windows\SysWOW64\Macromed

2015-10-07 17:44 - 2015-07-21 16:18 - 00000000 ____D C:\ProgramData\Package Cache

2015-10-07 17:44 - 2015-07-21 16:18 - 00000000 ____D C:\ProgramData\Package Cache

2015-10-07 17:43 - 2013-10-08 14:27 - 00044696 _____ (Microsoft Corporation) C:\Windows\system32\mfc100jpn.dll

2015-10-07 17:40 - 2015-06-25 23:34 - 00400544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vcamp140.dll

2015-10-07 16:58 - 2015-06-25 05:37 - 00000000 ____D C:\Program Files (x86)\VS Revo Group

2015-10-07 14:25 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system

2015-10-07 14:23 - 2015-05-20 22:38 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll

2015-10-07 14:22 - 2015-05-20 22:38 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll

2015-10-07 13:11 - 2015-05-19 13:27 - 01156621 _____ C:\Windows\WindowsUpdate.log

2015-09-28 08:59 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2015-09-23 03:29 - 2015-07-21 16:23 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 12.0

2015-09-23 03:28 - 2015-07-21 16:22 - 00000000 ____D C:\Program Files (x86)\Microsoft SDKs

2015-09-23 03:28 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\MSBuild

2015-09-23 03:27 - 2015-07-21 16:43 - 00000000 ____D C:\Program Files (x86)\Microsoft ASP.NET

2015-09-23 03:23 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared

2015-09-23 03:13 - 2015-05-19 18:50 - 01760532 _____ C:\Windows\SysWOW64\PerfStringBackup.INI

2015-09-23 02:51 - 2015-07-21 16:57 - 00000000 ____D C:\Users\admin\Documents\Visual Studio 2013

2015-09-21 20:15 - 2015-06-24 01:10 - 00000000 ____D C:\Users\admin\AppData\Roaming\VMware

2015-09-21 20:15 - 2015-06-24 01:10 - 00000000 ____D C:\Users\admin\AppData\Local\VMware

2015-09-21 19:12 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\FxsTmp

2015-09-18 18:16 - 2015-05-19 13:27 - 00000000 ____D C:\Users\admin

2015-09-16 22:58 - 2015-08-11 01:31 - 00002153 _____ C:\Users\admin\Desktop\Gothic II - Die Nacht des Raben.lnk

2015-09-16 00:23 - 2015-06-24 22:36 - 00000000 ____D C:\AdwCleaner

2015-09-16 00:11 - 2015-06-27 20:26 - 00001069 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MakeTorrent 2.lnk

2015-09-16 00:11 - 2015-05-19 21:32 - 00002699 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lumac.lnk

2015-09-16 00:11 - 2015-05-19 13:51 - 00001061 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2015-09-16 00:11 - 2012-03-14 13:15 - 00001345 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk

2015-09-16 00:11 - 2012-03-14 13:15 - 00001326 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk

2015-09-16 00:11 - 2009-07-14 07:01 - 00001218 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk

2015-09-16 00:11 - 2009-07-14 06:57 - 00001523 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

2015-09-16 00:11 - 2009-07-14 06:57 - 00001304 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk

2015-09-16 00:11 - 2009-07-14 06:57 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk

2015-09-16 00:11 - 2009-07-14 06:54 - 00001210 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk

2015-09-16 00:11 - 2009-07-14 06:49 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk

2015-09-16 00:10 - 2015-08-04 13:09 - 00000823 _____ C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Tor Browser.lnk

2015-09-16 00:10 - 2015-05-20 22:36 - 00001173 _____ C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Sims 4 by BuZeR.lnk

2015-09-16 00:10 - 2015-05-19 13:28 - 00001325 _____ C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-09-15 23:46 - 2015-06-24 02:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-09-15 23:46 - 2015-06-24 02:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-09-15 23:46 - 2015-06-24 02:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-09-15 23:46 - 2015-06-24 02:14 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-09-13 23:16 - 2015-09-02 11:05 - 00000000 ____D C:\Users\admin\AppData\Local\Ubisoft Game Launcher

2015-09-13 23:12 - 2015-09-02 11:05 - 00000000 ____D C:\Program Files (x86)\Ubisoft

2015-09-11 18:29 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache

2015-09-11 16:46 - 2011-04-12 09:54 - 00000000 ____D C:\Program Files\Windows Journal

2015-09-11 16:46 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
 

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
 

2015-05-20 22:51 - 2015-06-05 16:58 - 0000001 _____ () C:\Users\admin\AppData\Roaming\update.dat
 

Einige Dateien in TEMP:

====================

C:\Users\admin\AppData\Local\Temp\SandboxieInstall.exe

C:\Users\admin\AppData\Local\Temp\CmdLineExt02.dll

C:\Users\admin\AppData\Local\Temp\SIntf16.dll

C:\Users\admin\AppData\Local\Temp\SIntf32.dll
 
 

==================== Bamital & volsnap =================
 

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
 

C:\Windows\system32\winlogon.exe => Datei ist digital signiert

C:\Windows\system32\wininit.exe => Datei ist digital signiert

C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert

C:\Windows\explorer.exe => Datei ist digital signiert

C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert

C:\Windows\system32\svchost.exe => Datei ist digital signiert

C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert

C:\Windows\system32\services.exe => Datei ist digital signiert

C:\Windows\system32\User32.dll => Datei ist digital signiert

C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert

C:\Windows\system32\userinit.exe => Datei ist digital signiert

C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert

C:\Windows\system32\rpcss.dll => Datei ist digital signiert

C:\Windows\system32\dnsapi.dll => Datei ist digital signiert

C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert

C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
 
 

LastRegBack: 2015-10-02 10:20
 

==================== Ende von FRST.txt ============================

und hier ein frisches addition logfile:

Code:

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:11-10-2015 01

durchgeführt von admin (2015-10-11 17:39:33)

Gestartet von C:\Users\admin\Desktop

Windows 7 Ultimate Service Pack 1 (X64) (2015-05-19 11:27:50)

Start-Modus: Normal

==========================================================
 
 

==================== Konten: =============================
 

admin (S-1-5-21-560193511-1957534509-1735208640-1001 - Administrator - Enabled) => C:\Users\admin

Administrator (S-1-5-21-560193511-1957534509-1735208640-500 - Administrator - Disabled)

Gast (S-1-5-21-560193511-1957534509-1735208640-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-560193511-1957534509-1735208640-1002 - Limited - Enabled)
 

==================== Sicherheits-Center ========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
 
 

==================== Installierte Programme ======================
 

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
 

Adobe Flash Player 19 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 19.0.0.185 - Adobe Systems Incorporated)

Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.185 - Adobe Systems Incorporated)

Adobe Shockwave Player 12.1 (HKLM-x32\...\{B0B387B2-B1E4-43F2-961D-08ABFD759E1A}) (Version: 12.1.9.160 - Adobe Systems, Inc)

Age of Conan: Hyborian Adventures (HKLM-x32\...\Age of Conan_is1) (Version:  - Funcom)

Age of Empires II HD (HKLM-x32\...\Age of Empires II HD_is1) (Version: 1.0 - PLAZA)

Allgemeine Runtime Files (x86) (HKLM\...\{1F6D1DB5-82B5-41A4-85A2-0A382C142A35}_is1) (Version: 1.0.4.0 - Sereby Corporation)

ArcaniA - Fall of Setarrif (HKLM-x32\...\{BA1F2D65-B22F-47C7-A3D0-A7827DF20272}_is1) (Version:  - Nordic Games GmbH)

ArcaniA - Gothic 4 (HKLM-x32\...\{EE74D039-45D7-44E9-BF95-B9CFB015964F}_is1) (Version:  - Nordic Games GmbH)

AzureTools.Notifications (x32 Version: 2.1.10731.1602 - Microsoft Corporation) Hidden

Behaviors SDK (XAML) for Visual Studio (x32 Version: 12.0.41002.1 - Microsoft Corporation) Hidden

BitTorrent (HKU\S-1-5-21-560193511-1957534509-1735208640-1001\...\BitTorrent) (Version: 7.9.5.41074 - BitTorrent Inc.)

Blend for Visual Studio 2013 (x32 Version: 12.0.41002.1 - Microsoft Corporation) Hidden

Blend for Visual Studio 2013 DEU resources (x32 Version: 12.0.41002.1 - Microsoft Corporation) Hidden

Blend for Visual Studio 2013 ENU resources (x32 Version: 12.0.41002.1 - Microsoft Corporation) Hidden

Blend for Visual Studio SDK for .NET 4.5 (x32 Version: 3.0.40218.0 - Microsoft Corporation) Hidden

Blend for Visual Studio SDK for Silverlight 5 (x32 Version: 3.0.40218.0 - Microsoft Corporation) Hidden

Build Tools - amd64 (Version: 12.0.21005 - Microsoft Corporation) Hidden

Build Tools - x86 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden

Build Tools Language Resources - amd64 (Version: 12.0.21005 - Microsoft Corporation) Hidden

Build Tools Language Resources - x86 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden

CCleaner (HKLM\...\CCleaner) (Version: 5.06 - Piriform)

COMODO Internet Security Premium (HKLM\...\{73830292-868E-4C82-9AF5-CCFE2047B6A3}) (Version: 8.2.0.4508 - COMODO Security Solutions Inc.)

DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 10.1.0.0074 - Disc Soft Ltd)

Devenv-Ressourcen für Microsoft Visual Studio 2013 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden

DirectX 9.0c Extra Files (x86, x64) (HKLM\...\{8729E65B-8C12-4A42-B1FE-E4DA7ED52855}_is1) (Version: 1.10.06.0 - Sereby Corporation)

Dotfuscator and Analytics Community Edition (x32 Version: 5.5.4954.46574 - PreEmptive Solutions) Hidden

Dotfuscator and Analytics Community Edition Language Pack (x32 Version: 5.5.4954.46574 - PreEmptive Solutions) Hidden

Entity Framework Tools for Visual Studio 2013 (HKLM-x32\...\{08AEF86A-1956-4846-B906-B01350E96E30}) (Version: 12.0.20912.0 - Microsoft Corporation)

ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )

Gothic II - Die Nacht des Raben (HKLM-x32\...\Gothic II - Die Nacht des Raben) (Version:  - JoWooD Productions Software AG)

Gothic II (HKLM-x32\...\Gothic II) (Version:  - JoWooD Productions Software AG)

Icons from File 5.0.6 (HKLM-x32\...\Icons from File_is1) (Version: 5.0.6 - Vitaliy Levchenko)

IIS 8.0 Express (HKLM\...\{7BF61FA9-BDFB-4563-98AD-FCB0DA28CCC7}) (Version: 8.0.1557 - Microsoft Corporation)

IIS Express Application Compatibility Database for x64 (HKLM\...\{9f4f4a9b-eec5-4906-92fe-d1f43ccf5c8d}.sdb) (Version:  - )

IIS Express Application Compatibility Database for x86 (HKLM\...\{fdfba1f3-74ae-4255-9c10-a0f552b4610f}.sdb) (Version:  - )

IsoBuster 3.6 (HKLM-x32\...\IsoBuster_is1) (Version: 3.6 - Smart Projects)

Java 8 Update 60 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418060F0}) (Version: 8.0.600.27 - Oracle Corporation)

Java 8 Update 60 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218060F0}) (Version: 8.0.600.27 - Oracle Corporation)

Java SE Development Kit 8 Update 45 (HKLM-x32\...\{32A3A4F4-B792-11D6-A78A-00B0D0180450}) (Version: 8.0.450.15 - Oracle Corporation)

JavaScript Tooling (Version: 12.0.21005 - Microsoft Corporation) Hidden

JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)

LocalESPC Dev12 (x32 Version: 8.100.25984 - Microsoft Corporation) Hidden

LocalESPCui for de-de Dev12 (x32 Version: 8.100.25984 - Microsoft) Hidden

LocalESPCui for en-us Dev12 (x32 Version: 8.100.25984 - Microsoft) Hidden

Lumac (HKLM-x32\...\InstallShield_{5DE11949-2B11-4F13-BAD5-1C237122CFDB}) (Version: 1.1.92.0 - Firstload)

Lumac (x32 Version: 1.1.92.0 - Firstload) Hidden

MakeTorrent v2.1 (HKLM-x32\...\MakeTorrent 2) (Version:  - )

Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5 Multi-Targeting Pack (HKLM-x32\...\{56E962F0-4FB0-3C67-88DB-9EAA6EEFC493}) (Version: 4.5.50710 - Microsoft Corporation)

Microsoft .NET Framework 4.5 SDK - DEU Lang Pack (HKLM-x32\...\{21B0F482-5EF9-45DA-8840-340AFE705A6C}) (Version: 4.5.50710 - Microsoft Corporation)

Microsoft .NET Framework 4.5 SDK (HKLM-x32\...\{4AE57014-05C4-4864-A13D-86517A7E1BA4}) (Version: 4.5.50710 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (ENU) (HKLM-x32\...\{D3517C62-68A5-37CF-92F7-93C029A89681}) (Version: 4.5.50932 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (HKLM-x32\...\{6A0C6700-EA93-372C-8871-DCCF13D160A4}) (Version: 4.5.50932 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 SDK (Deutsch) (HKLM-x32\...\{CBD7095F-7211-43FD-9FE7-FB08D753AF79}) (Version: 4.5.51641 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 SDK (HKLM-x32\...\{19A5926D-66E1-46FC-854D-163AA10A52D3}) (Version: 4.5.51641 - Microsoft Corporation)

Microsoft .NET Framework 4.6 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.6.00081 - Microsoft Corporation)

Microsoft .NET Framework 4.6 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.00081 - Microsoft Corporation)

Microsoft Help Viewer 2.1 (HKLM-x32\...\Microsoft Help Viewer 2.1) (Version: 2.1.21005 - Microsoft Corporation)

Microsoft Help Viewer 2.1 Sprachpaket - DEU (HKLM-x32\...\Microsoft Help Viewer 2.1 Sprachpaket - DEU) (Version: 2.1.21005 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)

Microsoft Silverlight 5 SDK (HKLM-x32\...\{E1FBB3D4-ADB0-4949-B101-855DA061C735}) (Version: 5.0.61118.0 - Microsoft Corporation)

Microsoft SQL Server 2012 Command Line Utilities  (HKLM\...\{58FED865-4F13-408D-A5BF-996019C4B936}) (Version: 11.1.3000.0 - Microsoft Corporation)

Microsoft SQL Server 2012 Data-Tier App Framework  (HKLM-x32\...\{1B876496-B3A2-4D22-9B12-B608A3FD4B8B}) (Version: 11.1.2902.0 - Microsoft Corporation)

Microsoft SQL Server 2012 Data-Tier App Framework  (x64) (HKLM\...\{A6BA243E-85A3-4635-A269-32949C98AC7F}) (Version: 11.1.2902.0 - Microsoft Corporation)

Microsoft SQL Server 2012 Express LocalDB  (HKLM\...\{6C026A91-640F-4A23-8B68-05D589CC6F18}) (Version: 11.1.3000.0 - Microsoft Corporation)

Microsoft SQL Server 2012 Management Objects  (HKLM-x32\...\{2F7DBBE6-8EBC-495C-9041-46A772F4E311}) (Version: 11.1.3000.0 - Microsoft Corporation)

Microsoft SQL Server 2012 Management Objects  (x64) (HKLM\...\{43A5C316-9521-49C3-B9B6-FCE5E1005DF0}) (Version: 11.1.3000.0 - Microsoft Corporation)

Microsoft SQL Server 2012 Native Client  (HKLM\...\{D411E9C9-CE62-4DBF-9D92-4CB22B750ED5}) (Version: 11.1.3000.0 - Microsoft Corporation)

Microsoft SQL Server 2012 Transact-SQL ScriptDom  (HKLM\...\{54C5041B-0E91-4E92-8417-AAA12493C790}) (Version: 11.1.3000.0 - Microsoft Corporation)

Microsoft SQL Server 2012 T-SQL Language Service  (HKLM-x32\...\{04DD7AF4-A6D3-4E30-9BB9-3B3670719234}) (Version: 11.1.3000.0 - Microsoft Corporation)

Microsoft SQL Server 2014 Express LocalDB  (HKLM\...\{AB8DE9BA-19E1-446A-BCFA-6B3DA9751E21}) (Version: 12.0.2000.8 - Microsoft Corporation)

Microsoft SQL Server 2014 Management Objects  (HKLM-x32\...\{2774595F-BC2A-4B12-A25B-0C37A37049B0}) (Version: 12.0.2000.8 - Microsoft Corporation)

Microsoft SQL Server 2014 Management Objects  (x64) (HKLM\...\{1F9EB3B6-AED7-4AA7-B8F1-8E314B74B2A5}) (Version: 12.0.2000.8 - Microsoft Corporation)

Microsoft SQL Server 2014 Transact-SQL ScriptDom  (HKLM\...\{020CDFE0-C127-4047-B571-37C82396B662}) (Version: 12.0.2000.8 - Microsoft Corporation)

Microsoft SQL Server 2014 T-SQL Language Service  (HKLM-x32\...\{47D08E7A-92A1-489B-B0BF-415516497BCE}) (Version: 12.0.2000.8 - Microsoft Corporation)

Microsoft SQL Server Compact 4.0 SP1 x64 DEU  (HKLM\...\{98225B15-ECF5-4645-B5AC-F8C5E869A5D5}) (Version: 4.0.8876.1 - Microsoft Corporation)

Microsoft SQL Server Compact 4.0 SP1 x64 ENU (HKLM\...\{78909610-D229-459C-A936-25D92283D3FD}) (Version: 4.0.8876.1 - Microsoft Corporation)

Microsoft SQL Server Data Tools - enu (12.0.41012.0) (HKLM-x32\...\{AC8E0CF4-42A1-4151-B684-97CF6FD726CF}) (Version: 12.0.41012.0 - Microsoft Corporation)

Microsoft SQL Server Data Tools Build Utilities - DEU (12.0.30919.1) (HKLM-x32\...\{BCB8A870-2B3D-4CC0-87D6-F931E065AC0C}) (Version: 12.0.30919.1 - Microsoft Corporation)

Microsoft SQL Server Data Tools Build Utilities - enu (12.0.30919.1) (HKLM-x32\...\{6781FF9B-E87D-4A03-9373-A55A288B83FA}) (Version: 12.0.30919.1 - Microsoft Corporation)

Microsoft SQL Server System CLR Types (HKLM-x32\...\{A47FD1BF-A815-4A76-BE65-53A15BD5D25D}) (Version: 10.50.1600.1 - Microsoft Corporation)

Microsoft SQL Server System CLR Types (x64) (HKLM\...\{4701DEDE-1888-49E0-BAE5-857875924CA2}) (Version: 10.50.1600.1 - Microsoft Corporation)

Microsoft System CLR Types for SQL Server 2012 (HKLM-x32\...\{070C38AC-05CE-43DF-9A20-141332F6AB2B}) (Version: 11.1.3366.16 - Microsoft Corporation)

Microsoft System CLR Types for SQL Server 2012 (x64) (HKLM\...\{05FF8209-C4F1-4C77-BC28-791653156D20}) (Version: 11.1.3366.16 - Microsoft Corporation)

Microsoft System CLR Types for SQL Server 2014 (HKLM\...\{8C06D6DB-A391-4686-B050-99CC522A7843}) (Version: 12.0.2000.8 - Microsoft Corporation)

Microsoft System CLR Types for SQL Server 2014 (HKLM-x32\...\{4AEB505C-95E1-4964-9B64-8D27F3186D30}) (Version: 12.0.2000.8 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61187 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61186 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.7523 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.7523 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.7523 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.7523 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 Redistributable - x86 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}) (Version: 11.0.61030.0 - Корпорация Майкрософт)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{e6e75766-da0f-4ba2-9788-6ea593ce702d}) (Version: 12.0.30501.0 - Microsoft Corporation)

Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026 (HKLM-x32\...\{e46eca4f-393b-40df-9f49-076faf788d83}) (Version: 14.0.23026.0 - Microsoft Corporation)

Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026 (HKLM-x32\...\{74d0e5db-b326-4dae-a6b2-445b9de1836e}) (Version: 14.0.23026.0 - Microsoft Corporation)

Microsoft Visual J# 2.0 Redistributable Package - SE (x64) (HKLM\...\Microsoft Visual J# 2.0 Redistributable Package - SE (x64)) (Version:  - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)

Microsoft Visual Studio Professional 2013 (HKLM-x32\...\{6dff50d0-3bc3-4a92-b724-bf6d6a99de4f}) (Version: 12.0.21005.13 - Microsoft Corporation)

Microsoft Web Deploy 3.5 (HKLM\...\{69A998C5-00A9-42CA-AB4E-C31CFFCD9251}) (Version: 3.1237.1763 - Microsoft Corporation)

Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)

Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 38.0.1 - Mozilla)

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

Nero 7 Ultra Edition (HKLM-x32\...\{C6115A28-F277-4E82-B067-84D28BF21031}) (Version: 7.03.1357 - Nero AG)

No-IP DUC (HKLM-x32\...\NoIPDUC) (Version: 4.1.0 - Vitalwerks Internet Solutions LLC)

NVIDIA 3D Vision Controller-Treiber 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation)

NVIDIA Grafiktreiber 341.74 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 341.74 - NVIDIA Corporation)

NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)

NVIDIA Update 10.4.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 10.4.0 - NVIDIA Corporation)

Open XML SDK 2.5 for Microsoft Office (x32 Version: 2.5.5631 - Microsoft Corporation) Hidden

Paket zur Festlegung von Zielversionen für Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM-x32\...\{D5409B11-EF28-37A1-AE7A-6051A5BAD923}) (Version: 4.5.50932 - Microsoft Corporation)

Paket zur Festlegung von Zielversionen für Microsoft .NET Framework 4.5.1 RC für Windows Store-Apps (Deutsch) (x32 Version: 4.5.21005 - Microsoft Corporation) Hidden

Postal III (HKLM-x32\...\Postal III_is1) (Version:  - )

PreEmptive Analytics Client German Language Pack (x32 Version: 1.2.3197.1 - PreEmptive Solutions) Hidden

PreEmptive Analytics Visual Studio Components (x32 Version: 1.2.3197.1 - PreEmptive Solutions) Hidden

Prerequisites for SSDT  (HKLM-x32\...\{21373064-AD95-48DB-A32E-0D9E08EF7355}) (Version: 12.0.2000.8 - Microsoft Corporation)

Prerequisites for SSDT  (HKLM-x32\...\{35C1D9D6-87C0-46A3-B1B4-EDBCC063221C}) (Version: 11.1.3000.0 - Microsoft Corporation)

Python Tools Redirection Template (x32 Version: 1.1 - Microsoft Corporation) Hidden

Rayman 3 Hoodlum Havoc Version 1.0 (HKLM-x32\...\Rayman 3 Hoodlum Havoc_is1) (Version: 1.0 - Ubisoft)

Rayman Legends, âåðñèÿ 1.0.0.0 (HKLM-x32\...\Rayman Legends_is1) (Version: 1.0.0.0 - )

Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

Sandboxie 5.04 (64-bit) (HKLM\...\Sandboxie) (Version: 5.04 - Sandboxie Holdings, LLC)

SharePoint Client Components (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden

SharePoint Client Components (Version: 16.0.2617.1200 - Microsoft Corporation) Hidden

Sims 4 by BuZeR version 1.5.139.1020 (HKLM-x32\...\{ED118F10-E516-4245-160F-6F13F508F71F}_is1) (Version: 1.5.139.1020 - )

Software Version Updater (HKLM-x32\...\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96}) (Version:  - ) <==== ACHTUNG

Team Explorer for Microsoft Visual Studio 2013 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden

Update for  (KB2504637) (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}.KB2504637) (Version: 1 - Microsoft Corporation)

Uplay (HKLM-x32\...\Uplay) (Version: 7.5 - Ubisoft)

Usenet.nl (HKLM-x32\...\Usenet.nl_is1) (Version:  - )

VirtualDJ 8 (HKLM-x32\...\{90AE6F39-3EE1-45A1-90D5-FB6C82391EDF}) (Version: 8.0.2338.0 - Atomix Productions)

VLC media player 2.0.3 (HKLM-x32\...\VLC media player) (Version: 2.0.3 - VideoLAN)

VMware Workstation (HKLM-x32\...\VMware_Workstation) (Version: 11.1.2 - VMware, Inc)

VMware Workstation (Version: 11.1.2 - VMware, Inc.) Hidden

WCF Data Services 5.6.0 Runtime (x32 Version: 5.6.61587.0 - Microsoft Corporation) Hidden

WCF Data Services Tools for Microsoft Visual Studio 2013 (x32 Version: 5.6.61587.0 - Microsoft Corporation) Hidden

WCF RIA Services V1.0 SP2 (HKLM-x32\...\{5D8DD6A8-C4D7-4554-93F9-F1CC28C72600}) (Version: 4.1.62812.0 - Microsoft Corporation)

WinRAR 5.21 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH)

Workflow Manager Client 1.0 (Version: 2.0.30813.2 - Microsoft Corporation) Hidden

Workflow Manager Tools 1.0 for Visual Studio (Version: 2.0.30725.1 - Microsoft Corporation) Hidden

Zombi (HKLM-x32\...\Zombi_R.G. Mechanics_is1) (Version:  - R.G. Mechanics, markfiter)
 

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
 

==================== Wiederherstellungspunkte =========================
 

Wiederherstellungspunkte konnten nicht aufgelistet werden

Überprüfen Sie den "winmgmt" Dienst oder reparieren Sie den WMI.
 
 

==================== Hosts Inhalt: ===============================
 

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
 

2009-07-14 04:34 - 2015-10-08 00:48 - 00000855 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

Task: {08609CA5-AA36-4788-AEEC-A11898B235BD} - kein Pfad

Task: {1A4BC754-33BC-494B-8F77-3E7B4736BAA6} - kein Pfad

Task: {1C09C8A0-E499-406C-80E0-520E00F1936F} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-08-07] (COMODO)

Task: {2211FB0C-FECE-4278-B168-A8FE88EAF404} - kein Pfad

Task: {34249658-9DD4-487A-AE7F-6BA53E1348AC} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2015-05-19] (Microsoft Corporation)

Task: {37C10430-6650-4F41-9D17-C7F56091B351} - kein Pfad

Task: {3E862320-224B-422A-B2F9-4C37BF9883A7} - kein Pfad

Task: {414984BB-CD47-4E0A-BA5D-125D827AF850} - kein Pfad

Task: {46D0B116-4B77-4400-9D5C-75589895F7EC} - kein Pfad

Task: {4EF299B5-522B-440A-82A3-51964A6A2FFE} - System32\Tasks\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-08-07] (COMODO)

Task: {51000FED-3EB2-4A64-8AC9-C09A72C2F330} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-06-24] (Piriform Ltd)

Task: {5CDDDA7A-A8EB-4816-9632-B1D1A01AD666} - kein Pfad

Task: {6A53FD57-EE34-450A-8B31-DC4E916A4A64} - kein Pfad

Task: {708CB597-66A2-475F-A59A-7CBD04D849BC} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-08-07] (COMODO)

Task: {807F0029-3273-4FBC-81FC-55037A44C58C} - System32\Tasks\{23620CA1-CC87-49ED-BB6E-44277012C1B0} => pcalua.exe -a "C:\ProgramData\VMware\VMware Player\Uninstaller\\uninstall.exe" -c -x -S "C:\ProgramData\VMware\VMware Player\Uninstaller\"

Task: {9B52632A-A969-40A6-B830-FDE6D3C8C80E} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2015-05-19] (Microsoft Corporation)

Task: {9CB522C8-0F13-470C-A6F5-D88ADBB3897D} - kein Pfad

Task: {A460D382-66EA-4D05-B2EE-4A3C575F6EEB} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2015-05-19] (Microsoft)

Task: {AB2144B0-DE80-4E51-8A55-288D7860BD0F} - System32\Tasks\COMODO\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-08-07] (COMODO)

Task: {AEFB686A-57A1-47B5-B70A-8659B852F45B} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2015-08-07] (COMODO)

Task: {B0DD3DB1-00DF-4CDE-9ABF-8AD09FF19531} - kein Pfad

Task: {C13F68C8-8678-4B06-AC4B-91DC0500947C} - kein Pfad

Task: {DE9E383F-27C4-49C3-8DF3-E326443204F7} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2015-05-19] (Microsoft Corporation)

Task: {E64C6729-054E-41F0-B244-E9C5B277279E} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2015-05-19] (Microsoft Corporation)

Task: {E83B68C2-0A80-4CAA-B87B-597256520679} - kein Pfad

Task: {EC4E71F3-3224-4259-A444-36BB2B3F75DB} - kein Pfad

Task: {127C27E8-993E-4AC2-BFBA-75C4057CCAFE} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-21] (Microsoft Corporation)

Task: {1D290CE2-8968-490C-ACA9-5CC52D603838} - System32\Tasks\{2D8ECF9C-61FD-4ACC-8CF2-FAA2A8027CDD} => C:\Users\admin\Desktop\Bifrost.exe

Task: {79CC19AA-C0E1-4CFA-BF19-4C4592D5F616} - System32\Tasks\{84428AE9-0A90-41D9-A9EA-B64252541EAC} => C:\Users\admin\Desktop\Neuer Ordner\Bifrost Stub Customizer v2.0.exe

Task: {A0A50D1C-ACCC-44F9-A66F-023F2D313B22} - System32\Tasks\{EDED2321-2278-4C8B-AF8E-023C0A6238E9} => pcalua.exe -a C:\Users\admin\Desktop\dd2\INSTALL.EXE -d C:\Users\admin\Desktop\dd2

Task: {B454D397-B4BE-49A9-8CF4-BACC8DB37F25} - System32\Tasks\{7971804C-8CAA-4D0F-BCBD-664B3155E6E8} => C:\Users\admin\Desktop\Neuer Ordner\Bifrost Stub Customizer v2.0.exe

Task: {D30267F1-1475-4B1E-8E1B-66AB4100F7CB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-10-08] (Adobe Systems Incorporated)
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
 

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\AmiUpdXp.job =>  <==== ACHTUNG
 

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
 

2015-05-19 15:30 - 2015-08-18 02:07 - 00115376 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2015-05-31 07:36 - 2015-07-01 20:50 - 12732608 _____ () C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe

2015-01-08 23:02 - 2015-01-08 23:02 - 00067808 _____ () C:\Program Files\COMODO\COMODO Internet Security\scanners\smart.cav

2015-05-08 20:50 - 2015-05-08 20:50 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll

2015-05-31 07:59 - 2015-05-31 07:59 - 01301696 _____ () C:\Program Files (x86)\VMware\VMware Workstation\libxml2.dll

2015-05-31 07:36 - 2015-05-31 07:36 - 00191680 _____ () C:\Program Files (x86)\VMware\VMware Workstation\LIBEXPAT.dll

2015-05-31 07:36 - 2015-05-31 07:36 - 00388288 _____ () C:\Program Files (x86)\VMware\VMware Workstation\ssoClient.dll

2015-05-31 07:36 - 2015-05-31 07:36 - 00194752 _____ () C:\Program Files (x86)\VMware\VMware Workstation\nfc-types.dll
 

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
 

AlternateDataStreams: C:\autoexec.bat:$CmdTcID

AlternateDataStreams: C:\vstdlib_s.dll:$CmdZnID

AlternateDataStreams: C:\Windows\notepad.exe:$CmdTcID

AlternateDataStreams: C:\Windows\splwow64.exe:$CmdTcID

AlternateDataStreams: C:\Windows\unins000.exe:$CmdTcID

AlternateDataStreams: C:\Windows\unins001.exe:$CmdTcID

AlternateDataStreams: C:\Windows\UNNeroBackItUp.exe:$CmdTcID

AlternateDataStreams: C:\Windows\UNNeroMediaHome.exe:$CmdTcID

AlternateDataStreams: C:\Windows\UNNeroShowTime.exe:$CmdTcID

AlternateDataStreams: C:\Windows\UNNeroVision.exe:$CmdTcID

AlternateDataStreams: C:\Windows\UNRecode.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system\msvcrt10.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system\plugin.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system\vb40016.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system\vbrun100.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system\vbrun200.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system\vbrun300.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\acmigration.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\adtschema.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\advapi32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\aeinv.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\aelupsvc.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\aepdu.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\aepic.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-eventing-provider-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\apisetschema.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\apphelp.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\appidapi.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\appidcertstorecheck.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\appidpolicyconverter.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\appidsvc.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\appinfo.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\appraiser.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\appverif.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\atmfd.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\atmlib.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\auditpol.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\authui.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\basesrv.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\browcli.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\browser.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\cdd.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\cdosys.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\certenc.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\certutil.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\cewmdm.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\charmap.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\clfs.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\clfsw32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\coin95itp.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\comctl32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\CompatTelRunner.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\conhost.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\consent.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\credssp.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\crypt32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\cryptbase.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\cryptdlg.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\cryptnet.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\cryptsvc.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\cscript.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\csrsrv.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d2d1.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3d10warp.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\D3DCompiler_33.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\D3DCompiler_34.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\D3DCompiler_35.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\D3DCompiler_36.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\D3DCompiler_37.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\D3DCompiler_38.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\D3DCompiler_39.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\D3DCompiler_40.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\D3DCompiler_41.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\D3DCompiler_42.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\D3DCompiler_43.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dcsx_42.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dcsx_43.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx10.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx10_33.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx10_34.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx10_35.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx10_36.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx10_37.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx10_38.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx10_39.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx10_40.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx10_41.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx10_42.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx10_43.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx11_42.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx11_43.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx9_24.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx9_25.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx9_26.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx9_27.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx9_28.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx9_29.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx9_30.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx9_31.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx9_32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx9_33.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx9_34.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx9_35.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\d3dx9_36.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\D3DX9_37.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\D3DX9_38.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\D3DX9_39.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\D3DX9_40.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\D3DX9_41.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\D3DX9_42.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\D3DX9_43.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\davclnt.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\dciman32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\devinv.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\diagtrack.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\diskperf.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\dpnet.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\dwmapi.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\dwmcore.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\DWrite.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\dxcap.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\dxcpl.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\dxmasf.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\dxtmsft.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\dxtrans.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\FntCache.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\fontsub.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\FWPUCLNT.DLL:$CmdTcID

AlternateDataStreams: C:\Windows\system32\gdi32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\generaltel.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\ie4uinit.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\ieapfltr.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\iedkcs32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\ieetwcollector.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\ieetwcollectorres.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\ieetwproxystub.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\ieframe.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\iernonce.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\iertutil.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\iesetup.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\IEUDINIT.EXE:$CmdTcID

AlternateDataStreams: C:\Windows\system32\ieui.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\ieUnatt.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\IKEEXT.DLL:$CmdTcID

AlternateDataStreams: C:\Windows\system32\IMJP10K.DLL:$CmdTcID

AlternateDataStreams: C:\Windows\system32\inetcpl.cpl:$CmdTcID

AlternateDataStreams: C:\Windows\system32\InkEd.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\invagent.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\iologmsg.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\JavaScriptCollectionAgent.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\jnwmon.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\jscript.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\jscript9.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\jscript9diag.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\jsproxy.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\KBDBASH.DLL:$CmdTcID

AlternateDataStreams: C:\Windows\system32\KBDRU.DLL:$CmdTcID

AlternateDataStreams: C:\Windows\system32\KBDRU1.DLL:$CmdTcID

AlternateDataStreams: C:\Windows\system32\KBDTAT.DLL:$CmdTcID

AlternateDataStreams: C:\Windows\system32\KBDYAK.DLL:$CmdTcID

AlternateDataStreams: C:\Windows\system32\kerberos.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\kernel32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\KernelBase.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\localspl.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\logman.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\lpk.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\lsasrv.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\lsass.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\mcupdate_GenuineIntel.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\mfc100jpn.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\microsoft.windows.softwarelogo.showdesktop.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\msaudite.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\msctf.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\msdxm.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\system32\msfeeds.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\mshtml.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\MshtmlDac.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\mshtmled.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\mshtmlmedia.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\msi.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\msiexec.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\msihnd.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\msimsg.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\msmmsp.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\msmpeg2vdec.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\msobjs.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\msrating.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\MsRdpWebAccess.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\MsSpellCheckingFacility.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\mstsc.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\mstscax.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\msv1_0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\msxml3.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\msxml3r.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\msxml6.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\msxml6r.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\ncrypt.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\netapi32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\notepad.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\nshwfp.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\ntdll.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\ntoskrnl.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\ntvdm64.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\nvapi64.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\nvaudcap64v.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\nvcompiler.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\nvcuda.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\nvcuvid.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\nvd3dumx.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\nvdispco6434144.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\nvdispco6434174.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\nvdispco6434181.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\nvdispgenco6434144.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\nvdispgenco6434174.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\nvdispgenco6434181.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\NvFBC64.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\NvIFR64.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\nvoglv64.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\nvopencl.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\nvvsvc.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\nvwgf2umx.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\ole32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\oleaut32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\OpenCL.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\OxpsConverter.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\packager.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\pku2u.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\poqexec.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\rastls.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\rdpcorekmts.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\rdpcorets.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\rdpendp_winip.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\RdpGroupPolicyExtension.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\rdpudd.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\rdpwsx.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\rdrmemptylst.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\rdvidcrl.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\relog.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\rpcrt4.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\rstrui.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\scavengeui.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\scesrv.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\schannel.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\schedsvc.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\scrrun.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\sdbinst.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\sechost.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\secur32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\setbcdlocale.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\shdocvw.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\shell32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\shimeng.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\smss.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\spoolsv.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\spwmp.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\srclient.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\srcore.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\sspicli.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\sspisrv.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\synceng.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\sysmain.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\taskhost.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\tdh.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\tier0_s.dll:$CmdZnID

AlternateDataStreams: C:\Windows\system32\tracerpt.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\tsgqec.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\TSpkg.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\TsUsbGDCoInstaller.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\TSWbPrxy.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\typeperf.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\tzres.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\ucrtbase.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\uplay_r1_loader.dll:$CmdZnID

AlternateDataStreams: C:\Windows\system32\urlmon.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\UtcResources.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\vbscript.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\vmnetbridge.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\vnetinst.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\vsgraphicsremoteengine.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\vsjitdebugger.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\vstdlib_s.dll:$CmdZnID

AlternateDataStreams: C:\Windows\system32\wdigest.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\WebClnt.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\win32k.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\win32spl.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\WindowsCodecs.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\wininet.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\winload.efi:$CmdTcID

AlternateDataStreams: C:\Windows\system32\winlogon.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\winresume.efi:$CmdTcID

AlternateDataStreams: C:\Windows\system32\WinSetupUI.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\winsrv.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\winsta.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\wintrust.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\wksprt.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\wksprtPS.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\wmp.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\WMPhoto.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\wmploc.DLL:$CmdTcID

AlternateDataStreams: C:\Windows\system32\wow64.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\wow64cpu.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\wow64win.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\wscript.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\wshom.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\system32\WSManHTTPConfig.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\WSManMigrationPlugin.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\WsmAuto.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\WsmSvc.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\WsmWmiPl.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\wu.upgrade.ps.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\wuapi.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\wuapp.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\wuauclt.exe:$CmdTcID

AlternateDataStreams: C:\Windows\system32\wuaueng.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\wucltux.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\wudriver.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\wups.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\wups2.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\wuwebv.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\x3daudio1_0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\x3daudio1_1.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\X3DAudio1_2.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\X3DAudio1_3.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\X3DAudio1_4.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\X3DAudio1_5.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\X3DAudio1_6.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\X3DAudio1_7.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\xactengine2_0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\xactengine2_1.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\xactengine2_10.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\xactengine2_2.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\xactengine2_3.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\xactengine2_4.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\xactengine2_5.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\xactengine2_6.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\xactengine2_7.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\xactengine2_8.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\xactengine2_9.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\xactengine3_0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\xactengine3_1.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\xactengine3_2.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\xactengine3_3.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\xactengine3_4.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\xactengine3_5.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\xactengine3_6.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\xactengine3_7.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\XAPOFX1_0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\XAPOFX1_1.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\XAPOFX1_2.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\XAPOFX1_3.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\XAPOFX1_4.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\XAPOFX1_5.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\XAudio2_0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\XAudio2_1.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\XAudio2_2.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\XAudio2_3.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\XAudio2_4.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\XAudio2_5.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\XAudio2_6.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\XAudio2_7.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\xinput1_1.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\xinput1_2.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\xinput1_3.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\adtschema.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\advapi32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\AiORuntimes.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-eventing-provider-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\apisetschema.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\apphelp.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\appidapi.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\appverif.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\atl70.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\atl71.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\atmfd.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\atmlib.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\auditpol.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\authui.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\autoitx3.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\browcli.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\cdosys.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\certenc.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\certutil.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\cewmdm.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\charmap.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\clfsw32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\comct232.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\comct332.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\comctl32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\comctl32.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\comdlg32.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\credssp.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\crypt32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\cryptbase.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\cryptdlg.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\cryptnet.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\cryptsvc.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\cscript.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\cygwin1.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d2d1.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3d10warp.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_33.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_34.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_35.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_36.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_37.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_38.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_39.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_40.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_41.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_42.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\D3DCompiler_43.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dcsx_42.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dcsx_43.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx10.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_33.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_34.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_35.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_36.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_37.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_38.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_39.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_40.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_41.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_42.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx10_43.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx11_42.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx11_43.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_24.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_25.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_26.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_27.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_28.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_29.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_30.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_31.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_33.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_34.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_35.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\d3dx9_36.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\D3DX9_37.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\D3DX9_38.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\D3DX9_39.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\D3DX9_40.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\D3DX9_41.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\D3DX9_42.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\D3DX9_43.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\davclnt.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\dblist32.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\dciman32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\diskperf.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\dpnet.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\dwmapi.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\dwmcore.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\DWrite.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\dxcap.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\dxcpl.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\dxmasf.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\dxtmsft.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\dxtrans.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\FlashPlayerApp.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\fontsub.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\FWPUCLNT.DLL:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\gdi32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\ieapfltr.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\iedkcs32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\ieetwproxystub.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\ieframe.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\iernonce.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\iertutil.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\iesetup.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\ieui.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\ieUnatt.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\IMJP10K.DLL:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\inetcpl.cpl:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\InkEd.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\instnm.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\IoctlSvc.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\iologmsg.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\jscript.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\jscript9.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\jscript9diag.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\jsproxy.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\KBDBASH.DLL:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\KBDRU.DLL:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\KBDRU1.DLL:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\KBDTAT.DLL:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\KBDYAK.DLL:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\kerberos.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\kernel32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\KernelBase.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\libeay32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\libiconv2.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\libintl3.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\libmmd.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\libpng13.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\libpng15.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\libssl32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\logman.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\lpk.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mci32.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mfc70.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mfc70CHS.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mfc70CHT.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mfc70DEU.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mfc70ENU.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mfc70ESP.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mfc70FRA.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mfc70ITA.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mfc70JPN.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mfc70KOR.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mfc70u.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mfc71.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mfc71CHS.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mfc71CHT.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mfc71DEU.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mfc71ENU.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mfc71ESP.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mfc71FRA.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mfc71ITA.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mfc71JPN.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mfc71KOR.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mfc71u.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msaudite.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mscomct2.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mscomctl.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mscomm32.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msctf.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msdatgrd.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msdatlst.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msdia100.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msdxm.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msfeeds.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msflxgrd.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mshflxgd.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mshtml.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\MshtmlDac.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mshtmled.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mshtmlmedia.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msi.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msiexec.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msihnd.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msimsg.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msinet.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msmask32.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msmpeg2vdec.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msobjs.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msrating.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\MsRdpWebAccess.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msstdfmt.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msstkprp.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mstsc.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mstscax.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msv1_0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msvci70.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msvcp70.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msvcp71.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msvcr70.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msvcr71.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\mswinsck.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msxml3.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msxml3r.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msxml6.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\msxml6r.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\ncrypt.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\netapi32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\notepad.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\nshwfp.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\ntdll.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\ntkrnlpa.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\ntoskrnl.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\ntvdm64.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\nvapi.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\nvaudcap32v.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\nvcompiler.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\nvcuda.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\nvcuvid.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\nvd3dum.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\NvFBC.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\NvIFR.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\nvoglv32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\nvopencl.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\nvwgf2um.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\ole32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\oleaut32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\openal32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\OpenCL.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\packager.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\picclp32.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\pku2u.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\poqexec.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\rastls.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\rdpendp_winip.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\rdvidcrl.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\relog.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\richtx32.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\rpcrt4.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\scesrv.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\schannel.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\scrrun.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\sdbinst.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\sechost.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\secur32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\setup16.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\shdocvw.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\shell32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\shimeng.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\spwmp.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\srclient.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\ssleay32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\sspicli.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\synceng.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\sysinfo.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\tabctl32.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\tdh.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\tier0_s.dll:$CmdZnID

AlternateDataStreams: C:\Windows\SysWOW64\tracerpt.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\tsgqec.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\TSpkg.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\typeperf.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\tzres.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\ucrtbase.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\uplay_r1_loader.dll:$CmdZnID

AlternateDataStreams: C:\Windows\SysWOW64\urlmon.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\user.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\vb40032.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\vbscript.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\vcamp140.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\vmnat.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\vmnetdhcp.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\vsgraphicsremoteengine.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\vsjitdebugger.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\vstdlib_s.dll:$CmdZnID

AlternateDataStreams: C:\Windows\SysWOW64\wdigest.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\WebClnt.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\win32spl.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\WindowsCodecs.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\wininet.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\winsta.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\wintrust.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\wksprtPS.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\wmp.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\WMPhoto.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\wmploc.DLL:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\wow32.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\wrap_oal.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\wscript.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\wshom.ocx:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\WSManHTTPConfig.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\WSManMigrationPlugin.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\WsmAuto.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\WsmSvc.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\WsmWmiPl.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\wuapi.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\wuapp.exe:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\wudriver.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\wups.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\wuwebv.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\x3daudio1_0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\x3daudio1_1.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\X3DAudio1_2.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\X3DAudio1_3.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\X3DAudio1_4.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\X3DAudio1_5.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\X3DAudio1_6.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\X3DAudio1_7.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_1.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_10.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_2.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_3.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_4.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_5.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_6.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_7.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_8.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\xactengine2_9.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\xactengine3_0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\xactengine3_1.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\xactengine3_2.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\xactengine3_3.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\xactengine3_4.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\xactengine3_5.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\xactengine3_6.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\xactengine3_7.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\XAPOFX1_0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\XAPOFX1_1.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\XAPOFX1_2.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\XAPOFX1_3.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\XAPOFX1_4.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\XAPOFX1_5.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\XAudio2_0.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\XAudio2_1.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\XAudio2_2.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\XAudio2_3.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\XAudio2_4.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\XAudio2_5.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\XAudio2_6.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\XAudio2_7.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\xinput1_1.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\xinput1_2.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\xinput1_3.dll:$CmdTcID

AlternateDataStreams: C:\Windows\SysWOW64\zlib1.dll:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\appid.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\Diskdump.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\dtlitescsibus.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\dxgkrnl.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\dxgmms1.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\fvevol.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\http.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\ksecdd.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\ksecpkg.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\L1E62x64.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\mbam.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\mountmgr.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\mrxsmb.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\mrxsmb10.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\mrxsmb20.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\msiscsi.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\mwac.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\ntfs.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\nvlddmkm.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\nvvad64v.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\partmgr.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\rdpvideominiport.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\rdpwd.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\storport.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\stream.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\terminpt.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\tssecsrv.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\TsUsbFlt.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\TsUsbGD.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\vmci.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\vmnetadapter.sys:$CmdTcID

AlternateDataStreams: C:\Windows\system32\Drivers\vmnetbridge.sys:$CmdTcID

AlternateDataStreams: C:\Users\admin\Desktop\FRST64.exe:$CmdTcID

AlternateDataStreams: C:\Users\admin\Desktop\FRST64.exe:$CmdZnID
 

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"
 

==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
 
 

==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
 
 

==================== Andere Bereiche ============================
 

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
 

HKU\S-1-5-21-560193511-1957534509-1735208640-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 192.168.1.1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

mpsdrv => Firewall Dienst läuft nicht.

MpsSvc => Firewall Dienst läuft nicht.

bfe => Firewall Dienst läuft nicht.
 

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
 

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
 
 

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

FirewallRules: [{3945C57F-279A-459C-A8FE-AE5138F72912}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{D4BC426F-536B-4BA2-8D3B-5207990745E7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{25D6673A-33B2-4C67-A33E-723BAEE6ECEC}] => (Allow) C:\Users\admin\AppData\Roaming\BitTorrent\BitTorrent.exe

FirewallRules: [{CBCAFFDA-F86E-444E-B797-9E93A6B6B82F}] => (Allow) C:\Users\admin\AppData\Roaming\BitTorrent\BitTorrent.exe

FirewallRules: [{E07A3B24-AF55-45EB-987F-28E099A44A28}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe

FirewallRules: [{04006571-C299-4D1F-BDDA-40FCB9484846}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe

FirewallRules: [{CBE6A3C2-CF81-45CA-A87B-806229BAAC38}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe

FirewallRules: [TCP Query User{FCCD3125-2FB2-497F-A74D-CCA8149904DC}C:\users\admin\desktop\dc\darkcomet.exe] => (Allow) C:\users\admin\desktop\dc\darkcomet.exe

FirewallRules: [UDP Query User{CE4E2128-F169-42D6-8AD3-0B35FDAF1544}C:\users\admin\desktop\dc\darkcomet.exe] => (Allow) C:\users\admin\desktop\dc\darkcomet.exe

FirewallRules: [TCP Query User{D427572D-88C9-43D9-BC3B-859CE73B107A}C:\users\admin\desktop\bifrost(win7)\bifrost.exe] => (Allow) C:\users\admin\desktop\bifrost(win7)\bifrost.exe

FirewallRules: [UDP Query User{2B20F3F9-83D3-41B0-BB8E-F02BA2391FEB}C:\users\admin\desktop\bifrost(win7)\bifrost.exe] => (Allow) C:\users\admin\desktop\bifrost(win7)\bifrost.exe

FirewallRules: [{E26E7D8C-7236-43C7-A3DE-02807DD62CEB}] => (Allow) C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe

FirewallRules: [{89A7298D-2ED6-4E53-9FF4-9ED5615646FC}] => (Allow) C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe

FirewallRules: [{9D3479CF-1495-49B0-93B9-A16A0D76F674}] => (Allow) C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe

FirewallRules: [{C1AD0EC3-C8BA-468C-9DB7-BBFD317C4847}] => (Allow) C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe

FirewallRules: [TCP Query User{93B58B63-40E3-4BC8-9F1E-3FD8AAEA2DF4}C:\program files (x86)\funcom\age of conan\conanpatcher.exe] => (Allow) C:\program files (x86)\funcom\age of conan\conanpatcher.exe

FirewallRules: [UDP Query User{64D620FC-2CCB-4565-A435-37C95559A567}C:\program files (x86)\funcom\age of conan\conanpatcher.exe] => (Allow) C:\program files (x86)\funcom\age of conan\conanpatcher.exe

FirewallRules: [TCP Query User{FCAC87B2-8FF0-424C-BF98-5BFD98DCC366}C:\program files (x86)\funcom\age of conan\ageofconan.exe] => (Allow) C:\program files (x86)\funcom\age of conan\ageofconan.exe

FirewallRules: [UDP Query User{3B2AE6C9-C6CD-4F91-A08E-B9D7C55DD86E}C:\program files (x86)\funcom\age of conan\ageofconan.exe] => (Allow) C:\program files (x86)\funcom\age of conan\ageofconan.exe

FirewallRules: [{16B94FD7-47B1-42AD-96C9-A523C6E7E6B7}] => (Allow) C:\Program Files (x86)\WinSCP\WinSCP.exe

FirewallRules: [{6EDA7CA2-B5B5-4E2A-A40A-F2B6AFCB8C81}] => (Allow) C:\Program Files (x86)\WinSCP\WinSCP.exe

FirewallRules: [{25B57D77-E17D-4AE1-BFCB-95D9DAAE0085}] => (Allow) C:\Program Files (x86)\WinSCP\WinSCP.exe

FirewallRules: [{BD8E7152-5240-4893-8B0E-3512E5A664D2}] => (Allow) C:\Program Files (x86)\WinSCP\WinSCP.exe

FirewallRules: [TCP Query User{3D88B679-5C8F-4D3A-AB2A-9609E5EADE4D}C:\users\admin\desktop\epsxe\epsxe 1.70\epsxe.exe] => (Allow) C:\users\admin\desktop\epsxe\epsxe 1.70\epsxe.exe

FirewallRules: [UDP Query User{BF6D2823-C955-4805-BFD3-83B6BD25B82F}C:\users\admin\desktop\epsxe\epsxe 1.70\epsxe.exe] => (Allow) C:\users\admin\desktop\epsxe\epsxe 1.70\epsxe.exe

FirewallRules: [{091724C2-F5CB-4C57-AEE9-1DCF8C1D7926}] => (Allow) C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\devenv.exe

FirewallRules: [{C2F61917-20C7-4335-BB7B-8B8E219DD2BC}] => (Allow) C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\devenv.exe

FirewallRules: [TCP Query User{D2F55E05-CCC3-4B7A-A813-B2B220742836}C:\users\admin\desktop\dolphin-x64\dolphin.exe] => (Block) C:\users\admin\desktop\dolphin-x64\dolphin.exe

FirewallRules: [UDP Query User{5334C742-FA3B-44DC-837B-4289D2C7AEA9}C:\users\admin\desktop\dolphin-x64\dolphin.exe] => (Block) C:\users\admin\desktop\dolphin-x64\dolphin.exe

FirewallRules: [TCP Query User{7FDAA97A-89F5-4045-BBCF-A144602B47A0}C:\program files (x86)\java\jre1.8.0_60\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_60\bin\javaw.exe

FirewallRules: [UDP Query User{95DC43D7-389D-4224-8732-2D48DD747533}C:\program files (x86)\java\jre1.8.0_60\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_60\bin\javaw.exe

FirewallRules: [TCP Query User{47B4D1B5-7DA2-41DA-8458-6463B2783B17}C:\users\admin\desktop\dd\fgd.exe] => (Allow) C:\users\admin\desktop\dd\fgd.exe

FirewallRules: [UDP Query User{EBF310ED-4973-439A-A743-0F5B0E2C7F36}C:\users\admin\desktop\dd\fgd.exe] => (Allow) C:\users\admin\desktop\dd\fgd.exe

FirewallRules: [{CC1587B9-385F-4523-AC1A-3F0BB2F52764}] => (Allow) LPort=12292
 

==================== Fehlerhafte Geräte im Gerätemanager =============
 

Konnte Geräte nicht auflisten. Überprüfen Sie den "winmgmt" Dienst oder reparieren Sie den WMI.
 
 

==================== Fehlereinträge in der Ereignisanzeige: =========================
 

Der Dienst der Ereignisanzeige konnte nicht gestartet werden, Einträge konnten nicht gelesen werden.
 

Systemfehler 123 aufgetreten.
 

Die Syntax f�r den Dateinamen, Verzeichnisnamen oder die Datentr�gerbezeichnung ist falsch.
 
 

==================== Speicherinformationen =========================== 
 

Prozessor: Intel(R) Core(TM)2 CPU 6600 @ 2.40GHz

Prozentuale Nutzung des RAM: 49%

Installierter physikalischer RAM: 3071.12 MB

Verfügbarer physikalischer RAM: 1562.06 MB

Summe virtueller Speicher: 6440.44 MB

Verfügbarer virtueller Speicher: 4529.91 MB
 

==================== Laufwerke ================================
 

Drive c: () (Fixed) (Total:931.41 GB) (Free:676.49 GB) NTFS

Drive d: (Disk) (CDROM) (Total:6.7 GB) (Free:0 GB) CDFS
 

==================== MBR & Partitionstabelle ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 3941A79A)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)
 

==================== Ende von Addition.txt ==========================

die frst logfiles werden zwar angezeigt nach dem scannen so das ich es kopieren kann,es wird aber nicht in dem gleichen verzeichnis gespeichert wie das programm.....nirgendwo.
und wegen deinen fragen,ja habe beides versucht und es geht nicht:(

funktionieren den die services jetzt wenigstens wieder?
was können wir noch tun,damit das spiel läuft?
oder habe ich irgendwie nen virus?

mfg.