Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Windows 10 PC mit der Zeit sehr langsam. (https://www.trojaner-board.de/183522-windows-10-pc-zeit-sehr-langsam.html)

kakuzu 16.12.2016 15:26
Windows 10 PC mit der Zeit sehr langsam.
 
Guten Abend,

heute melde ich mich bei euch mit einem Problem mit dem PC meiner Mutter. Dieser wurde mit der Zeit immer langsamer. Zuviele Anwendungen nehme ich nicht an. Der PC wird selten genutzt und benötigt mittlerweile mehrere Minuten zum Starten.

Anbei einmal die Log vom FRSTT. Vllt gibt es ja doch Probleme die ich auf den ertsen Blick nicht erkennen kann.

LG kakuzu

deeprybka 18.12.2016 16:15
:hallo:

Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das...:abklatsch:
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lies die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem.
  • Führe bitte nur Scans durch, zu denen Du von mir aufgefordert wurdest.
  • Bitte kein Crossposting (posten in mehreren Foren).
  • Installiere oder deinstalliere während der Bereinigung keine Software, außer Du wurdest dazu aufgefordert.
  • Speichere alle unsere Tools auf dem Desktop ab. Link: So ladet Ihr unsere Tools richtig
  • Poste die Logfiles direkt in Deinen Thread in Code-Tags.
  • Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 24 Stunden nichts von mir liest, dann schreibe mir bitte eine PM.

Hinweis:
Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden.
Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert.
Adware & Co. können wir sehr gut entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean :daumenhoc bekommst.


Los geht's:

Bitte alle Logs in codetags posten. Danke

kakuzu 19.12.2016 21:58
FRST log habe ich im 1. Post angehängt da sie zu groß sind für nen Beitrag.

deeprybka 20.12.2016 13:00
Dann musst sie halt splitten...

kakuzu 21.12.2016 21:11
Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 07-12-2016
durchgeführt von bambi (Administrator) auf ANDREA (16-12-2016 15:18:36)
Gestartet von C:\Users\bambi\Downloads
Geladene Profile: bambi (Verfügbare Profile: bambi & Administrator)
Platform: Windows 10 Home Version 1607 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Edge)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(AuthenTec, Inc) C:\Program Files\Lenovo Fingerprint Reader\TrueSuiteService.exe
(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro PDF\Professional\7.0\NitroPDFDriverService2x64.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(DEVGURU Co., LTD.) C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
() C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(AuthenTec Inc.) C:\Program Files\Lenovo Fingerprint Reader\TouchControl.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
() C:\Program Files (x86)\Lenovo\LocationAware\lpdagent.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(AuthenTec, Inc.) C:\Program Files\Common Files\AuthenTec\TrueService.exe
(AuthenTec, Inc.) C:\Program Files\Common Files\AuthenTec\TrueService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
() C:\Program Files\Lenovo Fingerprint Reader\x86\IEWebSiteLogon.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP Officejet Pro 6830\Bin\ScanToPCActivationApp.exe
(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP Officejet Pro 6830\Bin\HPNetworkCommunicatorCom.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.9.261.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google) C:\Users\bambi\AppData\Local\Google\Chrome\User Data\SwReporter\14.81.1\software_reporter_tool.exe
(Google) C:\Users\bambi\AppData\Local\Google\Chrome\User Data\SwReporter\14.81.1\software_reporter_tool.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgentUserBroker.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [373760 2012-07-20] (Alcor Micro Corp.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508104 2015-09-04] (Adobe Systems Incorporated)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3952800 2015-08-21] (Synaptics Incorporated)
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331STI.EXE [561672 2015-06-12] (Vimicro)
HKLM-x32\...\Run: [UpdatePPShortCut] => C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [222504 2010-09-17] (CyberLink Corp.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [6111824 2015-08-26] (AVAST Software)
HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [832272 2014-05-21] (BlueStack Systems, Inc.)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2292912 2015-09-17] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2015-04-10] (Oracle Corporation)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-510132055-1619855064-2757486123-1001\...\Run: [Google+ Auto Backup] => C:\Users\bambi\AppData\Local\Programs\Google\Google+ Auto Backup\Google+ Auto Backup.exe [3619096 2014-01-06] (Google Inc.)
HKU\S-1-5-21-510132055-1619855064-2757486123-1001\...\Run: [HP Deskjet 3070 B611 series (NET)] => C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-510132055-1619855064-2757486123-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-12-19] (TomTom)
HKU\S-1-5-21-510132055-1619855064-2757486123-1001\...\Run: [Zoner Photo Studio Autoupdate] => C:\Program Files\Zoner\Photo Studio 18\Program32\ZPSTRAY.EXE [680528 2016-03-24] (ZONER software)
HKU\S-1-5-21-510132055-1619855064-2757486123-1001\...\Run: [HP Officejet Pro 6830 (NET)] => C:\Program Files\HP\HP Officejet Pro 6830\Bin\ScanToPCActivationApp.exe [3493952 2014-07-18] (Hewlett-Packard Development Company, LP)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-09-11] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-09-11] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-09-11] ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-08-16] (AVAST Software)
ShellIconOverlayIdentifiers: [1aCopyShExtError] -> {83BEA36E-7680-4598-A4DF-994426F6E78D} => C:\Users\bambi\AppData\Roaming\Copy\overlay\CopyShExt.dll Keine Datei
ShellIconOverlayIdentifiers: [2aCopyShExtSynced] -> {845B7388-6F85-4F32-9FD5-F02DC7882B89} => C:\Users\bambi\AppData\Roaming\Copy\overlay\CopyShExt.dll Keine Datei
ShellIconOverlayIdentifiers: [3aCopyShExtSyncing] -> {F6378A7A-F753-449B-AE1B-997A96132E61} => C:\Users\bambi\AppData\Roaming\Copy\overlay\CopyShExt.dll Keine Datei
ShellIconOverlayIdentifiers: [4aCopyShExtSyncingProg1] -> {3A511828-777D-46F8-82F4-5B530C1B3D9E} => C:\Users\bambi\AppData\Roaming\Copy\overlay\CopyShExt.dll Keine Datei
ShellIconOverlayIdentifiers: [5aCopyShExtSyncingProg2] -> {C8C88204-5B14-40EC-BA72-8AEBC762047E} => C:\Users\bambi\AppData\Roaming\Copy\overlay\CopyShExt.dll Keine Datei
ShellIconOverlayIdentifiers: [6aCopyShExtSyncingProg3] -> {ACFF45C3-3EEB-4351-86C2-6696BA264239} => C:\Users\bambi\AppData\Roaming\Copy\overlay\CopyShExt.dll Keine Datei
ShellIconOverlayIdentifiers: [7aCopyShExtSyncingProg4] -> {29AF997F-488B-46F0-AE78-7146F1B89CC3} => C:\Users\bambi\AppData\Roaming\Copy\overlay\CopyShExt.dll Keine Datei
ShellIconOverlayIdentifiers: [8aCopyShExtSyncingProg5] -> {03F9AD29-1C78-4B66-8890-B177B5430C53} => C:\Users\bambi\AppData\Roaming\Copy\overlay\CopyShExt.dll Keine Datei
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-01-18] (IvoSoft)
ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll Keine Datei
ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll Keine Datei
ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll Keine Datei
ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll Keine Datei
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-01-18] (IvoSoft)
Startup: C:\Users\bambi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 3070 B611 series (Netzwerk).lnk [2015-12-25]
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 3070 B611 series (Netzwerk).lnk -> C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{626aea12-4f6c-45ed-ab92-4bed76616c46}: [NameServer] 192.168.178.1,192.168.178.2
Tcpip\..\Interfaces\{b97a054d-302f-4673-8ebe-52ad18de72b4}: [DhcpNameServer] 192.168.178.1

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG
HKU\S-1-5-21-510132055-1619855064-2757486123-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-510132055-1619855064-2757486123-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-510132055-1619855064-2757486123-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.olb.de/privatkunden/20245.php
HKU\S-1-5-21-510132055-1619855064-2757486123-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/welcome/thinkpad
SearchScopes: HKU\S-1-5-21-510132055-1619855064-2757486123-1001 -> {97A1CB85-33E0-43C9-AF62-06B364D8B666} URL =
BHO: TrueSuite Browser Helper Object -> {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} -> C:\Program Files\Lenovo Fingerprint Reader\IEBHO.DLL [2012-08-31] (AuthenTec Inc.)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-08-16] (AVAST Software)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2015-09-13] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-08-16] (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2015-09-13] (Oracle Corporation)
Toolbar: HKLM - Kein Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  Keine Datei
DPF: HKLM-x32 {4FF78044-96B4-4312-A5B7-FDA3CB328095}
DPF: HKLM-x32 {C752FF21-A8EF-468E-B507-5BBAFB84359E} hxxps://hbciweb.olb.de/financebrowser5/plugin/Signlet-Plugin-1.0.49.0.CAB

FireFox:
========
FF DefaultProfile: rd8k8p76.default
FF ProfilePath: C:\Users\bambi\AppData\Roaming\TomTom\HOME\Profiles\dgbmdkvv.default [2015-04-14]
FF Extension: (Map status indicator) - C:\Program Files (x86)\TomTom HOME 2\xul\extensions\MapShare-status@tomtom.com [2015-04-14] [ist nicht signiert]
FF ProfilePath: C:\Users\bambi\AppData\Roaming\Mozilla\Firefox\Profiles\rd8k8p76.default [2016-06-09]
FF Homepage: Mozilla\Firefox\Profiles\rd8k8p76.default -> hxxp://www.youtube.com/
FF Extension: (convert2mp3.net YouTube2MP3 Converter) - C:\Users\bambi\AppData\Roaming\Mozilla\Firefox\Profiles\rd8k8p76.default\Extensions\info@convert2mp3.net.xpi [2016-03-31]
FF Extension: (TrueSuite Website Logon) - C:\Program Files (x86)\Mozilla Firefox\distribution\bundles\websitelogon@truesuite.com [2016-04-17] [ist nicht signiert]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: (Kein Name) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-12-25] [ist nicht signiert]
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2015-09-17] (Adobe Systems)
FF Plugin-x32: @authentec.com/ffwloplugin -> C:\Program Files\Lenovo Fingerprint Reader\npffwloplugin.dll [2012-08-31] (AuthenTec, Inc)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.80.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2015-09-13] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.80.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2015-09-13] (Oracle Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro PDF\Professional 7\npnitromozilla.dll [2012-07-31] ( )
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-05] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-05] (Google Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2015-09-17] (Adobe Systems)

Chrome:
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxps://de.yahoo.com?fr=hp-avast&type=avastbcl
CHR StartupUrls: Default -> "hxxps://de.yahoo.com?fr=hp-avast&type=avastbcl"
CHR Profile: C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Default [2016-12-16]
CHR Extension: (ProxFlow) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2016-11-12]
CHR Extension: (Google Docs) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-07]
CHR Extension: (Google Drive) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-30]
CHR Extension: (YouTube) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-05]
CHR Extension: (Google-Suche) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-31]
CHR Extension: (Search by Image (by Google)) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Default\Extensions\dajedkncpodkggklbegccjpmnglmnflm [2016-11-12]
CHR Extension: (Internet Banking der OLB) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Default\Extensions\fipffogddddpcmkklaodlnofkmpognml [2016-02-08]
CHR Extension: (Google Docs Offline) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-31]
CHR Extension: (AdBlock) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-12-16]
CHR Extension: (Nehmen Sie Screenshot der Webseite - FireShot) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbpblocgmgfnpjjppndjkmgjaogfceg [2016-12-16]
CHR Extension: (Awesome Screenshot App) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfpiaehgjbbfednooihadalhehabhcjo [2016-08-05]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-17]
CHR Extension: (Google Mail) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-29]
CHR Extension: (Chrome Media Router) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-11-12]
CHR Profile: C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Profile 4 [2015-07-21]
CHR Extension: (ProxFlow) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\aakchaleigkohafkfjfjbblobjifikek [2015-07-21]
CHR Extension: (Google Docs) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\aohghmighlieiainnegkcijnfilokake [2015-07-21]
CHR Extension: (Google Drive) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-07-21]
CHR Extension: (YouTube) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-07-21]
CHR Extension: (Webseiten-Screenshot - Webpage Screenshot) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\ckibcdccnfeookdmbahgiakhnjcddpki [2015-07-21]
CHR Extension: (Google-Suche) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-07-21]
CHR Extension: (AdBlock) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-07-21]
CHR Extension: (Hide My AdBlocker) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\gihcngphjjankfngmgdkihhngndcdflc [2014-07-25]
CHR Extension: (History Timeline) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\gjhpcfomcckgcaniehfgakaddjgncpeb [2014-05-28]
CHR Extension: (Avast Online Security) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-07-21]
CHR Extension: (PageSpeed Insights (by Google)) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\gplegfbjlmmehdoakndmohflojccocli [2014-10-12]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-07-21]
CHR Extension: (Google Wallet) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-21]
CHR Extension: (Better History) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\obciceimmggglbmelaidpjlmodcebijb [2015-07-21]
CHR Extension: (Google Mail) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-07-21]
CHR Profile: C:\Users\bambi\AppData\Local\Google\Chrome\User Data\System Profile [2015-07-21]
CHR Extension: (Google Präsentationen) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-07-21]
CHR Extension: (Google Docs) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\aohghmighlieiainnegkcijnfilokake [2015-07-21]
CHR Extension: (Google Drive) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-07-21]
CHR Extension: (YouTube) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-07-21]
CHR Extension: (Google-Suche) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-07-21]
CHR Extension: (Google Tabellen) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-07-21]
CHR Extension: (Avast Online Security) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-07-21]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-07-21]
CHR Extension: (Google Wallet) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-21]
CHR Extension: (Google Mail) - C:\Users\bambi\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-07-21]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-12-25]

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [669872 2015-09-15] (Adobe Systems Incorporated)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2207960 2016-09-26] (Adobe Systems, Incorporated)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [146600 2015-08-16] (AVAST Software)
R2 BcmBtRSupport; C:\WINDOWS\system32\BtwRSupportService.exe [2251992 2015-03-27] (Broadcom Corporation.)
S2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [402192 2014-05-21] (BlueStack Systems, Inc.)
S2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [385808 2014-05-21] (BlueStack Systems, Inc.)
S2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [774928 2014-05-21] (BlueStack Systems, Inc.)
R2 FPLService; C:\Program Files\Lenovo Fingerprint Reader\TrueSuiteService.exe [2139496 2012-08-31] (AuthenTec, Inc)
R2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [337888 2016-05-03] (Intel Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-07-17] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
R2 LocationTaskManager; C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe [458336 2012-08-14] ()
R2 NitroDriverReadSpool2; C:\Program Files\Common Files\Nitro PDF\Professional\7.0\NitroPDFDriverService2x64.exe [216072 2012-07-31] (Nitro PDF Software)
R2 ss_conn_service; C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [754784 2016-01-08] (DEVGURU Co., LTD.)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [247968 2015-08-21] (Synaptics Incorporated)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5702416 2015-09-11] (TeamViewer GmbH)
R3 TrueService; C:\Program Files\Common Files\AuthenTec\TrueService.exe [401256 2012-07-16] (AuthenTec, Inc.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 aswHwid; C:\WINDOWS\system32\drivers\aswHwid.sys [28656 2015-12-25] (AVAST Software)
R2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [97648 2015-12-25] (AVAST Software)
R1 aswRdr; C:\WINDOWS\system32\drivers\aswRdr2.sys [93528 2015-12-25] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65224 2015-12-25] (AVAST Software)
R1 aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [1065720 2016-03-06] (AVAST Software)
R1 aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [464256 2016-02-18] (AVAST Software)
R2 aswStm; C:\WINDOWS\system32\drivers\aswStm.sys [155304 2015-12-25] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [273784 2015-12-25] (AVAST Software)
R3 bcbtums; C:\WINDOWS\system32\drivers\bcbtums.sys [173312 2015-03-27] (Broadcom Corporation.)
R3 BCM43XX; C:\WINDOWS\system32\DRIVERS\bcmwl63a.sys [6957744 2014-02-19] (Broadcom Corporation)
S2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [123152 2014-05-21] (BlueStack Systems)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [130688 2016-07-22] (Samsung Electronics Co., Ltd.)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [589824 2016-07-16] (Realtek                                            )
R3 SmbDrvI; C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys [44192 2015-08-21] (Synaptics Incorporated)
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [164992 2016-07-22] (Samsung Electronics Co., Ltd.)
R3 vm331avs; C:\WINDOWS\System32\Drivers\vm331avs.sys [802312 2015-06-12] (Vimicro Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2016-12-16 15:18 - 2016-12-16 15:19 - 00028647 _____ C:\Users\bambi\Downloads\FRST.txt
2016-12-16 15:18 - 2016-12-16 15:18 - 02420224 _____ (Farbar) C:\Users\bambi\Downloads\FRST64.exe
2016-12-16 15:18 - 2016-12-16 15:18 - 00000000 ____D C:\FRST
2016-12-08 20:16 - 2016-11-02 13:01 - 00484584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2016-12-08 20:16 - 2016-11-02 13:01 - 00315744 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2016-12-08 20:16 - 2016-11-02 12:22 - 01570672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2016-12-08 20:16 - 2016-11-02 12:13 - 00773720 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2016-12-08 20:16 - 2016-11-02 12:12 - 00376672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2016-12-08 20:16 - 2016-11-02 12:12 - 00341344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2016-12-08 20:16 - 2016-11-02 12:10 - 02323728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2016-12-08 20:16 - 2016-11-02 12:09 - 02257104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-12-08 20:16 - 2016-11-02 12:08 - 00576408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2016-12-08 20:16 - 2016-11-02 12:08 - 00186424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\weretw.dll
2016-12-08 20:16 - 2016-11-02 12:05 - 03892352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2016-12-08 20:16 - 2016-11-02 12:05 - 00959112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2016-12-08 20:16 - 2016-11-02 12:05 - 00951904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2016-12-08 20:16 - 2016-11-02 12:04 - 04312248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2016-12-08 20:16 - 2016-11-02 12:03 - 00714592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2016-12-08 20:16 - 2016-11-02 12:02 - 00682816 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2016-12-08 20:16 - 2016-11-02 12:02 - 00238056 _____ (Microsoft Corporation) C:\WINDOWS\system32\weretw.dll
2016-12-08 20:16 - 2016-11-02 12:01 - 01263856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2016-12-08 20:16 - 2016-11-02 12:01 - 00545936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2016-12-08 20:16 - 2016-11-02 12:00 - 08156080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2016-12-08 20:16 - 2016-11-02 12:00 - 01274712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2016-12-08 20:16 - 2016-11-02 11:50 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe
2016-12-08 20:16 - 2016-11-02 11:49 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys
2016-12-08 20:16 - 2016-11-02 11:49 - 00037376 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2016-12-08 20:16 - 2016-11-02 11:47 - 00047104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Shell.Search.UriHandler.dll
2016-12-08 20:16 - 2016-11-02 11:46 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininetlui.dll
2016-12-08 20:16 - 2016-11-02 11:44 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AuthExt.dll
2016-12-08 20:16 - 2016-11-02 11:42 - 00632832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sud.dll
2016-12-08 20:16 - 2016-11-02 11:42 - 00506880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DevicePairing.dll
2016-12-08 20:16 - 2016-11-02 11:40 - 00896512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontext.dll
2016-12-08 20:16 - 2016-11-02 11:39 - 00348672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\zipfldr.dll
2016-12-08 20:16 - 2016-11-02 11:38 - 00760832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appwiz.cpl
2016-12-08 20:16 - 2016-11-02 11:36 - 07626752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2016-12-08 20:16 - 2016-11-02 11:33 - 12349952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2016-12-08 20:16 - 2016-11-02 11:33 - 03307520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2016-12-08 20:16 - 2016-11-02 11:32 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\efsext.dll
2016-12-08 20:16 - 2016-11-02 11:31 - 00226304 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcTok.exe
2016-12-08 20:16 - 2016-11-02 11:31 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSpkg.dll
2016-12-08 20:16 - 2016-11-02 11:30 - 00109056 _____ (Microsoft Corporation) C:\WINDOWS\system32\dab.dll
2016-12-08 20:16 - 2016-11-02 11:30 - 00058880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Shell.Search.UriHandler.dll
2016-12-08 20:16 - 2016-11-02 11:29 - 00884224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2016-12-08 20:16 - 2016-11-02 11:29 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkBindingEngineMigPlugin.dll
2016-12-08 20:16 - 2016-11-02 11:29 - 00122368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NPSM.dll
2016-12-08 20:16 - 2016-11-02 11:28 - 04423680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
2016-12-08 20:16 - 2016-11-02 11:28 - 00566784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActionCenterCPL.dll
2016-12-08 20:16 - 2016-11-02 11:28 - 00432128 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpAXHolder.dll
2016-12-08 20:16 - 2016-11-02 11:28 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2016-12-08 20:16 - 2016-11-02 11:28 - 00274432 _____ (Microsoft Corporation) C:\WINDOWS\system32\ListSvc.dll
2016-12-08 20:16 - 2016-11-02 11:28 - 00252928 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2016-12-08 20:16 - 2016-11-02 11:28 - 00109568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\chartv.dll
2016-12-08 20:16 - 2016-11-02 11:27 - 02458112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\themecpl.dll
2016-12-08 20:16 - 2016-11-02 11:27 - 01388544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Cred.dll
2016-12-08 20:16 - 2016-11-02 11:27 - 00580608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hgcpl.dll
2016-12-08 20:16 - 2016-11-02 11:27 - 00545792 _____ (Microsoft Corporation) C:\WINDOWS\system32\timedate.cpl
2016-12-08 20:16 - 2016-11-02 11:27 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.dll
2016-12-08 20:16 - 2016-11-02 11:26 - 02747392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2016-12-08 20:16 - 2016-11-02 11:26 - 02484736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gameux.dll
2016-12-08 20:16 - 2016-11-02 11:26 - 00912896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.dll
2016-12-08 20:16 - 2016-11-02 11:26 - 00712192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2016-12-08 20:16 - 2016-11-02 11:26 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ddraw.dll
2016-12-08 20:16 - 2016-11-02 11:26 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\stobject.dll
2016-12-08 20:16 - 2016-11-02 11:26 - 00278016 _____ (Microsoft Corporation) C:\WINDOWS\system32\netplwiz.dll
2016-12-08 20:16 - 2016-11-02 11:25 - 02998272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2016-12-08 20:16 - 2016-11-02 11:25 - 01556480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
2016-12-08 20:16 - 2016-11-02 11:23 - 00101888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bowser.sys
2016-12-08 20:16 - 2016-11-02 11:22 - 13441024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2016-12-08 20:16 - 2016-11-02 11:22 - 00369664 _____ (Microsoft Corporation) C:\WINDOWS\system32\msinfo32.exe
2016-12-08 20:16 - 2016-11-02 11:19 - 00130560 _____ (Microsoft Corporation) C:\WINDOWS\system32\chartv.dll
2016-12-08 20:16 - 2016-11-02 11:19 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\system32\asycfilt.dll
2016-12-08 20:16 - 2016-11-02 11:18 - 00991232 _____ (Microsoft Corporation) C:\WINDOWS\system32\comdlg32.dll
2016-12-08 20:16 - 2016-11-02 11:18 - 00836608 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcRefreshTask.dll
2016-12-08 20:16 - 2016-11-02 11:17 - 01282048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2016-12-08 20:16 - 2016-11-02 11:17 - 00909824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2016-12-08 20:16 - 2016-11-02 11:16 - 03133440 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2016-12-08 20:16 - 2016-11-02 11:16 - 01359360 _____ (Microsoft Corporation) C:\WINDOWS\system32\usercpl.dll
2016-12-08 20:16 - 2016-11-02 11:16 - 00881664 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2016-12-08 20:16 - 2016-11-02 11:16 - 00308736 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActionCenter.dll
2016-12-08 20:16 - 2016-11-02 11:15 - 00483328 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.dll
2016-12-08 20:16 - 2016-11-02 11:14 - 01726976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
2016-12-08 20:16 - 2016-11-02 09:20 - 00446896 _____ C:\WINDOWS\system32\ApnDatabase.xml
2016-12-08 20:16 - 2016-10-15 05:51 - 01637728 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2016-12-08 20:16 - 2016-10-15 05:51 - 01235296 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2016-12-08 20:16 - 2016-10-15 05:51 - 00595296 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2016-12-08 20:16 - 2016-10-15 05:51 - 00584032 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2016-12-08 20:16 - 2016-10-15 05:51 - 00322912 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2016-12-08 20:16 - 2016-10-15 05:51 - 00232800 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2016-12-08 20:16 - 2016-10-15 05:51 - 00137568 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2016-12-08 20:16 - 2016-10-15 05:51 - 00078688 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2016-12-08 20:16 - 2016-10-15 05:48 - 00498952 _____ (Microsoft Corporation) C:\WINDOWS\system32\DolbyDecMFT.dll
2016-12-08 20:16 - 2016-10-15 05:43 - 01356352 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipUp.exe
2016-12-08 20:16 - 2016-10-15 05:41 - 05622088 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
2016-12-08 20:16 - 2016-10-15 05:30 - 00509280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2016-12-08 20:16 - 2016-10-15 05:30 - 00341936 _____ (Microsoft Corporation) C:\WINDOWS\system32\wintrust.dll
2016-12-08 20:16 - 2016-10-15 05:29 - 00908640 _____ (Microsoft Corporation) C:\WINDOWS\system32\drvstore.dll
2016-12-08 20:16 - 2016-10-15 05:29 - 00079200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\crashdmp.sys
2016-12-08 20:16 - 2016-10-15 05:26 - 01694712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll
2016-12-08 20:16 - 2016-10-15 05:26 - 01600632 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2016-12-08 20:16 - 2016-10-15 05:26 - 00160096 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHostBroker.dll
2016-12-08 20:16 - 2016-10-15 05:25 - 00882680 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeManagerObj.dll
2016-12-08 20:16 - 2016-10-15 05:25 - 00742704 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll
2016-12-08 20:16 - 2016-10-15 05:21 - 01100128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys
2016-12-08 20:16 - 2016-10-15 05:21 - 00292872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpeffects.dll
2016-12-08 20:16 - 2016-10-15 05:20 - 02276736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2016-12-08 20:16 - 2016-10-15 05:15 - 01853776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2016-12-08 20:16 - 2016-10-15 05:15 - 01557808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
2016-12-08 20:16 - 2016-10-15 05:15 - 01123368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll
2016-12-08 20:16 - 2016-10-15 05:15 - 00687936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
2016-12-08 20:16 - 2016-10-15 05:10 - 00254656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmpeffects.dll
2016-12-08 20:16 - 2016-10-15 05:01 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll
2016-12-08 20:16 - 2016-10-15 05:00 - 00323584 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
2016-12-08 20:16 - 2016-10-15 05:00 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2016-12-08 20:16 - 2016-10-15 05:00 - 00018432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\stdole2.tlb
2016-12-08 20:16 - 2016-10-15 04:58 - 00258560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\xboxgip.sys
2016-12-08 20:16 - 2016-10-15 04:57 - 00217600 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpdxm.dll
2016-12-08 20:16 - 2016-10-15 04:57 - 00186880 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2016-12-08 20:16 - 2016-10-15 04:57 - 00175104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmpdxm.dll
2016-12-08 20:16 - 2016-10-15 04:56 - 00339968 _____ (Microsoft Corporation) C:\WINDOWS\system32\esentutl.exe
2016-12-08 20:16 - 2016-10-15 04:56 - 00306688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esentutl.exe
2016-12-08 20:16 - 2016-10-15 04:56 - 00095232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BluetoothApis.dll
2016-12-08 20:16 - 2016-10-15 04:56 - 00065024 _____ (Microsoft Corporation) C:\WINDOWS\system32\OnDemandConnRouteHelper.dll
2016-12-08 20:16 - 2016-10-15 04:55 - 00329216 _____ (Microsoft Corporation) C:\WINDOWS\system32\wc_storage.dll
2016-12-08 20:16 - 2016-10-15 04:55 - 00126464 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpshell.dll
2016-12-08 20:16 - 2016-10-15 04:54 - 00463872 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
2016-12-08 20:16 - 2016-10-15 04:54 - 00152064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\autoplay.dll
2016-12-08 20:16 - 2016-10-15 04:54 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmpshell.dll
2016-12-08 20:16 - 2016-10-15 04:53 - 00313856 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshostcore.dll
2016-12-08 20:16 - 2016-10-15 04:52 - 00523776 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2016-12-08 20:16 - 2016-10-15 04:52 - 00288256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\systemcpl.dll
2016-12-08 20:16 - 2016-10-15 04:51 - 00226304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcore6.dll
2016-12-08 20:16 - 2016-10-15 04:50 - 17188352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2016-12-08 20:16 - 2016-10-15 04:50 - 02716672 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmSvc.dll
2016-12-08 20:16 - 2016-10-15 04:50 - 00967168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys
2016-12-08 20:16 - 2016-10-15 04:50 - 00509440 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_Bluetooth.dll
2016-12-08 20:16 - 2016-10-15 04:50 - 00090112 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll
2016-12-08 20:16 - 2016-10-15 04:50 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll
2016-12-08 20:16 - 2016-10-15 04:49 - 01913344 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_fs.dll
2016-12-08 20:16 - 2016-10-15 04:49 - 00187904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscsvc.dll
2016-12-08 20:16 - 2016-10-15 04:49 - 00032256 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSManHTTPConfig.exe
2016-12-08 20:16 - 2016-10-15 04:48 - 01554944 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_health.dll
2016-12-08 20:16 - 2016-10-15 04:48 - 01054208 _____ (Microsoft Corporation) C:\WINDOWS\system32\qmgr.dll
2016-12-08 20:16 - 2016-10-15 04:47 - 07792640 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2016-12-08 20:16 - 2016-10-15 04:47 - 04612608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2016-12-08 20:16 - 2016-10-15 04:47 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.BackgroundMediaPlayback.dll
2016-12-08 20:16 - 2016-10-15 04:46 - 03287552 _____ (Microsoft Corporation) C:\WINDOWS\system32\mispace.dll
2016-12-08 20:16 - 2016-10-15 04:46 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Playback.BackgroundMediaPlayer.dll
2016-12-08 20:16 - 2016-10-15 04:45 - 00702464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Playback.MediaPlayer.dll
2016-12-08 20:16 - 2016-10-15 04:44 - 00747008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RemoteNaturalLanguage.dll
2016-12-08 20:16 - 2016-10-15 04:43 - 02748928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mispace.dll
2016-12-08 20:16 - 2016-10-15 04:43 - 01365504 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpncore.dll
2016-12-08 20:16 - 2016-10-15 04:43 - 00574976 _____ (Microsoft Corporation) C:\WINDOWS\system32\energy.dll
2016-12-08 20:16 - 2016-10-15 04:42 - 00539136 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2016-12-08 20:16 - 2016-10-15 04:41 - 07654912 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2016-12-08 20:16 - 2016-10-15 04:41 - 00161792 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeHelper.dll
2016-12-08 20:16 - 2016-10-15 04:41 - 00067584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iscsiwmi.dll
2016-12-08 20:16 - 2016-10-15 04:39 - 01060864 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpMapControl.dll
2016-12-08 20:16 - 2016-10-15 04:39 - 00869888 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2016-12-08 20:16 - 2016-10-15 04:39 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3D12.dll
2016-12-08 20:16 - 2016-10-15 04:39 - 00631296 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationController.dll
2016-12-08 20:16 - 2016-10-15 04:39 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Geolocation.dll
2016-12-08 20:16 - 2016-10-15 04:38 - 01993216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2016-12-08 20:16 - 2016-10-15 04:38 - 00913920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.dll
2016-12-08 20:16 - 2016-10-15 04:37 - 03733504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll
2016-12-08 20:16 - 2016-10-15 04:37 - 01980416 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2016-12-08 20:16 - 2016-10-15 04:37 - 01029632 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2016-12-08 20:16 - 2016-10-15 04:37 - 00093184 _____ (Microsoft Corporation) C:\WINDOWS\system32\cmifw.dll
2016-12-08 20:16 - 2016-10-15 04:36 - 00983040 _____ (Microsoft Corporation) C:\WINDOWS\system32\RemoteNaturalLanguage.dll
2016-12-08 20:16 - 2016-10-15 04:36 - 00673792 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2016-12-08 20:16 - 2016-10-15 04:36 - 00338944 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhcpl.dll
2016-12-08 20:16 - 2016-10-15 04:36 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cmifw.dll
2016-12-08 20:16 - 2016-10-15 04:35 - 03054080 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll
2016-12-08 20:16 - 2016-10-15 04:35 - 02708992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll
2016-12-08 20:16 - 2016-10-15 04:35 - 02315264 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2016-12-08 20:16 - 2016-10-15 04:35 - 02005504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2016-12-08 20:16 - 2016-10-15 04:35 - 00905216 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
2016-12-08 20:16 - 2016-10-15 04:35 - 00701952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.Connectivity.dll
2016-12-08 20:16 - 2016-10-15 04:34 - 00936448 _____ (Microsoft Corporation) C:\WINDOWS\system32\NMAA.dll
2016-12-08 20:15 - 2016-11-02 12:20 - 00590960 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2016-12-08 20:15 - 2016-11-02 12:13 - 01883784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2016-12-08 20:15 - 2016-11-02 12:12 - 02255712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2016-12-08 20:15 - 2016-11-02 12:08 - 00602464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll
2016-12-08 20:15 - 2016-11-02 12:05 - 06657176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2016-12-08 20:15 - 2016-11-02 12:05 - 00405856 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2016-12-08 20:15 - 2016-11-02 12:03 - 02750936 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-12-08 20:15 - 2016-11-02 12:01 - 01425000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d9.dll
2016-12-08 20:15 - 2016-11-02 12:01 - 01415744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2016-12-08 20:15 - 2016-11-02 12:00 - 22223968 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-12-08 20:15 - 2016-11-02 12:00 - 00534096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2016-12-08 20:15 - 2016-11-02 11:59 - 04673304 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2016-12-08 20:15 - 2016-11-02 11:44 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2016-12-08 20:15 - 2016-11-02 11:43 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2016-12-08 20:15 - 2016-11-02 11:42 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe
2016-12-08 20:15 - 2016-11-02 11:38 - 22563840 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2016-12-08 20:15 - 2016-11-02 11:37 - 19415040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2016-12-08 20:15 - 2016-11-02 11:36 - 19415552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-12-08 20:15 - 2016-11-02 11:34 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe
2016-12-08 20:15 - 2016-11-02 11:31 - 03196416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2016-12-08 20:15 - 2016-11-02 11:31 - 01228288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usercpl.dll
2016-12-08 20:15 - 2016-11-02 11:31 - 00159232 _____ (Microsoft Corporation) C:\WINDOWS\system32\ACPBackgroundManagerPolicy.dll
2016-12-08 20:15 - 2016-11-02 11:31 - 00097792 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2016-12-08 20:15 - 2016-11-02 11:30 - 12175360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-12-08 20:15 - 2016-11-02 11:30 - 09131008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2016-12-08 20:15 - 2016-11-02 11:30 - 00567296 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevicePairing.dll
2016-12-08 20:15 - 2016-11-02 11:29 - 07469056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2016-12-08 20:15 - 2016-11-02 11:29 - 03666432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-12-08 20:15 - 2016-11-02 11:29 - 01247232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2016-12-08 20:15 - 2016-11-02 11:29 - 00296960 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsensorgroup.dll
2016-12-08 20:15 - 2016-11-02 11:28 - 06044160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2016-12-08 20:15 - 2016-11-02 11:28 - 00807424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.OnlineId.dll
2016-12-08 20:15 - 2016-11-02 11:28 - 00411136 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCenter.dll
2016-12-08 20:15 - 2016-11-02 11:28 - 00240640 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkDesktopSettings.dll
2016-12-08 20:15 - 2016-11-02 11:28 - 00115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\IdCtrls.dll
2016-12-08 20:15 - 2016-11-02 11:27 - 23677952 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-12-08 20:15 - 2016-11-02 11:27 - 00631296 _____ (Microsoft Corporation) C:\WINDOWS\system32\WlanMediaManager.dll
2016-12-08 20:15 - 2016-11-02 11:27 - 00495104 _____ (Microsoft Corporation) C:\WINDOWS\system32\DataSenseHandlers.dll
2016-12-08 20:15 - 2016-11-02 11:26 - 00388608 _____ (Microsoft Corporation) C:\WINDOWS\system32\zipfldr.dll
2016-12-08 20:15 - 2016-11-02 11:26 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
2016-12-08 20:15 - 2016-11-02 11:25 - 00655872 _____ (Microsoft Corporation) C:\WINDOWS\system32\sud.dll
2016-12-08 20:15 - 2016-11-02 11:25 - 00496128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.UserAccountsHandlers.dll
2016-12-08 20:15 - 2016-11-02 11:24 - 00940032 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontext.dll
2016-12-08 20:15 - 2016-11-02 11:23 - 03106304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe
2016-12-08 20:15 - 2016-11-02 11:23 - 02104320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
2016-12-08 20:15 - 2016-11-02 11:22 - 13081600 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-12-08 20:15 - 2016-11-02 11:22 - 04749312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2016-12-08 20:15 - 2016-11-02 11:22 - 00337920 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2016-12-08 20:15 - 2016-11-02 11:21 - 05111296 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2016-12-08 20:15 - 2016-11-02 11:21 - 00942080 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2016-12-08 20:15 - 2016-11-02 11:20 - 02273792 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2016-12-08 20:15 - 2016-11-02 11:19 - 08127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2016-12-08 20:15 - 2016-11-02 11:19 - 08075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2016-12-08 20:15 - 2016-11-02 11:19 - 01586176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2016-12-08 20:15 - 2016-11-02 11:19 - 00981504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll
2016-12-08 20:15 - 2016-11-02 11:19 - 00805888 _____ (Microsoft Corporation) C:\WINDOWS\system32\FrameServer.dll
2016-12-08 20:15 - 2016-11-02 11:19 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\NPSM.dll
2016-12-08 20:15 - 2016-11-02 11:18 - 01690112 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2016-12-08 20:15 - 2016-11-02 11:17 - 04746752 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-12-08 20:15 - 2016-11-02 11:17 - 00982528 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2016-12-08 20:15 - 2016-11-02 11:17 - 00828416 _____ (Microsoft Corporation) C:\WINDOWS\system32\appwiz.cpl
2016-12-08 20:15 - 2016-11-02 11:17 - 00389632 _____ (Microsoft Corporation) C:\WINDOWS\system32\stobject.dll
2016-12-08 20:15 - 2016-11-02 11:16 - 03400192 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncCenter.dll
2016-12-08 20:15 - 2016-11-02 11:16 - 02688512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2016-12-08 20:15 - 2016-11-02 11:16 - 02669056 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-12-08 20:15 - 2016-11-02 11:16 - 02512384 _____ (Microsoft Corporation) C:\WINDOWS\system32\themecpl.dll
2016-12-08 20:15 - 2016-11-02 11:16 - 01779712 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-12-08 20:15 - 2016-11-02 11:16 - 00770560 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2016-12-08 20:15 - 2016-11-02 11:16 - 00629248 _____ (Microsoft Corporation) C:\WINDOWS\system32\hgcpl.dll
2016-12-08 20:15 - 2016-11-02 11:16 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppBroker.dll
2016-12-08 20:15 - 2016-11-02 11:15 - 04708864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
2016-12-08 20:15 - 2016-11-02 11:15 - 02611200 _____ (Microsoft Corporation) C:\WINDOWS\system32\gameux.dll
2016-12-08 20:15 - 2016-11-02 11:15 - 01513472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2016-12-08 20:15 - 2016-11-02 11:15 - 01348608 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2016-12-08 20:15 - 2016-11-02 11:13 - 03496960 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVidCtl.dll
2016-12-08 20:15 - 2016-11-02 11:13 - 03299840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstsc.exe
2016-12-08 20:15 - 2016-11-02 10:11 - 00788624 _____ C:\WINDOWS\SysWOW64\locale.nls
2016-12-08 20:15 - 2016-11-02 10:11 - 00788624 _____ C:\WINDOWS\system32\locale.nls
2016-12-08 20:15 - 2016-10-15 05:51 - 02186896 _____ (Microsoft Corporation) C:\WINDOWS\system32\hevcdecoder.dll
2016-12-08 20:15 - 2016-10-15 05:38 - 00500064 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
2016-12-08 20:15 - 2016-10-15 05:34 - 01969912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hevcdecoder.dll
2016-12-08 20:15 - 2016-10-15 05:31 - 02190688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2016-12-08 20:15 - 2016-10-15 05:31 - 00658272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2016-12-08 20:15 - 2016-10-15 05:19 - 00272720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wintrust.dll
2016-12-08 20:15 - 2016-10-15 05:18 - 02166232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2016-12-08 20:15 - 2016-10-15 05:18 - 01556712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2016-12-08 20:15 - 2016-10-15 05:11 - 01435896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2016-12-08 20:15 - 2016-10-15 05:06 - 05685760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2016-12-08 20:15 - 2016-10-15 05:05 - 07216640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2016-12-08 20:15 - 2016-10-15 05:00 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll
2016-12-08 20:15 - 2016-10-15 04:59 - 00272384 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfksproxy.dll
2016-12-08 20:15 - 2016-10-15 04:59 - 00130560 _____ (Microsoft Corporation) C:\WINDOWS\splwow64.exe
2016-12-08 20:15 - 2016-10-15 04:59 - 00018432 _____ (Microsoft Corporation) C:\WINDOWS\system32\stdole2.tlb
2016-12-08 20:15 - 2016-10-15 04:56 - 00327680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2016-12-08 20:15 - 2016-10-15 04:56 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.WiFi.dll
2016-12-08 20:15 - 2016-10-15 04:55 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidclass.sys
2016-12-08 20:15 - 2016-10-15 04:54 - 00717312 _____ (Microsoft Corporation) C:\WINDOWS\system32\taskbarcpl.dll
2016-12-08 20:15 - 2016-10-15 04:54 - 00217088 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevicePairingFolder.dll
2016-12-08 20:15 - 2016-10-15 04:54 - 00043520 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2016-12-08 20:15 - 2016-10-15 04:52 - 00410624 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpsvc.dll
2016-12-08 20:15 - 2016-10-15 04:52 - 00339456 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpusersvc.dll
2016-12-08 20:15 - 2016-10-15 04:52 - 00163328 _____ (Microsoft Corporation) C:\WINDOWS\system32\autoplay.dll
2016-12-08 20:15 - 2016-10-15 04:51 - 13868544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2016-12-08 20:15 - 2016-10-15 04:51 - 00429568 _____ (Microsoft Corporation) C:\WINDOWS\system32\SndVolSSO.dll
2016-12-08 20:15 - 2016-10-15 04:49 - 00111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAppInstaller.exe
2016-12-08 20:15 - 2016-10-15 04:46 - 00471552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.BackgroundMediaPlayback.dll
2016-12-08 20:15 - 2016-10-15 04:45 - 01790464 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationFramework.dll
2016-12-08 20:15 - 2016-10-15 04:44 - 00636928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll
2016-12-08 20:15 - 2016-10-15 04:44 - 00470016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.BackgroundMediaPlayer.dll
2016-12-08 20:15 - 2016-10-15 04:42 - 00467968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Geolocation.dll
2016-12-08 20:15 - 2016-10-15 04:42 - 00459776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.MediaPlayer.dll
2016-12-08 20:15 - 2016-10-15 04:41 - 00945664 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll
2016-12-08 20:15 - 2016-10-15 04:38 - 00675840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.dll
2016-12-08 20:15 - 2016-10-15 04:37 - 01643008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll
2016-12-08 20:15 - 2016-10-15 04:36 - 00792064 _____ (Microsoft Corporation) C:\WINDOWS\system32\spoolsv.exe
2016-12-08 20:15 - 2016-10-15 04:36 - 00542208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.Connectivity.dll
2016-12-08 20:15 - 2016-10-15 04:36 - 00347136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Display.dll
2016-12-08 20:15 - 2016-10-15 04:35 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2016-12-08 20:15 - 2016-10-15 04:34 - 02476544 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2016-12-08 20:15 - 2016-10-15 04:32 - 00886784 _____ (Microsoft Corporation) C:\WINDOWS\system32\CPFilters.dll
2016-12-08 20:14 - 2016-11-02 12:22 - 00601712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2016-12-08 20:14 - 2016-11-02 12:20 - 00378720 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2016-12-08 20:14 - 2016-11-02 12:15 - 01051112 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2016-12-08 20:14 - 2016-11-02 12:15 - 00894096 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2016-12-08 20:14 - 2016-11-02 12:14 - 07816544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-12-08 20:14 - 2016-11-02 12:13 - 01354320 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2016-12-08 20:14 - 2016-11-02 12:13 - 01173496 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2016-12-08 20:14 - 2016-11-02 12:13 - 00423776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifitask.exe
2016-12-08 20:14 - 2016-11-02 12:08 - 00111968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupApi.dll
2016-12-08 20:14 - 2016-11-02 12:05 - 20969928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2016-12-08 20:14 - 2016-11-02 12:04 - 02678056 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2016-12-08 20:14 - 2016-11-02 12:04 - 00596832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comctl32.dll
2016-12-08 20:14 - 2016-11-02 12:02 - 00848736 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll
2016-12-08 20:14 - 2016-11-02 12:02 - 00148832 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll
2016-12-08 20:14 - 2016-11-02 12:01 - 00276832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\input.dll
2016-12-08 20:14 - 2016-11-02 12:01 - 00092512 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2016-12-08 20:14 - 2016-11-02 12:00 - 04130432 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2016-12-08 20:14 - 2016-11-02 12:00 - 01061968 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
2016-12-08 20:14 - 2016-11-02 11:56 - 01609920 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d9.dll
2016-12-08 20:14 - 2016-11-02 11:56 - 01572768 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2016-12-08 20:14 - 2016-11-02 11:56 - 01418312 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2016-12-08 20:14 - 2016-11-02 11:56 - 00628552 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2016-12-08 20:14 - 2016-11-02 11:56 - 00322912 _____ (Microsoft Corporation) C:\WINDOWS\system32\input.dll
2016-12-08 20:14 - 2016-11-02 11:55 - 00048992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\iorate.sys
2016-12-08 20:14 - 2016-11-02 11:48 - 00095232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSpkg.dll
2016-12-08 20:14 - 2016-11-02 11:48 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2016-12-08 20:14 - 2016-11-02 11:48 - 00032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\efsext.dll
2016-12-08 20:14 - 2016-11-02 11:47 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll
2016-12-08 20:14 - 2016-11-02 11:47 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BcastDVRHelper.dll
2016-12-08 20:14 - 2016-11-02 11:46 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppCapture.dll
2016-12-08 20:14 - 2016-11-02 11:45 - 00492032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.exe
2016-12-08 20:14 - 2016-11-02 11:45 - 00253952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BioFeedback.dll
2016-12-08 20:14 - 2016-11-02 11:45 - 00182784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsensorgroup.dll
2016-12-08 20:14 - 2016-11-02 11:44 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2016-12-08 20:14 - 2016-11-02 11:43 - 00731136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d8.dll
2016-12-08 20:14 - 2016-11-02 11:43 - 00270336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2016-12-08 20:14 - 2016-11-02 11:43 - 00198144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FSClient.dll
2016-12-08 20:14 - 2016-11-02 11:43 - 00126464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2016-12-08 20:14 - 2016-11-02 11:42 - 00866816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Cred.dll
2016-12-08 20:14 - 2016-11-02 11:42 - 00549376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActionCenterCPL.dll
2016-12-08 20:14 - 2016-11-02 11:42 - 00306176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2016-12-08 20:14 - 2016-11-02 11:42 - 00202752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.HumanInterfaceDevice.dll
2016-12-08 20:14 - 2016-11-02 11:41 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2016-12-08 20:14 - 2016-11-02 11:40 - 00548352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ddraw.dll
2016-12-08 20:14 - 2016-11-02 11:40 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll
2016-12-08 20:14 - 2016-11-02 11:39 - 00465920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppBroker.dll
2016-12-08 20:14 - 2016-11-02 11:39 - 00236544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAnimation.dll
2016-12-08 20:14 - 2016-11-02 11:36 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ErrorDetailsUpdate.dll
2016-12-08 20:14 - 2016-11-02 11:35 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msinfo32.exe
2016-12-08 20:14 - 2016-11-02 11:34 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-system-events.dll
2016-12-08 20:14 - 2016-11-02 11:33 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2016-12-08 20:14 - 2016-11-02 11:32 - 00045056 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2016-12-08 20:14 - 2016-11-02 11:31 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\system32\BcastDVRHelper.dll
2016-12-08 20:14 - 2016-11-02 11:31 - 00170496 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppCapture.dll
2016-12-08 20:14 - 2016-11-02 11:31 - 00090624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2016-12-08 20:14 - 2016-11-02 11:31 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininetlui.dll
2016-12-08 20:14 - 2016-11-02 11:30 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\system32\FlightSettings.dll
2016-12-08 20:14 - 2016-11-02 11:30 - 00363520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BioFeedback.dll
2016-12-08 20:14 - 2016-11-02 11:30 - 00321536 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2016-12-08 20:14 - 2016-11-02 11:30 - 00134144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ErrorDetails.dll
2016-12-08 20:14 - 2016-11-02 11:29 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll
2016-12-08 20:14 - 2016-11-02 11:29 - 00314880 _____ (Microsoft Corporation) C:\WINDOWS\system32\FSClient.dll
2016-12-08 20:14 - 2016-11-02 11:29 - 00276992 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2016-12-08 20:14 - 2016-11-02 11:29 - 00211968 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2016-12-08 20:14 - 2016-11-02 11:29 - 00139264 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2016-12-08 20:14 - 2016-11-02 11:28 - 00748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2016-12-08 20:14 - 2016-11-02 11:28 - 00690176 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2016-12-08 20:14 - 2016-11-02 11:28 - 00321024 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkUXBroker.dll
2016-12-08 20:14 - 2016-11-02 11:28 - 00279552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.HumanInterfaceDevice.dll
2016-12-08 20:14 - 2016-11-02 11:28 - 00260608 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe
2016-12-08 20:14 - 2016-11-02 11:28 - 00088576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2016-12-08 20:14 - 2016-11-02 11:28 - 00079360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\asycfilt.dll
2016-12-08 20:14 - 2016-11-02 11:27 - 00605184 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.exe
2016-12-08 20:14 - 2016-11-02 11:27 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll
2016-12-08 20:14 - 2016-11-02 11:26 - 01880576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2016-12-08 20:14 - 2016-11-02 11:26 - 01595392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-12-08 20:14 - 2016-11-02 11:26 - 01509376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2016-12-08 20:14 - 2016-11-02 11:26 - 00798208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2016-12-08 20:14 - 2016-11-02 11:26 - 00273920 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAnimation.dll
2016-12-08 20:14 - 2016-11-02 11:25 - 02256384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-12-08 20:14 - 2016-11-02 11:25 - 00956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2016-12-08 20:14 - 2016-11-02 11:25 - 00772608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntshrui.dll
2016-12-08 20:14 - 2016-11-02 11:25 - 00541696 _____ (Microsoft Corporation) C:\WINDOWS\system32\ipnathlp.dll
2016-12-08 20:14 - 2016-11-02 11:24 - 03778560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2016-12-08 20:14 - 2016-11-02 11:23 - 02356736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVidCtl.dll
2016-12-08 20:14 - 2016-11-02 11:23 - 00199680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GlobCollationHost.dll
2016-12-08 20:14 - 2016-11-02 11:23 - 00072704 _____ (Microsoft Corporation) C:\WINDOWS\system32\ErrorDetailsUpdate.dll
2016-12-08 20:14 - 2016-11-02 11:20 - 00167936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ErrorDetails.dll
2016-12-08 20:14 - 2016-11-02 11:18 - 00243712 _____ (Microsoft Corporation) C:\WINDOWS\system32\shdocvw.dll
2016-12-08 20:14 - 2016-11-02 11:16 - 04148736 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2016-12-08 20:14 - 2016-11-02 11:16 - 01637888 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2016-12-08 20:14 - 2016-11-02 11:16 - 01490944 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-12-08 20:14 - 2016-11-02 11:16 - 00265728 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll
2016-12-08 20:14 - 2016-11-02 11:15 - 03616768 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2016-12-08 20:14 - 2016-11-02 11:15 - 00842240 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntshrui.dll
2016-12-08 20:14 - 2016-11-02 11:13 - 00322048 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll
2016-12-08 20:14 - 2016-10-15 05:51 - 00283488 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2016-12-08 20:14 - 2016-10-15 05:38 - 00409952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS
2016-12-08 20:14 - 2016-10-15 05:37 - 00063328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dam.sys
2016-12-08 20:14 - 2016-10-15 05:33 - 00455040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DolbyDecMFT.dll
2016-12-08 20:14 - 2016-10-15 05:31 - 02827864 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2016-12-08 20:14 - 2016-10-15 05:31 - 00402272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2016-12-08 20:14 - 2016-10-15 05:30 - 01851696 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2016-12-08 20:14 - 2016-10-15 05:30 - 00557408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2016-12-08 20:14 - 2016-10-15 05:29 - 02913104 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2016-12-08 20:14 - 2016-10-15 05:29 - 01267504 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll
2016-12-08 20:14 - 2016-10-15 05:29 - 00335712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2016-12-08 20:14 - 2016-10-15 05:26 - 01990648 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2016-12-08 20:14 - 2016-10-15 05:26 - 01472536 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
2016-12-08 20:14 - 2016-10-15 05:26 - 00811416 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFCaptureEngine.dll
2016-12-08 20:14 - 2016-10-15 05:26 - 00691080 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
2016-12-08 20:14 - 2016-10-15 05:22 - 01461200 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2016-12-08 20:14 - 2016-10-15 05:21 - 02537824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2016-12-08 20:14 - 2016-10-15 05:21 - 00584032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys
2016-12-08 20:14 - 2016-10-15 05:18 - 00846560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll
2016-12-08 20:14 - 2016-10-15 05:18 - 00749920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\drvstore.dll
2016-12-08 20:14 - 2016-10-15 04:59 - 00187904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfksproxy.dll
2016-12-08 20:14 - 2016-10-15 04:57 - 00039424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dtdump.exe
2016-12-08 20:14 - 2016-10-15 04:56 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdd.dll
2016-12-08 20:14 - 2016-10-15 04:56 - 00219648 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSrvPolicyManager.dll
2016-12-08 20:14 - 2016-10-15 04:56 - 00120832 _____ (Microsoft Corporation) C:\WINDOWS\system32\BluetoothApis.dll
2016-12-08 20:14 - 2016-10-15 04:56 - 00098816 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthRadioMedia.dll
2016-12-08 20:14 - 2016-10-15 04:56 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\system32\HttpsDataSource.dll
2016-12-08 20:14 - 2016-10-15 04:55 - 00265728 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcore6.dll
2016-12-08 20:14 - 2016-10-15 04:55 - 00236544 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_Flights.dll
2016-12-08 20:14 - 2016-10-15 04:55 - 00142336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.WiFi.dll
2016-12-08 20:14 - 2016-10-15 04:54 - 00410112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SndVolSSO.dll
2016-12-08 20:14 - 2016-10-15 04:54 - 00241152 _____ (Microsoft Corporation) C:\WINDOWS\system32\dafBth.dll
2016-12-08 20:14 - 2016-10-15 04:53 - 00147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll
2016-12-08 20:14 - 2016-10-15 04:52 - 06285312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2016-12-08 20:14 - 2016-10-15 04:50 - 02333184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmSvc.dll
2016-12-08 20:14 - 2016-10-15 04:50 - 00438784 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDec.dll
2016-12-08 20:14 - 2016-10-15 04:50 - 00310272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2016-12-08 20:14 - 2016-10-15 04:49 - 00838144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JpMapControl.dll
2016-12-08 20:14 - 2016-10-15 04:49 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSManHTTPConfig.exe
2016-12-08 20:14 - 2016-10-15 04:48 - 01323008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_fs.dll
2016-12-08 20:14 - 2016-10-15 04:47 - 01113600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll
2016-12-08 20:14 - 2016-10-15 04:47 - 00558080 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnprv.dll
2016-12-08 20:14 - 2016-10-15 04:45 - 00406016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2016-12-08 20:14 - 2016-10-15 04:44 - 00090112 _____ (Microsoft Corporation) C:\WINDOWS\system32\powercfg.exe
2016-12-08 20:14 - 2016-10-15 04:43 - 00078336 _____ (Microsoft Corporation) C:\WINDOWS\system32\iscsiwmi.dll
2016-12-08 20:14 - 2016-10-15 04:42 - 06108672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2016-12-08 20:14 - 2016-10-15 04:42 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\powercfg.exe
2016-12-08 20:14 - 2016-10-15 04:41 - 05376000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2016-12-08 20:14 - 2016-10-15 04:39 - 04474368 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll
2016-12-08 20:14 - 2016-10-15 04:39 - 01005568 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3D12.dll
2016-12-08 20:14 - 2016-10-15 04:39 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll
2016-12-08 20:14 - 2016-10-15 04:37 - 00715264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlCore.dll
2016-12-08 20:14 - 2016-10-15 04:37 - 00709120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CPFilters.dll
2016-12-08 20:14 - 2016-10-15 04:36 - 02290176 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2016-12-08 20:14 - 2016-10-15 04:36 - 01170944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll
2016-12-08 20:14 - 2016-10-15 04:35 - 00760832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NMAA.dll
2016-12-08 20:14 - 2016-10-15 04:34 - 01840640 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2016-12-08 20:14 - 2016-10-15 04:31 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2016-12-08 20:14 - 2016-09-10 14:21 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\capimg.sys
2016-12-08 20:14 - 2016-08-27 06:12 - 00244816 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2016-12-08 20:14 - 2016-08-06 05:17 - 00619368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2016-12-08 20:14 - 2016-08-02 05:30 - 00822784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2016-11-22 16:53 - 2016-11-22 16:53 - 00000000 ____D C:\Users\bambi\Desktop\Facebook
2016-11-21 19:06 - 2016-11-21 19:06 - 00014484 _____ C:\Users\bambi\Documents\taufe 1 und 2.dxp
2016-11-21 18:30 - 2016-11-21 18:30 - 00001231 _____ C:\Users\Public\Desktop\CDBurnerXP.lnk
2016-11-20 18:09 - 2016-11-21 18:27 - 00000000 ____D C:\Users\bambi\Desktop\Taufe

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2016-12-16 15:17 - 2016-07-16 12:47 - 00000000 ___HD C:\Program Files\WindowsApps
2016-12-16 15:17 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-12-16 15:17 - 2016-07-16 12:45 - 00000000 ____D C:\WINDOWS\INF
2016-12-16 15:14 - 2016-11-12 18:01 - 00000000 ____D C:\Users\bambi
2016-12-16 15:12 - 2015-02-03 12:59 - 00000000 __SHD C:\Users\bambi\IntelGraphicsProfiles
2016-12-16 15:12 - 2013-01-14 22:32 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-12-16 15:11 - 2013-01-14 17:49 - 00000000 ____D C:\Users\bambi\AppData\LocalLow\AuthenTec
2016-12-16 15:04 - 2016-11-12 18:34 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-12-16 15:03 - 2016-11-12 17:51 - 00259640 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-12-08 20:37 - 2016-07-16 07:04 - 00524288 _____ C:\WINDOWS\system32\config\BBI
2016-12-08 20:36 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2016-12-08 20:36 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\oobe
2016-12-08 20:36 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\migwiz
2016-12-08 20:35 - 2016-07-16 12:47 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2016-12-08 20:35 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\appraiser
2016-12-08 20:35 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\ShellExperiences
2016-12-08 20:35 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\bcastdvr
2016-12-08 20:34 - 2016-07-16 12:47 - 00015425 _____ C:\WINDOWS\system32\OEMDefaultAssociations.xml
2016-12-08 20:29 - 2016-07-16 12:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-12-03 04:55 - 2016-11-12 17:51 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2016-11-25 05:06 - 2016-11-12 17:45 - 00000000 ____D C:\Windows.old
2016-11-25 04:44 - 2016-11-08 17:54 - 00000000 ____D C:\Users\Public\Documents\AdobeGC
2016-11-25 04:41 - 2014-02-19 11:10 - 00000000 ____D C:\Users\bambi\AppData\Local\Packages
2016-11-25 04:38 - 2014-02-19 11:20 - 00000000 ____D C:\Users\bambi\AppData\Local\Adobe
2016-11-22 17:20 - 2016-07-16 23:51 - 00500774 _____ C:\WINDOWS\system32\perfh007.dat
2016-11-22 17:20 - 2016-07-16 23:51 - 00089628 _____ C:\WINDOWS\system32\perfc007.dat
2016-11-22 17:20 - 2015-12-25 16:36 - 01474824 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-11-22 17:15 - 2015-06-24 16:57 - 00000000 ____D C:\Program Files (x86)\CDBurnerXP
2016-11-22 16:54 - 2014-02-19 11:19 - 00000000 ____D C:\Users\bambi\AppData\Local\Google
2016-11-22 16:47 - 2014-02-19 20:00 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2016-11-21 18:30 - 2015-06-24 16:57 - 00001181 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2016-11-20 18:38 - 2014-02-21 18:17 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-11-20 18:28 - 2014-02-21 18:17 - 141011376 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-11-16 04:20 - 2016-11-12 18:39 - 00000000 ____D C:\Users\bambi\AppData\Local\ConnectedDevicesPlatform
2016-11-16 04:15 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\appcompat
2016-11-16 04:14 - 2016-06-09 16:42 - 00002331 _____ C:\Users\bambi\Desktop\Google Chrome.lnk

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2014-02-19 11:12 - 2014-02-19 11:12 - 0000000 _____ () C:\Users\bambi\AppData\Roaming\AbsoluteReminder.xml
2015-03-13 17:44 - 2015-03-13 17:52 - 0001456 _____ () C:\Users\bambi\AppData\Local\Adobe Für Web speichern 13.0 Prefs
2015-04-16 18:21 - 2015-04-16 18:22 - 0003584 _____ () C:\Users\bambi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-02-22 18:46 - 2014-02-22 18:46 - 0007602 _____ () C:\Users\bambi\AppData\Local\Resmon.ResmonCfg
2014-03-04 18:38 - 2014-03-04 18:38 - 0000057 _____ () C:\ProgramData\Ament.ini
2012-10-18 07:32 - 2014-02-19 12:03 - 0001638 _____ () C:\ProgramData\MH_ErrorLog.txt
2012-10-18 07:23 - 2012-10-18 07:23 - 0000107 _____ () C:\ProgramData\{324F76CC-D8DD-4D87-B77D-D4AF5E1AA7B3}.log
2012-10-18 07:20 - 2012-10-18 07:21 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2012-10-18 07:21 - 2012-10-18 07:22 - 0000110 _____ () C:\ProgramData\{B7A0CE06-068E-11D6-97FD-0050BACBF861}.log
2012-10-18 07:22 - 2012-10-18 07:23 - 0000115 _____ () C:\ProgramData\{D6E853EC-8960-4D44-AF03-7361BB93227C}.log

==================== Bamital & volsnap ======================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert

LastRegBack: 2016-11-25 04:54

==================== Ende von FRST.txt ============================

kakuzu 21.12.2016 21:12
Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 07-12-2016
durchgeführt von bambi (16-12-2016 15:20:41)
Gestartet von C:\Users\bambi\Downloads
Windows 10 Home Version 1607 (X64) (2016-11-12 17:39:26)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-510132055-1619855064-2757486123-500 - Administrator - Disabled) => C:\Users\Administrator
bambi (S-1-5-21-510132055-1619855064-2757486123-1001 - Administrator - Enabled) => C:\Users\bambi
benny (S-1-5-21-510132055-1619855064-2757486123-1019 - Limited - Enabled)
DefaultAccount (S-1-5-21-510132055-1619855064-2757486123-503 - Limited - Disabled)
Gast (S-1-5-21-510132055-1619855064-2757486123-501 - Limited - Disabled)

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

"Durchstarten mit Ponky - Mathe 1+2" (HKLM-x32\...\"Durchstarten mit Ponky - Mathe 1+2") (Version: 2.00 - Engel Edition)
"Englisch in der Grundschule mit Ponky 1.+2. Kl." (HKLM-x32\...\"Englisch in der Grundschule mit Ponky 1.+2. Kl.") (Version: 2.00 - Engel Edition)
"Ponky gezielt Deutsch 1+2" (HKLM-x32\...\"Ponky gezielt Deutsch 1+2") (Version: 2.00 - Engel Edition)
7-Zip 9.22 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0922-000001000000}) (Version: 9.22.00.0 - Igor Pavlov)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 18.0.0.199 - Adobe Systems Incorporated)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 3.3.0.151 - Adobe Systems Incorporated)
Adobe Photoshop CC 2014 (HKLM-x32\...\{D7A4F897-B20A-42D0-862D-CB5F6DB7391D}) (Version: 15.2.2 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader (HKLM-x32\...\AmUStor) (Version: 3.12.3042.71515 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 3.12.3042.71515 - Alcor Micro Corp.) Hidden
Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 7.01.00 - )
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 11.1.2245 - AVAST Software)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
BlueStacks App Player (HKLM-x32\...\BlueStacks App Player) (Version: 0.8.10.3096 - BlueStack Systems, Inc.)
BlueStacks Notification Center (HKLM-x32\...\{0BED0B96-70B8-4893-884B-DC485DC8C1B7}) (Version: 0.8.10.3096 - BlueStack Systems, Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Broadcom 802.11 Network Adapter (HKLM\...\Broadcom 802.11 Network Adapter) (Version: 6.30.59.151 - Broadcom Corporation)
Canon Utilities Digital Photo Professional 3.10 (HKLM-x32\...\DPP) (Version: 3.10.2.0 - Canon Inc.)
Canon Utilities EOS Sample Music (HKLM-x32\...\EOS Sample Music) (Version: 1.0.0.204 - Canon Inc.)
Canon Utilities EOS Utility (HKLM-x32\...\EOS Utility) (Version: 2.10.2.0 - Canon Inc.)
Canon Utilities PhotoStitch (HKLM-x32\...\PhotoStitch) (Version: 3.1.22.46 - Canon Inc.)
Canon Utilities Picture Style Editor (HKLM-x32\...\Picture Style Editor) (Version: 1.9.0.0 - Canon Inc.)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.7.6389 - CDBurnerXP)
Cisco EAP-FAST Module (x32 Version: 2.2.14 - Cisco Systems, Inc.) Hidden
Cisco LEAP Module (x32 Version: 1.0.19 - Cisco Systems, Inc.) Hidden
Cisco PEAP Module (x32 Version: 1.1.6 - Cisco Systems, Inc.) Hidden
Classic Shell (HKLM\...\{2368907C-E8F6-4750-A023-254C3E2B5E8D}) (Version: 4.0.4 - IvoSoft)
CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4420.52 - CyberLink Corp.)
Duden Deutsch 3 (HKLM-x32\...\Duden Deutsch 3_is1) (Version:  - Duden Paetec)
Fingerprint Reader (HKLM\...\{1CACE706-D749-44CA-BBFE-AF60946D1B18}) (Version: 6.0.200.75 - AuthenTec, Inc.)
FlashFXP 5 (HKLM-x32\...\FlashFXP 5) (Version: 5.0.0.3791 - OpenSight Software LLC)
FreeRIP MP3 Converter 4.5.2 (HKLM-x32\...\{501451DE-5808-4599-B544-8BD0915B6B24}_is1) (Version: 4.5.2 - GreenTree Applications SRL)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 54.0.2840.99 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden
Google+ Auto Backup (HKLM-x32\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
Helium (HKLM-x32\...\{9A781940-AC41-4D5E-8E1E-76A04B916FB9}) (Version: 1.0.0 - ClockworkMod)
HP Deskjet 3070 B611 series - Grundlegende Software für das Gerät (HKLM\...\{48DF59F8-2ACD-4F1F-87F3-D820FE7A6178}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP ePrint (HKLM-x32\...\{2794875B-6CCF-48B8-84A5-5B10DB98BEE6}) (Version: 12.0.13351.1658 - Hewlett-Packard)
HP Officejet Pro 6830 - Grundlegende Software für das Gerät (HKLM\...\{5DC2B010-E138-4A57-A5C4-D7C702FFFA44}) (Version: 33.1.73.49987 - Hewlett-Packard Co.)
HP Officejet Pro 6830 Hilfe (HKLM-x32\...\{5EB6AD89-997E-4F65-BA3F-0D072BE1CB4F}) (Version: 34.0.0 - Hewlett Packard)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Ich sehe was ... die große Schatzsuche (HKLM-x32\...\{3170BDC4-4BF9-42AE-81BC-14D4F60569C0}) (Version: 1.00.0000 - )
Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33057) (Version: 3.6.1.33057.10 - Intel)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4276 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Java 7 Update 80 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217080FF}) (Version: 7.0.800 - Oracle)
Lenovo Auto Scroll Utility (HKLM\...\LenovoAutoScrollUtility) (Version: 1.32 - )
Lenovo EasyCamera (HKLM-x32\...\{ADE16A9D-FBDC-4ecc-B6BD-9C31E51D0332}) (Version: 3.15.0414.1 - Vimicro)
Lenovo Patch Utility 64 bit (HKLM\...\{ABE4638D-D208-4061-9F26-E3E11E3A1E0C}) (Version: 1.3.1.1 - Lenovo Group Limited)
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.10.15 - Lenovo)
Lenovo Settings - Camera Audio (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 4.0.5.0 - Lenovo Corporation)
Lenovo Settings Dependency Package (HKLM\...\{3694BA2E-BE31-4B7E-886B-A0B559E69D4D}_is1) (Version: 1.0.0.12 - Lenovo Group Limited)
Lenovo Settings Mobile Hotspot (HKLM\...\{42603F7D-B08D-436B-B0D8-3E2DEF1AFD41}_is1) (Version: 1.0.0.21 - Lenovo)
Lenovo Solution Center (HKLM\...\{14CE4053-33B9-4973-9377-E8D1844C1066}) (Version: 1.1.011.00 - Lenovo Group Limited)
Lernerfolg Grundschule Deutsch Teil 1 und 2 (HKLM-x32\...\{0309FEDE-8014-4DA7-BCEE-DBD5F2A02176}_is1) (Version: LernerfolgGerman 12 v2013 - Tivola)
Lernerfolg Grundschule Englisch Teil 1 und 2 (HKLM-x32\...\{CCF09A05-0B9D-4881-B015-C99637DEB6E4}_is1) (Version: LernerfolgEnglish 12 v2013 - Tivola)
Lernerfolg Grundschule Mathematik Teil 1 und 2 (HKLM-x32\...\{26A5F720-DCF2-4E8E-8BE5-F229041CE1BF}_is1) (Version: LernerfolgMathe 12 v2013 - Tivola)
LibreOffice 4.2.1.1 (HKLM-x32\...\{C83C3B4C-1AFF-4CEA-8078-74E7A3FE8F03}) (Version: 4.2.1.1 - The Document Foundation)
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft Office (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.6120.5004 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Mozilla Firefox 45.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 45.0.1 (x86 de)) (Version: 45.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 45.0.1 - Mozilla)
Nitro Pro 7 (HKLM\...\{3E0150DE-2F78-4673-8815-A5A804F61240}) (Version: 7.4.1.21 - Nitro PDF Software)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
PowerDVD Create (HKLM-x32\...\InstallShield_{DE485075-8CD3-4A1E-9ABC-6412EBA44872}) (Version: 10.0 - CyberLink Corp.)
PowerDVD Create 10 (x32 Version: 10.0.1.1904 - CyberLink Corp.) Hidden
Ravensburger tiptoi (HKLM-x32\...\Ravensburger tiptoi) (Version:  - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.2.612.2012 - Realtek)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.16044.2 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.16044.2 - Samsung Electronics Co., Ltd.) Hidden
Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.59.0 - Samsung Electronics Co., Ltd.)
Studie zur Verbesserung von HP Officejet Pro 6830 (HKLM\...\{A9F6BE81-6915-4458-8D03-254C5F053C26}) (Version: 33.1.73.49987 - Hewlett-Packard Co.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.0.19.1 - Synaptics Incorporated)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.47484 - TeamViewer)
The Inner World 1.2 (HKLM\...\{E8C6E886-0605-416D-BCC1-33B84E08F7EA}) (Version: 1.2 - Headup Games GmbH)
ThinkPad Bluetooth with Enhanced Data Rate Software (HKLM\...\{C6D9ED03-6FCF-4410-9CB7-45CA285F9E11}) (Version: 12.0.0.1900 - Broadcom Corporation)
TomTom HOME (HKLM-x32\...\{BB05590A-6602-43F3-A400-77EA0976BC0A}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Versteckt - Entdeckt! Fantasy (HKLM-x32\...\{09A79A8C-11EA-418B-B7AF-5FA3556C3B8C}) (Version: 1.00.0000 - Terzio Verlag)
WaveEditor (x32 Version: 1.0.1.4013 - CyberLink Corp.) Hidden
Welt der Zahl 2 (HKLM-x32\...\Welt der Zahl 2) (Version:  - Bildungshaus Schulbuchverlage Westermann Schroedel Diesterweg Schöningh Winklers GmbH)
Windows-Treiberpaket - Intel Corporation (iaStorA) HDC  (07/09/2012 11.5.0.1207) (HKLM\...\D71710885D9974CC7D79FF49E8EFAC772C251FFA) (Version: 07/09/2012 11.5.0.1207 - Intel Corporation)
Windows-Treiberpaket - Lenovo 1.66.00.07 (08/15/2012 1.66.00.07) (HKLM\...\E56A6B34B44A7A597FFEBE0E14D81095E0FD4D73) (Version: 08/15/2012 1.66.00.07 - Lenovo)
Zoner Photo Studio 18 (HKLM\...\ZonerPhotoStudio18_DE_is1) (Version: 18.0.1.9 - ZONER software)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-510132055-1619855064-2757486123-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-510132055-1619855064-2757486123-1001_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {08C63703-5EC6-4D19-BA2D-651FCD9CBB0B} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {0ABB0036-CDDB-47D7-9964-19FF7DC4E172} - System32\Tasks\CLMLSvc => C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [2012-05-24] (CyberLink)
Task: {25F81172-4679-427F-8D48-883B47903D76} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {26962F88-5354-4ECE-A514-C51388A43EDB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {2AF78076-4CBD-4E27-AFCD-8E8E65DA2672} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {2C1D8EA6-FDE5-4E50-9FF3-5F22DFCB9D28} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-12-25] (AVAST Software)
Task: {332F6968-9043-4277-9714-651FA6136830} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\WINDOWS\System32\AutoWorkplace.exe
Task: {488E04B5-7FC6-4E54-8146-039ABD955E2A} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {6027ED7C-F31F-49C3-8B60-65CD4623E337} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {7BC6D8FA-0BE6-4D54-A1CC-433A979C1596} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {846BEC0F-8665-48C6-9F88-0795928AA578} - System32\Tasks\Intel\Intel Service Manager => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [2012-07-12] (Intel Corporation)
Task: {8956B0A2-3F0B-4889-99FF-04CE11216205} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {9DA4940D-F2CB-49FE-AC22-B92BB17DF7A1} - System32\Tasks\Lenovo\LSC\Time72Task => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe
Task: {A02DF192-3FFE-4CB1-81CE-4747518D574D} - System32\Tasks\AdobeAAMUpdater-1.0-Andrea-bambi => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2015-09-04] (Adobe Systems Incorporated)
Task: {C1F49AEA-AD11-4229-BF4C-995894738F16} - System32\Tasks\HPCustParticipation HP Officejet Pro 6830 => C:\Program Files\HP\HP Officejet Pro 6830\Bin\HPCustPartic.exe [2014-07-18] (Hewlett-Packard Development Company, LP)
Task: {C38ED66A-B836-4160-8671-F5191140D725} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Task: {C45B5E88-9FA3-4F3D-9744-3F59D547690A} - System32\Tasks\StartPowerDVDService => C:\PROGRAM FILES (x86)\Cyberlink\PowerDVD10\PDVD10Serv.exe [2012-07-13] (CyberLink Corp.)
Task: {CB5849A5-FF43-4EE2-8464-622E51FBDE9C} - System32\Tasks\Lenovo\LSC\RebootCountTask => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe
Task: {E37D5F08-F8BC-4D2A-A637-585E0A8E1B7A} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe
Task: {E45D7A57-66D0-4ABD-B4E2-3BDF0BB34FED} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\lsc.exe
Task: {E665CBCE-B14C-420F-9E38-B9FF13E90F8C} - \WPD\SqmUpload_S-1-5-21-510132055-1619855064-2757486123-1001 -> Keine Datei <==== ACHTUNG
Task: {F01D73BC-D8A9-49B7-BAD5-C8A31304AB53} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {FD55BA6F-2776-4D6F-9177-15C0E7CDA5D9} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

ShortcutWithArgument: C:\Users\bambi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome-Apps\Awesome Screenshot App.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --profile-directory=Default --app-id=mfpiaehgjbbfednooihadalhehabhcjo
ShortcutWithArgument: C:\Users\bambi\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\48499db33039e897\Benny - Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory="Profile 4"

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2016-07-16 12:42 - 2016-07-16 12:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-11-12 17:42 - 2016-11-12 17:42 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2012-10-18 07:30 - 2012-08-29 06:05 - 00115200 _____ () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL
2012-08-14 18:35 - 2012-08-14 18:35 - 00458336 _____ () C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe
2013-11-30 18:46 - 2013-11-26 01:22 - 00607744 _____ () C:\WINDOWS\system32\spool\DRIVERS\x64\3\JobCapsA.DLL
2016-11-12 17:42 - 2016-11-12 17:42 - 02681200 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2012-08-31 03:43 - 2012-08-31 03:43 - 01130344 _____ () C:\Program Files\Lenovo Fingerprint Reader\DataManager.dll
2012-08-31 03:43 - 2012-08-31 03:43 - 00087400 _____ () C:\Program Files\Lenovo Fingerprint Reader\ssutil.dll
2012-08-14 18:35 - 2012-08-14 18:35 - 00013920 _____ () C:\Program Files (x86)\Lenovo\LocationAware\lpdagent.exe
2016-11-12 17:42 - 2016-11-12 17:42 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2015-09-11 19:02 - 2015-09-11 19:02 - 00803488 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
2016-11-12 18:45 - 2016-11-12 18:45 - 01864384 _____ () C:\Users\bambi\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\amd64\ClientTelemetry.dll
2016-11-12 17:43 - 2016-11-12 17:43 - 03388256 _____ () C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\ContentDeliveryManager.Background.dll
2016-11-12 17:43 - 2016-11-12 17:43 - 02263904 _____ () C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\ContentManagementSDK.dll
2012-08-31 03:44 - 2012-08-31 03:44 - 04622184 _____ () C:\Program Files\Lenovo Fingerprint Reader\x86\IEWebSiteLogon.exe
2016-11-12 17:42 - 2016-11-12 17:42 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2016-12-08 20:15 - 2016-11-02 11:30 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2016-12-08 20:15 - 2016-11-02 11:21 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-12-08 20:15 - 2016-11-02 11:15 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-12-08 20:14 - 2016-11-02 11:14 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2016-12-08 20:15 - 2016-11-02 11:15 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2016-12-08 20:15 - 2016-11-02 11:16 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-12-08 20:15 - 2016-11-02 11:17 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-12-08 20:14 - 2016-11-02 11:13 - 00114176 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Dss.BackgroundTask.dll
2016-12-08 20:14 - 2016-11-02 11:13 - 00115712 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\DeviceSideServicesActionUriHandler.dll
2016-12-08 20:15 - 2016-11-02 11:13 - 00522752 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.NodeWinrtWrap.dll
2016-07-16 12:43 - 2016-07-16 23:56 - 00040448 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\dss_service\node_modules\winrt-projections\bin\Winrt_Projections.node
2016-07-16 12:43 - 2016-07-16 23:56 - 00813056 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\dss_service\node_modules\windows.web.http\bin\NodeRT_Windows_Web_Http.node
2016-07-16 12:43 - 2016-07-16 23:56 - 00963584 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\dss_service\node_modules\windows.web.http.headers\bin\NodeRT_Windows_Web_Http_Headers.node
2016-07-16 12:43 - 2016-07-16 23:56 - 00249344 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\dss_service\node_modules\windows.web.http.filters\bin\NodeRT_Windows_Web_Http_Filters.node
2016-07-16 12:43 - 2016-07-16 23:56 - 00572416 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\dss_service\node_modules\windows.storage.streams\bin\NodeRT_Windows_Storage_Streams.node
2016-07-16 12:43 - 2016-07-16 23:56 - 00403968 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\dss_service\node_modules\windows.foundation\bin\NodeRT_Windows_Foundation.node
2016-07-16 12:43 - 2016-07-16 23:56 - 00183296 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\dss_service\node_modules\nodert-buffer-utils\bin\NodeRT_Buffer_Utils.node
2016-11-08 18:10 - 2016-11-08 18:11 - 00055808 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11610.1001.10.0_x64__8wekyb3d8bbwe\WinStoreTasksWrapper.dll
2016-11-21 18:23 - 2016-11-21 18:23 - 00072192 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.9.261.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2016-11-21 18:23 - 2016-11-21 18:23 - 00178688 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.9.261.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2016-11-21 18:23 - 2016-11-21 18:23 - 41609728 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.9.261.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2016-11-20 18:29 - 2016-11-20 18:29 - 01084928 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1611.3132.0_x64__8wekyb3d8bbwe\TimeBackground.dll
2015-08-16 09:22 - 2015-08-16 09:22 - 00102864 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-08-16 09:22 - 2015-08-16 09:22 - 00123976 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-11-22 17:20 - 2016-11-22 17:20 - 03129808 _____ () C:\Program Files\AVAST Software\Avast\defs\16112200\algo.dll
2016-12-16 15:09 - 2016-12-16 15:09 - 03131344 _____ () C:\Program Files\AVAST Software\Avast\defs\16121600\algo.dll
2012-05-24 20:19 - 2012-05-24 20:19 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2012-05-24 20:19 - 2012-05-24 20:19 - 00016400 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2012-10-18 07:05 - 2012-06-25 03:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2012-08-31 03:44 - 2012-08-31 03:44 - 00900456 _____ () C:\Program Files\Lenovo Fingerprint Reader\x86\DataManager.dll
2015-04-14 15:32 - 2015-04-14 15:32 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2016-11-12 19:23 - 2016-11-08 21:29 - 01819240 _____ () C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\libglesv2.dll
2016-11-12 19:23 - 2016-11-08 21:29 - 00093288 _____ () C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\libegl.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)


==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2012-07-26 06:26 - 2014-09-18 16:36 - 00000027 ____A C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1      localhost

==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-510132055-1619855064-2757486123-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\bambi\Pictures\Picasa\Hintergründe\picasabackground-001.bmp
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

HKLM\...\StartupApproved\StartupFolder: => "Bluetooth.lnk"
HKLM\...\StartupApproved\Run: => "HotKeysCmds"
HKLM\...\StartupApproved\Run: => "IgfxTray"
HKLM\...\StartupApproved\Run: => "Persistence"
HKLM\...\StartupApproved\Run: => "LENOVO.TPKNRRES"
HKLM\...\StartupApproved\Run: => "LnvMobHotspotClient"
HKLM\...\StartupApproved\Run: => "RTHDVCPL"
HKLM\...\StartupApproved\Run: => "AmIcoSinglun64"
HKLM\...\StartupApproved\Run: => "SynTPEnh"
HKLM\...\StartupApproved\Run: => "AdobeAAMUpdater-1.0"
HKLM\...\StartupApproved\Run32: => "UpdatePPShortCut"
HKLM\...\StartupApproved\Run32: => "331BigDog"
HKLM\...\StartupApproved\Run32: => "HP Software Update"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "BlueStacks Agent"
HKLM\...\StartupApproved\Run32: => "Adobe Creative Cloud"
HKU\S-1-5-21-510132055-1619855064-2757486123-1001\...\StartupApproved\StartupFolder: => "Tintenwarnungen überwachen - HP Deskjet 3070 B611 series (Netzwerk).lnk"
HKU\S-1-5-21-510132055-1619855064-2757486123-1001\...\StartupApproved\Run: => "Google+ Auto Backup"
HKU\S-1-5-21-510132055-1619855064-2757486123-1001\...\StartupApproved\Run: => "HP Deskjet 3070 B611 series (NET)"
HKU\S-1-5-21-510132055-1619855064-2757486123-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-510132055-1619855064-2757486123-1001\...\StartupApproved\Run: => "TomTomHOME.exe"
HKU\S-1-5-21-510132055-1619855064-2757486123-1001\...\StartupApproved\Run: => "Zoner Photo Studio Autoupdate"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [vm-monitoring-nb-session] => LPort=139
FirewallRules: [{2044E54B-55EE-4B88-93E3-17BBA698CF62}] => C:\Program Files\HP\HP Officejet Pro 6830\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{928AC0B0-89F6-491D-AD2E-E2263F317FA9}] => LPort=5357
FirewallRules: [{3C200A12-11AA-46C8-A9F8-F9B1C7785E3C}] => C:\Program Files\HP\HP Officejet Pro 6830\Bin\DeviceSetup.exe
FirewallRules: [{D1BAC13D-5779-455D-A70B-708B5C80C2D8}] => C:\Program Files\HP\HP Officejet Pro 6830\bin\SendAFax.exe
FirewallRules: [{FA069720-7AB8-410F-9913-20C9A2FA0AAC}] => C:\Program Files\HP\HP Officejet Pro 6830\bin\DigitalWizards.exe
FirewallRules: [{82DB8E59-D0A5-4C26-A11E-470F1A7A80B5}] => C:\Program Files\HP\HP Officejet Pro 6830\bin\FaxApplications.exe
FirewallRules: [{D745F0CF-11A5-4515-80A8-1D57DC85ADA3}] => C:\Program Files\Zoner\Photo Studio 18\Program32\MediaServer.exe
FirewallRules: [{467037BE-D0E6-46D5-A79F-F182000733B1}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{A8B63589-F770-424B-90CF-DA6ACB4FB4D2}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [UDP Query User{20C7C538-8E32-4DA9-ADF7-C24B4879B417}C:\program files (x86)\libreoffice 4\program\soffice.bin] => C:\program files (x86)\libreoffice 4\program\soffice.bin
FirewallRules: [TCP Query User{BA4D9363-8C80-4D55-B7BC-467B9FE4DAC2}C:\program files (x86)\libreoffice 4\program\soffice.bin] => C:\program files (x86)\libreoffice 4\program\soffice.bin
FirewallRules: [UDP Query User{E95126D1-5146-46B0-9524-7C8AECAEE510}C:\users\bambi\appdata\local\temp\_istmp1.dir\_ins5576._mp] => C:\users\bambi\appdata\local\temp\_istmp1.dir\_ins5576._mp
FirewallRules: [TCP Query User{C150D4BF-78AD-4C7B-929B-03F526FB6801}C:\users\bambi\appdata\local\temp\_istmp1.dir\_ins5576._mp] => C:\users\bambi\appdata\local\temp\_istmp1.dir\_ins5576._mp
FirewallRules: [{6B3A7F80-E9B5-4DE9-9A8A-FDF0FAF11C9E}] => C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{A85899CF-FACC-414F-89EF-322CEE194652}] => C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\HPNetworkCommunicator.exe
FirewallRules: [{56377BFB-3287-4322-BC16-C264262B323D}] => C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\DeviceSetup.exe
FirewallRules: [{416131C1-D362-4B39-B756-7433CB83B725}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{D9AC9F65-280A-4A43-B313-63A2169DCCA9}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{967FD29B-87BB-4442-A0AB-188942549C3B}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{F0FBB80A-B4C4-4156-98CE-F66A6922DB6A}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{F0B099C6-675D-4839-B0E6-43F0D7E7BD52}] => C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{D702581A-0E3B-49F5-864D-64EAFF4A3DD6}] => C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{F55FBC3A-E639-4819-B2E7-1BC5FF2A44FC}] => C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{7CDEB123-C68B-4CC4-9CE3-AFFF201B6E96}] => C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{CC3CCF26-1538-4795-922E-4C632D281690}] => C:\Program Files (x86)\Hearthstone\Hearthstone.exe
FirewallRules: [{33263FEE-F2CF-4AA5-9588-2D92919BE1A3}] => C:\Program Files (x86)\Hearthstone\Hearthstone.exe
FirewallRules: [{3BAE4581-B294-4954-AED3-078957DBF6A9}] => C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{A0AC17FD-CF65-46A9-808F-8887D630CD0C}] => C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{748FAAE1-F42F-4A31-AE7E-119EDCFEF6E8}] => C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{E5235CA5-0CF3-4037-8127-60AD6C62A4BC}] => C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{4E1CC2F3-FD86-407E-ACCD-38323C3D6312}] => C:\Users\bambi\AppData\Local\Temp\7zS747F\HPDiagnosticCoreUI.exe
FirewallRules: [{26DE0D83-AC3B-44C5-AA11-F0ABB93B137F}] => C:\Users\bambi\AppData\Local\Temp\7zS747F\HPDiagnosticCoreUI.exe
FirewallRules: [{C517648B-BE8D-4289-A20C-7376C9E1F541}] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Wiederherstellungspunkte =========================

25-11-2016 06:29:16 Geplanter Prüfpunkt
08-12-2016 20:17:45 Windows Update

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (12/16/2016 03:12:37 PM) (Source: Location Task Manager) (EventID: 0) (User: )
Description: (PerformTasks()): Der Ordner "LocalState" konnte nicht abgerufen werden. Überprüfen Sie die Installation von "Lenovo Settings".

Error: (12/16/2016 03:11:46 PM) (Source: Location Task Manager) (EventID: 0) (User: )
Description: (InitAgent()): Der Ordner "LocalState" konnte nicht abgerufen werden. Überprüfen Sie die Installation von "Lenovo Settings".

Error: (12/08/2016 08:18:20 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.

System Error:
Zugriff verweigert
.

Error: (12/08/2016 07:48:04 PM) (Source: Location Task Manager) (EventID: 0) (User: )
Description: (PerformTasks()): Der Ordner "LocalState" konnte nicht abgerufen werden. Überprüfen Sie die Installation von "Lenovo Settings".

Error: (12/08/2016 07:46:58 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 485475641

Error: (12/08/2016 07:46:58 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 485475641

Error: (12/08/2016 07:46:57 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (12/03/2016 04:48:50 AM) (Source: Location Task Manager) (EventID: 0) (User: )
Description: (PerformTasks()): Der Ordner "LocalState" konnte nicht abgerufen werden. Überprüfen Sie die Installation von "Lenovo Settings".

Error: (12/03/2016 04:47:45 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_WbioSrvc, Version: 10.0.14393.0, Zeitstempel: 0x57899b1c
Name des fehlerhaften Moduls: UPKBU.DLL, Version: 1.6.1.341, Zeitstempel: 0x502239a7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000cccd7
ID des fehlerhaften Prozesses: 0x848
Startzeit der fehlerhaften Anwendung: 0x01d244dbd3b96464
Pfad der fehlerhaften Anwendung: C:\WINDOWS\system32\svchost.exe
Pfad des fehlerhaften Moduls: C:\WINDOWS\SYSTEM32\WINBIOPLUGINS\UPKBU.DLL
Berichtskennung: afdd4dea-8a89-4c38-a65f-012f12a6ac19
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (11/25/2016 06:52:35 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Andrea)
Description: Bei der Aktivierung der App „Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy!App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.


Systemfehler:
=============
Error: (12/16/2016 03:14:42 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: Der Server "{784E29F4-5EBE-4279-9948-1E8FE941646D}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (12/16/2016 03:14:08 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Windows Search" wurde nicht richtig gestartet.

Error: (12/16/2016 03:12:06 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Dienst antwortete nicht rechtzeitig auf die Start- oder Steuerungsanforderung.

Error: (12/16/2016 03:12:06 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst FontCache3.0.0.0 erreicht.

Error: (12/16/2016 03:11:48 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 und der APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (12/16/2016 03:11:16 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: Der Server "{B91D5831-B1BD-4608-8198-D72E155020F7}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (12/16/2016 03:09:16 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: Der Server "{B91D5831-B1BD-4608-8198-D72E155020F7}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (12/16/2016 03:05:59 PM) (Source: Microsoft-Windows-Eventlog) (EventID: 30) (User: NT-AUTORITÄT)
Description: Der Ereignisprotokollierungsdienst hat beim Aktivieren des Herausgebers "{0BF2FB94-7B60-4B4D-9766-E82F658DF540}" für den Kanal "Microsoft-Windows-Kernel-ShimEngine/Operational" einen Fehler (5) erkannt. Dieser Fehler hat keinen Einfluss auf den Betrieb des Kanals, beeinträchtigt jedoch die Fähigkeit des Herausgebers, Ereignisse für den Kanal auszulösen. Dieser Fehler ist oft darauf zurückzuführen, dass der Anbieter die ETW-Anbietersicherheit verwendet und der Ereignisprotokoll-Dienstidentität keine Berechtigungen zum Aktivieren gewährt hat.

Error: (12/16/2016 03:05:03 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Computerstandard" wird dem Benutzer "NT-AUTORITÄT\Lokaler Dienst" (SID: S-1-5-19) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{7160A13D-73DA-4CEA-95B9-37356478588A}
 und der APPID
Nicht verfügbar
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (12/16/2016 03:05:03 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Computerstandard" wird dem Benutzer "NT-AUTORITÄT\Lokaler Dienst" (SID: S-1-5-19) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{7160A13D-73DA-4CEA-95B9-37356478588A}
 und der APPID
Nicht verfügbar
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.


==================== Speicherinformationen ===========================

Prozessor: Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz
Prozentuale Nutzung des RAM: 29%
Installierter physikalischer RAM: 7950.22 MB
Verfügbarer physikalischer RAM: 5606.49 MB
Summe virtueller Speicher: 9870.22 MB
Verfügbarer virtueller Speicher: 7611.52 MB

==================== Laufwerke ================================

Drive c: (Windows) (Fixed) (Total:917.29 GB) (Free:791.06 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive d: (INTENSO) (Removable) (Total:14.47 GB) (Free:13.47 GB) FAT32
Drive e: (MY_DATA_100116) (CDROM) (Total:0.53 GB) (Free:0 GB) CDFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 5333A5D9)

Partition: GPT.

========================================================
Disk: 1 (Size: 14.5 GB) (Disk ID: 00000000)

Partition: GPT.

==================== Ende von Addition.txt ============================

deeprybka 22.12.2016 23:09
Schritt 1
Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

kakuzu 25.12.2016 15:29
Sorry das ich jetzt erst Antworte. Derzeit viel zu tun. Dazu dann noch die Feiertage.

Anbei die gewünschte Log und noch ein paar schöne Weihnachtstage wünsche ich.

Code:
15:27:20.0149 0x20c8  TDSS rootkit removing tool 3.1.0.12 Nov  7 2016 07:10:01
15:27:20.0149 0x20c8  UEFI system
15:27:32.0944 0x20c8  ============================================================
15:27:32.0944 0x20c8  Current date / time: 2016/12/25 15:27:32.0944
15:27:32.0944 0x20c8  SystemInfo:
15:27:32.0944 0x20c8 
15:27:32.0944 0x20c8  OS Version: 10.0.14393 ServicePack: 0.0
15:27:32.0944 0x20c8  Product type: Workstation
15:27:32.0944 0x20c8  ComputerName: ANDREA
15:27:32.0960 0x20c8  UserName: bambi
15:27:32.0960 0x20c8  Windows directory: C:\WINDOWS
15:27:32.0960 0x20c8  System windows directory: C:\WINDOWS
15:27:32.0960 0x20c8  Running under WOW64
15:27:32.0960 0x20c8  Processor architecture: Intel x64
15:27:32.0960 0x20c8  Number of processors: 4
15:27:32.0960 0x20c8  Page size: 0x1000
15:27:32.0960 0x20c8  Boot type: Normal boot
15:27:32.0960 0x20c8  CodeIntegrityOptions = 0x00000001
15:27:32.0960 0x20c8  ============================================================
15:27:33.0913 0x20c8  KLMD registered as C:\WINDOWS\system32\drivers\89788915.sys
15:27:33.0913 0x20c8  KLMD ARK init status: drvProperties = 0xFFF00, osBuild = 14393.576, osProperties = 0x19
15:27:34.0476 0x20c8  System UUID: {8F578181-6AEC-6906-06A5-6B3C05F70F9C}
15:27:35.0679 0x20c8  Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
15:27:35.0710 0x20c8  Drive \Device\Harddisk1\DR1 - Size: 0x39EC00000 ( 14.48 Gb ), SectorSize: 0x200, Cylinders: 0x762, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
15:27:35.0726 0x20c8  ============================================================
15:27:35.0726 0x20c8  \Device\Harddisk0\DR0:
15:27:35.0726 0x20c8  GPT partitions:
15:27:35.0726 0x20c8  \Device\Harddisk0\DR0\Partition1: GPT, TypeGUID: {DE94BBA4-06D1-4D40-A16A-BFD50179D6AC}, UniqueGUID: {DCC79824-FE16-4DFA-8B37-9C65AC3863D6}, Name: , StartLBA 0x800, BlocksNum 0x1F4000
15:27:35.0726 0x20c8  \Device\Harddisk0\DR0\Partition2: GPT, TypeGUID: {C12A7328-F81F-11D2-BA4B-00A0C93EC93B}, UniqueGUID: {49C450E2-C441-4FA8-B7D4-7F27266A5DA6}, Name: EFI system partition, StartLBA 0x1F4800, BlocksNum 0x82000
15:27:35.0726 0x20c8  \Device\Harddisk0\DR0\Partition3: GPT, TypeGUID: {E3C9E316-0B5C-4DB8-817D-F92DF00215AE}, UniqueGUID: {40A9D181-38ED-425A-A9A7-D0D49AF570E7}, Name: Microsoft reserved partition, StartLBA 0x276800, BlocksNum 0x40000
15:27:35.0726 0x20c8  \Device\Harddisk0\DR0\Partition4: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {39A47645-888E-421A-842E-AD9F2314A9DD}, Name: Basic data partition, StartLBA 0x2B6800, BlocksNum 0x72A96007
15:27:35.0726 0x20c8  \Device\Harddisk0\DR0\Partition5: GPT, TypeGUID: {DE94BBA4-06D1-4D40-A16A-BFD50179D6AC}, UniqueGUID: {54203E86-19F7-4CD0-8158-7ACACFC45945}, Name: , StartLBA 0x72D4D000, BlocksNum 0x191800
15:27:35.0726 0x20c8  \Device\Harddisk0\DR0\Partition6: GPT, TypeGUID: {DE94BBA4-06D1-4D40-A16A-BFD50179D6AC}, UniqueGUID: {95AC5EFF-6E75-45D6-A1B4-96A86F5C0EF1}, Name: , StartLBA 0x72EDE800, BlocksNum 0xAF000
15:27:35.0726 0x20c8  \Device\Harddisk0\DR0\Partition7: GPT, TypeGUID: {DE94BBA4-06D1-4D40-A16A-BFD50179D6AC}, UniqueGUID: {7B9CA397-EB70-4FF8-8DD6-989952CBDBE9}, Name: , StartLBA 0x72F8D800, BlocksNum 0x1779000
15:27:35.0726 0x20c8  MBR partitions:
15:27:35.0726 0x20c8  \Device\Harddisk1\DR1:
15:27:35.0726 0x20c8  MBR partitions:
15:27:35.0726 0x20c8  \Device\Harddisk1\DR1\Partition1: MBR, Type 0xC, StartLBA 0x2000, BlocksNum 0x1CF4000
15:27:35.0726 0x20c8  ============================================================
15:27:35.0788 0x20c8  C: <-> \Device\Harddisk0\DR0\Partition4
15:27:35.0788 0x20c8  ============================================================
15:27:35.0788 0x20c8  Initialize success
15:27:35.0788 0x20c8  ============================================================
15:28:01.0102 0x2100  ============================================================
15:28:01.0102 0x2100  Scan started
15:28:01.0102 0x2100  Mode: Manual; SigCheck; TDLFS;
15:28:01.0102 0x2100  ============================================================
15:28:01.0102 0x2100  KSN ping started
15:28:01.0259 0x2100  KSN ping finished: true
15:28:06.0363 0x2100  ================ Scan system memory ========================
15:28:06.0363 0x2100  System memory - ok
15:28:06.0378 0x2100  ================ Scan services =============================
15:28:06.0675 0x2100  1394ohci - ok
15:28:06.0675 0x2100  3ware - ok
15:28:06.0706 0x2100  ACPI - ok
15:28:06.0706 0x2100  AcpiDev - ok
15:28:06.0706 0x2100  acpiex - ok
15:28:06.0722 0x2100  acpipagr - ok
15:28:06.0776 0x2100  AcpiPmi - ok
15:28:06.0776 0x2100  acpitime - ok
15:28:07.0036 0x2100  [ 0D19026AB5812D3A7B9DBB386F8334D8, 3FF22476D621ECFC2C80EF63D1A90C45F672CE299DC92A874E049779EF96AB4A ] AdobeUpdateService C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
15:28:07.0116 0x2100  AdobeUpdateService - ok
15:28:07.0152 0x2100  ADP80XX - ok
15:28:07.0214 0x2100  AFD - ok
15:28:07.0341 0x2100  [ 021D06851E7AFF5C314039DF813608F3, 081B14840F4AD428B4407AA2E639369A45D174D9507BD107F33FE3A94FB8F8EC ] AGSService      C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
15:28:07.0417 0x2100  AGSService - ok
15:28:07.0425 0x2100  ahcache - ok
15:28:07.0445 0x2100  AJRouter - ok
15:28:07.0449 0x2100  ALG - ok
15:28:07.0545 0x2100  AmdK8 - ok
15:28:07.0557 0x2100  AmdPPM - ok
15:28:07.0581 0x2100  amdsata - ok
15:28:07.0602 0x2100  amdsbs - ok
15:28:07.0616 0x2100  amdxata - ok
15:28:07.0723 0x2100  [ C7BE7FBB9B6BDE11E12A0F204384C1D6, 36A6387B90DFB2488ABF135198F0F9E19EE29F7A521818DF92E64B36A0BE0245 ] AmUStor        C:\WINDOWS\system32\drivers\AmUStor.SYS
15:28:07.0984 0x2100  AmUStor - ok
15:28:07.0984 0x2100  AppID - ok
15:28:08.0031 0x2100  AppIDSvc - ok
15:28:08.0046 0x2100  Appinfo - ok
15:28:08.0078 0x2100  applockerfltr - ok
15:28:08.0140 0x2100  AppReadiness - ok
15:28:08.0171 0x2100  AppXSvc - ok
15:28:08.0187 0x2100  arcsas - ok
15:28:08.0234 0x2100  [ 7BC1F2FC2A9D79E1EBBBF6D69AC3BA1F, 236265BE3F1B2130025A3A10152893BD0D18AD8965732361058B775F010539A2 ] aswHwid        C:\WINDOWS\system32\drivers\aswHwid.sys
15:28:08.0359 0x2100  aswHwid - ok
15:28:08.0421 0x2100  [ 68E76C1675AC171A84F5B7230652E19D, A707A4E51110B15FF7D73C95D4D9C1E457FC9D93E1479BDB67EBDDDD6AC28D8E ] aswMonFlt      C:\WINDOWS\system32\drivers\aswMonFlt.sys
15:28:08.0515 0x2100  aswMonFlt - ok
15:28:08.0562 0x2100  [ 2D6B49A071216796106E7804AB2BA7DC, 6A58A3B36EA05A24333482F87CFD315F73E56A64E46493E82E0FE9115E284168 ] aswRdr          C:\WINDOWS\system32\drivers\aswRdr2.sys
15:28:08.0609 0x2100  aswRdr - ok
15:28:08.0656 0x2100  [ E46B51C99BB750A81AC6A68362475A5C, 2A61C09902B39696D151B9D5E6A60FFC3CF3EA02613EC64BBAB4DEE3C78838E2 ] aswRvrt        C:\WINDOWS\system32\drivers\aswRvrt.sys
15:28:08.0703 0x2100  aswRvrt - ok
15:28:08.0765 0x2100  [ 01487B49CC9289D7A1DADAD6A9A2C02F, 2BCF6F7094A0C71F0DCC47CECBBF675FEDFBCC3D7149B6E5F91F2568A342ABC5 ] aswSnx          C:\WINDOWS\system32\drivers\aswSnx.sys
15:28:08.0841 0x2100  aswSnx - ok
15:28:08.0893 0x2100  [ 619CA9F210F0F36F8162E5B7BFDDA5CD, D0D87549BD32F575E518B510085F86D434C3B948733391A6F7959918D761F29B ] aswSP          C:\WINDOWS\system32\drivers\aswSP.sys
15:28:08.0917 0x2100  aswSP - ok
15:28:08.0949 0x2100  [ D9079E1A1C2A1F8ED5F37AF8E6CD3161, 629E3A642C5E3BEA65CDD2E08CAD69F9649A98BDA906678B51D3D2C9DB5BB253 ] aswStm          C:\WINDOWS\system32\drivers\aswStm.sys
15:28:08.0961 0x2100  aswStm - ok
15:28:08.0981 0x2100  [ 3BEC32A0B646D914921FD56AA39998C1, 8DB7CBF3DEF8EAE1D7D28C38B3A0FCD5C2A04D772078B907F35C66451355A04A ] aswVmm          C:\WINDOWS\system32\drivers\aswVmm.sys
15:28:09.0003 0x2100  aswVmm - ok
15:28:09.0003 0x2100  AsyncMac - ok
15:28:09.0028 0x2100  atapi - ok
15:28:09.0051 0x2100  AudioEndpointBuilder - ok
15:28:09.0063 0x2100  Audiosrv - ok
15:28:09.0172 0x2100  [ 4956380A54B1C9E6BFDF3D80DACB9698, 0B0F9807EEF0F3BFE4F862876633D241DBA8F72A1373445976FF388678C4734C ] avast! Antivirus C:\Program Files\AVAST Software\Avast\AvastSvc.exe
15:28:09.0204 0x2100  avast! Antivirus - ok
15:28:09.0219 0x2100  AxInstSV - ok
15:28:09.0240 0x2100  b06bdrv - ok
15:28:09.0248 0x2100  BasicDisplay - ok
15:28:09.0256 0x2100  BasicRender - ok
15:28:09.0296 0x2100  [ 6FED40EC0DB11DF1B2AD08621FBDDED6, 06258C9C9B7C231A6900E1E237001A4E5513F74CEA7B4DFAB56490D455AB0549 ] bcbtums        C:\WINDOWS\system32\drivers\bcbtums.sys
15:28:09.0328 0x2100  bcbtums - ok
15:28:09.0666 0x2100  [ B6C331F0962882034A7AF08AE24E6B44, D986462FF7B56D80A39CEFA7441AAEF72E9B9CCD6E0355DD4CAA1ABF45F0432F ] BCM43XX        C:\WINDOWS\system32\DRIVERS\bcmwl63a.sys
15:28:10.0064 0x2100  BCM43XX - ok
15:28:10.0189 0x2100  [ 43907773F7563AF4DF0999D47522E802, 2563666842008E202B6A64435F06169A259D6DC56D16AF7359114C20A4FA4400 ] BcmBtRSupport  C:\WINDOWS\system32\BtwRSupportService.exe
15:28:10.0252 0x2100  BcmBtRSupport - ok
15:28:10.0298 0x2100  bcmfn - ok
15:28:10.0298 0x2100  bcmfn2 - ok
15:28:10.0330 0x2100  BDESVC - ok
15:28:10.0345 0x2100  Beep - ok
15:28:10.0361 0x2100  BFE - ok
15:28:10.0391 0x2100  BITS - ok
15:28:10.0451 0x2100  [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD, 17BFFC5DF609CE3B2F0CAB4BD6C118608C66A3AD86116A47E90B2BB7D8954122 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
15:28:10.0475 0x2100  Bonjour Service - ok
15:28:10.0479 0x2100  bowser - ok
15:28:10.0499 0x2100  BrokerInfrastructure - ok
15:28:10.0519 0x2100  Browser - ok
15:28:10.0583 0x2100  [ 6670404CB9374C77F737840E1F284964, 6C6E6704D86A49A13333ACA5E278A8C61C75B8844760EDDB7699EA5A51F5F36A ] BstHdAndroidSvc C:\Program Files (x86)\BlueStacks\HD-Service.exe
15:28:10.0611 0x2100  BstHdAndroidSvc - ok
15:28:10.0647 0x2100  [ 8B8700C1F8BF6B84C6D09B9DC8A8866A, 111505107636227C4CA8B377EA3C2136B266A7D66443D16980CB9A84DEBD425A ] BstHdDrv        C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys
15:28:10.0694 0x2100  BstHdDrv - ok
15:28:10.0741 0x2100  [ 6F283166909004EF930CCEA18C74C2EF, 5C966BCA2F44F5CFC7BA61E0644E9CB5377CF0EF908E3A4E4F51F2434DCCA517 ] BstHdLogRotatorSvc C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
15:28:10.0772 0x2100  BstHdLogRotatorSvc - ok
15:28:10.0804 0x2100  [ 3A8A1A2AE57F4FB1E6E53B09F9F57540, F29C75F92FB5757EB4430130F8FC9CA1D5AE149E2281B2F508C01732D1DB5BCB ] BstHdUpdaterSvc C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe
15:28:10.0844 0x2100  BstHdUpdaterSvc - ok
15:28:10.0890 0x2100  BthAvrcpTg - ok
15:28:10.0898 0x2100  BthHFEnum - ok
15:28:10.0906 0x2100  bthhfhid - ok
15:28:10.0953 0x2100  BthHFSrv - ok
15:28:10.0961 0x2100  BTHMODEM - ok
15:28:11.0056 0x2100  [ 851ED52AE3E62CD5374BD4BBFF7A9DAB, 381281CB7D8FC4026092330B06E24BC84EEF79EE3C97E21900D950D7D9AB2FC3 ] BTHPORT        C:\WINDOWS\System32\drivers\BTHport.sys
15:28:11.0455 0x2100  BTHPORT - ok
15:28:11.0475 0x2100  bthserv - ok
15:28:11.0522 0x2100  BTHUSB - ok
15:28:11.0542 0x2100  [ 8B8B304DF17084338326BC4ACC2716C5, 426D56742D0E3E8471EE28FC5E0158223826770DF5BED88D5863D265A070A45D ] btwampfl        C:\WINDOWS\system32\DRIVERS\btwampfl.sys
15:28:11.0605 0x2100  btwampfl - ok
15:28:11.0652 0x2100  buttonconverter - ok
15:28:11.0683 0x2100  CapImg - ok
15:28:11.0683 0x2100  cdfs - ok
15:28:11.0698 0x2100  CDPSvc - ok
15:28:11.0743 0x2100  CDPUserSvc - ok
15:28:11.0830 0x2100  cdrom - ok
15:28:11.0850 0x2100  CertPropSvc - ok
15:28:11.0882 0x2100  cht4iscsi - ok
15:28:11.0890 0x2100  cht4vbd - ok
15:28:11.0934 0x2100  circlass - ok
15:28:11.0956 0x2100  CLFS - ok
15:28:11.0976 0x2100  ClipSVC - ok
15:28:11.0984 0x2100  clreg - ok
15:28:12.0008 0x2100  CmBatt - ok
15:28:12.0008 0x2100  CNG - ok
15:28:12.0024 0x2100  cnghwassist - ok
15:28:12.0700 0x2100  CompositeBus - ok
15:28:12.0715 0x2100  COMSysApp - ok
15:28:12.0746 0x2100  condrv - ok
15:28:12.0778 0x2100  CoreMessagingRegistrar - ok
15:28:13.0549 0x2100  [ A28D6FA203CE094BDE7ED8CEC6079E42, 5DCA8BA21F5FD0D9F00620E7592949ABCF3BA202CF7AF3D84F93DF7C13E2D4C9 ] cphs            C:\WINDOWS\SysWow64\IntelCpHeciSvc.exe
15:28:15.0064 0x2100  cphs - ok
15:28:15.0079 0x2100  CryptSvc - ok
15:28:15.0126 0x2100  dam - ok
15:28:15.0142 0x2100  DcomLaunch - ok
15:28:15.0173 0x2100  DcpSvc - ok
15:28:15.0201 0x2100  defragsvc - ok
15:28:15.0226 0x2100  DeviceAssociationService - ok
15:28:15.0257 0x2100  DeviceInstall - ok
15:28:15.0335 0x2100  DevQueryBroker - ok
15:28:15.0367 0x2100  Dfsc - ok
15:28:15.0429 0x2100  [ 0F4A5D01156B948B54550375498B08A2, 1CAE3D744429A06E9C9EC46AC6B216AB68154EF8FACDD0721C47902B83820F56 ] dg_ssudbus      C:\WINDOWS\system32\DRIVERS\ssudbus.sys
15:28:15.0632 0x2100  dg_ssudbus - ok
15:28:15.0679 0x2100  Dhcp - ok
15:28:15.0793 0x2100  diagnosticshub.standardcollector.service - ok
15:28:15.0825 0x2100  DiagTrack - ok
15:28:15.0887 0x2100  disk - ok
15:28:15.0934 0x2100  DmEnrollmentSvc - ok
15:28:15.0950 0x2100  dmvsc - ok
15:28:16.0012 0x2100  dmwappushservice - ok
15:28:16.0075 0x2100  Dnscache - ok
15:28:16.0106 0x2100  dot3svc - ok
15:28:16.0137 0x2100  DPS - ok
15:28:16.0184 0x2100  drmkaud - ok
15:28:16.0246 0x2100  DsmSvc - ok
15:28:16.0278 0x2100  DsSvc - ok
15:28:16.0309 0x2100  DXGKrnl - ok
15:28:16.0356 0x2100  EapHost - ok
15:28:16.0387 0x2100  ebdrv - ok
15:28:16.0465 0x2100  EFS - ok
15:28:16.0496 0x2100  EhStorClass - ok
15:28:16.0575 0x2100  EhStorTcgDrv - ok
15:28:16.0637 0x2100  embeddedmode - ok
15:28:16.0700 0x2100  EntAppSvc - ok
15:28:16.0715 0x2100  ErrDev - ok
15:28:16.0731 0x2100  EventSystem - ok
15:28:16.0746 0x2100  exfat - ok
15:28:16.0793 0x2100  fastfat - ok
15:28:16.0825 0x2100  Fax - ok
15:28:16.0856 0x2100  fdc - ok
15:28:16.0887 0x2100  fdPHost - ok
15:28:16.0903 0x2100  FDResPub - ok
15:28:16.0981 0x2100  fhsvc - ok
15:28:17.0059 0x2100  FileCrypt - ok
15:28:17.0075 0x2100  FileInfo - ok
15:28:17.0106 0x2100  Filetrace - ok
15:28:17.0137 0x2100  flpydisk - ok
15:28:17.0168 0x2100  FltMgr - ok
15:28:17.0224 0x2100  FontCache - ok
15:28:17.0412 0x2100  FontCache3.0.0.0 - ok
15:28:18.0016 0x2100  [ 0BBC120A3B91DF55E6925E84A8018CEB, D0AD0957096D56A01DAB91ACD847EAC392EA16A23D0532A4125D4055585D4437 ] FPLService      C:\Program Files\Lenovo Fingerprint Reader\TrueSuiteService.exe
15:28:18.0141 0x2100  FPLService - ok
15:28:18.0172 0x2100  FrameServer - ok
15:28:18.0211 0x2100  FsDepends - ok
15:28:18.0211 0x2100  Fs_Rec - ok
15:28:18.0246 0x2100  fvevol - ok
15:28:18.0319 0x2100  gencounter - ok
15:28:18.0354 0x2100  genericusbfn - ok
15:28:18.0387 0x2100  GPIOClx0101 - ok
15:28:18.0420 0x2100  gpsvc - ok
15:28:18.0448 0x2100  GpuEnergyDrv - ok
15:28:18.0663 0x2100  [ DD7423ABBE2913E70D50E9318AD57EE4, 74BC123808F3FA60ADDC51C1383F8250608D3DBA3A8DC175B3418A1CF0BC53E9 ] gupdate        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
15:28:18.0691 0x2100  gupdate - ok
15:28:18.0707 0x2100  [ DD7423ABBE2913E70D50E9318AD57EE4, 74BC123808F3FA60ADDC51C1383F8250608D3DBA3A8DC175B3418A1CF0BC53E9 ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
15:28:18.0735 0x2100  gupdatem - ok
15:28:18.0797 0x2100  [ C1B577B2169900F4CF7190C39F085794, 73E104B96A48F4C80D8C37254ECB0891D15C0D2F0C251B57C168F90D60316447 ] gusvc          C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
15:28:18.0837 0x2100  gusvc - ok
15:28:18.0906 0x2100  HdAudAddService - ok
15:28:18.0977 0x2100  HDAudBus - ok
15:28:18.0997 0x2100  HidBatt - ok
15:28:19.0005 0x2100  HidBth - ok
15:28:19.0013 0x2100  hidi2c - ok
15:28:19.0025 0x2100  hidinterrupt - ok
15:28:19.0057 0x2100  HidIr - ok
15:28:19.0094 0x2100  hidserv - ok
15:28:19.0178 0x2100  HidUsb - ok
15:28:19.0194 0x2100  HomeGroupListener - ok
15:28:19.0215 0x2100  HomeGroupProvider - ok
15:28:19.0246 0x2100  HpSAMD - ok
15:28:19.0262 0x2100  HTTP - ok
15:28:19.0325 0x2100  HvHost - ok
15:28:19.0391 0x2100  hvservice - ok
15:28:19.0422 0x2100  hwpolicy - ok
15:28:19.0463 0x2100  hyperkbd - ok
15:28:19.0489 0x2100  i8042prt - ok
15:28:19.0513 0x2100  iagpio - ok
15:28:19.0528 0x2100  iai2c - ok
15:28:19.0544 0x2100  iaLPSS2i_GPIO2 - ok
15:28:19.0559 0x2100  iaLPSS2i_I2C - ok
15:28:19.0575 0x2100  iaLPSSi_GPIO - ok
15:28:19.0607 0x2100  iaLPSSi_I2C - ok
15:28:19.0699 0x2100  [ 0FE66A51D81A25AACEAAE4C26308121D, C5553F7ABA74A8EB71A4ED0E8F2A6AA2892F871D164F2D4FADB035BE7D1A8C44 ] iaStorA        C:\WINDOWS\system32\drivers\iaStorA.sys
15:28:19.0784 0x2100  iaStorA - ok
15:28:19.0800 0x2100  iaStorAV - ok
15:28:19.0812 0x2100  iaStorV - ok
15:28:19.0844 0x2100  ibbus - ok
15:28:19.0910 0x2100  [ DB706D75DADEA0ED1D939C3FC7508AF9, B3F6535422B6AFD83B9DAF661988293511BA33D8472D756232047F310E56B571 ] IBMPMDRV        C:\WINDOWS\system32\DRIVERS\ibmpmdrv.sys
15:28:19.0963 0x2100  IBMPMDRV - ok
15:28:20.0050 0x2100  [ 9E60D9F0E66480EF6D3355BD1FD20127, 3D24F4CB628E362EA2A975D8DED9CD930974E885BA70E19E7EAC069EEB7CBC53 ] IBMPMSVC        C:\WINDOWS\system32\ibmpmsvc.exe
15:28:20.0095 0x2100  IBMPMSVC - ok
15:28:20.0155 0x2100  [ 83FF82FE209E7997067B375DAD6CF23D, E312DD068E51DBF96A8232D7D1C9F158652FDA23649655F1102928B320795091 ] ICCS            C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
15:28:20.0179 0x2100  ICCS - ok
15:28:20.0223 0x2100  icssvc - ok
15:28:21.0154 0x2100  [ 9CE4D3A79D3180AC5A141E2F7E7137F4, 1D717D2156B78632895281779D2646AB066619EA1DB293A9505BF7C174F53271 ] igfx            C:\WINDOWS\system32\DRIVERS\igdkmd64.sys
15:28:21.0294 0x2100  igfx - ok
15:28:21.0430 0x2100  [ 6A9C613D0F5F9676D128F39B63ACE45B, 027B9568C740E336C7CBBE952309E2719E8FFA14E7DFC2B85B49E0C0CE7D2149 ] igfxCUIService1.0.0.0 C:\WINDOWS\system32\igfxCUIService.exe
15:28:21.0476 0x2100  igfxCUIService1.0.0.0 - ok
15:28:21.0508 0x2100  IKEEXT - ok
15:28:21.0530 0x2100  IndirectKmd - ok
15:28:21.0577 0x2100  [ B1F193AB8FB72E9FC34B3A39314ED872, 408E98D9C8ABB928090DD9E5D1BB227EFBC997BF168437BAEF0461EB0D1DAE3D ] intaud_WaveExtensible C:\WINDOWS\system32\drivers\intelaud.sys
15:28:21.0661 0x2100  intaud_WaveExtensible - ok
15:28:22.0142 0x2100  [ DC052337C24A87AA1ACC8FCE4F2D5C7F, A438A7A519E9B05DAC2AB097BFBDCD42766E9EAA66054DD6946D27802F0B150A ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RTKVHD64.sys
15:28:22.0357 0x2100  IntcAzAudAddService - ok
15:28:22.0422 0x2100  [ 87871AB7AC797F922A6F3D4C874CED96, 2BCD89911E42827CD294DD7D1486A7845D1F98019E51958E0F488384401B2944 ] IntcDAud        C:\WINDOWS\system32\DRIVERS\IntcDAud.sys
15:28:22.0474 0x2100  IntcDAud - ok
15:28:22.0724 0x2100  [ C99F8E90DE4B8F0C7FE15BB1CBCD29DC, F791EE101EEF8B9F48102B6C63A89B78F7C0041C750C4F4C0D16D54B583B7B5C ] Intel(R) Capability Licensing Service Interface C:\Program Files\Intel\iCLS Client\HeciServer.exe
15:28:22.0792 0x2100  Intel(R) Capability Licensing Service Interface - ok
15:28:22.0924 0x2100  [ 30E9FAC23E2537D82F2836CB81AEE186, 03E5072D43ECED70EF004D2E6E654B4CCCE059825CC3C641C0534E4C0BC0C7E8 ] Intel(R) ME Service C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
15:28:22.0948 0x2100  Intel(R) ME Service - ok
15:28:22.0992 0x2100  intelide - ok
15:28:23.0008 0x2100  intelpep - ok
15:28:23.0012 0x2100  intelppm - ok
15:28:23.0024 0x2100  iorate - ok
15:28:23.0048 0x2100  IpFilterDriver - ok
15:28:23.0104 0x2100  iphlpsvc - ok
15:28:23.0112 0x2100  IPMIDRV - ok
15:28:23.0120 0x2100  IPNAT - ok
15:28:23.0125 0x2100  irda - ok
15:28:23.0145 0x2100  IRENUM - ok
15:28:23.0161 0x2100  irmon - ok
15:28:23.0173 0x2100  isapnp - ok
15:28:23.0201 0x2100  iScsiPrt - ok
15:28:23.0246 0x2100  [ 48B904D31F2369D7B0122617038D3F5B, 8A43CB37667929CCCC37B6E79E82509BBCA6C8884B44059DC87BCA7C21BE7FE1 ] iwdbus          C:\WINDOWS\System32\drivers\iwdbus.sys
15:28:23.0340 0x2100  iwdbus - ok
15:28:23.0418 0x2100  [ 3C4002D339491AF73D663FFC7F6E5ECB, 0B53047989BDB781572253BC3AA757912FE54366870C1955E687972CE210C285 ] jhi_service    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
15:28:23.0449 0x2100  jhi_service - ok
15:28:23.0527 0x2100  kbdclass - ok
15:28:23.0527 0x2100  kbdhid - ok
15:28:23.0637 0x2100  kdnic - ok
15:28:23.0653 0x2100  KeyIso - ok
15:28:23.0684 0x2100  KSecDD - ok
15:28:23.0715 0x2100  KSecPkg - ok
15:28:23.0731 0x2100  ksthunk - ok
15:28:23.0768 0x2100  KtmRm - ok
15:28:23.0784 0x2100  LanmanServer - ok
15:28:23.0807 0x2100  LanmanWorkstation - ok
15:28:23.0846 0x2100  lfsvc - ok
15:28:23.0870 0x2100  LicenseManager - ok
15:28:23.0878 0x2100  lltdio - ok
15:28:23.0890 0x2100  lltdsvc - ok
15:28:23.0921 0x2100  lmhosts - ok
15:28:24.0022 0x2100  [ 4269D44BB47A6DA5D80B11F4C8536458, 7A8FFC8F851DD9E5C43986BE0888831CB71D188138DF3CF7F787DADDA70915B0 ] LMS            C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
15:28:24.0069 0x2100  LMS - ok
15:28:24.0289 0x2100  [ 03796C0C7D27AEE1BEEDFB7922093715, 1F30D236715387EAC545D2E8F5B625D03580DABCB16265AFBCACD196BB8596C5 ] LocationTaskManager C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe
15:28:24.0325 0x2100  LocationTaskManager - ok
15:28:24.0353 0x2100  LSI_SAS - ok
15:28:24.0353 0x2100  LSI_SAS2i - ok
15:28:24.0384 0x2100  LSI_SAS3i - ok
15:28:24.0400 0x2100  LSI_SSS - ok
15:28:24.0447 0x2100  LSM - ok
15:28:24.0463 0x2100  luafv - ok
15:28:24.0478 0x2100  MapsBroker - ok
15:28:24.0516 0x2100  megasas - ok
15:28:24.0552 0x2100  megasas2i - ok
15:28:24.0584 0x2100  megasr - ok
15:28:24.0599 0x2100  [ 772A1DEEDFDBC244183B5C805D1B7D85, 7D821B8DF1F174E5414FFDEAB5207DB687740E9842F7203600AEBA086945AFC9 ] MEIx64          C:\WINDOWS\System32\drivers\HECIx64.sys
15:28:24.0670 0x2100  MEIx64 - ok
15:28:24.0737 0x2100  MessagingService - ok
15:28:24.0815 0x2100  mlx4_bus - ok
15:28:24.0831 0x2100  MMCSS - ok
15:28:24.0847 0x2100  Modem - ok
15:28:24.0878 0x2100  monitor - ok
15:28:24.0878 0x2100  mouclass - ok
15:28:24.0919 0x2100  mouhid - ok
15:28:24.0940 0x2100  mountmgr - ok
15:28:25.0033 0x2100  [ A43F5F2D3D71A902502D61E71A18C265, 9685DABFF80EFFFD28B9B12696BF4821F30989C8441EA0AA3FF0F03ED799AD9D ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
15:28:25.0065 0x2100  MozillaMaintenance - ok
15:28:25.0080 0x2100  mpsdrv - ok
15:28:25.0099 0x2100  MpsSvc - ok
15:28:25.0130 0x2100  MRxDAV - ok
15:28:25.0177 0x2100  mrxsmb - ok
15:28:25.0192 0x2100  mrxsmb10 - ok
15:28:25.0239 0x2100  mrxsmb20 - ok
15:28:25.0255 0x2100  MsBridge - ok
15:28:25.0271 0x2100  MSDTC - ok
15:28:25.0299 0x2100  Msfs - ok
15:28:25.0327 0x2100  msgpiowin32 - ok
15:28:25.0338 0x2100  mshidkmdf - ok
15:28:25.0354 0x2100  mshidumdf - ok
15:28:25.0370 0x2100  msisadrv - ok
15:28:25.0422 0x2100  MSiSCSI - ok
15:28:25.0430 0x2100  msiserver - ok
15:28:25.0438 0x2100  MSKSSRV - ok
15:28:25.0442 0x2100  MsLldp - ok
15:28:25.0454 0x2100  MSPCLOCK - ok
15:28:25.0470 0x2100  MSPQM - ok
15:28:25.0470 0x2100  MsRPC - ok
15:28:25.0501 0x2100  mssmbios - ok
15:28:25.0501 0x2100  MSTEE - ok
15:28:25.0532 0x2100  MTConfig - ok
15:28:25.0532 0x2100  Mup - ok
15:28:25.0552 0x2100  mvumis - ok
15:28:25.0602 0x2100  NativeWifiP - ok
15:28:25.0618 0x2100  NcaSvc - ok
15:28:25.0665 0x2100  NcbService - ok
15:28:25.0665 0x2100  NcdAutoSetup - ok
15:28:25.0713 0x2100  ndfltr - ok
15:28:25.0725 0x2100  NDIS - ok
15:28:25.0733 0x2100  NdisCap - ok
15:28:25.0748 0x2100  NdisImPlatform - ok
15:28:25.0752 0x2100  NdisTapi - ok
15:28:25.0768 0x2100  Ndisuio - ok
15:28:25.0815 0x2100  NdisVirtualBus - ok
15:28:25.0815 0x2100  NdisWan - ok
15:28:25.0830 0x2100  ndiswanlegacy - ok
15:28:25.0830 0x2100  ndproxy - ok
15:28:25.0846 0x2100  Ndu - ok
15:28:25.0909 0x2100  NetAdapterCx - ok
15:28:25.0909 0x2100  NetBIOS - ok
15:28:25.0924 0x2100  NetBT - ok
15:28:25.0924 0x2100  Netlogon - ok
15:28:25.0955 0x2100  Netman - ok
15:28:26.0049 0x2100  netprofm - ok
15:28:26.0096 0x2100  NetSetupSvc - ok
15:28:26.0315 0x2100  NetTcpPortSharing - ok
15:28:26.0383 0x2100  NgcCtnrSvc - ok
15:28:26.0399 0x2100  NgcSvc - ok
15:28:26.0664 0x2100  [ FC77DFB33E77572661CD14C9AB222637, 803D7BF29CB2A024D945DEBA77976F31F44D431323FA2F913A0888A45EBC3B6E ] NitroDriverReadSpool2 C:\Program Files\Common Files\Nitro PDF\Professional\7.0\NitroPDFDriverService2x64.exe
15:28:26.0702 0x2100  NitroDriverReadSpool2 - ok
15:28:26.0749 0x2100  NlaSvc - ok
15:28:26.0780 0x2100  Npfs - ok
15:28:26.0826 0x2100  npsvctrig - ok
15:28:26.0866 0x2100  nsi - ok
15:28:26.0866 0x2100  nsiproxy - ok
15:28:26.0898 0x2100  NTFS - ok
15:28:26.0921 0x2100  Null - ok
15:28:26.0954 0x2100  nvraid - ok
15:28:26.0969 0x2100  nvstor - ok
15:28:27.0061 0x2100  OneSyncSvc - ok
15:28:27.0367 0x2100  p2pimsvc - ok
15:28:27.0429 0x2100  p2psvc - ok
15:28:27.0453 0x2100  Parport - ok
15:28:27.0466 0x2100  partmgr - ok
15:28:27.0527 0x2100  PcaSvc - ok
15:28:27.0566 0x2100  pci - ok
15:28:27.0597 0x2100  pciide - ok
15:28:27.0612 0x2100  pcmcia - ok
15:28:27.0628 0x2100  pcw - ok
15:28:27.0644 0x2100  pdc - ok
15:28:27.0675 0x2100  PEAUTH - ok
15:28:27.0722 0x2100  percsas2i - ok
15:28:27.0753 0x2100  percsas3i - ok
15:28:28.0671 0x2100  PerfHost - ok
15:28:28.0707 0x2100  PhoneSvc - ok
15:28:28.0743 0x2100  PimIndexMaintenanceSvc - ok
15:28:28.0816 0x2100  pla - ok
15:28:28.0846 0x2100  PlugPlay - ok
15:28:28.0862 0x2100  PNRPAutoReg - ok
15:28:28.0870 0x2100  PNRPsvc - ok
15:28:28.0904 0x2100  PolicyAgent - ok
15:28:28.0912 0x2100  Power - ok
15:28:29.0443 0x2100  [ 5759997444BE028351C165C4D2AE5095, 35479DCE746C759820920A77ABEC8C5CD9AB50DB10D093D486443936E929EC07 ] Power Manager DBC Service C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE
15:28:29.0537 0x2100  Power Manager DBC Service - ok
15:28:29.0584 0x2100  PptpMiniport - ok
15:28:30.0043 0x2100  [ 7196D3C2E2E3129814C8DAB91F9A7D1E, 6763E4BF8E846B597E78778E520F5BADC95608BAA4EA0AC84971384B5D976DD7 ] PrintNotify    C:\WINDOWS\system32\spool\drivers\x64\3\PrintConfig.dll
15:28:30.0335 0x2100  PrintNotify - ok
15:28:30.0399 0x2100  Processor - ok
15:28:30.0435 0x2100  ProfSvc - ok
15:28:30.0463 0x2100  Psched - ok
15:28:30.0507 0x2100  QWAVE - ok
15:28:30.0519 0x2100  QWAVEdrv - ok
15:28:30.0528 0x2100  RasAcd - ok
15:28:30.0579 0x2100  RasAgileVpn - ok
15:28:30.0610 0x2100  RasAuto - ok
15:28:30.0610 0x2100  Rasl2tp - ok
15:28:30.0650 0x2100  RasMan - ok
15:28:30.0657 0x2100  RasPppoe - ok
15:28:30.0665 0x2100  RasSstp - ok
15:28:30.0677 0x2100  rdbss - ok
15:28:30.0709 0x2100  rdpbus - ok
15:28:30.0724 0x2100  RDPDR - ok
15:28:30.0775 0x2100  RdpVideoMiniport - ok
15:28:30.0783 0x2100  rdyboost - ok
15:28:30.0800 0x2100  ReFSv1 - ok
15:28:30.0844 0x2100  RemoteAccess - ok
15:28:30.0873 0x2100  RemoteRegistry - ok
15:28:30.0923 0x2100  RetailDemo - ok
15:28:30.0927 0x2100  RmSvc - ok
15:28:30.0943 0x2100  RpcEptMapper - ok
15:28:30.0974 0x2100  RpcLocator - ok
15:28:30.0987 0x2100  RpcSs - ok
15:28:31.0027 0x2100  rspndr - ok
15:28:31.0059 0x2100  rt640x64 - ok
15:28:31.0118 0x2100  s3cap - ok
15:28:31.0178 0x2100  SamSs - ok
15:28:31.0253 0x2100  sbp2port - ok
15:28:31.0279 0x2100  SCardSvr - ok
15:28:31.0345 0x2100  ScDeviceEnum - ok
15:28:31.0370 0x2100  scfilter - ok
15:28:31.0377 0x2100  Schedule - ok
15:28:31.0393 0x2100  scmbus - ok
15:28:31.0409 0x2100  scmdisk0101 - ok
15:28:31.0441 0x2100  SCPolicySvc - ok
15:28:31.0475 0x2100  sdbus - ok
15:28:31.0523 0x2100  SDRSVC - ok
15:28:31.0575 0x2100  sdstor - ok
15:28:31.0591 0x2100  seclogon - ok
15:28:31.0631 0x2100  SENS - ok
15:28:31.0676 0x2100  SensorDataService - ok
15:28:31.0724 0x2100  SensorService - ok
15:28:31.0760 0x2100  SensrSvc - ok
15:28:31.0791 0x2100  SerCx - ok
15:28:31.0807 0x2100  SerCx2 - ok
15:28:31.0820 0x2100  Serenum - ok
15:28:31.0832 0x2100  Serial - ok
15:28:31.0840 0x2100  sermouse - ok
15:28:31.0876 0x2100  SessionEnv - ok
15:28:31.0923 0x2100  sfloppy - ok
15:28:31.0992 0x2100  SharedAccess - ok
15:28:32.0039 0x2100  ShellHWDetection - ok
15:28:32.0101 0x2100  shpamsvc - ok
15:28:32.0101 0x2100  SiSRaid2 - ok
15:28:32.0132 0x2100  SiSRaid4 - ok
15:28:32.0179 0x2100  [ 1FE05A4F787ED7DD39EA968172F20AFC, 566ECC090F120A4627B597EA65E6CF7D1A40CF840DFBED22EF224445D442815A ] SmbDrvI        C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys
15:28:32.0336 0x2100  SmbDrvI - ok
15:28:32.0385 0x2100  smphost - ok
15:28:32.0482 0x2100  SmsRouter - ok
15:28:32.0502 0x2100  SNMPTRAP - ok
15:28:32.0578 0x2100  spaceport - ok
15:28:32.0610 0x2100  SpbCx - ok
15:28:32.0634 0x2100  Spooler - ok
15:28:32.0696 0x2100  sppsvc - ok
15:28:32.0733 0x2100  srv - ok
15:28:32.0756 0x2100  srv2 - ok
15:28:32.0805 0x2100  srvnet - ok
15:28:32.0840 0x2100  SSDPSRV - ok
15:28:32.0872 0x2100  SstpSvc - ok
15:28:32.0955 0x2100  [ D08FFE34AF5B7AC5F69EEA1E0E8C6ECE, CC43752CE5C879E24229C84443DBEE667CE629ECF992AD0D42F0F77FE04F6751 ] ssudmdm        C:\WINDOWS\system32\DRIVERS\ssudmdm.sys
15:28:33.0043 0x2100  ssudmdm - ok
15:28:33.0475 0x2100  [ 7DB9E612A2742ACEAB080B882E83141C, FFD1FA36E732F55223F3F4B5F845331DBB3073B023C2C5BF51A0E7680DEE7FA7 ] ss_conn_service C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
15:28:33.0556 0x2100  ss_conn_service - ok
15:28:33.0626 0x2100  StateRepository - ok
15:28:33.0672 0x2100  stexstor - ok
15:28:33.0730 0x2100  [ B11724BFE7DA1BA55903B4D849415F1A, ED09B6AD68C87FED34FC66CB6C7A74DFC3AF524E3BE89EDD18A5B6685F656ACA ] StillCam        C:\WINDOWS\system32\DRIVERS\serscan.sys
15:28:33.0854 0x2100  StillCam - ok
15:28:33.0894 0x2100  stisvc - ok
15:28:33.0933 0x2100  storahci - ok
15:28:33.0996 0x2100  storflt - ok
15:28:34.0036 0x2100  stornvme - ok
15:28:34.0060 0x2100  storqosflt - ok
15:28:34.0088 0x2100  StorSvc - ok
15:28:34.0100 0x2100  storufs - ok
15:28:34.0114 0x2100  storvsc - ok
15:28:34.0148 0x2100  svsvc - ok
15:28:34.0180 0x2100  swenum - ok
15:28:34.0196 0x2100  swprv - ok
15:28:34.0224 0x2100  Synth3dVsc - ok
15:28:34.0316 0x2100  [ A3BBF71752E47CDF444DFD49E971E16B, A3E6F9D781FCF1F8146E23D90F9DFDAA24C20BCA82A00BE9534974720E003776 ] SynTP          C:\WINDOWS\system32\DRIVERS\SynTP.sys
15:28:34.0378 0x2100  SynTP - ok
15:28:34.0538 0x2100  [ 9C58665F465646B0784F595240237C10, 92033D63EF21733CA76BF47C433142F7A2390149C9162967F13C9F3F29236DBD ] SynTPEnhService C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
15:28:34.0601 0x2100  SynTPEnhService - ok
15:28:34.0632 0x2100  SysMain - ok
15:28:34.0695 0x2100  SystemEventsBroker - ok
15:28:34.0742 0x2100  TabletInputService - ok
15:28:34.0773 0x2100  TapiSrv - ok
15:28:34.0788 0x2100  Tcpip - ok
15:28:34.0804 0x2100  Tcpip6 - ok
15:28:34.0851 0x2100  tcpipreg - ok
15:28:34.0882 0x2100  tdx - ok
15:28:36.0029 0x2100  [ 2AA61246A5B813C1B12BCCFAA6F23DD8, 74EE3DB839A0F4BC781294803281DB2248D013B8808FF05F2EE9597C14C6FEED ] TeamViewer      C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
15:28:36.0302 0x2100  TeamViewer - ok
15:28:36.0317 0x2100  terminpt - ok
15:28:36.0364 0x2100  TermService - ok
15:28:36.0397 0x2100  Themes - ok
15:28:36.0459 0x2100  TieringEngineService - ok
15:28:36.0475 0x2100  tiledatamodelsvc - ok
15:28:36.0491 0x2100  TimeBrokerSvc - ok
15:28:36.0586 0x2100  [ 3B43F4F67F3C539C3BBF40A552A12B5E, 565593B9AD01CA02205FC53F6B8A8955CB26901397C3581C3C514F01B69B86BD ] TomTomHOMEService C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
15:28:36.0620 0x2100  TomTomHOMEService - ok
15:28:36.0672 0x2100  TPM - ok
15:28:36.0702 0x2100  [ 2E03012129324F35069D297B817F1383, 660473E94032EDB35B3F6100CE9C83E632AFA4776F053B3FEBDD3340E98A3530 ] TPPWRIF        C:\WINDOWS\system32\drivers\Tppwr64v.sys
15:28:36.0767 0x2100  TPPWRIF - ok
15:28:36.0819 0x2100  TrkWks - ok
15:28:37.0016 0x2100  [ 00629A30B9A95D3CC07E09C12F293BD1, CCB0EA347804CC7EDCDFBCA0AEAFF90310C7272D9F0AF7BC54D3F9D344AD4FCA ] TrueService    C:\Program Files\Common Files\AuthenTec\TrueService.exe
15:28:37.0036 0x2100  TrueService - ok
15:28:37.0145 0x2100  TrustedInstaller - ok
15:28:37.0177 0x2100  tsusbflt - ok
15:28:37.0208 0x2100  TsUsbGD - ok
15:28:37.0208 0x2100  tunnel - ok
15:28:37.0239 0x2100  tzautoupdate - ok
15:28:37.0300 0x2100  UASPStor - ok
15:28:37.0308 0x2100  UcmCx0101 - ok
15:28:37.0316 0x2100  UcmTcpciCx0101 - ok
15:28:37.0320 0x2100  UcmUcsi - ok
15:28:37.0336 0x2100  Ucx01000 - ok
15:28:37.0351 0x2100  UdeCx - ok
15:28:37.0367 0x2100  udfs - ok
15:28:37.0423 0x2100  UEFI - ok
15:28:37.0431 0x2100  Ufx01000 - ok
15:28:37.0467 0x2100  UfxChipidea - ok
15:28:37.0467 0x2100  ufxsynopsys - ok
15:28:37.0558 0x2100  UI0Detect - ok
15:28:37.0589 0x2100  umbus - ok
15:28:37.0605 0x2100  UmPass - ok
15:28:37.0631 0x2100  UmRdpService - ok
15:28:37.0664 0x2100  UnistoreSvc - ok
15:28:37.0847 0x2100  [ DBE2E6388379D5CC78099650541E9566, 1914BC929F109A49FB18ED31F239A9813A010B0A3914BC8CD0D6A94A67A072D7 ] UNS            C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
15:28:37.0910 0x2100  UNS - ok
15:28:37.0934 0x2100  upnphost - ok
15:28:37.0964 0x2100  UrsChipidea - ok
15:28:38.0055 0x2100  UrsCx01000 - ok
15:28:38.0063 0x2100  UrsSynopsys - ok
15:28:38.0087 0x2100  usbccgp - ok
15:28:38.0103 0x2100  usbcir - ok
15:28:38.0155 0x2100  usbehci - ok
15:28:38.0160 0x2100  usbhub - ok
15:28:38.0242 0x2100  USBHUB3 - ok
15:28:38.0266 0x2100  usbohci - ok
15:28:38.0297 0x2100  usbprint - ok
15:28:38.0333 0x2100  usbser - ok
15:28:38.0345 0x2100  USBSTOR - ok
15:28:38.0405 0x2100  usbuhci - ok
15:28:38.0475 0x2100  USBXHCI - ok
15:28:38.0541 0x2100  UserDataSvc - ok
15:28:38.0644 0x2100  UserManager - ok
15:28:38.0680 0x2100  UsoSvc - ok
15:28:38.0680 0x2100  VaultSvc - ok
15:28:38.0782 0x2100  vdrvroot - ok
15:28:38.0798 0x2100  vds - ok
15:28:38.0829 0x2100  VerifierExt - ok
15:28:38.0845 0x2100  vhdmp - ok
15:28:38.0860 0x2100  vhf - ok
15:28:39.0130 0x2100  [ 73A8377232E54A485E204165892B58FD, 9B3B9F14BB0C2967B8BCAC6E8C81ED6772CE5F6B014009BEB9946741FF78F771 ] vm331avs        C:\WINDOWS\System32\Drivers\vm331avs.sys
15:28:39.0325 0x2100  vm331avs - ok
15:28:39.0368 0x2100  vmbus - ok
15:28:39.0387 0x2100  VMBusHID - ok
15:28:39.0399 0x2100  vmgid - ok
15:28:39.0431 0x2100  vmicguestinterface - ok
15:28:39.0435 0x2100  vmicheartbeat - ok
15:28:39.0447 0x2100  vmickvpexchange - ok
15:28:39.0464 0x2100  vmicrdv - ok
15:28:39.0464 0x2100  vmicshutdown - ok
15:28:39.0479 0x2100  vmictimesync - ok
15:28:39.0479 0x2100  vmicvmsession - ok
15:28:39.0500 0x2100  vmicvss - ok
15:28:39.0568 0x2100  volmgr - ok
15:28:39.0576 0x2100  volmgrx - ok
15:28:39.0584 0x2100  volsnap - ok
15:28:39.0620 0x2100  volume - ok
15:28:39.0648 0x2100  vpci - ok
15:28:39.0681 0x2100  vsmraid - ok
15:28:39.0709 0x2100  VSS - ok
15:28:39.0729 0x2100  VSTXRAID - ok
15:28:39.0744 0x2100  vwifibus - ok
15:28:39.0776 0x2100  vwififlt - ok
15:28:39.0780 0x2100  vwifimp - ok
15:28:39.0810 0x2100  W32Time - ok
15:28:39.0827 0x2100  WacomPen - ok
15:28:39.0863 0x2100  WalletService - ok
15:28:39.0863 0x2100  wanarp - ok
15:28:39.0879 0x2100  wanarpv6 - ok
15:28:39.0899 0x2100  wbengine - ok
15:28:39.0943 0x2100  WbioSrvc - ok
15:28:39.0963 0x2100  wcifs - ok
15:28:39.0992 0x2100  Wcmsvc - ok
15:28:40.0012 0x2100  wcncsvc - ok
15:28:40.0020 0x2100  wcnfs - ok
15:28:40.0037 0x2100  WdBoot - ok
15:28:40.0060 0x2100  Wdf01000 - ok
15:28:40.0076 0x2100  WdFilter - ok
15:28:40.0103 0x2100  WdiServiceHost - ok
15:28:40.0111 0x2100  WdiSystemHost - ok
15:28:40.0146 0x2100  wdiwifi - ok
15:28:40.0177 0x2100  WdNisDrv - ok
15:28:40.0231 0x2100  WdNisSvc - ok
15:28:40.0246 0x2100  WebClient - ok
15:28:40.0293 0x2100  Wecsvc - ok
15:28:40.0317 0x2100  WEPHOSTSVC - ok
15:28:40.0337 0x2100  wercplsupport - ok
15:28:40.0345 0x2100  WerSvc - ok
15:28:40.0361 0x2100  WFPLWFS - ok
15:28:40.0392 0x2100  WiaRpc - ok
15:28:40.0413 0x2100  WIMMount - ok
15:28:40.0421 0x2100  WinDefend - ok
15:28:40.0460 0x2100  WindowsTrustedRT - ok
15:28:40.0464 0x2100  WindowsTrustedRTProxy - ok
15:28:40.0516 0x2100  WinHttpAutoProxySvc - ok
15:28:40.0575 0x2100  WinMad - ok
15:28:40.0694 0x2100  Winmgmt - ok
15:28:40.0725 0x2100  WinRM - ok
15:28:40.0787 0x2100  WINUSB - ok
15:28:40.0803 0x2100  WinVerbs - ok
15:28:40.0834 0x2100  wisvc - ok
15:28:40.0870 0x2100  WlanSvc - ok
15:28:40.0921 0x2100  wlidsvc - ok
15:28:40.0950 0x2100  WmiAcpi - ok
15:28:40.0997 0x2100  wmiApSrv - ok
15:28:41.0044 0x2100  WMPNetworkSvc - ok
15:28:41.0075 0x2100  Wof - ok
15:28:41.0115 0x2100  workfolderssvc - ok
15:28:41.0147 0x2100  WPDBusEnum - ok
15:28:41.0203 0x2100  WpdUpFltr - ok
15:28:41.0226 0x2100  WpnService - ok
15:28:41.0246 0x2100  WpnUserService - ok
15:28:41.0322 0x2100  ws2ifsl - ok
15:28:41.0342 0x2100  wscsvc - ok
15:28:41.0361 0x2100  WSDPrintDevice - ok
15:28:41.0390 0x2100  WSDScan - ok
15:28:41.0398 0x2100  WSearch - ok
15:28:41.0425 0x2100  wuauserv - ok
15:28:41.0425 0x2100  WudfPf - ok
15:28:41.0425 0x2100  WUDFRd - ok
15:28:41.0477 0x2100  wudfsvc - ok
15:28:41.0481 0x2100  WUDFWpdFs - ok
15:28:41.0501 0x2100  WwanSvc - ok
15:28:41.0529 0x2100  XblAuthManager - ok
15:28:41.0561 0x2100  XblGameSave - ok
15:28:41.0577 0x2100  xboxgip - ok
15:28:41.0612 0x2100  XboxNetApiSvc - ok
15:28:41.0656 0x2100  xinputhid - ok
15:28:41.0664 0x2100  ================ Scan global ===============================
15:28:41.0811 0x2100  [ Global ] - ok
15:28:41.0811 0x2100  ================ Scan MBR ==================================
15:28:41.0827 0x2100  [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk0\DR0
15:28:42.0387 0x2100  \Device\Harddisk0\DR0 - ok
15:28:42.0387 0x2100  [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk1\DR1
15:28:42.0559 0x2100  \Device\Harddisk1\DR1 - ok
15:28:42.0559 0x2100  ================ Scan VBR ==================================
15:28:42.0574 0x2100  [ B2A970ABEEA4E941875073B2B0C4CFD5 ] \Device\Harddisk0\DR0\Partition1
15:28:42.0699 0x2100  \Device\Harddisk0\DR0\Partition1 - ok
15:28:42.0731 0x2100  [ 6CFF6108F1968002BF5940441FC4AA35 ] \Device\Harddisk0\DR0\Partition2
15:28:42.0731 0x2100  \Device\Harddisk0\DR0\Partition2 - ok
15:28:42.0759 0x2100  [ 8A7BD8CB4D5175F9F5E697CE25A94A0F ] \Device\Harddisk0\DR0\Partition3
15:28:42.0763 0x2100  \Device\Harddisk0\DR0\Partition3 - ok
15:28:42.0789 0x2100  [ 8B7EF1C293D03F508F075434AE7A24ED ] \Device\Harddisk0\DR0\Partition4
15:28:42.0810 0x2100  \Device\Harddisk0\DR0\Partition4 - ok
15:28:42.0841 0x2100  [ AE8EE2B2FB4638AB4C6C3D71366C539F ] \Device\Harddisk0\DR0\Partition5
15:28:42.0888 0x2100  \Device\Harddisk0\DR0\Partition5 - ok
15:28:42.0928 0x2100  [ 122733F2CB2CE97DA366C7D5D708A46C ] \Device\Harddisk0\DR0\Partition6
15:28:42.0960 0x2100  \Device\Harddisk0\DR0\Partition6 - ok
15:28:42.0992 0x2100  [ 5BC64D8E9A435F75E86733E4457F1383 ] \Device\Harddisk0\DR0\Partition7
15:28:43.0023 0x2100  \Device\Harddisk0\DR0\Partition7 - ok
15:28:43.0023 0x2100  [ 9C2647BF6B63C76DD788DF3DF2FACEC0 ] \Device\Harddisk1\DR1\Partition1
15:28:43.0023 0x2100  \Device\Harddisk1\DR1\Partition1 - ok
15:28:43.0023 0x2100  ================ Scan generic autorun ======================
15:28:43.0170 0x2100  [ 55E2B2DA37C4A916327BA606CA8DAF89, A749A01C39C7197A56F3FAA63705155BA981A96AB521816C15F35FA5DCFDA9F6 ] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
15:28:43.0248 0x2100  AmIcoSinglun64 - detected UnsignedFile.Multi.Generic ( 1 )
15:28:43.0442 0x2100  Detect skipped due to KSN trusted
15:28:43.0442 0x2100  AmIcoSinglun64 - ok
15:28:43.0721 0x2100  [ 5A9CDFF0CEDFA8061D0DE6B6C2547F51, 76CDEF7A94D90D79CFA105E492E53350F7545900FEF651CD0D18B3163B812AD2 ] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe
15:28:43.0757 0x2100  AdobeAAMUpdater-1.0 - ok
15:28:43.0757 0x2100  SynTPEnh - ok
15:28:43.0874 0x2100  [ DD2764BF044F573EB40EF4ED65A53474, 920D1AF6E284F4E3E1D200B660F5DB65938D51D5E7FBD1AF6EBB2E0BB8F30F15 ] C:\Program Files (x86)\USB Camera\VM331STI.EXE
15:28:43.0958 0x2100  331BigDog - ok
15:28:44.0191 0x2100  [ 607FCAE0B447C1B917DADBF0BE9A83FE, 1400420835C4E523595A4700ABC2E0F66B7BBC6AC48DB334F4E41DA3B1581F20 ] C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe
15:28:44.0215 0x2100  UpdatePPShortCut - ok
15:28:45.0061 0x2100  [ F66203AF9C159E2CBD54DF981654F499, C28A7E3D4BB50F14D40C3AE9D1267D11015381A9615663BAAAB6C0084A72E607 ] C:\Program Files\AVAST Software\Avast\AvastUI.exe
15:28:45.0234 0x2100  AvastUI.exe - ok
15:28:45.0422 0x2100  [ E37A09376D7DD0F458BD8134545DC1E6, 5D86EF183C2DEAADCF33DF34A376118C6F213BC0545035FB8054BF04F6154C34 ] C:\Program Files (x86)\BlueStacks\HD-Agent.exe
15:28:45.0469 0x2100  BlueStacks Agent - ok
15:28:45.0981 0x2100  [ 3D1D33DE714636AEAB4AC18291D254F6, 8C9ECD5818F48B90FAEFBEC896F795DDE45CCE73BB11901E90E035F179037117 ] C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
15:28:46.0205 0x2100  Adobe Creative Cloud - ok
15:28:46.0282 0x2100  [ 504AAB0AF82973329CAEF8FFC595C05D, C5E619624870E9866B9D6B03683E4A700B92CA4254DE03F562E8A64F7F100A58 ] C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
15:28:46.0331 0x2100  SunJavaUpdateSched - ok
15:28:46.0445 0x2100  [ 34D296AFC913E302953C70463EF09A48, BC413307CBC56C039EE8A05B51A56E14EF59678FBB33815AEB320078056C8CE7 ] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
15:28:46.0471 0x2100  HP Software Update - ok
15:28:47.0002 0x2100  OneDriveSetup - ok
15:28:47.0002 0x2100  OneDriveSetup - ok
15:28:47.0478 0x2100  [ E5EA9032823E11543475D46775258CDA, 6056BE7D6FEB8D433E61829255D60B09961F6217D9DE7C600A421D57D853CE93 ] C:\Users\bambi\AppData\Local\Programs\Google\Google+ Auto Backup\Google+ Auto Backup.exe
15:28:47.0648 0x2100  Google+ Auto Backup - ok
15:28:48.0107 0x2100  [ 22F7B9670AD770C7ED7F4738204C8E5C, 7B793AC094CB1B073419B5DAE09DFBB8EBED03D29301F490AA76EA0667613438 ] C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\ScanToPCActivationApp.exe
15:28:48.0234 0x2100  HP Deskjet 3070 B611 series (NET) - ok
15:28:48.0356 0x2100  [ 4EA63B2AF94A69E5D89D25D45BF8C8D8, D666BC52A093643F21D99C55928851DDE5862DD47FA56C845019B31C6066D7B7 ] C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
15:28:48.0384 0x2100  TomTomHOME.exe - ok
15:28:48.0497 0x2100  [ 1D7DD340E13DF9585EABB849CFC3E11B, 31CCD9753402DC030C641214B4ECB48A757BCD9F427A143A88745C62EFF87766 ] C:\Users\bambi\AppData\Local\Microsoft\OneDrive\OneDrive.exe
15:28:48.0533 0x2100  OneDrive - ok
15:28:48.0750 0x2100  [ EB09976C0AA4F1F9934149084B1B3CB0, F5016056058C82C42CC52DCB042C47ED99585F3A0FF9E67444E4A54141C46EDF ] C:\Program Files\Zoner\Photo Studio 18\Program32\ZPSTRAY.EXE
15:28:48.0806 0x2100  Zoner Photo Studio Autoupdate - ok
15:28:49.0473 0x2100  [ 52931D60AEE60B678D0B6F6D0AAE8E38, 9EB5948C6593B939DF201ABC89917DF07F395BA221925FC15EFCE7452CE68D08 ] C:\Program Files\HP\HP Officejet Pro 6830\Bin\ScanToPCActivationApp.exe
15:28:49.0551 0x2100  HP Officejet Pro 6830 (NET) - ok
15:28:49.0551 0x2100  OneDriveSetup - ok
15:28:49.0908 0x2100  [ E5EA9032823E11543475D46775258CDA, 6056BE7D6FEB8D433E61829255D60B09961F6217D9DE7C600A421D57D853CE93 ] C:\Users\bambi\AppData\Local\Programs\Google\Google+ Auto Backup\Google+ Auto Backup.exe
15:28:49.0979 0x2100  Google+ Auto Backup - ok
15:28:50.0426 0x2100  [ 22F7B9670AD770C7ED7F4738204C8E5C, 7B793AC094CB1B073419B5DAE09DFBB8EBED03D29301F490AA76EA0667613438 ] C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\ScanToPCActivationApp.exe
15:28:50.0478 0x2100  HP Deskjet 3070 B611 series (NET) - ok
15:28:50.0552 0x2100  WAB Migrate - ok
15:28:50.0552 0x2100  Waiting for KSN requests completion. In queue: 16
15:28:51.0609 0x2100  AV detected via SS2: Windows Defender, C:\Program Files\Windows Defender\MSASCui.exe ( 4.10.14393.187 ), 0x60100 ( disabled : updated )
15:28:51.0630 0x2100  AV detected via SS2: avast! Antivirus, C:\Program Files\AVAST Software\Avast\VisthAux.exe ( 10.3.2225.1172 ), 0x41000 ( enabled : updated )
15:28:51.0638 0x2100  Win FW state via NFP2: enabled ( trusted )
15:28:51.0808 0x2100  ============================================================
15:28:51.0808 0x2100  Scan finished
15:28:51.0808 0x2100  ============================================================
15:28:51.0808 0x20f8  Detected object count: 0
15:28:51.0808 0x20f8  Actual detected object count: 0
15:28:59.0694 0x20b4  Deinitialize success

deeprybka 25.12.2016 15:32
Kein Problem...

Schritt 1

Downloade Dir bitte http://deeprybka.trojaner-board.de/adwcleaner/adwc.pngAdwCleaner auf Deinen Desktop.
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Werkzeuge > Optionen und vergewissere Dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel
    • "Prefetch" Dateien
    • Proxy
    • Winsock
    • Internet Explorer Richtlinien
    • Chrome Richtlinien
  • Bestätige die Auswahl mit Ok.
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen (auch dann wenn AdwCleaner sagt, dass nichts gefunden wurde) und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit Deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 2

http://deeprybka.trojaner-board.de/m...mbamlogo4a.pnghttp://deeprybka.trojaner-board.de/m...mbamlogo4b.png
  • Anleitung
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Unter Einstellungen/ Erkennung und Schutz setze bitte einen Haken bei "Suche nach Rootkits".
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass Deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

kakuzu 06.01.2017 17:24
Schonmal die erste Log die 2. kommt gleich.

AdwCleaner Logfile:
Code:
# AdwCleaner v6.041 - Bericht erstellt am 06/01/2017 um 17:16:12
# Aktualisiert am 16/12/2016 von Malwarebytes
# Datenbank : 2017-01-06.1 [Server]
# Betriebssystem : Windows 10 Home  (X64)
# Benutzername : bambi - ANDREA
# Gestartet von : C:\Users\bambi\Desktop\AdwCleaner_6.041.exe
# Modus: Löschen
# Unterstützung : https://www.malwarebytes.com/support



***** [ Dienste ] *****



***** [ Ordner ] *****



***** [ Dateien ] *****



***** [ DLL ] *****



***** [ WMI ] *****



***** [ Verknüpfungen ] *****



***** [ Aufgabenplanung ] *****



***** [ Registrierungsdatenbank ] *****



***** [ Browser ] *****

[-] [C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Gelöscht: www.yahoo.com
[-] [C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Profile 4\Web data] [Search Provider] Gelöscht: www.yahoo.com
[-] [C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Profile 4\Web data] [Search Provider] Gelöscht: de.yhs4.search.yahoo.com
[-] [C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Profile 4\Web data] [Search Provider] Gelöscht: wordpress.org
[-] [C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Profile 4\Web data] [Search Provider] Gelöscht: password-viewer.en.softonic.com
[-] [C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Profile 4] [startup_urls] Gelöscht: hxxp://mysearch.avg.com?cid={6906F778-DF21-4A84-8687-5B71364FFFCF}&mid=8fa50f37953e47d2a1f5d16b2f1ec0c5-20f00ebcee5ffec2e6b9d26a73226d781000484a&lang=de&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-03-05 11:33:10&v=17.3.1.91&pid=safeguard&sg=&sap=hp
[-] [C:\Users\bambi\AppData\Local\Google\Chrome\User Data\Profile 4] [homepage] Gelöscht: hxxp://mysearch.avg.com?cid={6906F778-DF21-4A84-8687-5B71364FFFCF}&mid=8fa50f37953e47d2a1f5d16b2f1ec0c5-20f00ebcee5ffec2e6b9d26a73226d781000484a&lang=de&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-03-05 11:33:10&v=17.3.1.91&pid=safeguard&sg=&sap=hp


*************************

:: "Tracing" Schlüssel gelöscht
:: Winsock Einstellungen zurückgesetzt
:: "Prefetch" Dateien gelöscht
:: Proxy Einstellungen zurückgesetzt
:: Internet Explorer Richtlinien gelöscht
:: Chrome Richtlinien gelöscht

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [2274 Bytes] - [06/01/2017 17:16:12]
C:\AdwCleaner\AdwCleaner[S0].txt - [2311 Bytes] - [06/01/2017 17:15:31]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [2420 Bytes] ##########
--- --- ---

Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlaufdatum: 06.01.2017
Suchlaufzeit: 17:26
Protokolldatei:
Administrator: Ja

Version: 2.2.1.1043
Malware-Datenbank: v2017.01.06.06
Rootkit-Datenbank: v2016.11.20.01
Lizenz: Kostenlose Version
Malware-Schutz: Deaktiviert
Schutz vor bösartigen Websites: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 10
CPU: x64
Dateisystem: NTFS
Benutzer: bambi

Suchlauftyp: Bedrohungssuchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 374910
Abgelaufene Zeit: 26 Min., 33 Sek.

Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Warnen
PUM: Aktiviert

Prozesse: 0
(keine bösartigen Elemente erkannt)

Module: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)

Registrierungswerte: 0
(keine bösartigen Elemente erkannt)

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Ordner: 0
(keine bösartigen Elemente erkannt)

Dateien: 1
PUP.Optional.OpenCandy, C:\Users\bambi\Downloads\PhotoScape_V3.7.exe, In Quarantäne, [aa047efa2880c96d0709539adc273bc5],

Physische Sektoren: 0
(keine bösartigen Elemente erkannt)


(end)

deeprybka 06.01.2017 22:32
Jetzt bitte Suchscan durchführen:

Schritt 1

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


kakuzu 14.01.2017 11:15
Hier einmal die Log vom OnlineScasnner.

Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=95f6166e36309f478f106ce0e2cf0f0b
# end=init
# utc_time=2017-01-14 07:47:30
# local_time=2017-01-14 08:47:30 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# osver=6.2.9200 NT
Update Init
Update Download
Update Finalize
Updated modules version: 32058
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=95f6166e36309f478f106ce0e2cf0f0b
# end=updated
# utc_time=2017-01-14 07:49:36
# local_time=2017-01-14 08:49:36 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# osver=6.2.9200 NT
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=95f6166e36309f478f106ce0e2cf0f0b
# engine=32058
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2017-01-14 10:05:05
# local_time=2017-01-14 11:05:05 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=788 16777213 100 87 6976278 91584592 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 5419202 58064572 0 0
# scanned=346096
# found=4
# cleaned=0
# scan_time=8128
sh=97ED1A18135AB92887F05171258CBA9696DF2DC6 ft=1 fh=c84d862f0f67dbcc vn="Variante von Win32/AdWare.iBryte.J.gen Anwendung" ac=I fn="C:\Users\bambi\Documents\samsung\Kies3\backup\GT-I9195\GT-I9195_\GT-I9195_20160501160612\Others\Download\GetTest.exe"
sh=97ED1A18135AB92887F05171258CBA9696DF2DC6 ft=1 fh=c84d862f0f67dbcc vn="Variante von Win32/AdWare.iBryte.J.gen Anwendung" ac=I fn="C:\Users\bambi\Documents\samsung\Kies3\backup\GT-I9195\GT-I9195_\GT-I9195_20160820114840\Others\Download\GetTest.exe"
sh=22150D15533550DC8B0F9D23871F3913648C62BB ft=1 fh=302cfdeb2de770ba vn="Variante von Win32/Toolbar.Widgi.N eventuell unerwünschte Anwendung" ac=I fn="C:\Users\bambi\Downloads\freeripmp3-setup-4.5.2 (1).exe"
sh=481D44FC175D7D04224C088E1F6CF6F77456A97A ft=1 fh=67aaf6f2fe92aec8 vn="Variante von Win32/DownloadSponsor.A eventuell unerwünschte Anwendung" ac=I fn="C:\Users\bambi\Downloads\TestDisk PhotoRec - CHIP-Installer.exe"

deeprybka 14.01.2017 12:23
Welche Probleme bestehen aktuell noch?

kakuzu 15.01.2017 15:39
Aktuell immer noch das Problem das der Rechner sehr lange zum Starten benötigt und auch während des Betriebes den eindruck macht das er recht langsam mittlerweile ist.

Scheint mir aber fast so das es an keiner Schadsoftware liegt. Werden wohl mal generell schauen was damit los ist.


Alle Zeitangaben in WEZ +1. Es ist jetzt 23:50 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131