Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Windows-Defender nicht reaktivierbar, obwohl Malware entfernt (https://www.trojaner-board.de/183806-windows-defender-reaktivierbar-obwohl-malware-entfernt.html)

Schnuckibaer 04.01.2017 21:31
Windows-Defender nicht reaktivierbar, obwohl Malware entfernt
 
Hallo,

ich habe mir mit dem Chip-Installer Malware eingefangen.

Zunächst öffneten sich in Firefox beim Starten mitunter nicht jugendfreie Seiten oder google leitete beim Suchen auf nova.rambler.ru und ähnliche Seiten weiter.
Der Echtzeitschutz bei Ad-Aware funktionierte nicht mehr und der Windows-Defender auch nicht.
Nach der Installation von Adwcleaner und Malwarebytes und diversen Funden sieht Firefox wieder "normal" aus, Ad-Aware läuft wieder.

Der Windows-Defender gibt aber noch die Fehlermeldung:
"Der Dienst "Windows Defender-Dienst" auf "Lokaler computer" konnte nicht gestartet werden.
Fehler 1053: Der Dienst antwortete nicht rechtzeitig auf die Start- oder Steuerungsanforderung."

Ich weiß nun nicht, wie ich den Defender reaktiviere und ob mein Laptop wieder "sauber" ist.

Hier die Log-Dateien:
Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 01-01-2017
durchgeführt von Denise (Administrator) auf WOMBAT (04-01-2017 20:43:51)
Gestartet von C:\Users\Denise\Downloads
Geladene Profile: UpdatusUser & Denise (Verfügbare Profile: UpdatusUser & Denise)
Platform: Windows 8.1 (Update) (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareService.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
() C:\Program Files (x86)\PHotkey\Atouch64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Program Files (x86)\PHotkey\POsd.exe
() C:\Program Files (x86)\PHotkey\GPMTray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareTray.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\SnippingTool.exe
(Microsoft Corporation) C:\Windows\System32\ByteCodeGenerator.exe

==================== Registry (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-30] (Intel Corporation)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028896 2013-08-28] (NVIDIA Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2780912 2013-09-19] (Synaptics Incorporated)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13662936 2013-10-24] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1360600 2013-10-29] (Realtek Semiconductor)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareTray.exe [9533688 2016-12-15] ()
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111576 2013-08-05] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [490760 2013-09-23] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-11] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-09-18] (CyberLink Corp.)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [25779624 2016-12-21] (Dropbox, Inc.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [210432 2016-07-05] (Geek Software GmbH)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1
HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\Run: [Power2GoExpress8] => NA
HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\MountPoints2: {a3baa892-5369-11e6-828f-0c8bfddd15ac} - "F:\windows\Data\setup.exe"
HKU\S-1-5-18\...\Run: [AppLauncher] => C:\Program Files (x86)\Ashampoo\Ashampoo AppLauncher\AppLauncher.exe
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt9] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt10] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt9] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-11-01] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-11-01] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-11-01] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NeroDesktopSwitcher.scf [2014-01-09] ()

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{2D7D7085-9498-4093-AC34-2DBFD52ED2F0}: [DhcpNameServer] 192.168.178.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2016-10-11] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2016-11-01] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2016-07-26] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-11-01] (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2016-07-26] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default [2017-01-04]
FF user.js: detected! => C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\user.js [2016-07-23]
FF Homepage: Mozilla\Firefox\Profiles\ytdyifhp.default -> www.google.de
FF Extension: (Firefox Hotfix) - C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\Extensions\firefox-hotfix@mozilla.org.xpi [2016-08-31]
FF Extension: (Video DownloadHelper) - C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2017-01-04]
FF Extension: (Adblock Plus) - C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-24]
FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files (x86)\congstar\Internet-Manager\Bin\addon => nicht gefunden
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_23_0_0_207.dll [2016-11-11] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_207.dll [2016-11-11] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-07-12] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2016-07-26] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-05] (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL [2014-07-24] (Nero AG)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\browser\defaults\preferences\firefox.js [2016-12-25]

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [3042032 2016-11-01] (Microsoft Corporation)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [74712 2013-03-11] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [316376 2013-03-11] (CyberLink)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-07-19] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-07-19] (Dropbox, Inc.)
R2 DbxSvc; C:\Windows\system32\DbxSvc.exe [42096 2016-12-21] (Dropbox, Inc.)
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [160768 2013-06-27] () [Datei ist nicht signiert]
S4 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-30] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [Datei ist nicht signiert]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 Intel(R) Wireless Bluetooth(R) 4.0 Radio Management; C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe [157128 2013-09-18] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareService.exe [630976 2016-12-15] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2013-10-11] ()
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14997280 2013-08-28] (NVIDIA Corporation)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [4088608 2016-09-21] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [235984 2016-11-24] (Safer-Networking Ltd.)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2145080 2015-06-25] (TuneUp Software)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3671792 2013-10-11] (Intel® Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [140600 2013-07-22] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1390904 2013-09-05] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
R3 gzflt; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Antimalware Engine\3.0.129.0\gzflt.sys [161592 2016-04-28] (BitDefender LLC)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [118728 2013-09-18] (Intel Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2017-01-04] (Malwarebytes)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [65408 2016-03-10] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
R3 NETwNb64; C:\Windows\system32\DRIVERS\NETwbw02.sys [3607520 2013-10-14] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-08-20] (NVIDIA Corporation)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R3 PegaRadioSwitch; C:\Windows\System32\drivers\PegaRadioSwitch.sys [23552 2013-08-22] (Windows (R) Win 7 DDK provider)
S3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1975000 2013-07-31] (Realtek Semiconductor Corporation                          )
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2013-09-19] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-09-19] (Synaptics Incorporated)
S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [485512 2016-04-28] (BitDefender S.R.L.)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [31144 2015-06-04] (TuneUp Software)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [34760 2013-08-22] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [265056 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
S3 dbx; system32\DRIVERS\dbx.sys [X]
S3 HSPADataCardusbmdm; \SystemRoot\system32\DRIVERS\HSPADataCardusbmdm.sys [X]
S3 HSPADataCardusbnmea; \SystemRoot\system32\DRIVERS\HSPADataCardusbnmea.sys [X]
S3 HSPADataCardusbser; \SystemRoot\system32\DRIVERS\HSPADataCardusbser.sys [X]
S3 massfilter; \SystemRoot\System32\drivers\massfilter.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-01-04 20:27 - 2017-01-04 20:32 - 00055817 _____ C:\Users\Denise\Downloads\Addition.txt
2017-01-04 20:24 - 2017-01-04 20:43 - 00023177 _____ C:\Users\Denise\Downloads\FRST.txt
2017-01-04 20:24 - 2017-01-04 20:24 - 00000000 ____D C:\Users\Denise\Downloads\FRST-OlderVersion
2017-01-04 19:30 - 2017-01-04 19:30 - 00000000 ___HD C:\ProgramData\8663r261o3m395
2016-12-29 20:49 - 2016-12-29 20:52 - 00000000 ____D C:\Users\Denise\Desktop\Handy Urlaub
2016-12-27 21:55 - 2016-12-27 21:55 - 00000000 ____D C:\Users\Denise\AppData\Roaming\Internet-Manager
2016-12-26 17:46 - 2017-01-04 20:43 - 00000000 ____D C:\FRST
2016-12-26 17:46 - 2017-01-04 20:24 - 02418176 _____ (Farbar) C:\Users\Denise\Downloads\FRST64.exe
2016-12-26 16:46 - 2017-01-04 20:32 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-12-26 16:45 - 2016-12-26 17:18 - 00001116 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-12-26 16:45 - 2016-12-26 16:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-12-26 16:45 - 2016-12-26 16:45 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-12-26 16:45 - 2016-12-26 16:45 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-12-26 16:45 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-12-26 16:45 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-12-26 16:45 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-12-26 16:44 - 2016-12-26 16:45 - 22851472 _____ (Malwarebytes ) C:\Users\Denise\Downloads\mbam-setup-2.2.1.1043.exe
2016-12-26 15:53 - 2016-12-26 15:56 - 00000000 ____D C:\AdwCleaner
2016-12-26 15:53 - 2016-12-26 15:53 - 03977168 _____ C:\Users\Denise\Downloads\adwcleaner_6.041.exe
2016-12-26 15:12 - 2016-12-25 22:34 - 00001282 _____ C:\Windows\system32\Drivers\etc\hosts.20161226-151245.backup
2016-12-26 12:47 - 2016-12-26 17:18 - 00001081 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-12-26 12:47 - 2016-12-26 17:18 - 00001063 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-12-26 12:47 - 2016-12-26 12:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-12-26 12:44 - 2016-12-26 12:44 - 00243720 _____ C:\Users\Denise\Downloads\Firefox Setup Stub 50.1.0.exe
2016-12-25 22:46 - 2017-01-02 16:34 - 00062070 _____ C:\Windows\PFRO.log
2016-12-25 22:46 - 2016-12-27 21:59 - 00477328 _____ C:\Windows\system32\FNTCACHE.DAT
2016-12-25 22:38 - 2016-12-25 22:41 - 00001058 _____ C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-12-25 22:36 - 2009-09-27 09:39 - 00415744 ___SH (The Public) C:\Windows\SysWOW64\avisynth.dll
2016-12-25 22:36 - 2005-07-14 12:31 - 00032256 ___SH C:\Windows\SysWOW64\AVSredirect.dll
2016-12-25 22:36 - 2004-02-22 10:11 - 00764416 ___SH (Abysmal Software) C:\Windows\SysWOW64\devil.dll
2016-12-25 22:36 - 2004-01-25 00:00 - 00070656 ___SH (www.helixcommunity.org) C:\Windows\SysWOW64\yv12vfw.dll
2016-12-25 22:36 - 2004-01-25 00:00 - 00070656 ___SH (www.helixcommunity.org) C:\Windows\SysWOW64\i420vfw.dll
2016-12-25 22:34 - 2016-12-26 00:08 - 00000000 ____D C:\Program Files (x86)\Cherciingnazak Schedule
2016-12-25 22:33 - 2016-12-26 12:13 - 00000000 ____D C:\Program Files (x86)\Drowiing
2016-12-25 22:33 - 2016-12-25 22:46 - 00000000 ____D C:\Users\Denise\AppData\Roaming\Dripied
2016-12-25 22:33 - 2016-12-25 22:34 - 00000000 ____D C:\Users\Denise\AppData\Roaming\Profiles
2016-12-25 22:33 - 2016-12-25 22:33 - 00000000 ____D C:\Users\Denise\Documents\eRightSoft
2016-12-25 22:33 - 2016-12-25 22:33 - 00000000 ____D C:\Users\Denise\AppData\Local\Steqiwardeadom
2016-12-25 22:33 - 2016-05-05 12:23 - 00556216 __RSH (FFmpeg Project) C:\Windows\SysWOW64\avutil-lav-55.dll
2016-12-25 22:33 - 2016-05-05 12:23 - 00537784 __RSH (FFmpeg Project) C:\Windows\SysWOW64\swscale-lav-4.dll
2016-12-25 22:33 - 2016-05-05 12:23 - 00405176 __RSH (Intel Corp.) C:\Windows\SysWOW64\IntelQuickSyncDecoder.dll
2016-12-25 22:33 - 2016-05-05 12:23 - 00276152 __RSH C:\Windows\SysWOW64\libbluray.dll
2016-12-25 22:33 - 2016-05-05 12:23 - 00000493 __RSH C:\Windows\SysWOW64\LAVFilters.Dependencies.manifest
2016-12-25 22:33 - 2016-05-05 12:22 - 10766520 __RSH (FFmpeg Project) C:\Windows\SysWOW64\avcodec-lav-57.dll
2016-12-25 22:33 - 2016-05-05 12:22 - 01699000 __RSH (FFmpeg Project) C:\Windows\SysWOW64\avformat-lav-57.dll
2016-12-25 22:33 - 2016-05-05 12:22 - 00188088 __RSH (FFmpeg Project) C:\Windows\SysWOW64\avfilter-lav-6.dll
2016-12-25 22:33 - 2016-05-05 12:22 - 00160440 __RSH (FFmpeg Project) C:\Windows\SysWOW64\avresample-lav-3.dll
2016-12-25 22:33 - 2004-10-10 08:50 - 00278528 _____ (Real Networks, Inc) C:\Windows\SysWOW64\pncrt.dll
2016-12-25 22:33 - 2004-07-02 16:33 - 00327749 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\drvc.dll
2016-12-25 22:32 - 2017-01-04 19:30 - 00000000 ___HD C:\ProgramData\93066184d64t1179994
2016-12-25 22:32 - 2016-12-25 22:44 - 00000000 ____D C:\Program Files (x86)\eRightSoft
2016-12-25 22:32 - 2016-12-25 22:43 - 00000000 ____D C:\Windows\system32\SSL
2016-12-25 22:31 - 2016-12-26 00:07 - 00000000 ___HD C:\Users\Denise\AppData\Roaming\DIFX
2016-12-25 22:31 - 2016-12-26 00:07 - 00000000 ____D C:\Users\Denise\AppData\Roaming\SPI
2016-12-25 22:06 - 2017-01-02 08:51 - 00000000 ____D C:\Users\Denise\Desktop\DVD Player Auto
2016-12-23 21:22 - 2016-12-23 21:22 - 00000000 ____D C:\ProgramData\Oracle
2016-12-23 21:21 - 2016-10-27 14:22 - 59890688 _____ (Ravensburger AG) C:\Users\Denise\Desktop\tiptoi_3.1.6.exe
2016-12-23 15:40 - 2016-12-23 15:40 - 00026306 _____ C:\Users\Denise\Desktop\Gutschein.docx
2016-12-22 14:13 - 2016-12-26 00:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2016-12-21 19:15 - 2016-12-21 19:15 - 00075888 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-stable.sys
2016-12-21 19:15 - 2016-12-21 19:15 - 00075888 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-dev.sys
2016-12-21 19:15 - 2016-12-21 19:15 - 00075888 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-canary.sys
2016-12-21 19:15 - 2016-12-21 19:15 - 00042096 _____ (Dropbox, Inc.) C:\Windows\system32\DbxSvc.exe
2016-12-18 11:54 - 2016-12-18 11:54 - 00106441 _____ C:\Users\Denise\Downloads\PMP_Order_1.pdf
2016-12-18 07:44 - 2017-01-04 19:15 - 00012827 _____ C:\Windows\setupact.log
2016-12-18 07:44 - 2016-12-18 07:44 - 00000000 _____ C:\Windows\setuperr.log
2016-12-17 08:31 - 2017-01-04 20:18 - 00039426 ____H C:\Users\Denise\AppData\Local\IconCache.db
2016-12-16 11:45 - 2016-12-16 11:45 - 00000000 ____D C:\Users\Denise\AppData\Local\CrashRpt
2016-12-16 11:43 - 2016-12-26 17:18 - 00001219 _____ C:\Users\Public\Desktop\Ashampoo Snap 2017.lnk
2016-12-16 11:43 - 2016-12-26 00:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
2016-12-16 11:39 - 2016-12-16 11:40 - 54653776 _____ (Ashampoo GmbH & Co. KG ) C:\Users\Denise\Downloads\ashampoo_snap_2017_23536.exe
2016-12-16 11:19 - 2016-12-16 11:19 - 00292995 _____ C:\Users\Denise\Downloads\mp3DC222.exe
2016-12-16 07:59 - 2016-12-26 00:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2016-12-16 07:57 - 2016-12-16 07:57 - 00000000 ____D C:\Program Files\Common Files\Lavasoft
2016-12-16 07:54 - 2016-12-16 07:54 - 02586928 _____ C:\Users\Denise\Downloads\Adaware_Installer(1).exe
2016-12-15 14:20 - 2016-12-26 17:17 - 00002276 _____ C:\Users\Denise\Desktop\Kindle.lnk
2016-12-15 14:20 - 2016-12-26 00:07 - 00000000 ____D C:\Users\Denise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon
2016-12-15 14:20 - 2016-12-15 14:21 - 00000000 ____D C:\Users\Denise\Documents\My Kindle Content
2016-12-15 14:20 - 2016-12-15 14:20 - 00000000 ____D C:\Users\Denise\AppData\Local\Amazon
2016-12-15 14:19 - 2016-12-15 14:20 - 66693792 _____ (Amazon.com) C:\Users\Denise\Downloads\KindleForPC-installer-1.17.44183.exe
2016-12-15 13:28 - 2016-12-15 13:28 - 00045532 _____ C:\Users\Denise\Downloads\PB_KAZ_KtoNr_0987363857_03-11-2016_0635.pdf
2016-12-15 13:28 - 2016-12-15 13:28 - 00042838 _____ C:\Users\Denise\Downloads\PB_KAZ_KtoNr_0987363857_05-12-2016_0620.pdf
2016-12-14 07:58 - 2016-12-01 15:13 - 00869576 _____ (Microsoft Corporation) C:\Windows\system32\msvcr120_clr0400.dll
2016-12-14 07:58 - 2016-12-01 15:13 - 00678592 _____ (Microsoft Corporation) C:\Windows\system32\msvcp120_clr0400.dll
2016-12-14 07:58 - 2016-12-01 15:11 - 00875720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr120_clr0400.dll
2016-12-14 07:58 - 2016-12-01 15:11 - 00536768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp120_clr0400.dll
2016-12-14 07:58 - 2016-10-20 14:14 - 00029888 _____ (Microsoft Corporation) C:\Windows\system32\aspnet_counters.dll
2016-12-14 07:58 - 2016-10-20 14:10 - 00028352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aspnet_counters.dll
2016-12-14 07:56 - 2016-11-19 22:24 - 00567152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2016-12-14 07:56 - 2016-11-19 22:24 - 00152856 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2016-12-14 07:56 - 2016-11-19 20:29 - 00401408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-12-14 07:56 - 2016-11-19 19:44 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2016-12-14 07:56 - 2016-11-19 18:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2016-12-14 07:56 - 2016-11-19 18:22 - 00111104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2016-12-14 07:56 - 2016-11-16 22:49 - 00377176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
2016-12-14 07:56 - 2016-11-12 22:06 - 00738104 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2016-12-14 07:56 - 2016-11-12 20:38 - 00613632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2016-12-14 07:56 - 2016-11-12 20:25 - 00576000 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-12-14 07:56 - 2016-11-12 20:08 - 25759744 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-12-14 07:56 - 2016-11-12 20:07 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-12-14 07:56 - 2016-11-12 19:53 - 06049280 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-12-14 07:56 - 2016-11-12 19:29 - 00498688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-12-14 07:56 - 2016-11-12 19:23 - 01033216 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2016-12-14 07:56 - 2016-11-12 19:17 - 20302848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-12-14 07:56 - 2016-11-12 19:14 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-12-14 07:56 - 2016-11-12 19:10 - 00806912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-12-14 07:56 - 2016-11-12 18:45 - 00880640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2016-12-14 07:56 - 2016-11-12 18:41 - 15257088 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-12-14 07:56 - 2016-11-12 18:38 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-12-14 07:56 - 2016-11-12 18:37 - 04608000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-12-14 07:56 - 2016-11-12 18:35 - 02920960 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-12-14 07:56 - 2016-11-12 18:21 - 13653504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-12-14 07:56 - 2016-11-12 18:20 - 01543680 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-12-14 07:56 - 2016-11-12 18:11 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-12-14 07:56 - 2016-11-12 18:05 - 02444800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-12-14 07:56 - 2016-11-12 18:02 - 01312256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-12-14 07:56 - 2016-11-12 18:02 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-12-14 07:56 - 2016-11-11 03:33 - 01541240 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2016-12-14 07:56 - 2016-11-09 18:25 - 01376768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2016-12-14 07:56 - 2016-11-05 21:46 - 00422744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\spaceport.sys
2016-12-14 07:56 - 2016-11-05 19:35 - 04169216 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-12-14 07:56 - 2016-11-05 18:57 - 03320320 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2016-12-14 07:56 - 2016-11-05 18:11 - 03606528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2016-12-14 07:56 - 2016-11-05 16:56 - 02778624 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2016-12-14 07:56 - 2016-11-05 16:46 - 02463744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2016-12-14 07:56 - 2016-10-28 03:56 - 01380048 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-12-14 07:56 - 2016-10-27 15:28 - 01097728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2016-12-14 07:56 - 2016-10-12 22:49 - 00379224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2016-12-14 07:56 - 2016-10-12 22:11 - 00922968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\refs.sys
2016-12-14 07:56 - 2016-10-11 17:45 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\TpmTasks.dll
2016-12-14 07:56 - 2016-10-11 00:31 - 00990040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2016-12-14 07:56 - 2016-10-10 19:18 - 00069976 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2016-12-14 07:56 - 2016-10-10 19:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cmimcext.sys
2016-12-14 07:56 - 2016-10-09 15:17 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\ActionQueue.dll
2016-12-14 07:56 - 2016-10-09 15:08 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\shsetup.dll
2016-12-14 07:56 - 2016-10-09 15:08 - 00095232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shsetup.dll
2016-12-14 07:56 - 2016-10-08 23:24 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll
2016-12-14 07:56 - 2016-10-08 22:31 - 00498688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll
2016-12-14 07:56 - 2016-10-08 22:10 - 03547648 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2016-12-14 07:56 - 2016-10-05 15:01 - 01200128 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Globalization.dll
2016-12-14 07:56 - 2016-10-05 15:00 - 00868864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Globalization.dll
2016-12-14 07:56 - 2016-10-05 15:00 - 00323072 _____ (Microsoft Corporation) C:\Windows\system32\GlobCollationHost.dll
2016-12-14 07:56 - 2016-10-05 14:52 - 00513456 _____ C:\Windows\SysWOW64\locale.nls
2016-12-14 07:56 - 2016-10-05 14:52 - 00513456 _____ C:\Windows\system32\locale.nls
2016-12-14 07:56 - 2016-10-05 05:15 - 01969944 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2016-12-14 07:56 - 2016-10-05 05:15 - 01613528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2016-12-14 07:56 - 2016-10-05 05:15 - 00324896 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2016-12-14 07:56 - 2016-10-05 05:15 - 00245320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2016-12-14 07:56 - 2016-09-27 21:16 - 00445873 _____ C:\Windows\system32\ApnDatabase.xml
2016-12-14 07:56 - 2016-09-20 23:30 - 02462040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2016-12-14 07:56 - 2015-10-22 16:58 - 00200704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GlobCollationHost.dll
2016-12-12 12:09 - 2016-12-12 12:19 - 01037434 _____ C:\Users\Denise\Downloads\20161108_214140.jpg
2016-12-12 12:09 - 2016-12-12 12:09 - 00944227 _____ C:\Users\Denise\Downloads\20161108_214126.jpg
2016-12-12 12:09 - 2016-12-12 12:09 - 00905302 _____ C:\Users\Denise\Downloads\20161108_214019.jpg
2016-12-12 12:09 - 2016-12-12 12:09 - 00810842 _____ C:\Users\Denise\Downloads\20161108_214004.jpg
2016-12-12 11:53 - 2016-12-12 11:53 - 00431690 _____ C:\Users\Denise\Downloads\3907_buildinginstruction
2016-12-11 21:32 - 2016-12-11 21:32 - 00117357 _____ C:\Users\Denise\Downloads\ZIAUFEIN_1481058355529JAOOW1ESAIGW.pdf
2016-12-11 16:05 - 2016-12-11 16:05 - 00104263 _____ C:\Users\Denise\Downloads\PMP_Order_19(1).pdf
2016-12-10 21:34 - 2016-12-10 21:34 - 00104266 _____ C:\Users\Denise\Downloads\PMP_Order_19.pdf
2016-12-08 13:26 - 2016-12-08 13:26 - 00049590 _____ C:\Users\Denise\Downloads\KleinunternehmerUmsatzsteuerrecht.pdf
2016-12-07 07:34 - 2016-12-07 07:34 - 02587440 _____ C:\Users\Denise\Downloads\Adaware_Installer.exe
2016-12-06 14:20 - 2016-12-06 14:20 - 00050834 _____ C:\Users\Denise\Downloads\ebooks-free-download14041.pdf

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-01-04 20:33 - 2016-11-20 07:49 - 00000000 ____D C:\Users\Denise\AppData\LocalLow\Mozilla
2017-01-04 20:28 - 2016-07-19 21:11 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3531133450-1765533330-4211851364-1002
2017-01-04 20:23 - 2016-07-19 21:54 - 00000000 ___RD C:\Users\Denise\Dropbox
2017-01-04 20:23 - 2016-07-19 21:46 - 00001216 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
2017-01-04 19:22 - 2013-09-12 12:28 - 00766620 _____ C:\Windows\system32\perfh007.dat
2017-01-04 19:22 - 2013-09-12 12:28 - 00159902 _____ C:\Windows\system32\perfc007.dat
2017-01-04 19:22 - 2013-09-12 12:00 - 01780340 _____ C:\Windows\system32\PerfStringBackup.INI
2017-01-04 19:22 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\Inf
2017-01-04 19:16 - 2016-10-19 16:37 - 00002370 _____ C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2017-01-04 19:16 - 2016-07-19 21:12 - 00000000 ___DO C:\Users\Denise\SkyDrive
2017-01-04 19:15 - 2013-08-22 15:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-01-04 19:14 - 2013-08-22 14:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2017-01-04 09:01 - 2016-08-20 13:36 - 00000000 ____D C:\Users\Denise\AppData\Roaming\vlc
2017-01-04 08:06 - 2016-07-19 21:46 - 00001220 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
2017-01-02 21:20 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\tracing
2017-01-02 16:34 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\registration
2017-01-01 21:20 - 2016-10-07 11:46 - 00000000 ____D C:\Users\Denise\Documents\Calibre Bibliothek
2016-12-31 22:01 - 2016-07-19 21:05 - 00000000 ___RD C:\Users\Denise\Pictures
2016-12-28 11:17 - 2016-07-19 21:05 - 00000000 ___RD C:\Users\Denise\Music
2016-12-27 21:59 - 2013-08-22 14:36 - 00000000 __RSD C:\Windows\Fonts
2016-12-27 21:56 - 2016-07-27 19:10 - 00000000 ____D C:\Windows\SysWOW64\SupportAppZXH
2016-12-27 21:56 - 2013-08-22 16:36 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
2016-12-27 21:56 - 2013-08-22 16:36 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs
2016-12-27 21:56 - 2013-08-22 14:36 - 00000000 ___RD C:\Program Files (x86)
2016-12-27 21:55 - 2016-07-19 21:05 - 00000000 ____D C:\Users\Denise\AppData\Roaming
2016-12-27 21:55 - 2013-08-22 16:36 - 00000000 __RHD C:\Users\Public\Desktop
2016-12-27 21:55 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\SysWOW64
2016-12-27 20:10 - 2013-11-13 16:02 - 00000000 ____D C:\ProgramData\CyberLink
2016-12-26 22:30 - 2016-07-24 08:40 - 00000000 ____D C:\Users\Denise\dwhelper
2016-12-26 22:26 - 2016-09-02 08:21 - 00000000 ____D C:\Users\Denise\Desktop\Tupperware
2016-12-26 17:18 - 2016-11-27 00:10 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-12-26 17:18 - 2016-11-27 00:10 - 00002065 _____ C:\Users\Public\Desktop\Acrobat Reader DC.lnk
2016-12-26 17:18 - 2016-10-19 17:36 - 00001411 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2016-12-26 17:18 - 2016-10-19 17:36 - 00001393 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2016-12-26 17:18 - 2016-08-20 13:35 - 00001084 _____ C:\Users\Public\Desktop\VLC media player.lnk
2016-12-26 17:18 - 2016-07-25 21:32 - 00002923 _____ C:\Users\Public\Desktop\Nero 2015.lnk
2016-12-26 17:18 - 2016-07-23 19:24 - 00002223 _____ C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2016-12-26 17:18 - 2016-07-23 19:24 - 00002221 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014.lnk
2016-12-26 17:18 - 2016-07-23 19:24 - 00002203 _____ C:\Users\Public\Desktop\TuneUp Utilities 2014.lnk
2016-12-26 17:18 - 2016-07-23 10:49 - 00002068 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\tiptoi® Manager Deinstallationsprogramm.lnk
2016-12-26 17:18 - 2016-07-23 10:49 - 00002000 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\tiptoi.lnk
2016-12-26 17:18 - 2016-07-21 20:13 - 00001081 _____ C:\Users\Public\Desktop\XMedia Recode.lnk
2016-12-26 17:18 - 2016-07-19 22:19 - 00002210 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions 4.5.lnk
2016-12-26 17:18 - 2016-07-19 22:19 - 00002192 _____ C:\Users\Public\Desktop\Adobe Digital Editions 4.5.lnk
2016-12-26 17:18 - 2016-07-19 22:07 - 00000970 _____ C:\Users\Public\Desktop\calibre - E-book management.lnk
2016-12-26 17:18 - 2013-09-13 08:14 - 00001394 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2016-12-26 17:18 - 2013-09-13 08:14 - 00001325 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2016-12-26 17:17 - 2016-07-19 22:56 - 00002497 _____ C:\Users\Denise\Desktop\Word 2013.lnk
2016-12-26 17:17 - 2016-07-19 22:56 - 00002493 _____ C:\Users\Denise\Desktop\Excel 2013.lnk
2016-12-26 17:17 - 2016-07-19 22:56 - 00002383 _____ C:\Users\Denise\Desktop\Outlook 2013.lnk
2016-12-26 17:17 - 2016-07-19 21:06 - 00001057 _____ C:\Users\Denise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-12-26 17:16 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\schemas
2016-12-26 17:15 - 2013-08-22 16:20 - 00000000 ____D C:\Windows\CbsTemp
2016-12-26 15:57 - 2016-11-19 19:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-12-26 15:55 - 2016-07-19 21:05 - 00000000 ___RD C:\Users\Denise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
2016-12-26 15:12 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\system32\Drivers\etc
2016-12-26 15:12 - 2013-08-22 14:25 - 00454135 ____R C:\Windows\system32\Drivers\etc\hosts
2016-12-26 15:07 - 2016-10-19 17:36 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2016-12-26 14:51 - 2013-08-22 14:36 - 00000000 ____D C:\Program Files\Common Files
2016-12-26 12:12 - 2016-07-19 22:35 - 00000000 ____D C:\Users\Denise\Documents\Outlook-Dateien
2016-12-26 12:11 - 2016-08-26 07:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
2016-12-26 12:11 - 2016-07-25 21:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero
2016-12-26 12:11 - 2016-07-21 20:19 - 00000000 ____D C:\Maus
2016-12-26 08:47 - 2013-11-26 14:46 - 00000000 ___RD C:\Users\UpdatusUser\Desktop
2016-12-26 08:27 - 2016-10-19 16:49 - 00262144 _____ C:\Users\Public\ntuser.dat
2016-12-26 07:38 - 2016-11-25 17:17 - 00000000 ____D C:\Users\Denise\AppData\Roaming\ActivePresenter
2016-12-26 07:38 - 2016-07-19 21:05 - 00000000 ____D C:\Users\Denise
2016-12-26 00:27 - 2013-08-22 16:36 - 00000000 ___RD C:\Windows\assembly
2016-12-26 00:26 - 2013-08-22 16:31 - 00000000 ____D C:\Windows\system32\DriverStore
2016-12-26 00:14 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\system32\wbem
2016-12-26 00:08 - 2016-10-19 17:36 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2016-12-26 00:08 - 2016-07-23 10:49 - 00000000 ____D C:\Program Files (x86)\Ravensburger tiptoi
2016-12-26 00:08 - 2016-07-19 22:19 - 00000000 ____D C:\Users\Denise\AppData\Local\Adobe_Systems_Incorporate
2016-12-26 00:08 - 2013-11-13 15:58 - 00000000 ____D C:\ProgramData\ashampoo
2016-12-26 00:08 - 2013-08-22 16:36 - 00000000 ____D C:\Program Files\Windows Defender
2016-12-26 00:08 - 2013-08-22 16:36 - 00000000 ____D C:\Program Files\Internet Explorer
2016-12-26 00:07 - 2016-08-13 15:42 - 00000000 ____D C:\Windows\system32\appraiser
2016-12-26 00:07 - 2016-07-26 07:43 - 00000000 ____D C:\Users\Denise\AppData\Roaming\XMedia Recode
2016-12-26 00:07 - 2016-07-23 10:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\tiptoi® Manager
2016-12-26 00:07 - 2013-11-26 14:46 - 00000000 ____D C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
2016-12-26 00:07 - 2013-11-15 17:10 - 00000000 ___HD C:\Windows\system32\WLANProfiles
2016-12-26 00:07 - 2013-09-20 10:35 - 00000000 ____D C:\Windows\system32\catroot2
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 __RSD C:\Windows\Media
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\SysWOW64\de-DE
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\SystemResources
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\System32\Tasks\Microsoft
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\system32\de-DE
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\system32\CodeIntegrity
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\rescache
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\PolicyDefinitions
2016-12-26 00:07 - 2013-08-22 16:33 - 00000000 ____D C:\Windows\system32\Drivers\UMDF
2016-12-26 00:07 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\WinSxS
2016-12-26 00:07 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\system32\Sysprep
2016-12-26 00:07 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\system32\oobe
2016-12-26 00:07 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\system32\migration
2016-12-26 00:06 - 2013-08-22 14:36 - 00000000 ___RD C:\Program Files
2016-12-25 22:57 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\Logs
2016-12-25 22:46 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\debug
2016-12-25 22:33 - 2016-07-19 21:05 - 00000000 ___RD C:\Users\Denise\Documents
2016-12-25 22:32 - 2016-07-19 21:05 - 00000000 ____D C:\Users\Denise\AppData\Local\Microsoft
2016-12-25 15:13 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\AppReadiness
2016-12-24 22:14 - 2016-07-19 21:05 - 00000000 ____D C:\Users\Denise\AppData\Local\Packages
2016-12-24 22:10 - 2016-07-19 22:19 - 00000000 ____D C:\Users\Denise\Documents\My Digital Editions
2016-12-23 21:24 - 2016-07-23 10:49 - 00000000 ____D C:\Users\Denise\AppData\Roaming\RavensburgerTipToi3
2016-12-23 21:23 - 2016-07-23 10:49 - 00000000 ____D C:\ProgramData\RavensburgerTipToi3
2016-12-22 14:14 - 2016-07-19 21:46 - 00000000 ____D C:\Program Files (x86)\Dropbox
2016-12-20 08:33 - 2013-08-22 16:36 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-12-20 08:32 - 2016-07-19 22:23 - 00000000 ____D C:\Program Files\Microsoft Office 15
2016-12-17 07:04 - 2013-11-13 16:04 - 00000000 ____D C:\ProgramData\install_clap
2016-12-17 07:04 - 2013-09-12 12:52 - 00000000 ____D C:\Windows\Panther
2016-12-16 13:32 - 2016-08-23 20:20 - 00217600 ___SH C:\Users\Denise\Desktop\Thumbs.db
2016-12-16 11:43 - 2013-11-13 15:56 - 00000000 ____D C:\Program Files (x86)\Ashampoo
2016-12-16 10:57 - 2013-09-12 11:53 - 00524288 ___SH C:\Windows\system32\config\COMPONENTS{42b82173-0b2e-11e3-93f4-90b11c2eb9f2}.TMContainer00000000000000000001.regtrans-ms
2016-12-16 10:57 - 2013-09-12 11:53 - 00065536 ___SH C:\Windows\system32\config\COMPONENTS{42b82173-0b2e-11e3-93f4-90b11c2eb9f2}.TM.blf
2016-12-15 09:47 - 2013-09-12 11:53 - 00524288 ___SH C:\Windows\system32\config\DRIVERS{e1793794-0b3d-11e3-9dfe-80de722c933b}.TMContainer00000000000000000001.regtrans-ms
2016-12-15 09:47 - 2013-09-12 11:53 - 00065536 ___SH C:\Windows\system32\config\DRIVERS{e1793794-0b3d-11e3-9dfe-80de722c933b}.TM.blf
2016-12-14 08:02 - 2016-07-23 14:30 - 00000000 ____D C:\Windows\system32\MRT
2016-12-14 08:02 - 2013-09-12 11:53 - 00524288 ___SH C:\Windows\system32\config\COMPONENTS{42b82173-0b2e-11e3-93f4-90b11c2eb9f2}.TMContainer00000000000000000002.regtrans-ms
2016-12-14 08:00 - 2013-11-15 16:01 - 135632432 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-12-14 07:40 - 2016-07-19 21:16 - 00003910 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{CD913E81-9733-4F87-B61C-593DA3D3B538}
2016-12-12 00:00 - 2016-11-10 07:59 - 00835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-12-12 00:00 - 2016-11-10 07:59 - 00177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-12-10 22:10 - 2016-07-19 21:05 - 00000000 ___SD C:\Users\Denise\AppData\Roaming\Microsoft
2016-12-09 23:40 - 2013-08-22 16:36 - 00000000 ___HD C:\Program Files\WindowsApps
2016-12-09 15:35 - 2013-11-26 14:46 - 00000000 ____D C:\Users\UpdatusUser

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2016-11-25 16:39 - 2016-11-25 16:48 - 0003584 _____ () C:\Users\Denise\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-11-26 14:54 - 2013-11-26 14:54 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2013-11-13 16:08 - 2013-11-13 16:09 - 0000104 _____ () C:\ProgramData\{01FB4998-33C4-4431-85ED-079E3EEFE75D}.log
2013-11-13 16:09 - 2013-11-13 16:10 - 0000119 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2013-11-13 16:04 - 2013-11-13 16:06 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2013-11-13 16:02 - 2013-11-13 16:02 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2013-11-13 16:07 - 2013-11-13 16:08 - 0000108 _____ () C:\ProgramData\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}.log
2013-11-13 16:02 - 2013-11-13 16:04 - 0000110 _____ () C:\ProgramData\{E3739848-5329-48E3-8D28-5BBD6E8BE384}.log
2013-11-13 16:06 - 2013-11-13 16:06 - 0000110 _____ () C:\ProgramData\{E3D04529-6EDB-11D8-A372-0050BAE317E1}.log

Einige Dateien in TEMP:
====================
C:\Users\Denise\AppData\Local\Temp\AppLauncher.exe
C:\Users\Denise\AppData\Local\Temp\libeay32.dll
C:\Users\Denise\AppData\Local\Temp\msvcr120.dll
C:\Users\Denise\AppData\Local\Temp\sqlite3.dll
C:\Users\Denise\AppData\Local\Temp\tu17p84.exe


==================== Bamital & volsnap ======================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert

LastRegBack: 2017-01-04 07:56

==================== Ende von FRST.txt ============================
Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 01-01-2017
durchgeführt von Denise (04-01-2017 20:45:39)
Gestartet von C:\Users\Denise\Downloads
Windows 8.1 (Update) (X64) (2016-07-19 20:05:43)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-3531133450-1765533330-4211851364-500 - Administrator - Disabled)
Denise (S-1-5-21-3531133450-1765533330-4211851364-1002 - Administrator - Enabled) => C:\Users\Denise
Gast (S-1-5-21-3531133450-1765533330-4211851364-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3531133450-1765533330-4211851364-1004 - Limited - Enabled)
UpdatusUser (S-1-5-21-3531133450-1765533330-4211851364-1001 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Ad-Aware Antivirus (Enabled - Up to date) {B0CC18C6-E527-6EE6-874C-9D19920E5619}
AS: Spybot - Search and Destroy (Disabled - Out of date) {A16C3F68-9280-E053-1818-342707FECF4D}
AS: Ad-Aware Antivirus (Enabled - Up to date) {0BADF922-C31D-6168-BDFC-A66BE9891CA4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

Ad-Aware Antivirus (HKLM\...\{AD9CEBD6-442D-4979-9D1D-E1050F2E272D}_AdAwareUpdater) (Version: 11.15.1046.10613 - Lavasoft)
AdAwareInstaller (Version: 11.15.1046.10613 - Lavasoft) Hidden
AdAwareUpdater (Version: 11.15.1046.10613 - Lavasoft) Hidden
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.020.20042 - Adobe Systems Incorporated)
Adobe Digital Editions 4.5 (HKLM-x32\...\Adobe Digital Editions 4.5) (Version: 4.5.1 - Adobe Systems Incorporated)
Adobe Flash Player 23 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 23.0.0.207 - Adobe Systems Incorporated)
Amazon Kindle (HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\Amazon Kindle) (Version: 1.17.1.44183 - Amazon)
AntimalwareEngine (Version: 3.0.129.0 - Lavasoft) Hidden
Ashampoo Snap 2017 (HKLM-x32\...\{0A11EA01-F22C-84C3-9723-53CA58DB6F9C}_is1) (Version: 1.0.1 - Ashampoo GmbH & Co. KG)
calibre (HKLM-x32\...\{F6BB454A-E737-4A1C-A5D4-0E2834E24905}) (Version: 2.62.0 - Kovid Goyal)
ConvertHelper 3.2 (HKLM\...\{27CC6AB1-E72B-4179-AF1A-EAE507EBAF52}}_is1) (Version:  - DownloadHelper)
CyberLink Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
CyberLink PowerRecover (HKLM-x32\...\InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.7.0.2103 - CyberLink Corp.)
CyberLink PowerRecover (Version: 5.7.0.2103 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Digital Plus Home Theater (HKLM\...\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.5.1.1 - Dolby Laboratories Inc)
Dropbox (HKLM-x32\...\Dropbox) (Version: 16.4.30 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.59.1 - Dropbox, Inc.) Hidden
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotogalerija (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotogalleri (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotogalleriet (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotoğraf Galerisi (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotótár (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galeria de Fotografias (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galería de fotos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galeria fotografii (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
GeForce Experience NvStream Client Components (Version: 0.1.87 - NVIDIA Corporation) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3355 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{302600C1-6BDF-4FD1-1309-148929CC1385}) (Version: 3.1.1309.0390 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.2.1000 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{105fa5c4-72e1-41f2-a82c-884d8aa4b381}) (Version: 16.6.0 - Intel Corporation)
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft Office Professional Plus 2013 - de-de (HKLM\...\ProPlusRetail - de-de) (Version: 15.0.4885.1001 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 50.1.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 50.1.0 (x86 de)) (Version: 50.1.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 50.1.0 - Mozilla)
Nero 2015 (HKLM-x32\...\{847D6818-3BA4-4F41-B5B7-4505D8E012B7}) (Version: 16.0.01300 - Nero AG)
Nero Info (HKLM-x32\...\{B791E0AB-87A9-41A4-8D98-D13C2E37D928}) (Version: 16.0.1002 - Nero AG)
NVIDIA GeForce Experience 1.6.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.6.1 - NVIDIA Corporation)
NVIDIA Graphics Driver 327.62 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.62 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA Virtual Audio 1.2.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.5 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4885.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4885.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4885.1001 - Microsoft Corporation) Hidden
PDF24 Creator 7.9.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0092 - Pegatron Corporation)
Podstawowe programy Windows Live (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Prerequisite installer (x32 Version: 16.0.0000 - Nero AG) Hidden
Raccolta foto (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.30164 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.19.726.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7076 - Realtek Semiconductor Corp.)
SHIELD Streaming (Version: 1.05.28 - NVIDIA Corporation) Hidden
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.15.0 - Synaptics Incorporated)
tiptoi® Manager 3.1.6 (HKLM-x32\...\9978-5763-2995-5228) (Version: 3.1.6 - Ravensburger AG)
TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.354 - TuneUp Software) Hidden
TuneUp Utilities 2014 (HKLM-x32\...\TuneUp Utilities) (Version: 14.0.1000.354 - TuneUp Software)
TuneUp Utilities 2014 (x32 Version: 14.0.1000.354 - TuneUp Software) Hidden
Valokuvavalikoima (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
XMedia Recode Version 3.3.3.3 (HKLM-x32\...\{DDA3C325-47B2-4730-9672-BF3771C08799}_is1) (Version: 3.3.3.3 - XMedia Recode)
Συλλογή φωτογραφιών (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {0C353ECE-7C42-4EDF-9E78-7F60D3E609D4} - System32\Tasks\Nero\Nero Info => C:\Program Files (x86)\Common Files\Nero\Nero Info\NeroInfo.exe [2014-05-20] (Nero AG)
Task: {1D8428DA-5690-4545-98FF-B02D46244094} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {1D9BAFD4-0F7A-4519-AC66-E4F6DF0051C9} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {2A4E3246-E54B-4597-8360-8120EADAB061} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {30894E26-3DFA-47E8-95C5-D7AC45A62494} - \93066184d64t1179994 -> Keine Datei <==== ACHTUNG
Task: {6DD7B98D-691E-4C99-A942-BB379DBA5CD9} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2016-11-01] (Microsoft Corporation)
Task: {98209A60-AC79-456E-8CFB-EA8D24C38CDD} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-09-19] (Synaptics Incorporated)
Task: {AE3A986E-65D2-4E77-82E1-2D9546986C36} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-11-01] (Microsoft Corporation)
Task: {BCEDF6AA-DC6E-47EE-A7A8-CAC36707ADC2} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-07-19] (Dropbox, Inc.)
Task: {CFA5AE2D-15E3-47FD-BD31-E4E713873AC7} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2014\OneClick.exe [2015-06-25] (TuneUp Software)
Task: {E0948293-2279-4D6B-8E77-F3AA3CA9A980} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-11-01] (Microsoft Corporation)
Task: {E1189ACB-8FE2-4F21-B9A3-00274A542B91} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2016-11-01] (Microsoft Corporation)
Task: {E7A91B92-EF72-4400-A58F-7BA85A14B0CB} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-07-19] (Dropbox, Inc.)
Task: {FEA5CC20-2042-4BC8-A122-F29B40BF89BC} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-10-21] (Adobe Systems Incorporated)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

Shortcut: C:\Users\Denise\AppData\Local\Microsoft\Windows\ConnectedSearch\History\site_1691182358_de-de.lnk -> hxxp://www.windowssearch.com:80/suggestions?qry=spotify&cc=DE&setlang=de-DE&inlang=de-DE&adlt=moderate&scale=100&contrast=none&hw=768%2C1366&CVID=7075BBFFD9B4452CA755DE3838E3C42

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MEDIONhome.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.medion.com

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2013-11-20 15:17 - 2013-06-27 10:56 - 00160768 _____ () C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
2016-07-26 06:27 - 2016-05-24 08:51 - 00116416 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2016-12-15 13:02 - 2016-12-15 13:02 - 00630976 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareService.exe
2016-12-15 13:06 - 2016-12-15 13:06 - 00122104 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\boost_thread-vc140-mt-1_61.dll
2016-12-15 13:06 - 2016-12-15 13:06 - 00030968 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\boost_system-vc140-mt-1_61.dll
2016-12-15 13:06 - 2016-12-15 13:06 - 00067832 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\boost_date_time-vc140-mt-1_61.dll
2016-12-15 13:06 - 2016-12-15 13:06 - 00145144 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\boost_filesystem-vc140-mt-1_61.dll
2016-12-15 13:06 - 2016-12-15 13:06 - 00733432 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\boost_log-vc140-mt-1_61.dll
2016-12-15 13:06 - 2016-12-15 13:06 - 00525048 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\boost_locale-vc140-mt-1_61.dll
2016-12-15 13:06 - 2016-12-15 13:06 - 00039672 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\boost_chrono-vc140-mt-1_61.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 11504888 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareServiceKernel.dll
2016-12-15 13:06 - 2016-12-15 13:06 - 03713272 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\RCF.dll
2016-12-15 13:06 - 2016-12-15 13:06 - 01001208 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\boost_regex-vc140-mt-1_61.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 01061624 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareActivation.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 00634616 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareApplicationUpdater.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 00843000 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareGamingMode.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 00120568 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareReset.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 00142584 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareTime.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 01025272 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareDefinitionsUpdater.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 00904440 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareDefinitionsUpdaterScheduler.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 01468664 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareIgnoreList.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 00252664 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareQuarantine.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 01644280 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareAntiMalwareEngine.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 00223992 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareAntiRootkitEngine.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 01192184 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareScannerHistory.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 01370360 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareScanner.dll
2016-12-15 13:06 - 2016-12-15 13:06 - 00039672 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\boost_timer-vc140-mt-1_61.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 01030904 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareScannerScheduler.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 01212152 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareRealTimeProtection.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 02879736 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareIncompatibles.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 01524472 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareAntiSpam.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 01456376 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareAntiPhishing.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 03462904 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareParentalControl.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 01599224 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareWebProtection.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 01339640 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareEmailProtection.dll
2016-12-15 13:06 - 2016-12-15 13:06 - 00073464 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\boost_iostreams-vc140-mt-1_61.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 01645816 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareNetworkProtection.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 01042680 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwarePromo.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 00475384 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareFeedback.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 03165944 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareThreatWorkAlliance.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 01325304 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwarePinCode.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 01044216 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareNotice.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 01597688 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareAvcEngine.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 01496312 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareRealTimeProtectionHistory.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 01380088 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareStatistics.dll
2015-06-25 06:53 - 2015-06-25 06:53 - 00699704 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\avgrepliba.dll
2013-11-20 15:17 - 2013-09-02 16:15 - 02216960 _____ () C:\Program Files (x86)\PHotkey\PHotkey.exe
2013-11-20 15:17 - 2010-12-17 15:04 - 00449032 _____ () C:\Program Files (x86)\PHotkey\ATouch64.exe
2013-11-20 15:17 - 2012-10-23 19:07 - 03471872 _____ () C:\Program Files (x86)\PHotkey\POSD.exe
2013-11-20 15:17 - 2013-07-18 16:41 - 08856576 _____ () C:\Program Files (x86)\PHotkey\GPMTray.exe
2016-12-15 13:05 - 2016-12-15 13:05 - 09533688 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareTray.exe
2016-12-15 13:05 - 2016-12-15 13:05 - 02479864 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\HtmlFramework.dll
2016-12-15 13:05 - 2016-12-15 13:05 - 00871672 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.15.1046.10613\AdAwareTrayDefaultSkin.dll
2016-10-19 17:36 - 2014-05-13 11:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2016-10-19 17:36 - 2014-05-13 11:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2016-10-19 17:36 - 2014-05-13 11:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2016-10-19 17:36 - 2012-08-23 09:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2016-10-19 17:36 - 2012-04-03 16:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2013-11-15 16:39 - 2013-09-16 12:20 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2013-11-20 15:17 - 2009-12-18 16:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll
2013-11-20 15:17 - 2009-12-18 16:41 - 00129544 _____ () C:\Program Files (x86)\PHotkey\GFNEX.dll
2016-12-16 07:56 - 2016-11-11 21:36 - 00035792 _____ () C:\Program Files (x86)\Dropbox\Client\_multiprocessing.pyd
2016-12-16 07:56 - 2016-11-11 21:36 - 00100296 _____ () C:\Program Files (x86)\Dropbox\Client\_ctypes.pyd
2016-12-16 07:56 - 2016-11-11 21:36 - 00018888 _____ () C:\Program Files (x86)\Dropbox\Client\select.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00019760 _____ () C:\Program Files (x86)\Dropbox\Client\tornado.speedups.pyd
2016-12-16 07:56 - 2016-11-11 21:36 - 00694224 _____ () C:\Program Files (x86)\Dropbox\Client\unicodedata.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00020816 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._constant_time.pyd
2016-12-16 07:56 - 2016-11-11 21:37 - 00123856 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_backend.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 01682760 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._openssl.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00020808 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._padding.pyd
2016-12-22 14:12 - 2016-11-11 21:36 - 00145864 _____ () C:\Program Files (x86)\Dropbox\Client\pyexpat.pyd
2016-12-22 14:12 - 2016-11-11 21:37 - 00019408 _____ () C:\Program Files (x86)\Dropbox\Client\faulthandler.pyd
2016-12-22 14:12 - 2016-11-11 21:36 - 00116688 _____ () C:\Program Files (x86)\Dropbox\Client\pywintypes27.dll
2016-12-16 07:56 - 2016-11-11 21:38 - 00105928 _____ () C:\Program Files (x86)\Dropbox\Client\win32api.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00021312 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.crt.compiled._winffi_crt.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00052024 _____ () C:\Program Files (x86)\Dropbox\Client\psutil._psutil_windows.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00038696 _____ () C:\Program Files (x86)\Dropbox\Client\fastpath.pyd
2016-12-22 14:12 - 2016-11-11 21:36 - 00392144 _____ () C:\Program Files (x86)\Dropbox\Client\pythoncom27.dll
2016-12-22 14:12 - 2016-11-11 21:38 - 00020936 _____ () C:\Program Files (x86)\Dropbox\Client\mmapfile.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00024528 _____ () C:\Program Files (x86)\Dropbox\Client\win32event.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00116176 _____ () C:\Program Files (x86)\Dropbox\Client\win32security.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00381752 _____ () C:\Program Files (x86)\Dropbox\Client\win32com.shell.shell.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00124880 _____ () C:\Program Files (x86)\Dropbox\Client\win32file.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00025424 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.kernel32.compiled._winffi_kernel32.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32clipboard.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00175560 _____ () C:\Program Files (x86)\Dropbox\Client\win32gui.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00030160 _____ () C:\Program Files (x86)\Dropbox\Client\win32pipe.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00043472 _____ () C:\Program Files (x86)\Dropbox\Client\win32process.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00048592 _____ () C:\Program Files (x86)\Dropbox\Client\win32service.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00057808 _____ () C:\Program Files (x86)\Dropbox\Client\win32evtlog.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32profile.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00246592 _____ () C:\Program Files (x86)\Dropbox\Client\breakpad.client.windows.handler.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00026456 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox.infinite.win.compiled._driverinstallation.pyd
2016-12-16 07:56 - 2016-11-11 21:37 - 00241104 _____ () C:\Program Files (x86)\Dropbox\Client\_jpegtran.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00020280 _____ () C:\Program Files (x86)\Dropbox\Client\cpuid.compiled._cpuid.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00028616 _____ () C:\Program Files (x86)\Dropbox\Client\win32ts.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00023376 _____ () C:\Program Files (x86)\Dropbox\Client\winscreenshot.compiled._CaptureScreenshot.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00020800 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.iphlpapi._winffi_iphlpapi.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00019776 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winerror._winffi_winerror.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00020800 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.wininet._winffi_wininet.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00350152 _____ () C:\Program Files (x86)\Dropbox\Client\winxpgui.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00022352 _____ () C:\Program Files (x86)\Dropbox\Client\winverifysignature.compiled._VerifySignature.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00024392 _____ () C:\Program Files (x86)\Dropbox\Client\librsyncffi.compiled._librsyncffi.pyd
2016-12-22 14:12 - 2016-11-11 21:35 - 00036296 _____ () C:\Program Files (x86)\Dropbox\Client\librsync.dll
2016-12-22 14:12 - 2016-12-21 19:26 - 00084280 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_sqlite_ext.DLL
2016-12-22 14:12 - 2016-12-21 19:26 - 01826096 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtCore.pyd
2016-12-16 07:56 - 2016-11-11 21:37 - 00083912 _____ () C:\Program Files (x86)\Dropbox\Client\sip.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00531248 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtNetwork.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 03928880 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWidgets.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 01972528 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtGui.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00133424 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKit.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00224056 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKitWidgets.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00207672 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtPrintSupport.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00020288 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.user32._winffi_user32.pyd
2016-12-22 14:12 - 2016-11-11 21:42 - 00017864 _____ () C:\Program Files (x86)\Dropbox\Client\libEGL.dll
2016-12-22 14:12 - 2016-11-11 21:42 - 01631184 _____ () C:\Program Files (x86)\Dropbox\Client\libGLESv2.dll
2016-12-22 14:12 - 2016-12-21 19:26 - 00042808 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebChannel.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00171320 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngineWidgets.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00357680 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQml.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00060880 _____ () C:\Program Files (x86)\Dropbox\Client\win32print.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00024904 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winhttp.compiled._winffi_winhttp.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00546096 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQuick.pyd

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\LavasoftAdAwareService11 => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LavasoftAdAwareService11 => ""="Service"

==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

Da befinden sich 7922 mehr Seiten.

IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\123simsen.com -> www.123simsen.com

Da befinden sich 7922 mehr Seiten.

IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\123simsen.com -> www.123simsen.com

Da befinden sich 7922 mehr Seiten.


==================== Hosts Inhalt: ==========================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2013-08-22 14:25 - 2016-12-26 15:12 - 00454135 ____R C:\Windows\system32\Drivers\etc\hosts

127.0.0.1        clients2.google.com
127.0.0.1        v1.ff.avast.com
127.0.0.1        vlcproxy.ff.avast.com
127.0.0.1        down.baidu2016.com
127.0.0.1        123.sogou.com
127.0.0.1        www.czzsyzgm.com
127.0.0.1        www.czzsyzxl.com
127.0.0.1        union.baidu2019.com
127.0.0.1        down.baidu2016.com
127.0.0.1        123.sogou.com
127.0.0.1        www.czzsyzgm.com
127.0.0.1        www.czzsyzxl.com
127.0.0.1        union.baidu2019.com127.0.0.1        www.007guard.com
127.0.0.1        007guard.com
127.0.0.1        008i.com
127.0.0.1        www.008k.com
127.0.0.1        008k.com
127.0.0.1        www.00hq.com
127.0.0.1        00hq.com
127.0.0.1        010402.com
127.0.0.1        www.032439.com
127.0.0.1        032439.com
127.0.0.1        www.0scan.com
127.0.0.1        0scan.com
127.0.0.1        1000gratisproben.com
127.0.0.1        www.1000gratisproben.com
127.0.0.1        1001namen.com
127.0.0.1        www.1001namen.com
127.0.0.1        100888290cs.com
127.0.0.1        www.100888290cs.com

Da befinden sich 15582 zusätzliche Einträge.


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\Control Panel\Desktop\\Wallpaper -> C:\Puh\Puh Privat\Nice Day\nAKED MOUSE\Spaziergang\BILD5294.JPG
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

HKLM\...\StartupApproved\StartupFolder: => "MCtlSvc.lnk"
HKLM\...\StartupApproved\StartupFolder: => "NeroDesktopSwitcher.scf"
HKLM\...\StartupApproved\Run: => "IAStorIcon"
HKLM\...\StartupApproved\Run: => "BTMTrayAgent"
HKLM\...\StartupApproved\Run: => "Nvtmru"
HKLM\...\StartupApproved\Run: => "SynTPEnh"
HKLM\...\StartupApproved\Run: => "RtHDVCpl"
HKLM\...\StartupApproved\Run: => "RtHDVBg_Dolby"
HKLM\...\StartupApproved\Run: => "IgfxTray"
HKLM\...\StartupApproved\Run: => "HotKeysCmds"
HKLM\...\StartupApproved\Run: => "Persistence"
HKLM\...\StartupApproved\Run32: => "CLMLServer_For_P2G8"
HKLM\...\StartupApproved\Run32: => "CLVirtualDrive"
HKLM\...\StartupApproved\Run32: => "RemoteControl10"
HKLM\...\StartupApproved\Run32: => "YouCam Service"
HKLM\...\StartupApproved\Run32: => "PDFPrint"
HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\StartupApproved\Run: => "SpybotPostWindows10UpgradeReInstall"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [vm-monitoring-nb-session] => LPort=139
FirewallRules: [{C6681879-51CB-4FD8-9A84-483DBB792DD9}] => C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{BF03DCCD-DD4D-400A-83DE-6EBD26343BBF}] => LPort=2869
FirewallRules: [{DF5F9400-8B73-4381-B95F-52AF8036BC90}] => LPort=1900
FirewallRules: [{6AE7B4B4-D8EC-4095-9EDE-1D0407493CB4}] => C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{77936D80-6A89-494F-A543-3C0D774614C7}] => C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{8C8323B7-A320-497D-AA70-C0FD492FAAC6}] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
FirewallRules: [{7C57A8A5-6887-4930-B692-5BDA66AD2CE3}] => C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
FirewallRules: [{BC1581EF-EB52-4DB3-806D-6AB1A096F9F0}] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{B090FAC3-34CA-4D99-8374-176423707E40}] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{BD8567CD-18AF-4F3B-9890-47FAD209DC7A}] => C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{AD3D86C8-9D08-4282-B600-06D66D58F91E}] => C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{B1D6920A-FDB1-460D-8785-F074E9A97829}] => C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{5C60FF39-F4AA-45AB-8D65-47390638EE55}] => C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{97D0BC8D-D025-4BD4-B9AB-97DA6D31A164}] => C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{571B4EB1-F5A3-479F-B707-957C19186B6D}] => C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{C8EB4CB1-D30F-4E62-A13B-8B9D04B9CB27}] => C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{ECDACF61-2598-47B3-9446-18AF27FA44EA}] => C:\Program Files (x86)\Nero\Nero Blu-ray Player\Blu-rayPlayer.exe
FirewallRules: [{AF658A1F-622E-4246-9E9F-4386AA84635B}] => C:\Program Files (x86)\Nero\Nero Blu-ray Player\Blu-rayPlayer.exe
FirewallRules: [{F1F82B8E-47E1-4734-B764-1BE0D30FF586}] => C:\Program Files (x86)\Nero\Nero 2015\Nero Burning ROM\StartNBR.exe
FirewallRules: [{FB3533A3-2370-4DFE-83B1-5AA7E5DCC5D6}] => C:\Program Files (x86)\Nero\KM\NMDllHost.exe
FirewallRules: [{896FE7D5-BB83-4ADA-BAE8-190C9C93425A}] => C:\Program Files (x86)\Nero\Nero 2015\Nero Burning ROM\nero.exe
FirewallRules: [{590C04BB-BEBC-4F39-A26E-CA240E6AEABB}] => C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{9226EE8C-D70E-46CB-86C6-FEF3B19528C5}] => C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{5AE195CA-2F53-41A0-9EE8-7EFE42A428B2}] => C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{4393D29C-BCFA-4D99-BDFB-D052C7BABC30}] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
FirewallRules: [{E6BD649F-7312-477E-B04C-F531D47FFFE9}] => C:\Windows\system32\rundll32.exe
FirewallRules: [{DDE35257-478B-4C15-830C-F3BCA8B62E5F}] => C:\Windows\System32\rundll32.exe
FirewallRules: [{16749CA5-9553-44D1-976F-2CA2CD95A67B}] => C:\Windows\System32\rundll32.exe
FirewallRules: [{434BD66E-2F89-474B-A37A-C056D1C7F5CA}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{DBC6CABE-2B06-434E-B577-9497E53E549C}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{A3B7F349-F50C-4684-939B-1D3CACE158F2}] => C:\Windows\System32\rundll32.exe
FirewallRules: [{DEC7CDB3-D197-4AC7-955C-EC896BD4D87A}] => C:\Windows\System32\rundll32.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service

==================== Wiederherstellungspunkte =========================

04-01-2017 08:10:21 Geplanter Prüfpunkt

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (01/04/2017 07:15:23 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (01/02/2017 04:35:14 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (12/29/2016 09:04:29 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Explorer.EXE, Version 6.3.9600.18460 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 130c

Startzeit: 01d2620c2e667e36

Endzeit: 0

Anwendungspfad: C:\Windows\Explorer.EXE

Berichts-ID: e14a6ce5-ce01-11e6-82a7-0c54a5f0a527

Vollständiger Name des fehlerhaften Pakets:

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (12/27/2016 10:03:54 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={DE254671-4ECE-4FAA-AE04-9583C6D96084}: Der Benutzer "SYSTEM" hat eine Verbindung mit dem Namen "congstar" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 797.

Error: (12/27/2016 10:01:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ZeroConfigService.exe, Version: 16.6.0.0, Zeitstempel: 0x52585e22
Name des fehlerhaften Moduls: MurocApi.dll, Version: 16.6.0.0, Zeitstempel: 0x52585cf1
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000002bcc5
ID des fehlerhaften Prozesses: 0xbec
Startzeit der fehlerhaften Anwendung: 0x01d26084408bc029
Pfad der fehlerhaften Anwendung: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
Pfad des fehlerhaften Moduls: C:\Program Files\Intel\WiFi\bin\MurocApi.dll
Berichtskennung: 932c00af-cc77-11e6-82a7-0c54a5f0a527
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (12/27/2016 10:00:14 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (12/27/2016 09:55:54 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".

Details:
AddLegacyDriverFiles: Unable to back up image of binary Bytemobile Kernel Network Provider.

System Error:
Das System kann die angegebene Datei nicht finden.
.

Error: (12/27/2016 09:55:54 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".

Details:
AddLegacyDriverFiles: Unable to back up image of binary Bytemobile Boot Time Load Driver.

System Error:
Das System kann die angegebene Datei nicht finden.
.

Error: (12/27/2016 09:55:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.3.9600.18460, Zeitstempel: 0x57c1b573
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x72ec4220
ID des fehlerhaften Prozesses: 0x18f4
Startzeit der fehlerhaften Anwendung: 0x01d2608394d4b06b
Pfad der fehlerhaften Anwendung: C:\Windows\SysWOW64\explorer.exe
Pfad des fehlerhaften Moduls: unknown
Berichtskennung: d2a03bfe-cc76-11e6-82a6-0c54a5f0a527
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (12/27/2016 09:55:25 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.3.9600.18460, Zeitstempel: 0x57c1b573
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x72ec4220
ID des fehlerhaften Prozesses: 0xcfc
Startzeit der fehlerhaften Anwendung: 0x01d260838c10fb1e
Pfad der fehlerhaften Anwendung: C:\Windows\SysWOW64\explorer.exe
Pfad des fehlerhaften Moduls: unknown
Berichtskennung: ca041f92-cc76-11e6-82a6-0c54a5f0a527
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:


Systemfehler:
=============
Error: (01/04/2017 08:43:31 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Defender-Dienst" wurde aufgrund folgenden Fehlers nicht gestartet:
Die digitale Signatur dieser Datei kann nicht überprüft werden. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um böswillige Software aus einer unbekannten Quelle handelt, installiert.

Error: (01/04/2017 07:09:03 PM) (Source: disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR2 gefunden.

Error: (12/30/2016 08:51:03 AM) (Source: disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR10 gefunden.

Error: (12/30/2016 08:51:03 AM) (Source: disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR10 gefunden.

Error: (12/30/2016 08:51:02 AM) (Source: disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR10 gefunden.

Error: (12/30/2016 08:51:02 AM) (Source: disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR10 gefunden.

Error: (12/30/2016 08:51:01 AM) (Source: disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR10 gefunden.

Error: (12/28/2016 07:42:17 PM) (Source: disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR3 gefunden.

Error: (12/27/2016 10:01:09 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (12/27/2016 09:58:49 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst gpsvc erreicht.


CodeIntegrity:
===================================
  Date: 2017-01-04 20:43:31.246
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-12-26 17:22:16.672
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-12-26 16:34:58.481
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-12-26 16:13:53.405
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-12-26 16:12:21.560
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-12-25 22:41:42.989
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-12-25 22:41:42.739
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-12-25 22:41:42.489
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-12-25 22:41:41.942
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-12-25 22:41:41.692
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Speicherinformationen ===========================

Prozessor: Intel(R) Core(TM) i3-4000M CPU @ 2.40GHz
Prozentuale Nutzung des RAM: 53%
Installierter physikalischer RAM: 8100.68 MB
Verfügbarer physikalischer RAM: 3732.07 MB
Summe virtueller Speicher: 9380.68 MB
Verfügbarer virtueller Speicher: 5616.15 MB

==================== Laufwerke ================================

Drive c: (Boot) (Fixed) (Total:869.8 GB) (Free:436.21 GB) NTFS
Drive d: (Recover) (Fixed) (Total:60 GB) (Free:42.06 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: F2E9FFFD)

Partition: GPT.

==================== Ende von Addition.txt ===========================
Ich hoffe, das sind alle Infos, die ihr auf Anhieb braucht, denn mehr Zeichen konnte ich nicht posten!

Vielen Dank im Voraus für eure Bemühungen.
Gruß Schnuckibaer

cosinus 05.01.2017 09:09
Logs von Malwarebytes und adwCleaner fehlen.

Ad-Aware kannst du deinstallieren, dieses Tool spielt überhaupt keine Rolle und wurde hier auch noch nie empfohlen.

Schnuckibaer 05.01.2017 13:26
Logs von Malwarebytes und adwCleaner
 
Hier die Logs, sie passten gestern nicht mehr in den Beitrag:

Code:
# AdwCleaner v6.041 - Bericht erstellt am 26/12/2016 um 15:54:08
# Aktualisiert am 16/12/2016 von Malwarebytes
# Datenbank : 2016-12-26.1 [Server]
# Betriebssystem : Windows 8.1  (X64)
# Benutzername : Denise - WOMBAT
# Gestartet von : C:\Users\Denise\Downloads\adwcleaner_6.041.exe
# Modus: Suchlauf
# Unterstützung : https://www.malwarebytes.com/support



***** [ Dienste ] *****

Dienst Gefunden: zdwfp


***** [ Ordner ] *****

Ordner Gefunden: C:\Program Files (x86)\26670030-1482701585-81E3-33A3-0C54A5F0A527
Ordner Gefunden: C:\Users\Denise\AppData\Local\BrowserAir
Ordner Gefunden: C:\Users\Denise\AppData\Roaming\Note-up
Ordner Gefunden: C:\ProgramData\SearchModule
Ordner Gefunden: C:\ProgramData\vCore
Ordner Gefunden: C:\ProgramData\Application Data\SearchModule
Ordner Gefunden: C:\ProgramData\Application Data\vCore
Ordner Gefunden: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\zdengine
Ordner Gefunden: C:\Users\Denise\AppData\Roaming\browsers
Ordner Gefunden: C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\naweriweentcofise
Ordner Gefunden: C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher


***** [ Dateien ] *****

Datei Gefunden: C:\Users\Denise\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet-Explorer Browser.lnk
Datei Gefunden: C:\Windows\SysNative\bi3.exe
Datei Gefunden: C:\Windows\SysNative\drivers\zdwfp64.sys
Datei Gefunden: C:\ProgramData\smp2.exe
Datei Gefunden: C:\ProgramData\smp2.exe
Datei Gefunden: C:\ProgramData\Application Data\smp2.exe
Datei Gefunden: C:\Users\Denise\AppData\Roaming\Browsers\firefox.bat.exe
Datei Gefunden: C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\searchplugins\smod.xml


***** [ DLL ] *****

Keine infizierten DLLs gefunden.


***** [ WMI ] *****

Keine schädlichen Schlüssel gefunden.


***** [ Verknüpfungen ] *****

Verknüpfung infiziert: C:\Users\Public\Desktop\Mozilla Firefox.lnk ( hxxp://www-searching.com/?prd=set_epf&s=gcpz0au,106dc15f-a298-4bcb-a94f-fa9eecf89470, )
Verknüpfung infiziert: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk ( hxxp://www-searching.com/?prd=set_epf&s=gcpz0au,106dc15f-a298-4bcb-a94f-fa9eecf89470, )
Verknüpfung infiziert: C:\Users\Denise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk ( hxxp://www%2dsearching.com/?prd=set_epf&s=gcpz0au,106dc15f-a298-4bcb-a94f-fa9eecf89470, )
Verknüpfung infiziert: C:\Users\Denise\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet-Explorer Browser.lnk ( hxxp://www%2dsearching.com/?prd=set_epf&s=gcpz0au,106dc15f-a298-4bcb-a94f-fa9eecf89470,
Verknüpfung infiziert: C:\Users\Denise\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk ( hxxp://www-searching.com/?prd=set_epf&s=gcpz0au,106dc15f-a298-4bcb-a94f-fa9eecf89470,


***** [ Aufgabenplanung ] *****

Aufgabe Gefunden: IBUpd2
Aufgabe Gefunden: SMW_P
Aufgabe Gefunden: updengine
Aufgabe Gefunden: Microsoft\Windows\Media Center\VCore


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden: HKLM\SOFTWARE\Classes\zdengineLib.DataContainer
Schlüssel Gefunden: HKLM\SOFTWARE\Classes\zdengineLib.DataContainer.1
Schlüssel Gefunden: HKLM\SOFTWARE\Classes\zdengineLib.DataController
Schlüssel Gefunden: HKLM\SOFTWARE\Classes\zdengineLib.DataController.1
Schlüssel Gefunden: HKLM\SOFTWARE\Classes\zdengineLib.DataTable
Schlüssel Gefunden: HKLM\SOFTWARE\Classes\zdengineLib.DataTable.1
Schlüssel Gefunden: HKLM\SOFTWARE\Classes\zdengineLib.DataTableFields
Schlüssel Gefunden: HKLM\SOFTWARE\Classes\zdengineLib.DataTableFields.1
Schlüssel Gefunden: HKLM\SOFTWARE\Classes\zdengineLib.DataTableHolder
Schlüssel Gefunden: HKLM\SOFTWARE\Classes\zdengineLib.DataTableHolder.1
Schlüssel Gefunden: HKLM\SOFTWARE\Classes\zdengineLib.LSPLogic
Schlüssel Gefunden: HKLM\SOFTWARE\Classes\zdengineLib.LSPLogic.1
Schlüssel Gefunden: HKLM\SOFTWARE\Classes\zdengineLib.ReadOnlyManager
Schlüssel Gefunden: HKLM\SOFTWARE\Classes\zdengineLib.ReadOnlyManager.1
Schlüssel Gefunden: HKLM\SOFTWARE\Classes\zdengineLib.WFPController
Schlüssel Gefunden: HKLM\SOFTWARE\Classes\zdengineLib.WFPController.1
Schlüssel Gefunden: [x64] HKLM\SOFTWARE\Classes\zdengineLib.DataContainer
Schlüssel Gefunden: [x64] HKLM\SOFTWARE\Classes\zdengineLib.DataContainer.1
Schlüssel Gefunden: [x64] HKLM\SOFTWARE\Classes\zdengineLib.DataController
Schlüssel Gefunden: [x64] HKLM\SOFTWARE\Classes\zdengineLib.DataController.1
Schlüssel Gefunden: [x64] HKLM\SOFTWARE\Classes\zdengineLib.DataTable
Schlüssel Gefunden: [x64] HKLM\SOFTWARE\Classes\zdengineLib.DataTable.1
Schlüssel Gefunden: [x64] HKLM\SOFTWARE\Classes\zdengineLib.DataTableFields
Schlüssel Gefunden: [x64] HKLM\SOFTWARE\Classes\zdengineLib.DataTableFields.1
Schlüssel Gefunden: [x64] HKLM\SOFTWARE\Classes\zdengineLib.DataTableHolder
Schlüssel Gefunden: [x64] HKLM\SOFTWARE\Classes\zdengineLib.DataTableHolder.1
Schlüssel Gefunden: [x64] HKLM\SOFTWARE\Classes\zdengineLib.LSPLogic
Schlüssel Gefunden: [x64] HKLM\SOFTWARE\Classes\zdengineLib.LSPLogic.1
Schlüssel Gefunden: [x64] HKLM\SOFTWARE\Classes\zdengineLib.ReadOnlyManager
Schlüssel Gefunden: [x64] HKLM\SOFTWARE\Classes\zdengineLib.ReadOnlyManager.1
Schlüssel Gefunden: [x64] HKLM\SOFTWARE\Classes\zdengineLib.WFPController
Schlüssel Gefunden: [x64] HKLM\SOFTWARE\Classes\zdengineLib.WFPController.1
Schlüssel Gefunden: HKLM\SOFTWARE\Classes\AppID\{25B1494D-230A-42CF-BBF6-EC73868D13DC}
Schlüssel Gefunden: HKU\.DEFAULT\Software\jhtrsq
Schlüssel Gefunden: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\Software\AppDataLow\Software\adawarebp
Schlüssel Gefunden: HKU\S-1-5-18\Software\jhtrsq
Schlüssel Gefunden: HKCU\Software\AppDataLow\Software\adawarebp
Schlüssel Gefunden: HKLM\SOFTWARE\BrowserAir
Schlüssel Gefunden: HKLM\SOFTWARE\zdengine
Schlüssel Gefunden: HKLM\SOFTWARE\trotuxSoftware
Schlüssel Gefunden: HKLM\SOFTWARE\jhtrsq
Schlüssel Gefunden: [x64] HKCU\Software\AppDataLow\Software\adawarebp
Schlüssel Gefunden: [x64] HKLM\SOFTWARE\jhtrsq
Schlüssel Gefunden: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\Software\Microsoft\Internet Explorer\SearchScopes\{B2D5F8F5-245B-4E5B-BABA-83B933EBF470}
Schlüssel Gefunden: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B2D5F8F5-245B-4E5B-BABA-83B933EBF470}
Schlüssel Gefunden: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B2D5F8F5-245B-4E5B-BABA-83B933EBF470}
Schlüssel Gefunden: HKLM\SYSTEM\CurrentControlSet\Control\Class\{0C95ABFE-4FB6-49DB-B22F-0E1F5FC4BEEC}
Schlüssel Gefunden: HKLM\SYSTEM\CurrentControlSet\Control\Class\{EEEFACB3-729F-4484-B66D-E7A7917BBFC1}
Schlüssel Gefunden: HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\zdwfp
Schlüssel Gefunden: HKLM\SOFTWARE\CLASSES\APPID\56BF5154-0B48-4ADB-902A-6C8B12E270D9


***** [ Internetbrowser ] *****

Firefox pref Gefunden: [C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\prefs.js] - "browser.newtab.url" -  "hxxp://www-searching.com/?site=shyosffdefault&prd=set_ff&s=gcpz0au,106dc15f-a298-4bcb-a94
Firefox pref Gefunden: [C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\prefs.js] - "browser.search.defaultenginename" -  "trotux"
Firefox pref Gefunden: [C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\prefs.js] - "browser.search.searchengine.hp" -  "hxxp://www.trotux.com/?z=d905852e00ab93a275b7190g7z3beoam9e0gew8b8t&from=isr&
Firefox pref Gefunden: [C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\prefs.js] - "browser.search.searchengine.sp" -  "hxxp://www.trotux.com/search/?from=isr&q={searchTerms}&type=sp&uid=ST1000LM01
Firefox pref Gefunden: [C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\prefs.js] - "browser.search.searchengine.url" -  "hxxp://www.trotux.com/search/?from=isr&q={searchTerms}&type=sp&uid=ST1000LM0
Firefox pref Gefunden: [C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\prefs.js] - "browser.search.selectedEngine" -  "trotux"
Firefox pref Gefunden: [C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\prefs.js] - "keyword.URL" -  "hxxp://www-searching.com/search.aspx?site=shdefault1&prd=smw&pid=s&shr=d&q={searchTerms}&s=gcpz0
Keine schädlichen Elemente in Chrome basierten Browsern gefunden.

*************************

C:\AdwCleaner\AdwCleaner[S0].txt - [8517 Bytes] - [26/12/2016 15:54:08]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [8590 Bytes] ##########
Code:
# AdwCleaner v6.041 - Bericht erstellt am 26/12/2016 um 15:56:21
# Aktualisiert am 16/12/2016 von Malwarebytes
# Datenbank : 2016-12-26.1 [Server]
# Betriebssystem : Windows 8.1  (X64)
# Benutzername : Denise - WOMBAT
# Gestartet von : C:\Users\Denise\Downloads\adwcleaner_6.041.exe
# Modus: Löschen
# Unterstützung : https://www.malwarebytes.com/support



***** [ Dienste ] *****

[-] Dienst gelöscht: zdwfp


***** [ Ordner ] *****

[-] Ordner gelöscht: C:\Program Files (x86)\26670030-1482701585-81E3-33A3-0C54A5F0A527
[-] Ordner gelöscht: C:\Users\Denise\AppData\Local\BrowserAir
[-] Ordner gelöscht: C:\Users\Denise\AppData\Roaming\Note-up
[-] Ordner gelöscht: C:\ProgramData\SearchModule
[-] Ordner gelöscht: C:\ProgramData\vCore
[#] Ordner mit Neustart gelöscht: C:\ProgramData\Application Data\SearchModule
[#] Ordner mit Neustart gelöscht: C:\ProgramData\Application Data\vCore
[-] Ordner gelöscht: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\zdengine
[-] Ordner gelöscht: C:\Users\Denise\AppData\Roaming\browsers
[-] Ordner gelöscht: C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\naweriweentcofise
[-] Ordner gelöscht: C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher


***** [ Dateien ] *****

[-] Datei gelöscht: C:\Users\Denise\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet-Explorer Browser.lnk
[-] Datei gelöscht: C:\Windows\SysNative\bi3.exe
[-] Datei gelöscht: C:\Windows\SysNative\drivers\zdwfp64.sys
[-] Datei gelöscht: C:\ProgramData\smp2.exe
[#] Datei gelöscht: C:\ProgramData\smp2.exe
[#] Datei gelöscht: C:\ProgramData\Application Data\smp2.exe
[#] Datei gelöscht: C:\Users\Denise\AppData\Roaming\Browsers\firefox.bat.exe
[-] Datei gelöscht: C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\searchplugins\smod.xml


***** [ DLL ] *****



***** [ WMI ] *****



***** [ Verknüpfungen ] *****

[-] Verknüpfung desinfiziert: C:\Users\Public\Desktop\Mozilla Firefox.lnk
[-] Verknüpfung desinfiziert: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[-] Verknüpfung desinfiziert: C:\Users\Denise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[!] Verknüpfung nicht gelöscht: C:\Users\Denise\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet-Explorer Browser.lnk
[-] Verknüpfung desinfiziert: C:\Users\Denise\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk


***** [ Aufgabenplanung ] *****

[-] Aufgabe gelöscht: IBUpd2
[-] Aufgabe gelöscht: SMW_P
[-] Aufgabe gelöscht: updengine
[-] Aufgabe gelöscht: Microsoft\Windows\Media Center\VCore


***** [ Registrierungsdatenbank ] *****

[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\zdengineLib.DataContainer
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\zdengineLib.DataContainer.1
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\zdengineLib.DataController
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\zdengineLib.DataController.1
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\zdengineLib.DataTable
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\zdengineLib.DataTable.1
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\zdengineLib.DataTableFields
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\zdengineLib.DataTableFields.1
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\zdengineLib.DataTableHolder
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\zdengineLib.DataTableHolder.1
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\zdengineLib.LSPLogic
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\zdengineLib.LSPLogic.1
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\zdengineLib.ReadOnlyManager
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\zdengineLib.ReadOnlyManager.1
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\zdengineLib.WFPController
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\zdengineLib.WFPController.1
[#] Schlüssel mit Neustart gelöscht: [x64] HKLM\SOFTWARE\Classes\zdengineLib.DataContainer
[#] Schlüssel mit Neustart gelöscht: [x64] HKLM\SOFTWARE\Classes\zdengineLib.DataContainer.1
[#] Schlüssel mit Neustart gelöscht: [x64] HKLM\SOFTWARE\Classes\zdengineLib.DataController
[#] Schlüssel mit Neustart gelöscht: [x64] HKLM\SOFTWARE\Classes\zdengineLib.DataController.1
[#] Schlüssel mit Neustart gelöscht: [x64] HKLM\SOFTWARE\Classes\zdengineLib.DataTable
[#] Schlüssel mit Neustart gelöscht: [x64] HKLM\SOFTWARE\Classes\zdengineLib.DataTable.1
[#] Schlüssel mit Neustart gelöscht: [x64] HKLM\SOFTWARE\Classes\zdengineLib.DataTableFields
[#] Schlüssel mit Neustart gelöscht: [x64] HKLM\SOFTWARE\Classes\zdengineLib.DataTableFields.1
[#] Schlüssel mit Neustart gelöscht: [x64] HKLM\SOFTWARE\Classes\zdengineLib.DataTableHolder
[#] Schlüssel mit Neustart gelöscht: [x64] HKLM\SOFTWARE\Classes\zdengineLib.DataTableHolder.1
[#] Schlüssel mit Neustart gelöscht: [x64] HKLM\SOFTWARE\Classes\zdengineLib.LSPLogic
[#] Schlüssel mit Neustart gelöscht: [x64] HKLM\SOFTWARE\Classes\zdengineLib.LSPLogic.1
[#] Schlüssel mit Neustart gelöscht: [x64] HKLM\SOFTWARE\Classes\zdengineLib.ReadOnlyManager
[#] Schlüssel mit Neustart gelöscht: [x64] HKLM\SOFTWARE\Classes\zdengineLib.ReadOnlyManager.1
[#] Schlüssel mit Neustart gelöscht: [x64] HKLM\SOFTWARE\Classes\zdengineLib.WFPController
[#] Schlüssel mit Neustart gelöscht: [x64] HKLM\SOFTWARE\Classes\zdengineLib.WFPController.1
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\AppID\{25B1494D-230A-42CF-BBF6-EC73868D13DC}
[-] Schlüssel gelöscht: HKU\.DEFAULT\Software\jhtrsq
[-] Schlüssel gelöscht: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\Software\AppDataLow\Software\adawarebp
[#] Schlüssel mit Neustart gelöscht: HKU\S-1-5-18\Software\jhtrsq
[#] Schlüssel mit Neustart gelöscht: HKCU\Software\AppDataLow\Software\adawarebp
[-] Schlüssel gelöscht: HKLM\SOFTWARE\BrowserAir
[-] Schlüssel gelöscht: HKLM\SOFTWARE\zdengine
[-] Schlüssel gelöscht: HKLM\SOFTWARE\trotuxSoftware
[-] Schlüssel gelöscht: HKLM\SOFTWARE\jhtrsq
[#] Schlüssel mit Neustart gelöscht: [x64] HKCU\Software\AppDataLow\Software\adawarebp
[-] Schlüssel gelöscht: [x64] HKLM\SOFTWARE\jhtrsq
[-] Schlüssel gelöscht: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\Software\Microsoft\Internet Explorer\SearchScopes\{B2D5F8F5-245B-4E5B-BABA-83B933EBF470}
[#] Schlüssel mit Neustart gelöscht: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B2D5F8F5-245B-4E5B-BABA-83B933EBF470}
[#] Schlüssel mit Neustart gelöscht: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B2D5F8F5-245B-4E5B-BABA-83B933EBF470}
[-] Schlüssel gelöscht: HKLM\SYSTEM\CurrentControlSet\Control\Class\{0C95ABFE-4FB6-49DB-B22F-0E1F5FC4BEEC}
[-] Schlüssel gelöscht: HKLM\SYSTEM\CurrentControlSet\Control\Class\{EEEFACB3-729F-4484-B66D-E7A7917BBFC1}
[-] Schlüssel gelöscht: HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\zdwfp
[-] Schlüssel gelöscht: HKLM\SOFTWARE\CLASSES\APPID\56BF5154-0B48-4ADB-902A-6C8B12E270D9


***** [ Browser ] *****

[-] Firefox Einstellungen bereinigt: "browser.newtab.url" -  "hxxp://www-searching.com/?site=shyosffdefault&prd=set_ff&s=gcpz0au,106dc15f-a298-4bcb-a94f-fa9eecf89470,"
[-] Firefox Einstellungen bereinigt: "browser.search.defaultenginename" -  "trotux"
[-] Firefox Einstellungen bereinigt: "browser.search.searchengine.hp" -  "hxxp://www.trotux.com/?z=d905852e00ab93a275b7190g7z3beoam9e0gew8b8t&from=isr&uid=ST1000LM014-1EJ164_W380TBM4XXXXW380TBM4&type=hp"
[-] Firefox Einstellungen bereinigt: "browser.search.searchengine.sp" -  "hxxp://www.trotux.com/search/?from=isr&q={searchTerms}&type=sp&uid=ST1000LM014-1EJ164_W380TBM4XXXXW380TBM4&z=d905852e00ab93a275b7190g7z3beoam9e0gew8b8t"
[-] Firefox Einstellungen bereinigt: "browser.search.searchengine.url" -  "hxxp://www.trotux.com/search/?from=isr&q={searchTerms}&type=sp&uid=ST1000LM014-1EJ164_W380TBM4XXXXW380TBM4&z=d905852e00ab93a275b7190g7z3beoam9e0gew8b8t"
[-] Firefox Einstellungen bereinigt: "browser.search.selectedEngine" -  "trotux"
[-] Firefox Einstellungen bereinigt: "keyword.URL" -  "hxxp://www-searching.com/search.aspx?site=shdefault1&prd=smw&pid=s&shr=d&q={searchTerms}&s=gcpz0au,106dc15f-a298-4bcb-a94f-fa9eecf89470,"


*************************

:: "Tracing" Schlüssel gelöscht
:: Winsock Einstellungen zurückgesetzt

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [8480 Bytes] - [26/12/2016 15:56:21]
C:\AdwCleaner\AdwCleaner[S0].txt - [8745 Bytes] - [26/12/2016 15:54:08]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [8626 Bytes] ##########
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlaufdatum: 26.12.2016
Suchlaufzeit: 16:46
Protokolldatei: Malwarebytes 2016-12-26.txt
Administrator: Ja

Version: 2.2.1.1043
Malware-Datenbank: v2016.12.26.02
Rootkit-Datenbank: v2016.11.20.01
Lizenz: Testversion
Malware-Schutz: Aktiviert
Schutz vor bösartigen Websites: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Denise

Suchlauftyp: Bedrohungssuchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 323227
Abgelaufene Zeit: 8 Min., 21 Sek.

Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(keine bösartigen Elemente erkannt)

Module: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 5
PUP.Optional.YesSearches, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{D2BA0564-51DC-48E6-9294-C2826B3E8D1F}, Löschen bei Neustart, [965441aaeeac1a1c73b1a46921df9868],
PUP.Optional.YesSearches, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Ghoversp Cache, Löschen bei Neustart, [935707e427733afc7049d63e06fae917],
Adware.Sasquor.SPL, HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\PRINT\PROVIDERS\75PN7H5N, In Quarantäne, [e604dc0f6d2da096adc11e68f40c59a7],
PUP.Optional.YTAdBlocker, HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{D42C3A49-ABAF-464B-BBCE-991C3DD395E8}, In Quarantäne, [a743cd1ed8c21521c11e02a7ca36df21],
PUP.Optional.YTAdBlocker, HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{D42C3A49-ABAF-464B-BBCE-991C3DD395E8}, In Quarantäne, [e406f7f4069435018857e3c6cb351ee2],

Registrierungswerte: 2
PUP.Optional.YesSearches, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{D2BA0564-51DC-48E6-9294-C2826B3E8D1F}|Path, \Ghoversp Cache, Löschen bei Neustart, [965441aaeeac1a1c73b1a46921df9868]
Adware.Sasquor.SPL, HKLM\SYSTEM\CURRENTCONTROLSET\CONTROL\PRINT\PROVIDERS\75pn7h5n|Name, C:\Program Files (x86)\Cherciingnazak Schedule\local64spl.dll, In Quarantäne, [e604dc0f6d2da096adc11e68f40c59a7]

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Ordner: 3
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher, In Quarantäne, [0cde10db3e5cea4c5ddda2b5f709758b],
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher\content, In Quarantäne, [0cde10db3e5cea4c5ddda2b5f709758b],
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher\META-INF, In Quarantäne, [0cde10db3e5cea4c5ddda2b5f709758b],

Dateien: 22
PUP.Optional.YesSearches, C:\Windows\System32\Tasks\Ghoversp Cache, In Quarantäne, [0edc24c723771d19f1d4cf3d1be57789],
PUP.Optional.AshampooRegistryCleaner, C:\ProgramData\ashampoo\ico_ashampoo_marketplace.ico, In Quarantäne, [83676982f4a64aec07fe4a6bf7097e82],
PUP.Optional.SearchModule, C:\Windows\Temp\SM_cache_iexplore.exe.cache, In Quarantäne, [78728962ddbd5fd7aee4252a00039f61],
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher\0024397e, In Quarantäne, [0cde10db3e5cea4c5ddda2b5f709758b],
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher\chrome.manifest, In Quarantäne, [0cde10db3e5cea4c5ddda2b5f709758b],
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher\install.rdf, In Quarantäne, [0cde10db3e5cea4c5ddda2b5f709758b],
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher\content\content.js, In Quarantäne, [0cde10db3e5cea4c5ddda2b5f709758b],
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher\content\icon-48.png, In Quarantäne, [0cde10db3e5cea4c5ddda2b5f709758b],
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher\content\icon-64.png, In Quarantäne, [0cde10db3e5cea4c5ddda2b5f709758b],
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher\META-INF\manifest.mf, In Quarantäne, [0cde10db3e5cea4c5ddda2b5f709758b],
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher\META-INF\mozilla.rsa, In Quarantäne, [0cde10db3e5cea4c5ddda2b5f709758b],
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher\META-INF\mozilla.sf, In Quarantäne, [0cde10db3e5cea4c5ddda2b5f709758b],
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\searchplugins\7yq5h3gb.xml, In Quarantäne, [1bcfa645b9e1fe3880645d9405fe6a96],
PUP.Optional.Search.ShrtCln, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://www-searching.com/search.aspx?site=shdefault1&prd=smw&pid=s&shr=d&q={searchTerms}&s=gcpz0au,106dc15f-a298-4bcb-a94f-fa9eecf89470,");), Ersetzt,[97535992158573c39044816dc53e7090]
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Profiles\Atdaght.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://www.trotux.com/?z=d905852e00ab93a275b7190g7z3beoam9e0gew8b8t&from=isr&uid=ST1000LM014-1EJ164_W380TBM4XXXXW380TBM4&type=hp");), Ersetzt,[a1497e6de9b100363caa3900e917837d]
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Profiles\Atdaght.default\prefs.js, Gut: (), Schlecht: (er", 1482613534);
user_pref("app.update.lastUpdateTime.), Ersetzt,[7872faf16337db5b36b0c079cb3520e0]
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Profiles\Atdaght.default\prefs.js, Gut: (), Schlecht: (es will be overwritten when the application exits.
 *
 * To make a manual change to preferences, you can visit the URL about:config
 */

user_pref("accessibility.typeahead), Ersetzt,[5199e3081f7b280e31b5de5b5fa1ab55]
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Profiles\Atdaght.default\prefs.js, Gut: (), Schlecht: (on is running,
 * the changes will be overwritten when the application exits.
 *
 * To make a manual change to preferences, you can visit the URL about:config
 */

user_pref("accessibility.type), Ersetzt,[a44609e2dcbe7bbb984e4bee3cc45ea2]
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Profiles\Atdaght.default\prefs.js, Gut: (), Schlecht: ( preferences, you can visit the URL about:config
 */

user_pref("accessibility.typeaheadfind", true);
user_pref("accessibility.typeaheadfind.flashBar", 0);
user_pref("app.update.auto", false);
u), Ersetzt,[5a904d9ebedce353be289e9bfb052ed2]
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Profiles\Atdaght.default\prefs.js, Gut: (), Schlecht: (changes will be overwritten when the application exit), Ersetzt,[678305e67129a5916e785fdaec140cf4]
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Profiles\Atdaght.default\prefs.js, Gut: (), Schlecht: (ypeaheadfind", true);
user_pref("accessibility.typeaheadfind.flashBar", 0);
user_pref("app.update.auto", false);
user_pref("app.update.enabled", false);
user_pref("ap), Ersetzt,[13d718d3b3e756e011d5c475e818f907]
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Profiles\Atdaght.default\searchplugins\7yq5h3gb.xml, In Quarantäne, [6f7b7a712c6e51e584f7ad5d11efc33d],

Physische Sektoren: 0
(keine bösartigen Elemente erkannt)


(end)
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlaufdatum: 29.12.2016
Suchlaufzeit: 20:46
Protokolldatei: Malwarebytes 2016-12-29.txt
Administrator: Ja

Version: 2.2.1.1043
Malware-Datenbank: v2016.12.26.05
Rootkit-Datenbank: v2016.11.20.01
Lizenz: Testversion
Malware-Schutz: Aktiviert
Schutz vor bösartigen Websites: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Denise

Suchlauftyp: Bedrohungssuchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 322963
Abgelaufene Zeit: 14 Min., 57 Sek.

Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(keine bösartigen Elemente erkannt)

Module: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)

Registrierungswerte: 0
(keine bösartigen Elemente erkannt)

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Ordner: 3
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher, Löschen bei Neustart, [f3faa14a405a092d85b54710c93725db],
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher\content, In Quarantäne, [f3faa14a405a092d85b54710c93725db],
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher\META-INF, In Quarantäne, [f3faa14a405a092d85b54710c93725db],

Dateien: 16
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher\0024397e, In Quarantäne, [f3faa14a405a092d85b54710c93725db],
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher\chrome.manifest, In Quarantäne, [f3faa14a405a092d85b54710c93725db],
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher\install.rdf, In Quarantäne, [f3faa14a405a092d85b54710c93725db],
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher\content\browser.xul, In Quarantäne, [f3faa14a405a092d85b54710c93725db],
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher\content\content.js, In Quarantäne, [f3faa14a405a092d85b54710c93725db],
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher\content\icon-48.png, In Quarantäne, [f3faa14a405a092d85b54710c93725db],
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher\content\icon-64.png, In Quarantäne, [f3faa14a405a092d85b54710c93725db],
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher\META-INF\manifest.mf, In Quarantäne, [f3faa14a405a092d85b54710c93725db],
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher\META-INF\mozilla.rsa, In Quarantäne, [f3faa14a405a092d85b54710c93725db],
PUP.Optional.FastSearch, C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\extensions\amcontextmenu@loucypher\META-INF\mozilla.sf, In Quarantäne, [f3faa14a405a092d85b54710c93725db],
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Profiles\Atdaght.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.search.defaultenginename", "trotux");), Ersetzt,[6d80e3083c5e74c211d5cc6d08f818e8]
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Profiles\Atdaght.default\prefs.js, Gut: (), Schlecht: (find", true);
user_pref("accessibility.typeaheadfind.flashBar", 0);
user_pref("app.update.auto", false);
user_pref("app.update.enabled", false);
user_pref("app.update.lastU), Ersetzt,[935a6f7cbddd62d46383d663679945bb]
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Profiles\Atdaght.default\prefs.js, Gut: (), Schlecht: (on is running,
 * the changfind", true);
user_pref("accessibility.typeaheadfind.flashBar", 0);
user_pref("app.update.auto", false);
user_pref("app.update.enabled", false);
user_pref("app.update.), Ersetzt,[12db9259d4c66fc7be28ad8cf9071ae6]
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Profiles\Atdaght.default\prefs.js, Gut: (), Schlecht: (update.auto", false);
user_pref("app.update.enabled", false);
user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1482614014);
user_pref("app.update.lastUpdateTime.background-updat), Ersetzt,[de0f39b20694ec4a796d1f1aaa56e61a]
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Profiles\Atdaght.default\prefs.js, Gut: (), Schlecht: (changfind", true);
user_pref("accessibility.typeahea), Ersetzt,[89649a517f1b60d6d70f2b0e996735cb]
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Profiles\Atdaght.default\prefs.js, Gut: (), Schlecht: (te.lastUpdateTime.addon-background-update-timer", 1482614014);
user_pref("app.update.lastUpdateTime.background-update-timer", 1482565783);
user_pref("app.update.lastUpd), Ersetzt,[f4f9e2098119be78f7ef59e053ad768a]

Physische Sektoren: 0
(keine bösartigen Elemente erkannt)


(end)
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlaufdatum: 02.01.2017
Suchlaufzeit: 08:28
Protokolldatei: Malwarebytes 2017-01-02.txt
Administrator: Ja

Version: 2.2.1.1043
Malware-Datenbank: v2016.12.26.05
Rootkit-Datenbank: v2016.11.20.01
Lizenz: Testversion
Malware-Schutz: Aktiviert
Schutz vor bösartigen Websites: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Denise

Suchlauftyp: Bedrohungssuchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 323115
Abgelaufene Zeit: 14 Min., 35 Sek.

Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(keine bösartigen Elemente erkannt)

Module: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)

Registrierungswerte: 0
(keine bösartigen Elemente erkannt)

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Ordner: 0
(keine bösartigen Elemente erkannt)

Dateien: 5
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Profiles\Atdaght.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.search.searchengine.hp", "hxxp://www.trotux.com/?z=d905852e00ab93a275b7190g7z3beoam9e0gew8b8t&from=isr&uid=ST1000LM014-1EJ164_W380TBM4XXXXW380TBM4&type=hp");), Ersetzt,[9f4ebd2e9a00ba7c6b7b2c0d27d9d22e]
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Profiles\Atdaght.default\prefs.js, Gut: (), Schlecht: (on is running,
 * the changpdateTime.addon-background-update-timer", 1482614014);
user_pref("app.update.lastUpdateTime.background-update-timer", 1482565783);
user_pref("app.update.lastUpdateTime.b), Ersetzt,[99546586881260d6489e86b330d048b8]
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Profiles\Atdaght.default\prefs.js, Gut: (), Schlecht: (ateTime.background-update-timer", 1482565783);
user_pref("app.update.lastUpdateTime.blocklist-background-update-timer", 1482613654);
user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails",), Ersetzt,[7479fcefb1e9cf6745a180b9e61aac54]
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Profiles\Atdaght.default\prefs.js, Gut: (), Schlecht: (changpdateTime.addon-background-update-timer", 148261), Ersetzt,[feeff3f8c2d8033334b2b584f50b5aa6]
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Profiles\Atdaght.default\prefs.js, Gut: (), Schlecht: (e.blocklist-background-update-timer", 1482613654);
user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1482676242);
user_pref("app.update.lastUpdateTime.e), Ersetzt,[24c99259bcde152105e143f6b14f40c0]

Physische Sektoren: 0
(keine bösartigen Elemente erkannt)


(end)
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlaufdatum: 04.01.2017
Suchlaufzeit: 08:13
Protokolldatei: Malwarebytes 2017-01-04-01.txt
Administrator: Ja

Version: 2.2.1.1043
Malware-Datenbank: v2016.12.26.05
Rootkit-Datenbank: v2016.11.20.01
Lizenz: Testversion
Malware-Schutz: Aktiviert
Schutz vor bösartigen Websites: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Denise

Suchlauftyp: Bedrohungssuchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 36
Abgelaufene Zeit: 0 Min., 33 Sek.

Speicher: Deaktiviert
Start: Deaktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(keine bösartigen Elemente erkannt)

Module: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)

Registrierungswerte: 0
(keine bösartigen Elemente erkannt)

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Ordner: 0
(keine bösartigen Elemente erkannt)

Dateien: 0
(keine bösartigen Elemente erkannt)

Physische Sektoren: 0
(keine bösartigen Elemente erkannt)


(end)

cosinus 05.01.2017 13:35
Zitat:
AV: Ad-Aware Antivirus (Enabled - Up to date) {B0CC18C6-E527-6EE6-874C-9D19920E5619}
AS: Spybot - Search and Destroy (Disabled - Out of date) {A16C3F68-9280-E053-1818-342707FECF4D}
Beides deinstallieren. Danach neue FRST-Logd.

Schnuckibaer 05.01.2017 13:57
Hier die neuen Logs nach der Deinstallation:

Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 01-01-2017
durchgeführt von Denise (Administrator) auf WOMBAT (05-01-2017 13:47:34)
Gestartet von C:\Users\Denise\Downloads
Geladene Profile: UpdatusUser & Denise (Verfügbare Profile: UpdatusUser & Denise)
Platform: Windows 8.1 (Update) (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe
() C:\Program Files (x86)\PHotkey\POsd.exe
() C:\Program Files (x86)\PHotkey\GPMTray.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-30] (Intel Corporation)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028896 2013-08-28] (NVIDIA Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2780912 2013-09-19] (Synaptics Incorporated)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13662936 2013-10-24] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1360600 2013-10-29] (Realtek Semiconductor)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111576 2013-08-05] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [490760 2013-09-23] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-11] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-09-18] (CyberLink Corp.)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [25779624 2016-12-21] (Dropbox, Inc.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [210432 2016-07-05] (Geek Software GmbH)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1
HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\Run: [Power2GoExpress8] => NA
HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\MountPoints2: {a3baa892-5369-11e6-828f-0c8bfddd15ac} - "F:\windows\Data\setup.exe"
HKU\S-1-5-18\...\Run: [AppLauncher] => C:\Program Files (x86)\Ashampoo\Ashampoo AppLauncher\AppLauncher.exe
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt9] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt10] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt9] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-11-01] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-11-01] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-11-01] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NeroDesktopSwitcher.scf [2014-01-09] ()

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{2D7D7085-9498-4093-AC34-2DBFD52ED2F0}: [DhcpNameServer] 192.168.178.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2016-10-11] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2016-11-01] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2016-07-26] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-11-01] (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2016-07-26] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default [2017-01-05]
FF user.js: detected! => C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\user.js [2016-07-23]
FF Homepage: Mozilla\Firefox\Profiles\ytdyifhp.default -> www.google.de
FF Extension: (Firefox Hotfix) - C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\Extensions\firefox-hotfix@mozilla.org.xpi [2016-08-31]
FF Extension: (Video DownloadHelper) - C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2017-01-04]
FF Extension: (Adblock Plus) - C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-24]
FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files (x86)\congstar\Internet-Manager\Bin\addon => nicht gefunden
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_23_0_0_207.dll [2016-11-11] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_207.dll [2016-11-11] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-07-12] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2016-07-26] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-05] (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL [2014-07-24] (Nero AG)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\browser\defaults\preferences\firefox.js [2016-12-25]

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [3042032 2016-11-01] (Microsoft Corporation)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [74712 2013-03-11] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [316376 2013-03-11] (CyberLink)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-07-19] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-07-19] (Dropbox, Inc.)
R2 DbxSvc; C:\Windows\system32\DbxSvc.exe [42096 2016-12-21] (Dropbox, Inc.)
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [160768 2013-06-27] () [Datei ist nicht signiert]
S4 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-30] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [Datei ist nicht signiert]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 Intel(R) Wireless Bluetooth(R) 4.0 Radio Management; C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe [157128 2013-09-18] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2013-10-11] ()
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14997280 2013-08-28] (NVIDIA Corporation)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2145080 2015-06-25] (TuneUp Software)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3671792 2013-10-11] (Intel® Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [140600 2013-07-22] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1390904 2013-09-05] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [118728 2013-09-18] (Intel Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2017-01-05] (Malwarebytes)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [65408 2016-03-10] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
R3 NETwNb64; C:\Windows\system32\DRIVERS\NETwbw02.sys [3607520 2013-10-14] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-08-20] (NVIDIA Corporation)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R3 PegaRadioSwitch; C:\Windows\System32\drivers\PegaRadioSwitch.sys [23552 2013-08-22] (Windows (R) Win 7 DDK provider)
S3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1975000 2013-07-31] (Realtek Semiconductor Corporation                          )
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2013-09-19] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-09-19] (Synaptics Incorporated)
S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [31144 2015-06-04] (TuneUp Software)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [34760 2013-08-22] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [265056 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
S3 dbx; system32\DRIVERS\dbx.sys [X]
S3 HSPADataCardusbmdm; \SystemRoot\system32\DRIVERS\HSPADataCardusbmdm.sys [X]
S3 HSPADataCardusbnmea; \SystemRoot\system32\DRIVERS\HSPADataCardusbnmea.sys [X]
S3 HSPADataCardusbser; \SystemRoot\system32\DRIVERS\HSPADataCardusbser.sys [X]
S3 massfilter; \SystemRoot\System32\drivers\massfilter.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-01-05 13:40 - 2017-01-05 13:40 - 00000085 _____ C:\Windows\wininit.ini
2017-01-04 20:50 - 2017-01-04 21:18 - 00000000 ____D C:\Users\Denise\Desktop\Trojanerboard
2017-01-04 20:27 - 2017-01-04 20:48 - 00056171 _____ C:\Users\Denise\Downloads\Addition.txt
2017-01-04 20:24 - 2017-01-05 13:48 - 00021373 _____ C:\Users\Denise\Downloads\FRST.txt
2017-01-04 20:24 - 2017-01-04 20:24 - 00000000 ____D C:\Users\Denise\Downloads\FRST-OlderVersion
2017-01-04 19:30 - 2017-01-04 19:30 - 00000000 ___HD C:\ProgramData\8663r261o3m395
2016-12-29 20:49 - 2016-12-29 20:52 - 00000000 ____D C:\Users\Denise\Desktop\Handy Urlaub
2016-12-27 21:55 - 2016-12-27 21:55 - 00000000 ____D C:\Users\Denise\AppData\Roaming\Internet-Manager
2016-12-26 17:46 - 2017-01-05 13:47 - 00000000 ____D C:\FRST
2016-12-26 17:46 - 2017-01-04 20:24 - 02418176 _____ (Farbar) C:\Users\Denise\Downloads\FRST64.exe
2016-12-26 16:46 - 2017-01-05 13:43 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-12-26 16:45 - 2016-12-26 17:18 - 00001116 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-12-26 16:45 - 2016-12-26 16:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-12-26 16:45 - 2016-12-26 16:45 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-12-26 16:45 - 2016-12-26 16:45 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-12-26 16:45 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-12-26 16:45 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-12-26 16:45 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-12-26 16:44 - 2016-12-26 16:45 - 22851472 _____ (Malwarebytes ) C:\Users\Denise\Downloads\mbam-setup-2.2.1.1043.exe
2016-12-26 15:53 - 2016-12-26 15:56 - 00000000 ____D C:\AdwCleaner
2016-12-26 15:53 - 2016-12-26 15:53 - 03977168 _____ C:\Users\Denise\Downloads\adwcleaner_6.041.exe
2016-12-26 15:12 - 2016-12-25 22:34 - 00001282 _____ C:\Windows\system32\Drivers\etc\hosts.20161226-151245.backup
2016-12-26 12:47 - 2016-12-26 17:18 - 00001081 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-12-26 12:47 - 2016-12-26 17:18 - 00001063 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-12-26 12:47 - 2016-12-26 12:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-12-26 12:44 - 2016-12-26 12:44 - 00243720 _____ C:\Users\Denise\Downloads\Firefox Setup Stub 50.1.0.exe
2016-12-25 22:46 - 2017-01-05 13:42 - 00065142 _____ C:\Windows\PFRO.log
2016-12-25 22:46 - 2016-12-27 21:59 - 00477328 _____ C:\Windows\system32\FNTCACHE.DAT
2016-12-25 22:38 - 2016-12-25 22:41 - 00001058 _____ C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-12-25 22:36 - 2009-09-27 09:39 - 00415744 ___SH (The Public) C:\Windows\SysWOW64\avisynth.dll
2016-12-25 22:36 - 2005-07-14 12:31 - 00032256 ___SH C:\Windows\SysWOW64\AVSredirect.dll
2016-12-25 22:36 - 2004-02-22 10:11 - 00764416 ___SH (Abysmal Software) C:\Windows\SysWOW64\devil.dll
2016-12-25 22:36 - 2004-01-25 00:00 - 00070656 ___SH (www.helixcommunity.org) C:\Windows\SysWOW64\yv12vfw.dll
2016-12-25 22:36 - 2004-01-25 00:00 - 00070656 ___SH (www.helixcommunity.org) C:\Windows\SysWOW64\i420vfw.dll
2016-12-25 22:34 - 2016-12-26 00:08 - 00000000 ____D C:\Program Files (x86)\Cherciingnazak Schedule
2016-12-25 22:33 - 2017-01-05 13:19 - 00000000 ____D C:\Program Files (x86)\Drowiing
2016-12-25 22:33 - 2016-12-25 22:46 - 00000000 ____D C:\Users\Denise\AppData\Roaming\Dripied
2016-12-25 22:33 - 2016-12-25 22:34 - 00000000 ____D C:\Users\Denise\AppData\Roaming\Profiles
2016-12-25 22:33 - 2016-12-25 22:33 - 00000000 ____D C:\Users\Denise\Documents\eRightSoft
2016-12-25 22:33 - 2016-12-25 22:33 - 00000000 ____D C:\Users\Denise\AppData\Local\Steqiwardeadom
2016-12-25 22:33 - 2016-05-05 12:23 - 00556216 __RSH (FFmpeg Project) C:\Windows\SysWOW64\avutil-lav-55.dll
2016-12-25 22:33 - 2016-05-05 12:23 - 00537784 __RSH (FFmpeg Project) C:\Windows\SysWOW64\swscale-lav-4.dll
2016-12-25 22:33 - 2016-05-05 12:23 - 00405176 __RSH (Intel Corp.) C:\Windows\SysWOW64\IntelQuickSyncDecoder.dll
2016-12-25 22:33 - 2016-05-05 12:23 - 00276152 __RSH C:\Windows\SysWOW64\libbluray.dll
2016-12-25 22:33 - 2016-05-05 12:23 - 00000493 __RSH C:\Windows\SysWOW64\LAVFilters.Dependencies.manifest
2016-12-25 22:33 - 2016-05-05 12:22 - 10766520 __RSH (FFmpeg Project) C:\Windows\SysWOW64\avcodec-lav-57.dll
2016-12-25 22:33 - 2016-05-05 12:22 - 01699000 __RSH (FFmpeg Project) C:\Windows\SysWOW64\avformat-lav-57.dll
2016-12-25 22:33 - 2016-05-05 12:22 - 00188088 __RSH (FFmpeg Project) C:\Windows\SysWOW64\avfilter-lav-6.dll
2016-12-25 22:33 - 2016-05-05 12:22 - 00160440 __RSH (FFmpeg Project) C:\Windows\SysWOW64\avresample-lav-3.dll
2016-12-25 22:33 - 2004-10-10 08:50 - 00278528 _____ (Real Networks, Inc) C:\Windows\SysWOW64\pncrt.dll
2016-12-25 22:33 - 2004-07-02 16:33 - 00327749 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\drvc.dll
2016-12-25 22:32 - 2017-01-04 19:30 - 00000000 ___HD C:\ProgramData\93066184d64t1179994
2016-12-25 22:32 - 2016-12-25 22:44 - 00000000 ____D C:\Program Files (x86)\eRightSoft
2016-12-25 22:32 - 2016-12-25 22:43 - 00000000 ____D C:\Windows\system32\SSL
2016-12-25 22:31 - 2016-12-26 00:07 - 00000000 ___HD C:\Users\Denise\AppData\Roaming\DIFX
2016-12-25 22:31 - 2016-12-26 00:07 - 00000000 ____D C:\Users\Denise\AppData\Roaming\SPI
2016-12-25 22:06 - 2017-01-02 08:51 - 00000000 ____D C:\Users\Denise\Desktop\DVD Player Auto
2016-12-23 21:22 - 2016-12-23 21:22 - 00000000 ____D C:\ProgramData\Oracle
2016-12-23 21:21 - 2016-10-27 14:22 - 59890688 _____ (Ravensburger AG) C:\Users\Denise\Desktop\tiptoi_3.1.6.exe
2016-12-23 15:40 - 2016-12-23 15:40 - 00026306 _____ C:\Users\Denise\Desktop\Gutschein.docx
2016-12-22 14:13 - 2016-12-26 00:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2016-12-21 19:15 - 2016-12-21 19:15 - 00075888 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-stable.sys
2016-12-21 19:15 - 2016-12-21 19:15 - 00075888 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-dev.sys
2016-12-21 19:15 - 2016-12-21 19:15 - 00075888 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-canary.sys
2016-12-21 19:15 - 2016-12-21 19:15 - 00042096 _____ (Dropbox, Inc.) C:\Windows\system32\DbxSvc.exe
2016-12-18 11:54 - 2016-12-18 11:54 - 00106441 _____ C:\Users\Denise\Downloads\PMP_Order_1.pdf
2016-12-18 07:44 - 2017-01-05 13:42 - 00013175 _____ C:\Windows\setupact.log
2016-12-18 07:44 - 2016-12-18 07:44 - 00000000 _____ C:\Windows\setuperr.log
2016-12-17 08:31 - 2017-01-05 13:40 - 00056155 ____H C:\Users\Denise\AppData\Local\IconCache.db
2016-12-16 11:45 - 2016-12-16 11:45 - 00000000 ____D C:\Users\Denise\AppData\Local\CrashRpt
2016-12-16 11:43 - 2016-12-26 17:18 - 00001219 _____ C:\Users\Public\Desktop\Ashampoo Snap 2017.lnk
2016-12-16 11:43 - 2016-12-26 00:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
2016-12-16 11:39 - 2016-12-16 11:40 - 54653776 _____ (Ashampoo GmbH & Co. KG ) C:\Users\Denise\Downloads\ashampoo_snap_2017_23536.exe
2016-12-16 11:19 - 2016-12-16 11:19 - 00292995 _____ C:\Users\Denise\Downloads\mp3DC222.exe
2016-12-16 07:54 - 2016-12-16 07:54 - 02586928 _____ C:\Users\Denise\Downloads\Adaware_Installer(1).exe
2016-12-15 14:20 - 2016-12-26 17:17 - 00002276 _____ C:\Users\Denise\Desktop\Kindle.lnk
2016-12-15 14:20 - 2016-12-26 00:07 - 00000000 ____D C:\Users\Denise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon
2016-12-15 14:20 - 2016-12-15 14:21 - 00000000 ____D C:\Users\Denise\Documents\My Kindle Content
2016-12-15 14:20 - 2016-12-15 14:20 - 00000000 ____D C:\Users\Denise\AppData\Local\Amazon
2016-12-15 14:19 - 2016-12-15 14:20 - 66693792 _____ (Amazon.com) C:\Users\Denise\Downloads\KindleForPC-installer-1.17.44183.exe
2016-12-15 13:28 - 2016-12-15 13:28 - 00045532 _____ C:\Users\Denise\Downloads\PB_KAZ_KtoNr_0987363857_03-11-2016_0635.pdf
2016-12-15 13:28 - 2016-12-15 13:28 - 00042838 _____ C:\Users\Denise\Downloads\PB_KAZ_KtoNr_0987363857_05-12-2016_0620.pdf
2016-12-14 07:58 - 2016-12-01 15:13 - 00869576 _____ (Microsoft Corporation) C:\Windows\system32\msvcr120_clr0400.dll
2016-12-14 07:58 - 2016-12-01 15:13 - 00678592 _____ (Microsoft Corporation) C:\Windows\system32\msvcp120_clr0400.dll
2016-12-14 07:58 - 2016-12-01 15:11 - 00875720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr120_clr0400.dll
2016-12-14 07:58 - 2016-12-01 15:11 - 00536768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp120_clr0400.dll
2016-12-14 07:58 - 2016-10-20 14:14 - 00029888 _____ (Microsoft Corporation) C:\Windows\system32\aspnet_counters.dll
2016-12-14 07:58 - 2016-10-20 14:10 - 00028352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aspnet_counters.dll
2016-12-14 07:56 - 2016-11-19 22:24 - 00567152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2016-12-14 07:56 - 2016-11-19 22:24 - 00152856 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2016-12-14 07:56 - 2016-11-19 20:29 - 00401408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-12-14 07:56 - 2016-11-19 19:44 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2016-12-14 07:56 - 2016-11-19 18:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2016-12-14 07:56 - 2016-11-19 18:22 - 00111104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2016-12-14 07:56 - 2016-11-16 22:49 - 00377176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
2016-12-14 07:56 - 2016-11-12 22:06 - 00738104 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2016-12-14 07:56 - 2016-11-12 20:38 - 00613632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2016-12-14 07:56 - 2016-11-12 20:25 - 00576000 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-12-14 07:56 - 2016-11-12 20:08 - 25759744 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-12-14 07:56 - 2016-11-12 20:07 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-12-14 07:56 - 2016-11-12 19:53 - 06049280 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-12-14 07:56 - 2016-11-12 19:29 - 00498688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-12-14 07:56 - 2016-11-12 19:23 - 01033216 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2016-12-14 07:56 - 2016-11-12 19:17 - 20302848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-12-14 07:56 - 2016-11-12 19:14 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-12-14 07:56 - 2016-11-12 19:10 - 00806912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-12-14 07:56 - 2016-11-12 18:45 - 00880640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2016-12-14 07:56 - 2016-11-12 18:41 - 15257088 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-12-14 07:56 - 2016-11-12 18:38 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-12-14 07:56 - 2016-11-12 18:37 - 04608000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-12-14 07:56 - 2016-11-12 18:35 - 02920960 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-12-14 07:56 - 2016-11-12 18:21 - 13653504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-12-14 07:56 - 2016-11-12 18:20 - 01543680 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-12-14 07:56 - 2016-11-12 18:11 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-12-14 07:56 - 2016-11-12 18:05 - 02444800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-12-14 07:56 - 2016-11-12 18:02 - 01312256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-12-14 07:56 - 2016-11-12 18:02 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-12-14 07:56 - 2016-11-11 03:33 - 01541240 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2016-12-14 07:56 - 2016-11-09 18:25 - 01376768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2016-12-14 07:56 - 2016-11-05 21:46 - 00422744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\spaceport.sys
2016-12-14 07:56 - 2016-11-05 19:35 - 04169216 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-12-14 07:56 - 2016-11-05 18:57 - 03320320 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2016-12-14 07:56 - 2016-11-05 18:11 - 03606528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2016-12-14 07:56 - 2016-11-05 16:56 - 02778624 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2016-12-14 07:56 - 2016-11-05 16:46 - 02463744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2016-12-14 07:56 - 2016-10-28 03:56 - 01380048 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-12-14 07:56 - 2016-10-27 15:28 - 01097728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2016-12-14 07:56 - 2016-10-12 22:49 - 00379224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2016-12-14 07:56 - 2016-10-12 22:11 - 00922968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\refs.sys
2016-12-14 07:56 - 2016-10-11 17:45 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\TpmTasks.dll
2016-12-14 07:56 - 2016-10-11 00:31 - 00990040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2016-12-14 07:56 - 2016-10-10 19:18 - 00069976 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2016-12-14 07:56 - 2016-10-10 19:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cmimcext.sys
2016-12-14 07:56 - 2016-10-09 15:17 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\ActionQueue.dll
2016-12-14 07:56 - 2016-10-09 15:08 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\shsetup.dll
2016-12-14 07:56 - 2016-10-09 15:08 - 00095232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shsetup.dll
2016-12-14 07:56 - 2016-10-08 23:24 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll
2016-12-14 07:56 - 2016-10-08 22:31 - 00498688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll
2016-12-14 07:56 - 2016-10-08 22:10 - 03547648 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2016-12-14 07:56 - 2016-10-05 15:01 - 01200128 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Globalization.dll
2016-12-14 07:56 - 2016-10-05 15:00 - 00868864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Globalization.dll
2016-12-14 07:56 - 2016-10-05 15:00 - 00323072 _____ (Microsoft Corporation) C:\Windows\system32\GlobCollationHost.dll
2016-12-14 07:56 - 2016-10-05 14:52 - 00513456 _____ C:\Windows\SysWOW64\locale.nls
2016-12-14 07:56 - 2016-10-05 14:52 - 00513456 _____ C:\Windows\system32\locale.nls
2016-12-14 07:56 - 2016-10-05 05:15 - 01969944 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2016-12-14 07:56 - 2016-10-05 05:15 - 01613528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2016-12-14 07:56 - 2016-10-05 05:15 - 00324896 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2016-12-14 07:56 - 2016-10-05 05:15 - 00245320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2016-12-14 07:56 - 2016-09-27 21:16 - 00445873 _____ C:\Windows\system32\ApnDatabase.xml
2016-12-14 07:56 - 2016-09-20 23:30 - 02462040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2016-12-14 07:56 - 2015-10-22 16:58 - 00200704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GlobCollationHost.dll
2016-12-12 12:09 - 2016-12-12 12:19 - 01037434 _____ C:\Users\Denise\Downloads\20161108_214140.jpg
2016-12-12 12:09 - 2016-12-12 12:09 - 00944227 _____ C:\Users\Denise\Downloads\20161108_214126.jpg
2016-12-12 12:09 - 2016-12-12 12:09 - 00905302 _____ C:\Users\Denise\Downloads\20161108_214019.jpg
2016-12-12 12:09 - 2016-12-12 12:09 - 00810842 _____ C:\Users\Denise\Downloads\20161108_214004.jpg
2016-12-12 11:53 - 2016-12-12 11:53 - 00431690 _____ C:\Users\Denise\Downloads\3907_buildinginstruction
2016-12-11 21:32 - 2016-12-11 21:32 - 00117357 _____ C:\Users\Denise\Downloads\ZIAUFEIN_1481058355529JAOOW1ESAIGW.pdf
2016-12-11 16:05 - 2016-12-11 16:05 - 00104263 _____ C:\Users\Denise\Downloads\PMP_Order_19(1).pdf
2016-12-10 21:34 - 2016-12-10 21:34 - 00104266 _____ C:\Users\Denise\Downloads\PMP_Order_19.pdf
2016-12-08 13:26 - 2016-12-08 13:26 - 00049590 _____ C:\Users\Denise\Downloads\KleinunternehmerUmsatzsteuerrecht.pdf
2016-12-07 07:34 - 2016-12-07 07:34 - 02587440 _____ C:\Users\Denise\Downloads\Adaware_Installer.exe
2016-12-06 14:20 - 2016-12-06 14:20 - 00050834 _____ C:\Users\Denise\Downloads\ebooks-free-download14041.pdf

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-01-05 13:47 - 2016-07-19 21:11 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3531133450-1765533330-4211851364-1002
2017-01-05 13:47 - 2013-09-12 12:28 - 00766620 _____ C:\Windows\system32\perfh007.dat
2017-01-05 13:47 - 2013-09-12 12:28 - 00159902 _____ C:\Windows\system32\perfc007.dat
2017-01-05 13:47 - 2013-09-12 12:00 - 01780340 _____ C:\Windows\system32\PerfStringBackup.INI
2017-01-05 13:47 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\Inf
2017-01-05 13:43 - 2016-07-19 21:54 - 00000000 ___RD C:\Users\Denise\Dropbox
2017-01-05 13:42 - 2016-10-19 17:36 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2017-01-05 13:42 - 2016-07-19 21:46 - 00001216 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
2017-01-05 13:42 - 2013-08-22 15:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-01-05 13:41 - 2013-08-22 14:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2017-01-05 13:40 - 2016-10-19 17:36 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2017-01-05 13:15 - 2016-11-20 07:49 - 00000000 ____D C:\Users\Denise\AppData\LocalLow\Mozilla
2017-01-04 21:06 - 2016-07-19 21:46 - 00001220 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
2017-01-04 19:16 - 2016-07-19 21:12 - 00000000 ___DO C:\Users\Denise\SkyDrive
2017-01-04 09:01 - 2016-08-20 13:36 - 00000000 ____D C:\Users\Denise\AppData\Roaming\vlc
2017-01-02 21:20 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\tracing
2017-01-02 16:34 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\registration
2017-01-01 21:20 - 2016-10-07 11:46 - 00000000 ____D C:\Users\Denise\Documents\Calibre Bibliothek
2016-12-31 22:01 - 2016-07-19 21:05 - 00000000 ___RD C:\Users\Denise\Pictures
2016-12-28 11:17 - 2016-07-19 21:05 - 00000000 ___RD C:\Users\Denise\Music
2016-12-27 21:59 - 2013-08-22 14:36 - 00000000 __RSD C:\Windows\Fonts
2016-12-27 21:56 - 2016-07-27 19:10 - 00000000 ____D C:\Windows\SysWOW64\SupportAppZXH
2016-12-27 21:56 - 2013-08-22 16:36 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
2016-12-27 21:56 - 2013-08-22 14:36 - 00000000 ___RD C:\Program Files (x86)
2016-12-27 21:55 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\SysWOW64
2016-12-27 20:10 - 2013-11-13 16:02 - 00000000 ____D C:\ProgramData\CyberLink
2016-12-26 22:30 - 2016-07-24 08:40 - 00000000 ____D C:\Users\Denise\dwhelper
2016-12-26 22:26 - 2016-09-02 08:21 - 00000000 ____D C:\Users\Denise\Desktop\Tupperware
2016-12-26 17:18 - 2016-11-27 00:10 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-12-26 17:18 - 2016-11-27 00:10 - 00002065 _____ C:\Users\Public\Desktop\Acrobat Reader DC.lnk
2016-12-26 17:18 - 2016-08-20 13:35 - 00001084 _____ C:\Users\Public\Desktop\VLC media player.lnk
2016-12-26 17:18 - 2016-07-25 21:32 - 00002923 _____ C:\Users\Public\Desktop\Nero 2015.lnk
2016-12-26 17:18 - 2016-07-23 19:24 - 00002223 _____ C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2016-12-26 17:18 - 2016-07-23 19:24 - 00002221 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014.lnk
2016-12-26 17:18 - 2016-07-23 19:24 - 00002203 _____ C:\Users\Public\Desktop\TuneUp Utilities 2014.lnk
2016-12-26 17:18 - 2016-07-23 10:49 - 00002068 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\tiptoi® Manager Deinstallationsprogramm.lnk
2016-12-26 17:18 - 2016-07-23 10:49 - 00002000 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\tiptoi.lnk
2016-12-26 17:18 - 2016-07-21 20:13 - 00001081 _____ C:\Users\Public\Desktop\XMedia Recode.lnk
2016-12-26 17:18 - 2016-07-19 22:19 - 00002210 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions 4.5.lnk
2016-12-26 17:18 - 2016-07-19 22:19 - 00002192 _____ C:\Users\Public\Desktop\Adobe Digital Editions 4.5.lnk
2016-12-26 17:18 - 2016-07-19 22:07 - 00000970 _____ C:\Users\Public\Desktop\calibre - E-book management.lnk
2016-12-26 17:18 - 2013-09-13 08:14 - 00001394 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2016-12-26 17:18 - 2013-09-13 08:14 - 00001325 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2016-12-26 17:17 - 2016-07-19 22:56 - 00002497 _____ C:\Users\Denise\Desktop\Word 2013.lnk
2016-12-26 17:17 - 2016-07-19 22:56 - 00002493 _____ C:\Users\Denise\Desktop\Excel 2013.lnk
2016-12-26 17:17 - 2016-07-19 22:56 - 00002383 _____ C:\Users\Denise\Desktop\Outlook 2013.lnk
2016-12-26 17:17 - 2016-07-19 21:06 - 00001057 _____ C:\Users\Denise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-12-26 17:16 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\schemas
2016-12-26 17:15 - 2013-08-22 16:20 - 00000000 ____D C:\Windows\CbsTemp
2016-12-26 15:57 - 2016-11-19 19:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-12-26 15:55 - 2016-07-19 21:05 - 00000000 ___RD C:\Users\Denise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
2016-12-26 15:12 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\system32\Drivers\etc
2016-12-26 15:12 - 2013-08-22 14:25 - 00454135 ____R C:\Windows\system32\Drivers\etc\hosts
2016-12-26 12:12 - 2016-07-19 22:35 - 00000000 ____D C:\Users\Denise\Documents\Outlook-Dateien
2016-12-26 12:11 - 2016-08-26 07:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
2016-12-26 12:11 - 2016-07-25 21:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero
2016-12-26 12:11 - 2016-07-21 20:19 - 00000000 ____D C:\Maus
2016-12-26 08:47 - 2013-11-26 14:46 - 00000000 ___RD C:\Users\UpdatusUser\Desktop
2016-12-26 07:38 - 2016-11-25 17:17 - 00000000 ____D C:\Users\Denise\AppData\Roaming\ActivePresenter
2016-12-26 07:38 - 2016-07-19 21:05 - 00000000 ____D C:\Users\Denise
2016-12-26 00:27 - 2013-08-22 16:36 - 00000000 ___RD C:\Windows\assembly
2016-12-26 00:26 - 2013-08-22 16:31 - 00000000 ____D C:\Windows\system32\DriverStore
2016-12-26 00:14 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\system32\wbem
2016-12-26 00:08 - 2016-07-23 10:49 - 00000000 ____D C:\Program Files (x86)\Ravensburger tiptoi
2016-12-26 00:08 - 2016-07-19 22:19 - 00000000 ____D C:\Users\Denise\AppData\Local\Adobe_Systems_Incorporate
2016-12-26 00:08 - 2013-11-13 15:58 - 00000000 ____D C:\ProgramData\ashampoo
2016-12-26 00:08 - 2013-08-22 16:36 - 00000000 ____D C:\Program Files\Windows Defender
2016-12-26 00:08 - 2013-08-22 16:36 - 00000000 ____D C:\Program Files\Internet Explorer
2016-12-26 00:07 - 2016-08-13 15:42 - 00000000 ____D C:\Windows\system32\appraiser
2016-12-26 00:07 - 2016-07-26 07:43 - 00000000 ____D C:\Users\Denise\AppData\Roaming\XMedia Recode
2016-12-26 00:07 - 2016-07-23 10:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\tiptoi® Manager
2016-12-26 00:07 - 2013-11-26 14:46 - 00000000 ____D C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
2016-12-26 00:07 - 2013-11-15 17:10 - 00000000 ___HD C:\Windows\system32\WLANProfiles
2016-12-26 00:07 - 2013-09-20 10:35 - 00000000 ____D C:\Windows\system32\catroot2
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 __RSD C:\Windows\Media
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\SysWOW64\de-DE
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\SystemResources
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\System32\Tasks\Microsoft
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\system32\de-DE
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\system32\CodeIntegrity
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\rescache
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\PolicyDefinitions
2016-12-26 00:07 - 2013-08-22 16:33 - 00000000 ____D C:\Windows\system32\Drivers\UMDF
2016-12-26 00:07 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\WinSxS
2016-12-26 00:07 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\system32\Sysprep
2016-12-26 00:07 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\system32\oobe
2016-12-26 00:07 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\system32\migration
2016-12-25 22:57 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\Logs
2016-12-25 22:46 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\debug
2016-12-25 22:33 - 2016-07-19 21:05 - 00000000 ___RD C:\Users\Denise\Documents
2016-12-25 22:32 - 2016-07-19 21:05 - 00000000 ____D C:\Users\Denise\AppData\Local\Microsoft
2016-12-25 15:13 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\AppReadiness
2016-12-24 22:14 - 2016-07-19 21:05 - 00000000 ____D C:\Users\Denise\AppData\Local\Packages
2016-12-24 22:10 - 2016-07-19 22:19 - 00000000 ____D C:\Users\Denise\Documents\My Digital Editions
2016-12-23 21:24 - 2016-07-23 10:49 - 00000000 ____D C:\Users\Denise\AppData\Roaming\RavensburgerTipToi3
2016-12-23 21:23 - 2016-07-23 10:49 - 00000000 ____D C:\ProgramData\RavensburgerTipToi3
2016-12-22 14:14 - 2016-07-19 21:46 - 00000000 ____D C:\Program Files (x86)\Dropbox
2016-12-20 08:33 - 2013-08-22 16:36 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-12-20 08:32 - 2016-07-19 22:23 - 00000000 ____D C:\Program Files\Microsoft Office 15
2016-12-17 07:04 - 2013-11-13 16:04 - 00000000 ____D C:\ProgramData\install_clap
2016-12-17 07:04 - 2013-09-12 12:52 - 00000000 ____D C:\Windows\Panther
2016-12-16 13:32 - 2016-08-23 20:20 - 00217600 ___SH C:\Users\Denise\Desktop\Thumbs.db
2016-12-16 11:43 - 2013-11-13 15:56 - 00000000 ____D C:\Program Files (x86)\Ashampoo
2016-12-16 10:57 - 2013-09-12 11:53 - 00524288 ___SH C:\Windows\system32\config\COMPONENTS{42b82173-0b2e-11e3-93f4-90b11c2eb9f2}.TMContainer00000000000000000001.regtrans-ms
2016-12-16 10:57 - 2013-09-12 11:53 - 00065536 ___SH C:\Windows\system32\config\COMPONENTS{42b82173-0b2e-11e3-93f4-90b11c2eb9f2}.TM.blf
2016-12-15 09:47 - 2013-09-12 11:53 - 00524288 ___SH C:\Windows\system32\config\DRIVERS{e1793794-0b3d-11e3-9dfe-80de722c933b}.TMContainer00000000000000000001.regtrans-ms
2016-12-15 09:47 - 2013-09-12 11:53 - 00065536 ___SH C:\Windows\system32\config\DRIVERS{e1793794-0b3d-11e3-9dfe-80de722c933b}.TM.blf
2016-12-14 08:02 - 2016-07-23 14:30 - 00000000 ____D C:\Windows\system32\MRT
2016-12-14 08:02 - 2013-09-12 11:53 - 00524288 ___SH C:\Windows\system32\config\COMPONENTS{42b82173-0b2e-11e3-93f4-90b11c2eb9f2}.TMContainer00000000000000000002.regtrans-ms
2016-12-14 08:00 - 2013-11-15 16:01 - 135632432 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-12-14 07:40 - 2016-07-19 21:16 - 00003910 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{CD913E81-9733-4F87-B61C-593DA3D3B538}
2016-12-12 00:00 - 2016-11-10 07:59 - 00835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-12-12 00:00 - 2016-11-10 07:59 - 00177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-12-10 22:10 - 2016-07-19 21:05 - 00000000 ___SD C:\Users\Denise\AppData\Roaming\Microsoft
2016-12-09 23:40 - 2013-08-22 16:36 - 00000000 ___HD C:\Program Files\WindowsApps
2016-12-09 15:35 - 2013-11-26 14:46 - 00000000 ____D C:\Users\UpdatusUser

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2016-11-25 16:39 - 2016-11-25 16:48 - 0003584 _____ () C:\Users\Denise\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-11-26 14:54 - 2013-11-26 14:54 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2013-11-13 16:08 - 2013-11-13 16:09 - 0000104 _____ () C:\ProgramData\{01FB4998-33C4-4431-85ED-079E3EEFE75D}.log
2013-11-13 16:09 - 2013-11-13 16:10 - 0000119 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2013-11-13 16:04 - 2013-11-13 16:06 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2013-11-13 16:02 - 2013-11-13 16:02 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2013-11-13 16:07 - 2013-11-13 16:08 - 0000108 _____ () C:\ProgramData\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}.log
2013-11-13 16:02 - 2013-11-13 16:04 - 0000110 _____ () C:\ProgramData\{E3739848-5329-48E3-8D28-5BBD6E8BE384}.log
2013-11-13 16:06 - 2013-11-13 16:06 - 0000110 _____ () C:\ProgramData\{E3D04529-6EDB-11D8-A372-0050BAE317E1}.log

Einige Dateien in TEMP:
====================
C:\Users\Denise\AppData\Local\Temp\AppLauncher.exe
C:\Users\Denise\AppData\Local\Temp\tu17p84.exe


==================== Bamital & volsnap ======================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert

LastRegBack: 2017-01-04 07:56

==================== Ende von FRST.txt ============================
Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 01-01-2017
durchgeführt von Denise (05-01-2017 13:48:36)
Gestartet von C:\Users\Denise\Downloads
Windows 8.1 (Update) (X64) (2016-07-19 20:05:43)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-3531133450-1765533330-4211851364-500 - Administrator - Disabled)
Denise (S-1-5-21-3531133450-1765533330-4211851364-1002 - Administrator - Enabled) => C:\Users\Denise
Gast (S-1-5-21-3531133450-1765533330-4211851364-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3531133450-1765533330-4211851364-1004 - Limited - Enabled)
UpdatusUser (S-1-5-21-3531133450-1765533330-4211851364-1001 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.020.20042 - Adobe Systems Incorporated)
Adobe Digital Editions 4.5 (HKLM-x32\...\Adobe Digital Editions 4.5) (Version: 4.5.1 - Adobe Systems Incorporated)
Adobe Flash Player 23 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 23.0.0.207 - Adobe Systems Incorporated)
Amazon Kindle (HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\Amazon Kindle) (Version: 1.17.1.44183 - Amazon)
Ashampoo Snap 2017 (HKLM-x32\...\{0A11EA01-F22C-84C3-9723-53CA58DB6F9C}_is1) (Version: 1.0.1 - Ashampoo GmbH & Co. KG)
calibre (HKLM-x32\...\{F6BB454A-E737-4A1C-A5D4-0E2834E24905}) (Version: 2.62.0 - Kovid Goyal)
ConvertHelper 3.2 (HKLM\...\{27CC6AB1-E72B-4179-AF1A-EAE507EBAF52}}_is1) (Version:  - DownloadHelper)
CyberLink Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
CyberLink PowerRecover (HKLM-x32\...\InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.7.0.2103 - CyberLink Corp.)
CyberLink PowerRecover (Version: 5.7.0.2103 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Digital Plus Home Theater (HKLM\...\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.5.1.1 - Dolby Laboratories Inc)
Dropbox (HKLM-x32\...\Dropbox) (Version: 16.4.30 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.59.1 - Dropbox, Inc.) Hidden
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotogalerija (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotogalleri (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotogalleriet (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotoğraf Galerisi (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotótár (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galeria de Fotografias (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galería de fotos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galeria fotografii (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
GeForce Experience NvStream Client Components (Version: 0.1.87 - NVIDIA Corporation) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3355 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{302600C1-6BDF-4FD1-1309-148929CC1385}) (Version: 3.1.1309.0390 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.2.1000 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{105fa5c4-72e1-41f2-a82c-884d8aa4b381}) (Version: 16.6.0 - Intel Corporation)
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft Office Professional Plus 2013 - de-de (HKLM\...\ProPlusRetail - de-de) (Version: 15.0.4885.1001 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 50.1.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 50.1.0 (x86 de)) (Version: 50.1.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 50.1.0 - Mozilla)
Nero 2015 (HKLM-x32\...\{847D6818-3BA4-4F41-B5B7-4505D8E012B7}) (Version: 16.0.01300 - Nero AG)
Nero Info (HKLM-x32\...\{B791E0AB-87A9-41A4-8D98-D13C2E37D928}) (Version: 16.0.1002 - Nero AG)
NVIDIA GeForce Experience 1.6.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.6.1 - NVIDIA Corporation)
NVIDIA Graphics Driver 327.62 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.62 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA Virtual Audio 1.2.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.5 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4885.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4885.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4885.1001 - Microsoft Corporation) Hidden
PDF24 Creator 7.9.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0092 - Pegatron Corporation)
Podstawowe programy Windows Live (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Prerequisite installer (x32 Version: 16.0.0000 - Nero AG) Hidden
Raccolta foto (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.30164 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.19.726.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7076 - Realtek Semiconductor Corp.)
SHIELD Streaming (Version: 1.05.28 - NVIDIA Corporation) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.15.0 - Synaptics Incorporated)
tiptoi® Manager 3.1.6 (HKLM-x32\...\9978-5763-2995-5228) (Version: 3.1.6 - Ravensburger AG)
TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.354 - TuneUp Software) Hidden
TuneUp Utilities 2014 (HKLM-x32\...\TuneUp Utilities) (Version: 14.0.1000.354 - TuneUp Software)
TuneUp Utilities 2014 (x32 Version: 14.0.1000.354 - TuneUp Software) Hidden
Valokuvavalikoima (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
XMedia Recode Version 3.3.3.3 (HKLM-x32\...\{DDA3C325-47B2-4730-9672-BF3771C08799}_is1) (Version: 3.3.3.3 - XMedia Recode)
Συλλογή φωτογραφιών (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {0C353ECE-7C42-4EDF-9E78-7F60D3E609D4} - System32\Tasks\Nero\Nero Info => C:\Program Files (x86)\Common Files\Nero\Nero Info\NeroInfo.exe [2014-05-20] (Nero AG)
Task: {30894E26-3DFA-47E8-95C5-D7AC45A62494} - \93066184d64t1179994 -> Keine Datei <==== ACHTUNG
Task: {6DD7B98D-691E-4C99-A942-BB379DBA5CD9} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2016-11-01] (Microsoft Corporation)
Task: {98209A60-AC79-456E-8CFB-EA8D24C38CDD} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-09-19] (Synaptics Incorporated)
Task: {AE3A986E-65D2-4E77-82E1-2D9546986C36} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-11-01] (Microsoft Corporation)
Task: {BCEDF6AA-DC6E-47EE-A7A8-CAC36707ADC2} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-07-19] (Dropbox, Inc.)
Task: {CFA5AE2D-15E3-47FD-BD31-E4E713873AC7} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2014\OneClick.exe [2015-06-25] (TuneUp Software)
Task: {E0948293-2279-4D6B-8E77-F3AA3CA9A980} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-11-01] (Microsoft Corporation)
Task: {E1189ACB-8FE2-4F21-B9A3-00274A542B91} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2016-11-01] (Microsoft Corporation)
Task: {E7A91B92-EF72-4400-A58F-7BA85A14B0CB} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-07-19] (Dropbox, Inc.)
Task: {FEA5CC20-2042-4BC8-A122-F29B40BF89BC} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-10-21] (Adobe Systems Incorporated)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

Shortcut: C:\Users\Denise\AppData\Local\Microsoft\Windows\ConnectedSearch\History\site_1691182358_de-de.lnk -> hxxp://www.windowssearch.com:80/suggestions?qry=spotify&cc=DE&setlang=de-DE&inlang=de-DE&adlt=moderate&scale=100&contrast=none&hw=768%2C1366&CVID=7075BBFFD9B4452CA755DE3838E3C42

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MEDIONhome.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.medion.com

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2013-11-20 15:17 - 2013-06-27 10:56 - 00160768 _____ () C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
2016-07-26 06:27 - 2016-05-24 08:51 - 00116416 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-06-25 06:53 - 2015-06-25 06:53 - 00699704 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\avgrepliba.dll
2013-11-20 15:17 - 2013-09-02 16:15 - 02216960 _____ () C:\Program Files (x86)\PHotkey\PHotkey.exe
2013-11-20 15:17 - 2012-10-23 19:07 - 03471872 _____ () C:\Program Files (x86)\PHotkey\POSD.exe
2013-11-20 15:17 - 2013-07-18 16:41 - 08856576 _____ () C:\Program Files (x86)\PHotkey\GPMTray.exe
2016-12-16 07:56 - 2016-11-11 21:36 - 00035792 _____ () C:\Program Files (x86)\Dropbox\Client\_multiprocessing.pyd
2016-12-16 07:56 - 2016-11-11 21:36 - 00100296 _____ () C:\Program Files (x86)\Dropbox\Client\_ctypes.pyd
2016-12-16 07:56 - 2016-11-11 21:36 - 00018888 _____ () C:\Program Files (x86)\Dropbox\Client\select.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00019760 _____ () C:\Program Files (x86)\Dropbox\Client\tornado.speedups.pyd
2016-12-16 07:56 - 2016-11-11 21:36 - 00694224 _____ () C:\Program Files (x86)\Dropbox\Client\unicodedata.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00020816 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._constant_time.pyd
2016-12-16 07:56 - 2016-11-11 21:37 - 00123856 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_backend.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 01682760 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._openssl.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00020808 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._padding.pyd
2016-12-22 14:12 - 2016-11-11 21:36 - 00145864 _____ () C:\Program Files (x86)\Dropbox\Client\pyexpat.pyd
2016-12-22 14:12 - 2016-11-11 21:37 - 00019408 _____ () C:\Program Files (x86)\Dropbox\Client\faulthandler.pyd
2016-12-22 14:12 - 2016-11-11 21:36 - 00116688 _____ () C:\Program Files (x86)\Dropbox\Client\pywintypes27.dll
2016-12-16 07:56 - 2016-11-11 21:38 - 00105928 _____ () C:\Program Files (x86)\Dropbox\Client\win32api.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00021312 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.crt.compiled._winffi_crt.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00052024 _____ () C:\Program Files (x86)\Dropbox\Client\psutil._psutil_windows.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00038696 _____ () C:\Program Files (x86)\Dropbox\Client\fastpath.pyd
2016-12-22 14:12 - 2016-11-11 21:36 - 00392144 _____ () C:\Program Files (x86)\Dropbox\Client\pythoncom27.dll
2016-12-22 14:12 - 2016-11-11 21:38 - 00020936 _____ () C:\Program Files (x86)\Dropbox\Client\mmapfile.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00024528 _____ () C:\Program Files (x86)\Dropbox\Client\win32event.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00116176 _____ () C:\Program Files (x86)\Dropbox\Client\win32security.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00381752 _____ () C:\Program Files (x86)\Dropbox\Client\win32com.shell.shell.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00124880 _____ () C:\Program Files (x86)\Dropbox\Client\win32file.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00025424 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.kernel32.compiled._winffi_kernel32.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32clipboard.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00175560 _____ () C:\Program Files (x86)\Dropbox\Client\win32gui.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00030160 _____ () C:\Program Files (x86)\Dropbox\Client\win32pipe.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00043472 _____ () C:\Program Files (x86)\Dropbox\Client\win32process.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00048592 _____ () C:\Program Files (x86)\Dropbox\Client\win32service.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00057808 _____ () C:\Program Files (x86)\Dropbox\Client\win32evtlog.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32profile.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00246592 _____ () C:\Program Files (x86)\Dropbox\Client\breakpad.client.windows.handler.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00026456 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox.infinite.win.compiled._driverinstallation.pyd
2016-12-16 07:56 - 2016-11-11 21:37 - 00241104 _____ () C:\Program Files (x86)\Dropbox\Client\_jpegtran.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00020280 _____ () C:\Program Files (x86)\Dropbox\Client\cpuid.compiled._cpuid.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00028616 _____ () C:\Program Files (x86)\Dropbox\Client\win32ts.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00023376 _____ () C:\Program Files (x86)\Dropbox\Client\winscreenshot.compiled._CaptureScreenshot.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00020800 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.iphlpapi._winffi_iphlpapi.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00019776 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winerror._winffi_winerror.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00020800 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.wininet._winffi_wininet.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00350152 _____ () C:\Program Files (x86)\Dropbox\Client\winxpgui.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00022352 _____ () C:\Program Files (x86)\Dropbox\Client\winverifysignature.compiled._VerifySignature.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00024392 _____ () C:\Program Files (x86)\Dropbox\Client\librsyncffi.compiled._librsyncffi.pyd
2016-12-22 14:12 - 2016-11-11 21:35 - 00036296 _____ () C:\Program Files (x86)\Dropbox\Client\librsync.dll
2016-12-22 14:12 - 2016-12-21 19:26 - 00084280 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_sqlite_ext.DLL
2016-12-22 14:12 - 2016-12-21 19:26 - 01826096 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtCore.pyd
2016-12-16 07:56 - 2016-11-11 21:37 - 00083912 _____ () C:\Program Files (x86)\Dropbox\Client\sip.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00531248 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtNetwork.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 03928880 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWidgets.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 01972528 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtGui.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00133424 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKit.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00224056 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKitWidgets.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00207672 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtPrintSupport.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00020288 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.user32._winffi_user32.pyd
2016-12-22 14:12 - 2016-11-11 21:42 - 00017864 _____ () C:\Program Files (x86)\Dropbox\Client\libEGL.dll
2016-12-22 14:12 - 2016-11-11 21:42 - 01631184 _____ () C:\Program Files (x86)\Dropbox\Client\libGLESv2.dll
2016-12-22 14:12 - 2016-12-21 19:26 - 00042808 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebChannel.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00171320 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngineWidgets.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00357680 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQml.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00060880 _____ () C:\Program Files (x86)\Dropbox\Client\win32print.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00024904 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winhttp.compiled._winffi_winhttp.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00546096 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQuick.pyd
2013-11-20 15:17 - 2009-12-18 16:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll
2013-11-20 15:17 - 2009-12-18 16:41 - 00129544 _____ () C:\Program Files (x86)\PHotkey\GFNEX.dll
2013-11-15 16:39 - 2013-09-16 12:20 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

Da befinden sich 7922 mehr Seiten.

IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\123simsen.com -> www.123simsen.com

Da befinden sich 7922 mehr Seiten.

IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\123simsen.com -> www.123simsen.com

Da befinden sich 7922 mehr Seiten.


==================== Hosts Inhalt: ==========================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2013-08-22 14:25 - 2016-12-26 15:12 - 00454135 ____R C:\Windows\system32\Drivers\etc\hosts

127.0.0.1        clients2.google.com
127.0.0.1        v1.ff.avast.com
127.0.0.1        vlcproxy.ff.avast.com
127.0.0.1        down.baidu2016.com
127.0.0.1        123.sogou.com
127.0.0.1        www.czzsyzgm.com
127.0.0.1        www.czzsyzxl.com
127.0.0.1        union.baidu2019.com
127.0.0.1        down.baidu2016.com
127.0.0.1        123.sogou.com
127.0.0.1        www.czzsyzgm.com
127.0.0.1        www.czzsyzxl.com
127.0.0.1        union.baidu2019.com127.0.0.1        www.007guard.com
127.0.0.1        007guard.com
127.0.0.1        008i.com
127.0.0.1        www.008k.com
127.0.0.1        008k.com
127.0.0.1        www.00hq.com
127.0.0.1        00hq.com
127.0.0.1        010402.com
127.0.0.1        www.032439.com
127.0.0.1        032439.com
127.0.0.1        www.0scan.com
127.0.0.1        0scan.com
127.0.0.1        1000gratisproben.com
127.0.0.1        www.1000gratisproben.com
127.0.0.1        1001namen.com
127.0.0.1        www.1001namen.com
127.0.0.1        100888290cs.com
127.0.0.1        www.100888290cs.com

Da befinden sich 15582 zusätzliche Einträge.


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\Control Panel\Desktop\\Wallpaper -> C:\Puh\Puh Privat\Nice Day\nAKED MOUSE\Spaziergang\BILD5294.JPG
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

HKLM\...\StartupApproved\StartupFolder: => "MCtlSvc.lnk"
HKLM\...\StartupApproved\StartupFolder: => "NeroDesktopSwitcher.scf"
HKLM\...\StartupApproved\Run: => "IAStorIcon"
HKLM\...\StartupApproved\Run: => "BTMTrayAgent"
HKLM\...\StartupApproved\Run: => "Nvtmru"
HKLM\...\StartupApproved\Run: => "SynTPEnh"
HKLM\...\StartupApproved\Run: => "RtHDVCpl"
HKLM\...\StartupApproved\Run: => "RtHDVBg_Dolby"
HKLM\...\StartupApproved\Run: => "IgfxTray"
HKLM\...\StartupApproved\Run: => "HotKeysCmds"
HKLM\...\StartupApproved\Run: => "Persistence"
HKLM\...\StartupApproved\Run32: => "CLMLServer_For_P2G8"
HKLM\...\StartupApproved\Run32: => "CLVirtualDrive"
HKLM\...\StartupApproved\Run32: => "RemoteControl10"
HKLM\...\StartupApproved\Run32: => "YouCam Service"
HKLM\...\StartupApproved\Run32: => "PDFPrint"
HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\StartupApproved\Run: => "SpybotPostWindows10UpgradeReInstall"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [vm-monitoring-nb-session] => LPort=139
FirewallRules: [{C6681879-51CB-4FD8-9A84-483DBB792DD9}] => C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{BF03DCCD-DD4D-400A-83DE-6EBD26343BBF}] => LPort=2869
FirewallRules: [{DF5F9400-8B73-4381-B95F-52AF8036BC90}] => LPort=1900
FirewallRules: [{6AE7B4B4-D8EC-4095-9EDE-1D0407493CB4}] => C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{77936D80-6A89-494F-A543-3C0D774614C7}] => C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{8C8323B7-A320-497D-AA70-C0FD492FAAC6}] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
FirewallRules: [{7C57A8A5-6887-4930-B692-5BDA66AD2CE3}] => C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
FirewallRules: [{BC1581EF-EB52-4DB3-806D-6AB1A096F9F0}] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{B090FAC3-34CA-4D99-8374-176423707E40}] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{BD8567CD-18AF-4F3B-9890-47FAD209DC7A}] => C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{AD3D86C8-9D08-4282-B600-06D66D58F91E}] => C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{B1D6920A-FDB1-460D-8785-F074E9A97829}] => C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{5C60FF39-F4AA-45AB-8D65-47390638EE55}] => C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{97D0BC8D-D025-4BD4-B9AB-97DA6D31A164}] => C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{571B4EB1-F5A3-479F-B707-957C19186B6D}] => C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{C8EB4CB1-D30F-4E62-A13B-8B9D04B9CB27}] => C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{ECDACF61-2598-47B3-9446-18AF27FA44EA}] => C:\Program Files (x86)\Nero\Nero Blu-ray Player\Blu-rayPlayer.exe
FirewallRules: [{AF658A1F-622E-4246-9E9F-4386AA84635B}] => C:\Program Files (x86)\Nero\Nero Blu-ray Player\Blu-rayPlayer.exe
FirewallRules: [{F1F82B8E-47E1-4734-B764-1BE0D30FF586}] => C:\Program Files (x86)\Nero\Nero 2015\Nero Burning ROM\StartNBR.exe
FirewallRules: [{FB3533A3-2370-4DFE-83B1-5AA7E5DCC5D6}] => C:\Program Files (x86)\Nero\KM\NMDllHost.exe
FirewallRules: [{896FE7D5-BB83-4ADA-BAE8-190C9C93425A}] => C:\Program Files (x86)\Nero\Nero 2015\Nero Burning ROM\nero.exe
FirewallRules: [{590C04BB-BEBC-4F39-A26E-CA240E6AEABB}] => C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{9226EE8C-D70E-46CB-86C6-FEF3B19528C5}] => C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{5AE195CA-2F53-41A0-9EE8-7EFE42A428B2}] => C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{4393D29C-BCFA-4D99-BDFB-D052C7BABC30}] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
FirewallRules: [{E6BD649F-7312-477E-B04C-F531D47FFFE9}] => C:\Windows\system32\rundll32.exe
FirewallRules: [{DDE35257-478B-4C15-830C-F3BCA8B62E5F}] => C:\Windows\System32\rundll32.exe
FirewallRules: [{16749CA5-9553-44D1-976F-2CA2CD95A67B}] => C:\Windows\System32\rundll32.exe
FirewallRules: [{434BD66E-2F89-474B-A37A-C056D1C7F5CA}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{DBC6CABE-2B06-434E-B577-9497E53E549C}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{A3B7F349-F50C-4684-939B-1D3CACE158F2}] => C:\Windows\System32\rundll32.exe
FirewallRules: [{DEC7CDB3-D197-4AC7-955C-EC896BD4D87A}] => C:\Windows\System32\rundll32.exe

==================== Wiederherstellungspunkte =========================

04-01-2017 08:10:21 Geplanter Prüfpunkt
05-01-2017 13:38:00 AA11

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (01/05/2017 01:42:35 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (01/04/2017 07:15:23 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (01/02/2017 04:35:14 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (12/29/2016 09:04:29 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Explorer.EXE, Version 6.3.9600.18460 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 130c

Startzeit: 01d2620c2e667e36

Endzeit: 0

Anwendungspfad: C:\Windows\Explorer.EXE

Berichts-ID: e14a6ce5-ce01-11e6-82a7-0c54a5f0a527

Vollständiger Name des fehlerhaften Pakets:

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (12/27/2016 10:03:54 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={DE254671-4ECE-4FAA-AE04-9583C6D96084}: Der Benutzer "SYSTEM" hat eine Verbindung mit dem Namen "congstar" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 797.

Error: (12/27/2016 10:01:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ZeroConfigService.exe, Version: 16.6.0.0, Zeitstempel: 0x52585e22
Name des fehlerhaften Moduls: MurocApi.dll, Version: 16.6.0.0, Zeitstempel: 0x52585cf1
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000002bcc5
ID des fehlerhaften Prozesses: 0xbec
Startzeit der fehlerhaften Anwendung: 0x01d26084408bc029
Pfad der fehlerhaften Anwendung: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
Pfad des fehlerhaften Moduls: C:\Program Files\Intel\WiFi\bin\MurocApi.dll
Berichtskennung: 932c00af-cc77-11e6-82a7-0c54a5f0a527
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (12/27/2016 10:00:14 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (12/27/2016 09:55:54 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".

Details:
AddLegacyDriverFiles: Unable to back up image of binary Bytemobile Kernel Network Provider.

System Error:
Das System kann die angegebene Datei nicht finden.
.

Error: (12/27/2016 09:55:54 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".

Details:
AddLegacyDriverFiles: Unable to back up image of binary Bytemobile Boot Time Load Driver.

System Error:
Das System kann die angegebene Datei nicht finden.
.

Error: (12/27/2016 09:55:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: explorer.exe, Version: 6.3.9600.18460, Zeitstempel: 0x57c1b573
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x72ec4220
ID des fehlerhaften Prozesses: 0x18f4
Startzeit der fehlerhaften Anwendung: 0x01d2608394d4b06b
Pfad der fehlerhaften Anwendung: C:\Windows\SysWOW64\explorer.exe
Pfad des fehlerhaften Moduls: unknown
Berichtskennung: d2a03bfe-cc76-11e6-82a6-0c54a5f0a527
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:


Systemfehler:
=============
Error: (01/04/2017 08:43:31 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Defender-Dienst" wurde aufgrund folgenden Fehlers nicht gestartet:
Die digitale Signatur dieser Datei kann nicht überprüft werden. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um böswillige Software aus einer unbekannten Quelle handelt, installiert.

Error: (01/04/2017 07:09:03 PM) (Source: disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR2 gefunden.

Error: (12/30/2016 08:51:03 AM) (Source: disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR10 gefunden.

Error: (12/30/2016 08:51:03 AM) (Source: disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR10 gefunden.

Error: (12/30/2016 08:51:02 AM) (Source: disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR10 gefunden.

Error: (12/30/2016 08:51:02 AM) (Source: disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR10 gefunden.

Error: (12/30/2016 08:51:01 AM) (Source: disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR10 gefunden.

Error: (12/28/2016 07:42:17 PM) (Source: disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR3 gefunden.

Error: (12/27/2016 10:01:09 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (12/27/2016 09:58:49 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst gpsvc erreicht.


CodeIntegrity:
===================================
  Date: 2017-01-04 20:43:31.246
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-12-26 17:22:16.672
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-12-26 16:34:58.481
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-12-26 16:13:53.405
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-12-26 16:12:21.560
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-12-25 22:41:42.989
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-12-25 22:41:42.739
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-12-25 22:41:42.489
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-12-25 22:41:41.942
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-12-25 22:41:41.692
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Speicherinformationen ===========================

Prozessor: Intel(R) Core(TM) i3-4000M CPU @ 2.40GHz
Prozentuale Nutzung des RAM: 28%
Installierter physikalischer RAM: 8100.68 MB
Verfügbarer physikalischer RAM: 5791.93 MB
Summe virtueller Speicher: 9380.68 MB
Verfügbarer virtueller Speicher: 7330.9 MB

==================== Laufwerke ================================

Drive c: (Boot) (Fixed) (Total:869.8 GB) (Free:437.14 GB) NTFS
Drive d: (Recover) (Fixed) (Total:60 GB) (Free:42.06 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: F2E9FFFD)

Partition: GPT.

==================== Ende von Addition.txt ============================

cosinus 05.01.2017 13:59
1. Schritt: Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers




2. Schritt: Kaspersky TDSS-Killer

Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.




Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

Schnuckibaer 05.01.2017 15:06
Hier das Ergebnis nach dem ersten Scan:
Code:
Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org

Database version:
  main:    v2017.01.05.04
  rootkit: v2016.11.20.01

Windows 8.1 x64 NTFS
Internet Explorer 11.0.9600.18538
Denise :: WOMBAT [administrator]

05.01.2017 14:11:24
mbar-log-2017-01-05 (14-11-24).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 328070
Time elapsed: 20 minute(s), 2 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 2
HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{30894E26-3DFA-47E8-95C5-D7AC45A62494} (Trojan.Agent.Generic) -> Delete on reboot. [bf8977014f5951e59b32ddca30d03bc5]
HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\93066184d64t1179994 (Trojan.Agent.Generic) -> Delete on reboot. [15331068c3e561d5b9483f68817fcb35]

Registry Values Detected: 1
HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{30894E26-3DFA-47E8-95C5-D7AC45A62494}|Path (Trojan.Agent.Generic) -> Data: \93066184d64t1179994 -> Delete on reboot. [bf8977014f5951e59b32ddca30d03bc5]

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
und nach dem zweiten:
Code:
Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org

Database version:
  main:    v2017.01.05.04
  rootkit: v2016.11.20.01

Windows 8.1 x64 NTFS
Internet Explorer 11.0.9600.18538
Denise :: WOMBAT [administrator]

05.01.2017 14:36:00
mbar-log-2017-01-05 (14-36-00).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 327606
Time elapsed: 17 minute(s), 48 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

Schnuckibaer 05.01.2017 15:07
Hier TDSS Killer mit einem Fund:

Code:
14:58:41.0092 0x067c  TDSS rootkit removing tool 3.1.0.12 Nov  7 2016 07:10:01
14:58:41.0092 0x067c  UEFI system
14:58:48.0964 0x067c  ============================================================
14:58:48.0964 0x067c  Current date / time: 2017/01/05 14:58:48.0964
14:58:48.0965 0x067c  SystemInfo:
14:58:48.0965 0x067c 
14:58:48.0965 0x067c  OS Version: 6.3.9600 ServicePack: 0.0
14:58:48.0965 0x067c  Product type: Workstation
14:58:48.0965 0x067c  ComputerName: WOMBAT
14:58:48.0965 0x067c  UserName: Denise
14:58:48.0965 0x067c  Windows directory: C:\Windows
14:58:48.0965 0x067c  System windows directory: C:\Windows
14:58:48.0965 0x067c  Running under WOW64
14:58:48.0965 0x067c  Processor architecture: Intel x64
14:58:48.0965 0x067c  Number of processors: 4
14:58:48.0965 0x067c  Page size: 0x1000
14:58:48.0965 0x067c  Boot type: Normal boot
14:58:48.0965 0x067c  CodeIntegrityOptions = 0x00000001
14:58:48.0965 0x067c  ============================================================
14:58:49.0075 0x067c  KLMD registered as C:\Windows\system32\drivers\01921924.sys
14:58:49.0075 0x067c  KLMD ARK init status: drvProperties = 0xFFF00, osBuild = 9600.18505, osProperties = 0x19
14:58:49.0374 0x067c  System UUID: {B5CD84BB-1583-5DCC-280C-944CC4B41974}
14:58:50.0476 0x067c  Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
14:58:50.0482 0x067c  ============================================================
14:58:50.0482 0x067c  \Device\Harddisk0\DR0:
14:58:50.0483 0x067c  GPT partitions:
14:58:50.0509 0x067c  \Device\Harddisk0\DR0\Partition1: GPT, TypeGUID: {DE94BBA4-06D1-4D40-A16A-BFD50179D6AC}, UniqueGUID: {389581E1-D835-4AA9-8CE9-C514391C7D65}, Name: Basic data partition, StartLBA 0x800, BlocksNum 0xF9800
14:58:50.0509 0x067c  \Device\Harddisk0\DR0\Partition2: GPT, TypeGUID: {C12A7328-F81F-11D2-BA4B-00A0C93EC93B}, UniqueGUID: {A4090D79-AAA5-4089-8FB7-52B06B75CABA}, Name: EFI system partition, StartLBA 0xFA000, BlocksNum 0x32000
14:58:50.0510 0x067c  \Device\Harddisk0\DR0\Partition3: GPT, TypeGUID: {E3C9E316-0B5C-4DB8-817D-F92DF00215AE}, UniqueGUID: {E21738F1-7B77-4D98-85F3-01DE579AA0B7}, Name: Microsoft reserved partition, StartLBA 0x12C000, BlocksNum 0x40000
14:58:50.0510 0x067c  \Device\Harddisk0\DR0\Partition4: GPT, TypeGUID: {8D7F0CC6-879E-47F6-A767-0ED8FD3B0659}, UniqueGUID: {B2121636-3377-4D0E-AFD4-DF94D7730988}, Name: Basic data partition, StartLBA 0x16C000, BlocksNum 0x200000
14:58:50.0510 0x067c  \Device\Harddisk0\DR0\Partition5: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {4A19F411-DF55-4095-8DFF-78F348AF0978}, Name: Basic data partition, StartLBA 0x36C000, BlocksNum 0x6CB9A000
14:58:50.0510 0x067c  \Device\Harddisk0\DR0\Partition6: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {17C99BB3-1BD0-42B3-A05F-CB0AFDF29D7B}, Name: Basic data partition, StartLBA 0x6CF06000, BlocksNum 0x77FE000
14:58:50.0510 0x067c  MBR partitions:
14:58:50.0510 0x067c  ============================================================
14:58:50.0517 0x067c  C: <-> \Device\Harddisk0\DR0\Partition5
14:58:50.0519 0x067c  D: <-> \Device\Harddisk0\DR0\Partition6
14:58:50.0519 0x067c  ============================================================
14:58:50.0519 0x067c  Initialize success
14:58:50.0519 0x067c  ============================================================
14:59:43.0279 0x096c  ============================================================
14:59:43.0279 0x096c  Scan started
14:59:43.0279 0x096c  Mode: Manual; SigCheck; TDLFS;
14:59:43.0279 0x096c  ============================================================
14:59:43.0279 0x096c  KSN ping started
14:59:43.0529 0x096c  KSN ping finished: true
14:59:45.0544 0x096c  ================ Scan system memory ========================
14:59:45.0544 0x096c  System memory - ok
14:59:45.0544 0x096c  ================ Scan services =============================
14:59:45.0748 0x096c  [ E1832BD9FD7E0FC2DC9FA5935DE3E8C1, 41FF7418887AFC8B9C96EF21C5950DD342CC9E3C0D87AFD60A05B988C1D6CC23 ] 1394ohci        C:\Windows\System32\drivers\1394ohci.sys
14:59:45.0888 0x096c  1394ohci - ok
14:59:45.0919 0x096c  [ AD508A1A46EC21B740AB31C28EFDFDB1, 9B1046CF0B80723149BD359B55CC0B8B3ABBEAA9038469F542A4C345C503FB02 ] 3ware          C:\Windows\system32\drivers\3ware.sys
14:59:45.0951 0x096c  3ware - ok
14:59:46.0060 0x096c  [ E796AE43DDD1844281DB4D57294D17C0, 21AE69615044A96041E46476BE814B52C22624B6C7EA6BFC77BB64F69C3C21F5 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
14:59:46.0185 0x096c  ACPI - ok
14:59:46.0201 0x096c  [ AC8279D229398BCF05C3154ADCA86813, 083E86CBE53244D24C334DB1511C77025133AE7875191845764B890A8CA5AFA9 ] acpiex          C:\Windows\system32\Drivers\acpiex.sys
14:59:46.0232 0x096c  acpiex - ok
14:59:46.0232 0x096c  [ A8970D9BF23CD309E0403978A1B58F3F, 9946C8477104EEC7DB197E2222F9905307F101C398CCED4B5FD0F86A5622C791 ] acpipagr        C:\Windows\System32\drivers\acpipagr.sys
14:59:46.0294 0x096c  acpipagr - ok
14:59:46.0294 0x096c  [ 111A89C99C5B4F1A7BCE5F643DD86F65, 41A2E49FF443927D05F7EF638518108227852984E68D4663C8761178C0B84A45 ] AcpiPmi        C:\Windows\System32\drivers\acpipmi.sys
14:59:46.0357 0x096c  AcpiPmi - ok
14:59:46.0357 0x096c  [ 5758387D68A20AE7D3245011B07E36E7, 77832E200E8B0D259552F6F60FE454A887E3EBBB9EA2F3590E6645289A04E293 ] acpitime        C:\Windows\System32\drivers\acpitime.sys
14:59:46.0404 0x096c  acpitime - ok
14:59:46.0451 0x096c  [ C92B0A0957ACAD3CEEF502A2CA10ACB8, 78BF46318B69D9479ECDC83446DD8D454AA2A9A9D94B33C5FC68933DB18AFA3B ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
14:59:46.0466 0x096c  AdobeARMservice - ok
14:59:46.0529 0x096c  [ 7C1FDF1B48298CBA7CE4BDD4978951AD, 80F4D536E1231B30E836F72ADC8814AE6AA9FEC573FB5F3F965FAC8ABCCAF0F8 ] ADP80XX        C:\Windows\system32\drivers\ADP80XX.SYS
14:59:46.0607 0x096c  ADP80XX - ok
14:59:46.0638 0x096c  [ BCD58DACAA1EAAADC115EDD940478F6D, F31613F583C302F62A00E6766B031531C9E193CAED563689B178BA257715B992 ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
14:59:46.0716 0x096c  AeLookupSvc - ok
14:59:46.0763 0x096c  [ A460C3AF3755A2A79A3C8EFE72E147B5, 62CEA85DA53D86D3E7B5D79F94095C6126FFF3DEE1427BBF3DEF5EA366B4513B ] AFD            C:\Windows\system32\drivers\afd.sys
14:59:46.0873 0x096c  AFD - ok
14:59:46.0919 0x096c  [ 7DFAEBA9AD62D20102B576D5CAC45EC8, 9FA5207335303D1E8E9A3C9E1FB82C09AD21B04382F69D777A67E48EE91D2093 ] agp440          C:\Windows\system32\drivers\agp440.sys
14:59:46.0935 0x096c  agp440 - ok
14:59:46.0966 0x096c  [ FE14D249D39368CA62D8DA6BC94AC694, E1036E22BFBD3750FD2D3DA6AB939B2DD54E824F4BD3E6539EF0E45AB5453DD1 ] ahcache        C:\Windows\system32\DRIVERS\ahcache.sys
14:59:47.0013 0x096c  ahcache - ok
14:59:47.0044 0x096c  [ 14A45BE6F5678339F0EC5752D9849410, DD0F60E96FAC68FBD5B86382E541408C613BD0F871D0E0A1EF9AB6E7B26E545C ] ALG            C:\Windows\System32\alg.exe
14:59:47.0107 0x096c  ALG - ok
14:59:47.0123 0x096c  [ 7589DE749DB6F71A68489DCE04158729, 5F35EDD50737985595C9D6703237CA2ADE49AA5443331020899698EB5114A0FB ] AmdK8          C:\Windows\System32\drivers\amdk8.sys
14:59:47.0185 0x096c  AmdK8 - ok
14:59:47.0201 0x096c  [ B46D2D89AFF8A9490FA8C98C7A5616E3, BE0765B5423B690E0F097FECD9717FAA95BFDFFDC6CF1B93DE5A19A1B7797879 ] AmdPPM          C:\Windows\System32\drivers\amdppm.sys
14:59:47.0248 0x096c  AmdPPM - ok
14:59:47.0263 0x096c  [ D2BF2F94A47D332814910FD47C6BBCD2, FE273D77D119D958676E1197D9EA7B008E3B05C6192B1962A81D4223ED204C35 ] amdsata        C:\Windows\system32\drivers\amdsata.sys
14:59:47.0294 0x096c  amdsata - ok
14:59:47.0310 0x096c  [ A8E04943C7BBA7219AA50400272C3C6E, 794C0BD12DF0392654E9A37AE4A24B5BE2D83F1F24F74DD48A1A0BF3AB8B1FF8 ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys
14:59:47.0357 0x096c  amdsbs - ok
14:59:47.0373 0x096c  [ CEA5F4F27CFC08E3A44D576811B35F50, 89DF64B81BD109BAABAE93A4603C1617241219F38DDAF325EFE6BD35FF6FD717 ] amdxata        C:\Windows\system32\drivers\amdxata.sys
14:59:47.0388 0x096c  amdxata - ok
14:59:47.0419 0x096c  [ 4DE4BE679205B3A712562507AEE75227, 1C40F14A2BFFFB8E9646B57419D9F810A86D0DCD94F9DE9D9851D498F86F343E ] AMPPAL          C:\Windows\System32\drivers\AMPPAL.sys
14:59:47.0451 0x096c  AMPPAL - ok
14:59:47.0466 0x096c  [ 415DD71628795197F7AFC176CBADC74E, 5F0359053A6CD6EE239139E0E6F46E1FA9A73F017C0CE9B7BC052216B2C846EC ] AppID          C:\Windows\system32\drivers\appid.sys
14:59:47.0544 0x096c  AppID - ok
14:59:47.0560 0x096c  [ 88358135810B9DFD830A9D3A8C3D149A, DF914DA3828EE2310895D156342E3B3DF5E8C6F6F9B851C359E82A1F48180D4B ] AppIDSvc        C:\Windows\System32\appidsvc.dll
14:59:47.0591 0x096c  AppIDSvc - ok
14:59:47.0607 0x096c  [ 734622FBA766DBD65B1803549B24A04A, 3B6872B87A60D4DA265D3B8AB0561A929CFE2C097419183E93D3843422363C89 ] Appinfo        C:\Windows\System32\appinfo.dll
14:59:47.0701 0x096c  Appinfo - ok
14:59:47.0732 0x096c  [ 35E28923A23ADABAA5A1B43256D0AB58, A5F3AF8BBEE58B2165BAFACC5FF8B167B55B020998D3D1565C2229ED8753B269 ] AppReadiness    C:\Windows\system32\AppReadiness.dll
14:59:47.0826 0x096c  AppReadiness - ok
14:59:47.0951 0x096c  [ E0F846ADE7DED88981D0908DE56FF160, D8F536438091878724A5004849306ADFB96A2778A9D958ED3DCC0CD9E35160BB ] AppXSvc        C:\Windows\system32\appxdeploymentserver.dll
14:59:48.0076 0x096c  AppXSvc - ok
14:59:48.0091 0x096c  [ 65045784366F7EC5FB4E71BCF923187B, 53C215C64FF12E44B097F7CB88E8482438CE0ACBD3C68D8FD38BA0D0D8747FAA ] arcsas          C:\Windows\system32\drivers\arcsas.sys
14:59:48.0123 0x096c  arcsas - ok
14:59:48.0138 0x096c  [ 3DB7721F06BC2FEDB25029EA23AB27DA, 221861148C66FE53E4D6EE49C6E656479AB5804A2D348A280A1CD8093E8AB788 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
14:59:48.0201 0x096c  AsyncMac - ok
14:59:48.0216 0x096c  [ 74B14192CF79A72F7536B27CB8814FBD, 0CF6BBB63FFE0C12777664D80B2797923844C8392D0FD81D7962EE5EE2C3C3D9 ] atapi          C:\Windows\system32\drivers\atapi.sys
14:59:48.0232 0x096c  atapi - ok
14:59:48.0279 0x096c  [ 431FE56F5A2F5937994CB2DA330B47DB, E5AED551529A21494114959251FDF566802DD6D9B9D86A937A0EECE53338CAC7 ] AudioEndpointBuilder C:\Windows\System32\AudioEndpointBuilder.dll
14:59:48.0373 0x096c  AudioEndpointBuilder - ok
14:59:48.0435 0x096c  [ 0F03CC00645D7F841879A048787D6AC7, 3ECD2486157469F2EDB63D4868338D1445F2909153DF0AFFE432083730EEE3F5 ] Audiosrv        C:\Windows\System32\Audiosrv.dll
14:59:48.0529 0x096c  Audiosrv - ok
14:59:48.0544 0x096c  [ 3C6ED74AF41DD1A5585CE5EF3D00915F, A742F576407776634E5A8E49C60023FFDF395DE0B2DE36662A23F85B79405ED2 ] AxInstSV        C:\Windows\System32\AxInstSV.dll
14:59:48.0591 0x096c  AxInstSV - ok
14:59:48.0638 0x096c  [ A4A73F631FE2AA2826FBE4A399B04DEF, 973AACE8DC8DA669D0DF20F17EFDEEABB90AA046AC980948D16A62D39A606A79 ] b06bdrv        C:\Windows\system32\drivers\bxvbda.sys
14:59:48.0701 0x096c  b06bdrv - ok
14:59:48.0716 0x096c  [ 8CC7F7E4AFCBA605921B137ED7992C68, 71406E6D6E9964740A6D90B05329D5492BB90AF40E0630CF2FBF4BA4BA14F2DD ] BasicDisplay    C:\Windows\System32\drivers\BasicDisplay.sys
14:59:48.0779 0x096c  BasicDisplay - ok
14:59:48.0794 0x096c  [ 38A82F4EE8C416A6744B6D30381ED768, 9EAAE5F43BA09359130AC04B1DCA0F5D4DF32ED89C02DC5CEB640918948847F7 ] BasicRender    C:\Windows\System32\drivers\BasicRender.sys
14:59:48.0841 0x096c  BasicRender - ok
14:59:48.0873 0x096c  [ C1ABB0F7E3BEA48A0417BDF6FF14AB21, 1CAC63A1A0FB9855A27EE977794576A860F6650C9EF7667FFB27F2A2FF721857 ] bcmfn2          C:\Windows\System32\drivers\bcmfn2.sys
14:59:48.0888 0x096c  bcmfn2 - ok
14:59:48.0904 0x096c  [ 174394F4EF93C117BF7BE3878046A1B1, D58E868342D1DAFC4B04384A3713F729DF07F408AA6AE4762E6A4244F976526A ] BDESVC          C:\Windows\System32\bdesvc.dll
14:59:48.0982 0x096c  BDESVC - ok
14:59:49.0013 0x096c  [ EC19013E4CF87609534165DF897274D6, 8ED45537CF2D58D759A587CCBFDADD5580C7447B0C3B172CF19ECC7585E073FC ] Beep            C:\Windows\system32\drivers\Beep.sys
14:59:49.0060 0x096c  Beep - ok
14:59:49.0123 0x096c  [ 5059D93764340D4EAEDF49C47133118F, 26C5779469E04BEAFD290B619CA355648F3911C66D41B22D2C3DCA909FCA0F6E ] BFE            C:\Windows\System32\bfe.dll
14:59:49.0263 0x096c  BFE - ok
14:59:49.0326 0x096c  [ 48554994279BFE17A3D2B00076D0CB1A, 6521B1EC0BC6B01F63976370D89FE7DC2E7404899F68B6FAC37A9173B9C5D489 ] BITS            C:\Windows\System32\qmgr.dll
14:59:49.0466 0x096c  BITS - ok
14:59:49.0560 0x096c  [ 4D87518BA68C308299441337C55F5427, AE46F847EE605213A3AE9BEFE5EB0B7B8D877340EA1A6CF9EF5683A02ECFE399 ] Bluetooth Device Monitor C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
14:59:49.0638 0x096c  Bluetooth Device Monitor - ok
14:59:49.0716 0x096c  [ 19786E2114E2FCB4EAA30808E9D4FB9A, FCBD15EA7CB0B22DA9ABFACF95DE877042201C85EBC219F5204E12F76E8DBC09 ] Bluetooth OBEX Service C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
14:59:49.0810 0x096c  Bluetooth OBEX Service - ok
14:59:49.0826 0x096c  [ 4938A9236300A356F97E378491EE4844, 60D892960D48EEF48F8EC4DE4F174EBD0BC0E7B28B6D8723D554CD1979EB55B4 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
14:59:49.0888 0x096c  bowser - ok
14:59:49.0935 0x096c  [ FA601515FF2B59F25FDD8EDB1D2A1104, 21DFB53241F8E880F7546B9ADF38F47D6AD0782EC7F8F0284ED69DE7CEF7DCB9 ] BrokerInfrastructure C:\Windows\System32\bisrv.dll
14:59:50.0013 0x096c  BrokerInfrastructure - ok
14:59:50.0029 0x096c  [ BC111AADACD0BF59D56547461D13AB6E, 91E3619930C29EE4B2683683888BA7EE3CF6B1DDB0C19A14E0880470CBE40EF4 ] Browser        C:\Windows\System32\browser.dll
14:59:50.0076 0x096c  Browser - ok
14:59:50.0107 0x096c  [ A8F23D453A424FF4DE04989C4727ECC7, AE4A9081395C7379F1C947EF8243F7609F90C843E086B8E77E1A2C06E36D4381 ] BthAvrcpTg      C:\Windows\System32\drivers\BthAvrcpTg.sys
14:59:50.0154 0x096c  BthAvrcpTg - ok
14:59:50.0154 0x096c  [ 1104A31260CCF4318C884E0AE6C513BF, A8F83B558944DEF0F84414A11DC3CB90C3A92377B46760EC0A9B8BC22FB0D5C7 ] BthEnum        C:\Windows\System32\drivers\BthEnum.sys
14:59:50.0201 0x096c  BthEnum - ok
14:59:50.0216 0x096c  [ 272A62B660A48AEF366F8A1836CED19F, 78EFAC6B1B2313482329BBFFBF0DDA6462BD88E5BE3C817C5E8E0EAF3074C925 ] BthHFEnum      C:\Windows\System32\drivers\bthhfenum.sys
14:59:50.0279 0x096c  BthHFEnum - ok
14:59:50.0294 0x096c  [ 71FE2A48E4C93DDB9798C024880B6C07, 8E93DE29C61A5FA64216231228CB3C4A1A693FE87CAA2C070BCAD7BE2D8ED000 ] bthhfhid        C:\Windows\System32\drivers\BthHFHid.sys
14:59:50.0341 0x096c  bthhfhid - ok
14:59:50.0357 0x096c  [ 9307A4B743D277C499CDA8E19E5687AC, 7A01989EC3D54581F292BDEDC9B9445F2ABD50165102617E3089BDD061C63A19 ] BthHFSrv        C:\Windows\System32\BthHFSrv.dll
14:59:50.0419 0x096c  BthHFSrv - ok
14:59:50.0466 0x096c  [ D30C67473A2E229662D21F27EAA9AAA5, D009C4836B0DFE963D8E3DEEDE611068838F2BBCAB146E6D70692FAB838E11F1 ] BthLEEnum      C:\Windows\System32\drivers\BthLEEnum.sys
14:59:50.0544 0x096c  BthLEEnum - ok
14:59:50.0544 0x096c  [ 07E33226AD218A2A162662A05CAFB52F, 0AC3D8B79EDA6DA232FA4E1CAF6592420A9EDE96350D1F0504C2434261684F0B ] BTHMODEM        C:\Windows\System32\drivers\bthmodem.sys
14:59:50.0591 0x096c  BTHMODEM - ok
14:59:50.0607 0x096c  [ FEA8FC81431AD93F44D5FBFBBF096AA7, C0581DF6B2AD24836604B083F4866F93A3F4D9091D382029948A5E6221EDF788 ] BthPan          C:\Windows\System32\drivers\bthpan.sys
14:59:50.0669 0x096c  BthPan - ok
14:59:50.0763 0x096c  [ 0CC00ADC1B84C93FB46E1A0974E956E1, 64C759244651B916901F4D0C82C3D6034532A20714A72FD26FC9D050B99E230B ] BTHPORT        C:\Windows\System32\Drivers\BTHport.sys
14:59:50.0873 0x096c  BTHPORT - ok
14:59:50.0904 0x096c  [ 043A0F37631BF453F16D478B71320F46, C368296B802984F438852927B8A40EA3F4205724A05828F3173F08EC17228356 ] bthserv        C:\Windows\system32\bthserv.dll
14:59:50.0951 0x096c  bthserv - ok
14:59:50.0951 0x096c  [ 08EA90955AED2D959EE67DF6EDF0E2B6, 0A70AA67E5DD24C473C66A570C0FEBA9D398A0F0AD8386FE05D01C4D16346968 ] BTHUSB          C:\Windows\System32\Drivers\BTHUSB.sys
14:59:50.0998 0x096c  BTHUSB - ok
14:59:51.0013 0x096c  [ 4428C299BE7B9841ECFA82044B69FA6A, F8AB607D6CACBF2DDE3C392F9756B9F32CB99664A75F3140365CB916450660EC ] btmaux          C:\Windows\system32\DRIVERS\btmaux.sys
14:59:51.0029 0x096c  btmaux - ok
14:59:51.0107 0x096c  [ 7B31A8A9DC95B3634D896FD0F2814F19, 8FD5FBC61968F4BB8C2BAD0D432D5B86DCFED38CCF6F559F9EFB71AADD25474F ] btmhsf          C:\Windows\system32\DRIVERS\btmhsf.sys
14:59:51.0185 0x096c  btmhsf - ok
14:59:51.0216 0x096c  [ 2FA6510E33F7DEFEC03658B74101A9B9, 61C8C8E3F09B427711464C974EE22E1E01C48E10DB54A4EC9901F482FC36C978 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
14:59:51.0263 0x096c  cdfs - ok
14:59:51.0294 0x096c  [ C6796EA22B513E3457514D92DCDB1A3D, 2B893F3950C6B913B934C2089B69F3B0B77F229AE1820907E598455CBB78139C ] cdrom          C:\Windows\System32\drivers\cdrom.sys
14:59:51.0326 0x096c  cdrom - ok
14:59:51.0341 0x096c  [ 41C0D7B1A6D4AD119BA6AC0487EA5C8E, 516C2B34BA7507D0DA4148B4ABC0A8C36286570D4EA5C60B28647B1249C15018 ] CertPropSvc    C:\Windows\System32\certprop.dll
14:59:51.0419 0x096c  CertPropSvc - ok
14:59:51.0435 0x096c  [ BE9936EDD3267FAAFF94A7835867F00B, 3CEEF2377D45ED38C7CD3CE4C746EC5EA7277EFEC728A5438F0EF5F62FC7C859 ] circlass        C:\Windows\System32\drivers\circlass.sys
14:59:51.0482 0x096c  circlass - ok
14:59:51.0513 0x096c  [ 9DA497AEAF35AA7BF7710132FC2A9906, D38DF749222BD0B6E8E6442CC79D56CF827A1430ACAB4F85F7FC469DD31A211C ] CLFS            C:\Windows\system32\drivers\CLFS.sys
14:59:51.0560 0x096c  CLFS - ok
14:59:51.0763 0x096c  [ 50CB1E82E5E28EC6ED27CC26DFC064B0, C95D5E09F6362240D0077BD469C14868F20A1B0F96C1DF29A9A211C3096CF5FA ] ClickToRunSvc  C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
14:59:51.0966 0x096c  ClickToRunSvc - ok
14:59:52.0013 0x096c  [ 3E76A1547F2448BCEE3D2F4AE3931AB5, 31B41723FAA4210A86B1AE02D6C052BD8B738C4B89FB0177C1AE997D24BA5B8C ] CLVirtualDrive  C:\Windows\system32\DRIVERS\CLVirtualDrive.sys
14:59:52.0029 0x096c  CLVirtualDrive - ok
14:59:52.0029 0x096c  [ 39F71BF21E7F8EBE9B4810BC95EE26D6, 6134013F918D41A1AA8C814217A272F2C428FA3FE97DB66501FA50A488B0C991 ] clwvd          C:\Windows\system32\DRIVERS\clwvd.sys
14:59:52.0044 0x096c  clwvd - ok
14:59:52.0060 0x096c  [ EF6EF85DADC3184A10D8F2F7159973CB, 42FCB286CED95A5DEBC5C0C894FCBC4818A2C818BB71087142FB51A08A0BE96B ] CmBatt          C:\Windows\System32\drivers\CmBatt.sys
14:59:52.0091 0x096c  CmBatt - ok
14:59:52.0123 0x096c  [ EFC79D3224D19FD926FFEA0A24729FEF, 41B0B41F7270C82691453679E03194845B9AF08C28800BF39D3CEB7CB1530BB8 ] CNG            C:\Windows\system32\Drivers\cng.sys
14:59:52.0169 0x096c  CNG - ok
14:59:52.0185 0x096c  [ 03AAED827C36F35D70900558B8274905, 8E44A23C6013FFAE7769F99CAA3B1D6288DE00A38937F9056903AC265B503AFA ] CompositeBus    C:\Windows\System32\drivers\CompositeBus.sys
14:59:52.0232 0x096c  CompositeBus - ok
14:59:52.0232 0x096c  COMSysApp - ok
14:59:52.0248 0x096c  [ A1FF7DFBFBE164CF92603C651D304DD2, 470ACE5A75E64FC62C950037201199857E974803625DC73BEDBCF6FA4DDD496C ] condrv          C:\Windows\system32\drivers\condrv.sys
14:59:52.0294 0x096c  condrv - ok
14:59:52.0419 0x096c  [ 194A042EE99B276A05A8006D49A59546, A23383CE0875470A7496031E6479F16BD67E4C92448B4D7A1946011A34606005 ] cphs            C:\Windows\SysWow64\IntelCpHeciSvc.exe
14:59:52.0451 0x096c  cphs - ok
14:59:52.0482 0x096c  [ 6324F0D18FB52833BA64BC828E29054C, 04118FA1BDFC512F76E4A81FEF34C78B6BD98429DB1D65123B6802B4A1E30584 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
14:59:52.0560 0x096c  CryptSvc - ok
14:59:52.0638 0x096c  [ 9FF6436D65CD8C798691373E28FBFB3B, 7A9ACD14679FB82E71EF4C47E43DAD931EC4FD727A5656AF8A3CC3B95D67EB5B ] CyberLink PowerDVD 10 MS Monitor Service C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
14:59:52.0654 0x096c  CyberLink PowerDVD 10 MS Monitor Service - ok
14:59:52.0685 0x096c  [ 06B5C625CB915E9A7A1F08A43E332FA1, 66F0BFE088B44ED3D36E62DC05200CD09F135FF63C447846C603D6246FABB9BE ] CyberLink PowerDVD 10 MS Service C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
14:59:52.0716 0x096c  CyberLink PowerDVD 10 MS Service - ok
14:59:52.0748 0x096c  [ 315BA4BC19316D72B2E037534E048B93, 69613635DB23E6A935673B1025C2010ED3E195473D25368CF74234C4C36910BE ] dam            C:\Windows\system32\drivers\dam.sys
14:59:52.0763 0x096c  dam - ok
14:59:52.0795 0x096c  [ A1F58FFF448E4099297D6EE0641D4D0E, 47839789332AAF8861F7731BF2D3FBB5E0991EA0D0B457BB4C8C1784F76C73DC ] dbupdate        C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
14:59:52.0826 0x096c  dbupdate - ok
14:59:52.0841 0x096c  [ A1F58FFF448E4099297D6EE0641D4D0E, 47839789332AAF8861F7731BF2D3FBB5E0991EA0D0B457BB4C8C1784F76C73DC ] dbupdatem      C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
14:59:52.0873 0x096c  dbupdatem - ok
14:59:52.0873 0x096c  dbx - ok
14:59:52.0888 0x096c  [ BC8C3896575B06303564265742142775, 38F64F215755E410F69F5BD88FCE6011093665F4C29DEE60A70632221D0C2BB3 ] DbxSvc          C:\Windows\system32\DbxSvc.exe
14:59:52.0919 0x096c  DbxSvc - ok
14:59:52.0982 0x096c  [ 7830CEA509693DE0817DF2F3F2D80E89, 7B1786CD225E2D6BCFA484D0BFB81DD162D5713EAEC80C53317CC6950E3D17F3 ] DcomLaunch      C:\Windows\system32\rpcss.dll
14:59:53.0107 0x096c  DcomLaunch - ok
14:59:53.0138 0x096c  [ 95E1ABFB27F8A62ED764805775F0D2F3, 692865DA60C93481E01592883678B2C51FD9AC9A835DFB00A8E3F2DFEE7AB0ED ] defragsvc      C:\Windows\System32\defragsvc.dll
14:59:53.0232 0x096c  defragsvc - ok
14:59:53.0279 0x096c  [ FF086DEF5995558CCB1B5AAC2110195D, CED52FF01F9247BFDAFC5C7EFC538F8638146ED715574A422496EE0F846CB079 ] DeviceAssociationService C:\Windows\system32\das.dll
14:59:53.0341 0x096c  DeviceAssociationService - ok
14:59:53.0357 0x096c  [ 2C02AFF8383D893F8DBEB07A84F6E77C, 7CC34BAC67E2988E3D16DD6EB6F6785CD2460E3EF7FBD0BD5F86E49793BD473E ] DeviceInstall  C:\Windows\system32\umpnpmgr.dll
14:59:53.0419 0x096c  DeviceInstall - ok
14:59:53.0451 0x096c  [ FBFF94FC1FE0699A6BC5ACE270AB9EA1, 7D67E7BE539D9D515A1A6B9282C72114310E874DD1FE51E71F002DBB0E1439FB ] Dfsc            C:\Windows\system32\Drivers\dfsc.sys
14:59:53.0498 0x096c  Dfsc - ok
14:59:53.0513 0x096c  [ 9593475FBC857A05D93BFF4FA7323C2B, D2A958AF5EFDC6136A6ABB7F8D5FE1F84C967E79BEA96C5BE3661A0145DEB907 ] dg_ssudbus      C:\Windows\system32\DRIVERS\ssudbus.sys
14:59:53.0544 0x096c  dg_ssudbus - ok
14:59:53.0591 0x096c  [ 3EEAADA3125431980E5804ED7143458A, 381E12C83E3211C255B321D35536F4049D67E31061F8D82155E4D4509E97F43D ] Dhcp            C:\Windows\system32\dhcpcore.dll
14:59:53.0654 0x096c  Dhcp - ok
14:59:53.0794 0x096c  [ 0AC9F83A5508935DE89C447473085EEA, 223782B17BACEFB0A663EB13514B68B919C95EF641CDDA7AC30CB239BC4307EC ] DiagTrack      C:\Windows\system32\diagtrack.dll
14:59:53.0951 0x096c  DiagTrack - ok
14:59:53.0982 0x096c  [ 8B1E62881D5AC68E673CD94B136B34AC, A0C50F17041E43AC07B67A74F2C408820316201439F47CDEA37A4F5891CC0E6F ] disk            C:\Windows\system32\drivers\disk.sys
14:59:54.0013 0x096c  disk - ok
14:59:54.0044 0x096c  [ EB70A894708D1BC176AFD690FF06085F, 0DD2A97F5E1B38D1F7C0D44E50F09EA222B18B3B074CC9C8CD25A7526CB1A112 ] dmvsc          C:\Windows\System32\drivers\dmvsc.sys
14:59:54.0091 0x096c  dmvsc - ok
14:59:54.0123 0x096c  [ 561CBB163EB3C8221D9B1D7D1E5CA477, 4D235E73CC127769A257B31A92180552276EC8DDD991F1106815FADEF385E72D ] Dnscache        C:\Windows\System32\dnsrslvr.dll
14:59:54.0201 0x096c  Dnscache - ok
14:59:54.0216 0x096c  [ 811EACBCC7C51A03AE11F13CC27B2AB6, FAB94F84950FFB7D3649BAFB8D96D43B880D7FDE8D5B879472AE26C4BC4203B0 ] dot3svc        C:\Windows\System32\dot3svc.dll
14:59:54.0326 0x096c  dot3svc - ok
14:59:54.0341 0x096c  [ B99CB575986789A93A683DCF292A43A1, 6ACEA31C723B74003E106FC8303542FCC6DBC4952B6B523F6590D006BE57238D ] DPS            C:\Windows\system32\dps.dll
14:59:54.0388 0x096c  DPS - ok
14:59:54.0419 0x096c  [ 00C594D5A1DBD22AD8B2902B9F6EFF94, 2920D62B5F7C49A8AFA80FCAD1E834BBAA670AEBDD7E6F21F0496D1D3CCB4E90 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
14:59:54.0435 0x096c  drmkaud - ok
14:59:54.0466 0x096c  [ 263625A4F616538EB867B6306A6590DB, 2A064720C247EAA3446EFDCC9E01D84CBA875905D78DFED0FBD62D1EE422D416 ] DsmSvc          C:\Windows\System32\DeviceSetupManager.dll
14:59:54.0513 0x096c  DsmSvc - ok
14:59:54.0638 0x096c  [ F74B839FA0F4E6060CA1DA6B8DA17941, EF493E1F55FCD6A8C32B3D5D5809B7EFCCC9829E9A347522D1E6FE080D41BF37 ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
14:59:54.0779 0x096c  DXGKrnl - ok
14:59:54.0794 0x096c  [ E253530BD5EDE28F1FF6AF93C4D8034D, 787A70C3E946348F066FB8EB81FCE60157217D93FD78ADC631B5835E8D76A253 ] Eaphost        C:\Windows\System32\eapsvc.dll
14:59:54.0841 0x096c  Eaphost - ok
14:59:55.0044 0x096c  [ 114BCFDF367FF37C3F1B0A96AF542E4D, D385BC1D91BC1406091C8C3691C07A90BD60EDE05B1384E5AA3506FCB909C857 ] ebdrv          C:\Windows\system32\drivers\evbda.sys
14:59:55.0279 0x096c  ebdrv - ok
14:59:55.0326 0x096c  [ 382100E75B6F4668AEAEF228C6CEFFAD, 9C7229F10F11D18E1FED6395391A46225A84B421034B9AB6F81AF7430FDC556F ] EFS            C:\Windows\System32\lsass.exe
14:59:55.0341 0x096c  EFS - ok
14:59:55.0357 0x096c  [ 43531A5993380CC5113242C29D265FD9, EE0076D96F7F3CF29884AC7A67C08A429115A7201354A1FB5DE45FD63ABB4960 ] EhStorClass    C:\Windows\system32\drivers\EhStorClass.sys
14:59:55.0373 0x096c  EhStorClass - ok
14:59:55.0404 0x096c  [ 6F8E738A9505A388B1157FDDE7B3101B, 3696CA634102B41EEA11EB9DCA0B24439D8636AED4A7190C138C5E64A2EFB514 ] EhStorTcgDrv    C:\Windows\system32\drivers\EhStorTcgDrv.sys
14:59:55.0419 0x096c  EhStorTcgDrv - ok
14:59:55.0435 0x096c  [ DFFFAE1442BA4076E18EED5E406FA0D3, 329FC6FB8D14BEACDBE2A5D4C496EDEA485E838B1DF27566E278F8F8E0D8E82E ] ErrDev          C:\Windows\System32\drivers\errdev.sys
14:59:55.0451 0x096c  ErrDev - ok
14:59:55.0498 0x096c  [ F00C593994D57C75273F820653440536, 2DC986D9890EC907405FB2045E6F55ACC384169B45F0B56CCB1A953CF71D9A5D ] EventSystem    C:\Windows\system32\es.dll
14:59:55.0560 0x096c  EventSystem - ok
14:59:55.0623 0x096c  [ 55588867D59BADA2F62E58618CE32B03, F7FAF420103272151194A475D6C8EF4449AFCED787AA3DF7C461370D828E522F ] EvtEng          C:\Program Files\Intel\WiFi\bin\EvtEng.exe
14:59:55.0669 0x096c  EvtEng - ok
14:59:55.0701 0x096c  [ 7729D294A555C7AEB281ED8E4D0E01E4, 7269E79D72CCE477AC108294D0DDFB59CF533B03C587599C5AB0507C43A0B6D4 ] exfat          C:\Windows\system32\drivers\exfat.sys
14:59:55.0763 0x096c  exfat - ok
14:59:55.0795 0x096c  [ 7C4E0D5900B2A1D11EDD626D6DDB937B, 732F310F8F6016C56F432A81636B13CE0124A802FE8DD91287B618EED22C9A1D ] fastfat        C:\Windows\system32\drivers\fastfat.sys
14:59:55.0826 0x096c  fastfat - ok
14:59:55.0873 0x096c  [ 304B6AEC4639A7CCCCF544C6BA6177B2, B75CDD52FD3890B3008E06C503945D1E36478F0EC5E067C8DBC2822D7935D24B ] Fax            C:\Windows\system32\fxssvc.exe
14:59:55.0998 0x096c  Fax - ok
14:59:55.0998 0x096c  [ 5D8402613E778B3BD45E687A8372710B, EE9EA10805168D309A609B9019AEC5961EE46D18207B5E0EA2DE4064A5770AF8 ] fdc            C:\Windows\System32\drivers\fdc.sys
14:59:56.0045 0x096c  fdc - ok
14:59:56.0060 0x096c  [ 020D2F29009F893ADEFF4405B4B44565, 9F8501064C72933D1442DA00E70392B30D0207EB7D60F50E6648FF363799E6F1 ] fdPHost        C:\Windows\system32\fdPHost.dll
14:59:56.0107 0x096c  fdPHost - ok
14:59:56.0123 0x096c  [ E80D2EDD2F88B6E20076A0A4F5A5A245, E3CD6E0BE152B22E8A7340EFFD10CCDB1B632CD3EDF487E83F697D2E22A7D594 ] FDResPub        C:\Windows\system32\fdrespub.dll
14:59:56.0154 0x096c  FDResPub - ok
14:59:56.0185 0x096c  [ 47AB7D16EDE434B934AA4D661456C2D5, D375A92FB3E4BB0A8DA5270DACC888E53FB9F514516039FE6DAE4D4EF6B9A970 ] fhsvc          C:\Windows\system32\fhsvc.dll
14:59:56.0248 0x096c  fhsvc - ok
14:59:56.0263 0x096c  [ BCFD8B149B3ADF92D0DB1E909CAF0265, 002B085C131473642450176B4B8359F3E5B04350AFB659B9C0F9EB587D1181E7 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
14:59:56.0279 0x096c  FileInfo - ok
14:59:56.0294 0x096c  [ A1A66C4FDAFD6B0289523232AFB7D8AF, 0F5832F626BB62190D5F3A088CE6E048D8A400CCF9EA527F06973CAD96D3A81C ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
14:59:56.0341 0x096c  Filetrace - ok
14:59:56.0357 0x096c  [ BE743083CF7063C486A4398E3AEFE59A, 85796D89943DD6FE3932C1ED6CF01470C1B4DFD243C390B07055FFDA3C231551 ] flpydisk        C:\Windows\System32\drivers\flpydisk.sys
14:59:56.0388 0x096c  flpydisk - ok
14:59:56.0451 0x096c  [ C1FB505A73FA2E9019D32444AB33B75A, 765F0635C18295855CA4C0394192E8B94BA2EA1C4D74F86B720358ABA019FFAA ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
14:59:56.0529 0x096c  FltMgr - ok
14:59:56.0685 0x096c  [ 1EFEF3B4EF2B241263F0F791EA128598, B6CADC254B0779E43E0D6AB6125A7E7ED8FF50C3158911681BA7B43160A08176 ] FontCache      C:\Windows\system32\FntCache.dll
14:59:56.0857 0x096c  FontCache - ok
14:59:56.0888 0x096c  [ 1C52387BF5A127F5F3BFB31288F30D93, 90D13F60170CD74304F3036A90D596AA3E1E134455A780310BDF67AC7815F2E7 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
14:59:56.0920 0x096c  FontCache3.0.0.0 - ok
14:59:56.0920 0x096c  [ A7C31B168F371E8E6796219F23E354DB, C51C9BF568F1E96CBBE57D2432B38F93F40520086DDB6AAAAC48CBCD1691B441 ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
14:59:56.0951 0x096c  FsDepends - ok
14:59:56.0966 0x096c  [ 09F460AFEDCA03F3BF6E07D1CCC9AC42, B832091BC9B2C2FE38A4BCA132ABB58251E851F21EC6F39636E73777AB9A5791 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
14:59:56.0982 0x096c  Fs_Rec - ok
14:59:57.0091 0x096c  [ D4AB6EE3D715BC44C00277FD934FAACF, DE8A8B14D7BA73BA1B5A833DE193CA65EDFE512A57D84F4F2CE19D9646D97F4E ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
14:59:57.0201 0x096c  fvevol - ok
14:59:57.0216 0x096c  [ 9591D0B9351ED489EAFD9D1CE52A8015, AC64C236C3AE545FCE8ED44A4A87FB86265A453BA60026EC9A4DE2B631E99996 ] FxPPM          C:\Windows\System32\drivers\fxppm.sys
14:59:57.0248 0x096c  FxPPM - ok
14:59:57.0263 0x096c  [ FC3EF65EE20D39F8749C2218DBA681CA, 12980F1DE99B25E6920A33556F3ABDA5EC9BFE4757BE602130B5E939D8D25CE3 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
14:59:57.0279 0x096c  gagp30kx - ok
14:59:57.0295 0x096c  [ 0BF5CAD281E25F1418E5B8875DC5ADD1, 0929AD8437DD78234553D8B2CDF0D6838FD54ACDE1918AFEBE48684EB32A07A3 ] gencounter      C:\Windows\System32\drivers\vmgencounter.sys
14:59:57.0310 0x096c  gencounter - ok
14:59:57.0341 0x096c  [ BAD9E1C82F963ADCFB198826F22A42E3, 6C5936C663BA05A9A55CB9EB036E4702AE3347D6D54BA1442C559DBFE7413692 ] GFNEXSrv        C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
14:59:57.0357 0x096c  GFNEXSrv - detected UnsignedFile.Multi.Generic ( 1 )
14:59:57.0857 0x096c  GFNEXSrv ( UnsignedFile.Multi.Generic ) - warning
14:59:57.0857 0x096c  Force sending object to P2P due to detect: GFNEXSrv
14:59:58.0076 0x096c  Object send P2P result: true
14:59:58.0248 0x096c  [ 8DF1254093B5C354CE725EB6B9B0DE19, DE6C5661CC076DA44B8A5D044FDB7280EDCF38D322A98C14FDC82E25586B3014 ] GPIOClx0101    C:\Windows\system32\Drivers\msgpioclx.sys
14:59:58.0279 0x096c  GPIOClx0101 - ok
14:59:58.0357 0x096c  [ 9678FD4747A4F2E2318245EE6099482E, C76AE30E8BA77DC330F9CFE5ECEA58FAE0995396742923B564A2257DE24D7B32 ] gpsvc          C:\Windows\System32\gpsvc.dll
14:59:58.0498 0x096c  gpsvc - ok
14:59:58.0529 0x096c  [ 56F69F7C25FB67C970997D7066DBC593, 83E03A82237DCC5BCB3E722ACECACEF3510CAA619F33E0D7C4D902A482E90418 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
14:59:58.0607 0x096c  HdAudAddService - ok
14:59:58.0623 0x096c  [ D4B7ED39C7900384D9E5C1283F1E7926, F93F98858067B40F1C071EAD0F8E85442A78B95342BC692AF4D726540634923F ] HDAudBus        C:\Windows\System32\drivers\HDAudBus.sys
14:59:58.0670 0x096c  HDAudBus - ok
14:59:58.0685 0x096c  [ 10A70BC1871CD955D85CD88372724906, 2480A74854D0A89FF028EE9BA41224D4B2F9B0863066BFC43097920794FEE08D ] HidBatt        C:\Windows\System32\drivers\HidBatt.sys
14:59:58.0701 0x096c  HidBatt - ok
14:59:58.0716 0x096c  [ 42F88B57CAE42FC10059C887B3FCFCEA, 9363AA2B8E839A6935A7C6A36C491938DF78024886DCCE6D29CB18E1D6A6D806 ] HidBth          C:\Windows\System32\drivers\hidbth.sys
14:59:58.0748 0x096c  HidBth - ok
14:59:58.0763 0x096c  [ C241A8BAFBBFC90176EA0F5240EACC17, 571E20B87818618BE9179986177D55739A240F04D1F740B3C1B7809B9427B767 ] hidi2c          C:\Windows\System32\drivers\hidi2c.sys
14:59:58.0795 0x096c  hidi2c - ok
14:59:58.0810 0x096c  [ 9BDDEE26255421017E161CCB9D5EDA95, B766FD5E31708F29384F69418FC33C4BCC6E3064AA553D5B1D30EE0B8B1BFB40 ] HidIr          C:\Windows\System32\drivers\hidir.sys
14:59:58.0841 0x096c  HidIr - ok
14:59:58.0857 0x096c  [ EA85B5093DF7B5C3E80362B053740AE2, 1D4251385402A2ADEE8FA1642F54180304F88337DA74989BDE44025ABB145FE5 ] hidserv        C:\Windows\system32\hidserv.dll
14:59:58.0904 0x096c  hidserv - ok
14:59:58.0920 0x096c  [ 49676FEC898AB2A11B157F848269A56E, 011E6DDEF9570212520F92FEFD205E1F8104F198B57C40D11BE857FCBCC5F68D ] HidUsb          C:\Windows\System32\drivers\hidusb.sys
14:59:58.0951 0x096c  HidUsb - ok
14:59:58.0982 0x096c  [ 93C4315F47F8D635C6DB0DF49FCE10EE, 70C52B8927D54ACD23F27948780B522974250FD5CD81AA9801C3F158C402889F ] hkmsvc          C:\Windows\system32\kmsvc.dll
14:59:59.0029 0x096c  hkmsvc - ok
14:59:59.0060 0x096c  [ AC49522ED106BD4B545D6614D71C2445, 40BD738A301170378ECFC031635EB04E2F812B676376CADDD6607ECABEC9255F ] HomeGroupListener C:\Windows\system32\ListSvc.dll
14:59:59.0123 0x096c  HomeGroupListener - ok
14:59:59.0154 0x096c  [ 99932E30CE0283B73BB6E5019E150394, 1F88C2F56A7B8E1F75E6359281F418F9661DA4FB7B7D7B14FA7F718B15D4DCE0 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
14:59:59.0216 0x096c  HomeGroupProvider - ok
14:59:59.0248 0x096c  [ A6AACEA4C785789BDA5912AD1FEDA80D, D197012A5DA6AB3F76FF298336DF0CF027C07ECC71267BAEF5912DE12893E096 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
14:59:59.0263 0x096c  HpSAMD - ok
14:59:59.0279 0x096c  HSPADataCardusbmdm - ok
14:59:59.0279 0x096c  HSPADataCardusbnmea - ok
14:59:59.0295 0x096c  HSPADataCardusbser - ok
14:59:59.0388 0x096c  [ 76A6FDA32A21515B67633497D8FDB1E4, 7DCAEC3186EAFDD4A53BCD8AAE9B82CBA8871C89B929FFD3BA43E675B95B2495 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
14:59:59.0498 0x096c  HTTP - ok
14:59:59.0498 0x096c  [ 90656C0B3864804B090434EFC582404F, BDB60050B729AACB9E009AC7129BEBD6298BBD8A9DB14B817D02E8E13669BD6E ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
14:59:59.0529 0x096c  hwpolicy - ok
14:59:59.0529 0x096c  [ 6D6F9E3BF0484967E52F7E846BFF1CA1, C982966BDE6A3E6773D9441ADA7A3B08D13511DFC68D04DF303248B942423F38 ] hyperkbd        C:\Windows\System32\drivers\hyperkbd.sys
14:59:59.0560 0x096c  hyperkbd - ok
14:59:59.0576 0x096c  [ 907C870F8C31F8DDD6F090857B46AB25, 308664A31717383D06185875E76C6612407A9F04E7DB28404F574A5706C6715D ] HyperVideo      C:\Windows\system32\DRIVERS\HyperVideo.sys
14:59:59.0591 0x096c  HyperVideo - ok
14:59:59.0623 0x096c  [ 49EE0AE9E5B64FFBBD06D55C4984B598, 8866627F9241B24A59C81D8BCC67A4DCA87576F589599BA291D0E323F679EB4D ] i8042prt        C:\Windows\System32\drivers\i8042prt.sys
14:59:59.0685 0x096c  i8042prt - ok
14:59:59.0701 0x096c  [ 5D90E32E36CE5D4C535D17CE08AEAF05, 976A463343E8C8308AFBE9E64DF56C430D2241DE002430D00318AB065EB72E4A ] iaLPSSi_GPIO    C:\Windows\System32\drivers\iaLPSSi_GPIO.sys
14:59:59.0716 0x096c  iaLPSSi_GPIO - ok
14:59:59.0732 0x096c  [ DD05E7E80F52ADE9AEB292819920F32C, E71AB6A50B0F90C8F94569CE89F66F915A0A4A00D4AC091B2E5E750D88CFC334 ] iaLPSSi_I2C    C:\Windows\System32\drivers\iaLPSSi_I2C.sys
14:59:59.0748 0x096c  iaLPSSi_I2C - ok
14:59:59.0795 0x096c  [ 71341219FBB4BAB7F2462C4267DAB594, 0C6B684781D27F423D20186A40D7513DD6ABC38AD286D013791B37CBF5477A55 ] iaStorA        C:\Windows\system32\drivers\iaStorA.sys
14:59:59.0841 0x096c  iaStorA - ok
14:59:59.0904 0x096c  [ 08BFE413B0B4AA8DFA4B5684CE06D3DC, 95DEEBB203E12EE6E191F5247A74C04AEC0E16DE981FADDC4D6C42EE41D8D079 ] iaStorAV        C:\Windows\system32\drivers\iaStorAV.sys
14:59:59.0951 0x096c  iaStorAV - ok
15:00:00.0045 0x096c  [ B64E1D5BABD095C13A382838F9DCC77F, D8FF4E1BBA7EF5EE136CC5892C72E0774D0AAE40CD9EB3368A698DA6C078BBAA ] IAStorDataMgrSvc C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
15:00:00.0060 0x096c  IAStorDataMgrSvc - ok
15:00:00.0123 0x096c  [ A2200C3033FA4EF249FC096A7A7D02A2, 5819F5C2020DE2EEE339B0C08CD4B1E3490EAFBBEA1277CE649DB5A5150986B0 ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
15:00:00.0201 0x096c  iaStorV - ok
15:00:00.0216 0x096c  [ CAAC69A001E1A5878D2F050F57F93DA4, 0A4263501F2C1C9E4B3764A2EF27607DF07810A10A2F23F3E389EA3E1E1ACA8A ] ibtusb          C:\Windows\system32\DRIVERS\ibtusb.sys
15:00:00.0232 0x096c  ibtusb - ok
15:00:00.0248 0x096c  IEEtwCollectorService - ok
15:00:00.0685 0x096c  [ 09E41C653B31A4AF5B0E5D25C3FBC057, B45740F3FCF3565AC1D40486B9313B61F0824B36BD6C28DB057497ACD9D4FB39 ] igfx            C:\Windows\system32\DRIVERS\igdkmd64.sys
15:00:01.0232 0x096c  igfx - ok
15:00:01.0451 0x096c  [ 5697FD05EC6915A1E7193D658D8D6E05, 0179C3AF29880AA21F609CB471034EA5FA49324ACCE12736866675C037EBEC7A ] IKEEXT          C:\Windows\System32\ikeext.dll
15:00:01.0576 0x096c  IKEEXT - ok
15:00:01.0591 0x096c  [ 4011430BC9DA46ADFAE9915EFEC312FB, 925DDDA187AE7C46C94FBBFA18FC602260957B6BA891D65DFC09385B6DDEAB58 ] intaud_WaveExtensible C:\Windows\system32\drivers\intelaud.sys
15:00:01.0623 0x096c  intaud_WaveExtensible - ok
15:00:01.0857 0x096c  [ 517869DB2BC6058D250A2963AE32B2D4, 155452DCBA19ABDF8ED72286E9AC43947A06F08C1BD044F88A870F3465981B79 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
15:00:02.0123 0x096c  IntcAzAudAddService - ok
15:00:02.0170 0x096c  [ B375D8686E1BD2B79C0F00E3868A8C3B, A15D99F04B69FB37ED3AC0C3BBA464BF6D6EB1873D4AE1062983120E3BD1C4DB ] IntcDAud        C:\Windows\system32\DRIVERS\IntcDAud.sys
15:00:02.0216 0x096c  IntcDAud - ok
15:00:02.0295 0x096c  [ DAE6C3099D291EED8922A65C29ABCF52, AD0A932345382824122F84AF97A8609BAE1B916A3B9FD608779A1411E37D3643 ] Intel(R) Capability Licensing Service Interface C:\Program Files\Intel\iCLS Client\HeciServer.exe
15:00:02.0373 0x096c  Intel(R) Capability Licensing Service Interface - detected UnsignedFile.Multi.Generic ( 1 )
15:00:02.0701 0x096c  Detect skipped due to KSN trusted
15:00:02.0701 0x096c  Intel(R) Capability Licensing Service Interface - ok
15:00:02.0779 0x096c  [ D45226E3E7A25F1E7CE8DF8FD0A2A098, 7BD74E9E3CB0A83D26BA3FD8177C6B9BA46A8695B6569CF7887FDC87947DA2D6 ] Intel(R) Capability Licensing Service TCP IP Interface C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
15:00:02.0841 0x096c  Intel(R) Capability Licensing Service TCP IP Interface - ok
15:00:02.0873 0x096c  [ 441D5FAF24CC2EC115B654A55C52F0AF, 5BF5299DAD9A7076C43D68C70E02AEC8DBFD89C1AFDF7CD6AB95550EE25EEB36 ] Intel(R) Wireless Bluetooth(R) 4.0 Radio Management C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe
15:00:02.0904 0x096c  Intel(R) Wireless Bluetooth(R) 4.0 Radio Management - ok
15:00:02.0920 0x096c  [ 4E448FCFFD00E8D657CD9E48D3E47157, 4A958CF0BF8DAEAE5E008500BA67CE89B21388592811274331EE39CAC1043A00 ] intelide        C:\Windows\system32\drivers\intelide.sys
15:00:02.0951 0x096c  intelide - ok
15:00:02.0966 0x096c  [ A770340FC02B999EF0DE6C2A6BC8437C, 214567BE706B21BEA7EC13AF6B10FBFF658000511DBBA79BAA28D1D4EFD029A7 ] intelpep        C:\Windows\system32\drivers\intelpep.sys
15:00:02.0982 0x096c  intelpep - ok
15:00:02.0998 0x096c  [ 47E74A8E53C7C24DCE38311E1451C1D9, 79B06E37A552C8A847404D4C572CDB8CF525354D8AE3BEBC06892B7C3B330761 ] intelppm        C:\Windows\System32\drivers\intelppm.sys
15:00:03.0045 0x096c  intelppm - ok
15:00:03.0076 0x096c  [ 9DB76D7F9E4E53EFE5DD8C53DE837514, 07BA4EDA9BE9139A689A2C3EFC1D1A4F3D1216625ED145F313398292A2CD5703 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
15:00:03.0123 0x096c  IpFilterDriver - ok
15:00:03.0185 0x096c  [ B452623C1DE60544054E784D94A7AA47, 57AECDEE0AB2B80DFFE11E43608988D46E9169288CB56D644DDE2CAFED6AFD40 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
15:00:03.0295 0x096c  iphlpsvc - ok
15:00:03.0341 0x096c  [ C800DCD904016B2BF6AB541083770A3A, 95A8FB9AB2818A4F44AFCBF2715B0B3024DCE38E1406EA639F2A5ECA105D2290 ] IPMIDRV        C:\Windows\System32\drivers\IPMIDrv.sys
15:00:03.0388 0x096c  IPMIDRV - ok
15:00:03.0420 0x096c  [ B7342B3C58E91107F6E946A93D9D4EFD, D5DA3C02C5C5A343785745EF6983CC9B5FBD3FB8D49FE9B450523E50212D1A32 ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
15:00:03.0513 0x096c  IPNAT - ok
15:00:03.0529 0x096c  [ AE44C526AB5F8A487D941CEB57B10C97, A783A2EAF7A6FF450FB3F189A5930036FA60D125C42171AC44B6FE2E3DBD6F7A ] IRENUM          C:\Windows\system32\drivers\irenum.sys
15:00:03.0560 0x096c  IRENUM - ok
15:00:03.0576 0x096c  [ 8AFEEA3955AA43616A60F133B1D25F21, E99359A4F1D653790133F145CF7C9F97399FD75C5E135AA7E5F989BB660789AF ] isapnp          C:\Windows\system32\drivers\isapnp.sys
15:00:03.0591 0x096c  isapnp - ok
15:00:03.0623 0x096c  [ AD3C1F4BD9167420F04052FDA197CF29, 82B687092DFC50E8885656AF06BFB7559930750F4905BC4DBDA3A5D334A443D1 ] iScsiPrt        C:\Windows\System32\drivers\msiscsi.sys
15:00:03.0670 0x096c  iScsiPrt - ok
15:00:03.0685 0x096c  [ EE03564B7FAFE2E44EDA33D52E83B4A3, 53C917EEC92B813EB0C86B225E9887C9CDFDD7708AEA71BFAC0A3039E26D7BEB ] iwdbus          C:\Windows\System32\drivers\iwdbus.sys
15:00:03.0701 0x096c  iwdbus - ok
15:00:03.0732 0x096c  [ 52069AEB42D3D0F97CBCA1085EBF55E6, ADB2EFFF563B3FE113FCD156FD1E469BC24FC1D68AFEDCA21306F76592C9FF88 ] jhi_service    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
15:00:03.0763 0x096c  jhi_service - ok
15:00:03.0779 0x096c  [ 5917AFE4A3F695A54B99C1849C8207FE, DD57638966F2F0387DCF9DA4BBAEE3CDD8CC6F1A2D49581A0374D46A565BED4F ] kbdclass        C:\Windows\System32\drivers\kbdclass.sys
15:00:03.0795 0x096c  kbdclass - ok
15:00:03.0810 0x096c  [ 8CD840A062F6BDF41DDE3ACB96164B72, AEAE867F3557C1CE6B931E19D7144A3BD3CBABD81B1542667680D54FC24DEBE1 ] kbdhid          C:\Windows\System32\drivers\kbdhid.sys
15:00:03.0857 0x096c  kbdhid - ok
15:00:03.0857 0x096c  [ 813871C7D402A05F2E3A7075F9584A05, FF0C2F87EB083F8CE74C679D80C845CDFBFBBC70BE818F899F3336BBB54A3FFB ] kdnic          C:\Windows\system32\DRIVERS\kdnic.sys
15:00:03.0920 0x096c  kdnic - ok
15:00:03.0935 0x096c  [ 382100E75B6F4668AEAEF228C6CEFFAD, 9C7229F10F11D18E1FED6395391A46225A84B421034B9AB6F81AF7430FDC556F ] KeyIso          C:\Windows\system32\lsass.exe
15:00:03.0951 0x096c  KeyIso - ok
15:00:03.0966 0x096c  [ 304DA394D958BC3B62AF6DF514005B01, 8D17777C82F034E800181E82D30FCED800CBC46CD659AE2E0D972CA1381BD4C2 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
15:00:03.0998 0x096c  KSecDD - ok
15:00:04.0013 0x096c  [ 3D4AE520CD6F6FFE549DD195C1F515BE, 2AD3E07F504CE50956C391FD4633D20B354A854C940B3563A67B79BB6E40218F ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
15:00:04.0060 0x096c  KSecPkg - ok
15:00:04.0060 0x096c  [ 11AFB527AA370B1DAFD5C36F35F6D45F, 757AD234284467ADB826F7CA0251F58D48866B91995BC867DEA4BAF676947163 ] ksthunk        C:\Windows\system32\drivers\ksthunk.sys
15:00:04.0107 0x096c  ksthunk - ok
15:00:04.0138 0x096c  [ C1591A66028C71147A3E2EAB0B1CCB7E, 82F3D5DCC1614398A144D9791E4BAA814DBA9112677341FD57D5E9834CEDEB41 ] KtmRm          C:\Windows\system32\msdtckrm.dll
15:00:04.0185 0x096c  KtmRm - ok
15:00:04.0216 0x096c  [ CA2828DDE4B09FEFFDB7CE68B3D8D00A, B514792FF1EF36C678BB51644A1C420105D5E2CD6DD5A89A3FB252D08277A40C ] LanmanServer    C:\Windows\system32\srvsvc.dll
15:00:04.0263 0x096c  LanmanServer - ok
15:00:04.0295 0x096c  [ 3DBD9100745F9B8506B8FEC6FE6CCDE3, C3EF2856A1680AFDE133887E48946CF9CAB6755C3BDC07F0326965DCD4096F62 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
15:00:04.0357 0x096c  LanmanWorkstation - ok
15:00:04.0404 0x096c  [ 8B9F3796EC1762CF255BDB324E5529C8, F73D6BEF19BE20AEB18DA82CB63E9D8B50ACBBE4ED9B646EF0C9F598F6B81F94 ] lfsvc          C:\Windows\System32\GeofenceMonitorService.dll
15:00:04.0498 0x096c  lfsvc - ok
15:00:04.0498 0x096c  [ C09010B3680860131631F53E8FE7BAD8, 35F2A06D5F29478D22ABDCC20DA893EF9D96504C65594A0CEA674D1C21B04FF8 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
15:00:04.0529 0x096c  lltdio - ok
15:00:04.0576 0x096c  [ DAE98CC96C5EE308BF4EA7B18F226CB8, 7A6CC56BF075010707715AB6608764291E358EDF27C806A025532869004C686B ] lltdsvc        C:\Windows\System32\lltdsvc.dll
15:00:04.0638 0x096c  lltdsvc - ok
15:00:04.0654 0x096c  [ 1E2662D847B7D9995C65D90D254A7E0F, AFD4063D2071FFCB6B0EAC0715276D986F42326919C86E525DCE12E1109A93E2 ] lmhosts        C:\Windows\System32\lmhsvc.dll
15:00:04.0701 0x096c  lmhosts - ok
15:00:04.0732 0x096c  [ 3DE66F47365AA8CEB18B1EE272F4FEBA, 8DDD6AB4AEDE3B2FEA0D3B63DD24E3F3422D6ADE067756A3919FCED53C349167 ] LMS            C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
15:00:04.0779 0x096c  LMS - ok
15:00:04.0795 0x096c  [ C755AE4635457AA2A11F79C0DF857ABC, E03D1ACAC155287291FE1BD0B653953ADC94279A74D0152088D698FAA796460F ] LSI_SAS        C:\Windows\system32\drivers\lsi_sas.sys
15:00:04.0826 0x096c  LSI_SAS - ok
15:00:04.0841 0x096c  [ ADAC09CBE7A2040B7F68B5E5C9A75141, 7865DA7E91404F3642BC444B97F6B7AA42B9523D5EDD7F6365DA236B8EC3410F ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys
15:00:04.0857 0x096c  LSI_SAS2 - ok
15:00:04.0873 0x096c  [ 04D1274BB9BBCCF12BD12374002AA191, 4B9618F8D25F2278DE1610A70ACAADB074D171D162C3AF27D464F5DC800A8E60 ] LSI_SAS3        C:\Windows\system32\drivers\lsi_sas3.sys
15:00:04.0904 0x096c  LSI_SAS3 - ok
15:00:04.0920 0x096c  [ 327469EEF3833D0C584B7E88A76AEC0C, 3D88B5A2D68F93F01B39C6E3D8D5C7A2A20686EFC756086E66AFFF1BC3019B85 ] LSI_SSS        C:\Windows\system32\drivers\lsi_sss.sys
15:00:04.0935 0x096c  LSI_SSS - ok
15:00:04.0998 0x096c  [ 9A7A7E45DAED2E8C2816716D8D28236A, C94787988826E546A8DC752BD6BE4EA7423DC3762B2D371DB297A63F865A95FF ] LSM            C:\Windows\System32\lsm.dll
15:00:05.0091 0x096c  LSM - ok
15:00:05.0107 0x096c  [ DDEE191AB32DFC22C6465002ECDF5EE4, 190C3930A8449118F9FEDF43C482837EF1C255E6D67F9651156E66A1E2BC6553 ] luafv          C:\Windows\system32\drivers\luafv.sys
15:00:05.0201 0x096c  luafv - ok
15:00:05.0201 0x096c  massfilter - ok
15:00:05.0216 0x096c  [ 78BFF5425E044086E74E78650A359FBB, 294738C10F3ED933D4EC40EA0659372FCF19A3C6D45D356917438CA495F2CB45 ] MBAMProtector  C:\Windows\system32\drivers\mbam.sys
15:00:05.0232 0x096c  MBAMProtector - ok
15:00:05.0341 0x096c  [ 9611577752E293259C7DCE19E9026362, 8CB5DFD63FA15603BB6FA6B501E09ED7F4DE0E8F68CB28B78CECAC3711BEFD24 ] MBAMScheduler  C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
15:00:05.0435 0x096c  MBAMScheduler - ok
15:00:05.0513 0x096c  [ F1A89A34388B5626F1548D393B23ECB1, EA00AC76C4C8C9340753B58A3313C9177A9B98F9F1BDE08F184CD0F53D0C186F ] MBAMService    C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
15:00:05.0607 0x096c  MBAMService - ok
15:00:05.0623 0x096c  [ 78488AF2AB2111D67B3C4044707A519B, 7AA71B9C4C7949A1A21F60EF7CCEDE0079794990696B60557B5DC86F4D47223A ] MBAMSwissArmy  C:\Windows\system32\drivers\MBAMSwissArmy.sys
15:00:05.0654 0x096c  MBAMSwissArmy - ok
15:00:05.0670 0x096c  [ 898415AC0B5F1D2A9A48ABCB68A6DC4B, E1FD9AE5E22E3E5A18288E66A6184E92A4B63A1274DCE147A7728BB09C6A225E ] MBAMWebAccessControl C:\Windows\system32\drivers\mwac.sys
15:00:05.0685 0x096c  MBAMWebAccessControl - ok
15:00:05.0701 0x096c  [ EB5C03A070F30D64A6DF80E53B22F53F, 12051B6AEBDEE1E28F24364F25A52BA3A6E282ECF86D6290E34BD38E6D4E066D ] megasas        C:\Windows\system32\drivers\megasas.sys
15:00:05.0732 0x096c  megasas - ok
15:00:05.0779 0x096c  [ F6F13533196DE7A582D422B0241E4363, B3CD9B08937AFFF12141B38634AF3A56F5AC5FF3EF03941802B9841DEC559469 ] megasr          C:\Windows\system32\drivers\megasr.sys
15:00:05.0841 0x096c  megasr - ok
15:00:05.0857 0x096c  [ E0EF6C1399A9B1AAA0B28590411BED04, 10C193D1ED434A6DC2AD8C450012B9AF1C848A0A0B3B775F13495648FB77E009 ] MEIx64          C:\Windows\system32\DRIVERS\TeeDriverx64.sys
15:00:05.0873 0x096c  MEIx64 - ok
15:00:05.0888 0x096c  [ 4C5179DB61B9E14BEC15CDC4B152B2E9, 9048BEC7AD6A3F4B640E99B1F0365AC9A46740B188758FBB2C160EF30AD6E64B ] MMCSS          C:\Windows\system32\mmcss.dll
15:00:05.0935 0x096c  MMCSS - ok
15:00:05.0951 0x096c  [ 8B38C44F69259987C95135C9627E2378, E698B82D4EFFF56D66C7FC9866369BA5736FDBDBE2028CC421C51E70DEA74727 ] Modem          C:\Windows\system32\drivers\modem.sys
15:00:05.0982 0x096c  Modem - ok
15:00:05.0998 0x096c  [ 601589000CC90F0DF8DA2CC254A3CCC9, D1238A386C41B6C368D9A44B7C112C943995B5403E2A5B4B7346B266DDB0C5A0 ] monitor        C:\Windows\System32\drivers\monitor.sys
15:00:06.0060 0x096c  monitor - ok
15:00:06.0060 0x096c  [ 08374E4E5B8914DE6067CBA99F61E930, CBB1390D6523FC968BEDF78FD13699488621ACB2CD1DF55D1606316090548661 ] mouclass        C:\Windows\System32\drivers\mouclass.sys
15:00:06.0091 0x096c  mouclass - ok
15:00:06.0107 0x096c  [ 5FCBAB60598AE119E02B4C27DE6B99EA, 36F30094F700DE41C293047ACB49ED1961DD927BEDAD8DFDAB7023D4D24CB0DE ] mouhid          C:\Windows\System32\drivers\mouhid.sys
15:00:06.0138 0x096c  mouhid - ok
15:00:06.0154 0x096c  [ 24DABC0A77FAFDC0E379AB3B30F61BB6, E66624ABBF1D742879035F9161F9D3713DE7B759B3D3CF8B96C9E397A02FCF82 ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
15:00:06.0185 0x096c  mountmgr - ok
15:00:06.0232 0x096c  [ E464A0A92E2E354D07DDA713D3E10DE4, D5CF213F03DF54EF9933027A7A7D4413371C1ECBFF61E4DE818D50FA72C8C5FC ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
15:00:06.0263 0x096c  MozillaMaintenance - ok
15:00:06.0295 0x096c  [ 6FC047578785B0435F4E2660946D1ADC, 8AEA5659F01FC2F75160922C69622502DABA39F33CB90D5178DD679A1CDE617D ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
15:00:06.0341 0x096c  mpsdrv - ok
15:00:06.0451 0x096c  [ D1418745A5472F3930A288E05B9E2C05, 95785F0FA7EE239459C0288DB37E9E54648029FD6FE45A61E6343526D67FFA32 ] MpsSvc          C:\Windows\system32\mpssvc.dll
15:00:06.0545 0x096c  MpsSvc - ok
15:00:06.0560 0x096c  [ 3F818C1518DA702C8F10259095C9BDE0, B98C1A6F9A3C01A10503B2B2C45CC89AFF17B346B15990F4DB4820F68BDC62C8 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
15:00:06.0638 0x096c  MRxDAV - ok
15:00:06.0716 0x096c  [ C3B0566DE49265AE98405825938C20A1, F8BCA4A5AF21B841C998D4772DA9FF84E45F1356AA1285A1D48C06574A81CA4C ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
15:00:06.0763 0x096c  mrxsmb - ok
15:00:06.0810 0x096c  [ 15D7AF1A26CCEBA32DF21A8E2098F463, 84390806AD3A9651DAB803E9257EEE851B898ED2AB56D8936E8C9F6B41967243 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
15:00:06.0904 0x096c  mrxsmb10 - ok
15:00:06.0920 0x096c  [ 0790EEB1EC199F8BE8259E47B373ED23, F9330F43B40675CCB60804182EF04BFBA3837ED14C798788A4B27D65A646D1C7 ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
15:00:06.0998 0x096c  mrxsmb20 - ok
15:00:07.0029 0x096c  [ F3C060444777A59FC63D920719E43CCD, 8766A2746E3DFB0749E902F458141269335CA6F0CEDCA3D5F8C204637C19E783 ] MsBridge        C:\Windows\system32\DRIVERS\bridge.sys
15:00:07.0060 0x096c  MsBridge - ok
15:00:07.0076 0x096c  [ 915747E010A9414B069173284A9B93F4, 8A335C28FE1EF96DD71485877F2E86155D24B5614ACE05468F4B07E2ACD56331 ] MSDTC          C:\Windows\System32\msdtc.exe
15:00:07.0123 0x096c  MSDTC - ok
15:00:07.0138 0x096c  [ D13329FBF8345B28AB30F44CC247DC08, 9C7EC2D4D65E6510EB5B9E61BB0D14F725D7E8FE98D65161C3971E43EF1AB6EB ] Msfs            C:\Windows\system32\drivers\Msfs.sys
15:00:07.0170 0x096c  Msfs - ok
15:00:07.0185 0x096c  [ C6B474E46F9E543B875981ED3FFE6ADD, E16687E52FB649C23D92159A1F036CB662202C1E58D961EECDAA528AA4FA669A ] msgpiowin32    C:\Windows\System32\drivers\msgpiowin32.sys
15:00:07.0216 0x096c  msgpiowin32 - ok
15:00:07.0216 0x096c  [ 65C92EB9D08DB5C69F28C7FFD4E84E31, D709BA4723225321F665B1157A33A4AE230420752308EF535DA9A41CAC164628 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
15:00:07.0248 0x096c  mshidkmdf - ok
15:00:07.0263 0x096c  [ 52299F086AC2DAFD100DD5DC4A8614BA, B36BE0FC96798E5EB8C193C318970E3906961E3ABC3BFAAD73138C76D9A95B0B ] mshidumdf      C:\Windows\System32\drivers\mshidumdf.sys
15:00:07.0295 0x096c  mshidumdf - ok
15:00:07.0310 0x096c  [ 36D92AF3343C3A3E57FEF11C449AEA4C, ECC85AA1E530DF55B4A4545798219F87F0FCA66DDD2E37BCEF0850D3C9129DD2 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
15:00:07.0341 0x096c  msisadrv - ok
15:00:07.0357 0x096c  [ A06142B3850B06972F1C89748FAA2C02, B1CCC5C8D100FEB384FCC85FED2A77F47DA4C9BA5F6889A130F4D73E30ACAA78 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
15:00:07.0435 0x096c  MSiSCSI - ok
15:00:07.0451 0x096c  msiserver - ok
15:00:07.0467 0x096c  [ A9BBBD2BAE6142253B9195E949AC2E8D, 599D2952D4E0B0B3E02D91E38A30F4900B1ADA330716B887B156A1CB9A3E6EE9 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
15:00:07.0513 0x096c  MSKSSRV - ok
15:00:07.0545 0x096c  [ 51B3AC0560848CD6D65AC2033E293113, 73A27E88774C6929328E6C9FC9C389F4DF76D4D4D5CBFC4F51651CC308829628 ] MsLldp          C:\Windows\system32\DRIVERS\mslldp.sys
15:00:07.0607 0x096c  MsLldp - ok
15:00:07.0623 0x096c  [ 7B2128EB875DCBC006E6A913211006D6, 97BBD7FF770741FBFC0F181A609AD0954EA926DA203B742E8F08C89AD8FE476E ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
15:00:07.0654 0x096c  MSPCLOCK - ok
15:00:07.0670 0x096c  [ 1E88171579B218115C7A772F8DE04BD8, B9EAA835D0BF8F9C4DF8403D95EF1400E8AE38F28F9DBA87657DE2129FEF02D2 ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
15:00:07.0685 0x096c  MSPQM - ok
15:00:07.0732 0x096c  [ BBE2A455053E63BECBF42C2F9B21FAE0, 7C5DF563499DF59DF9895A1581E47ADF5FD54C94ECEF6C886CDB60E5E95A6DAE ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
15:00:07.0779 0x096c  MsRPC - ok
15:00:07.0810 0x096c  [ 8D6B7D515C5CBCDB75B928A0B73C3C5E, 1EB4DC3DD21D2627C78EC3F9931D9E5D033169087E43B5D7C17BF1FF2A0028CD ] mssmbios        C:\Windows\System32\drivers\mssmbios.sys
15:00:07.0826 0x096c  mssmbios - ok
15:00:07.0857 0x096c  [ 115019AE01E0EB9C048530D2928AB4A2, 6E2275E85EACF2D0FC784792E0D72A165589D33CBAB3BCFA8E271CA09566C925 ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
15:00:07.0888 0x096c  MSTEE - ok
15:00:07.0904 0x096c  [ 96D604A35070360F0DD4A7A8AF410B5E, F94DD1A3566C7C8D0A76D6E1E2530552A9B7F99C5DA0DE11829325EAB9F8B7ED ] MTConfig        C:\Windows\System32\drivers\MTConfig.sys
15:00:07.0951 0x096c  MTConfig - ok
15:00:07.0967 0x096c  [ 438EA7A2D8D4F9B8AFB64748ACA70BA8, AEEB7B657B645C4006C6D5E8D07ECE581DEE7AD22EA1A587C552574990CF091B ] Mup            C:\Windows\system32\Drivers\mup.sys
15:00:07.0998 0x096c  Mup - ok
15:00:08.0029 0x096c  [ B8C35C94DCB2DFEAF03BB42131F2F77F, F0FCF367CA8F722D6ABCF7F363CD406D890D71452E91C3FC6677B47AD74D6324 ] mvumis          C:\Windows\system32\drivers\mvumis.sys
15:00:08.0045 0x096c  mvumis - ok
15:00:08.0092 0x096c  [ FCDCFEDAF3C1D61DE11FA0DE9453699C, 4E79F1040E62B0DEE00F3035DBFE5241A459FE4C1A46337FF13A25FF8C5A64A5 ] MyWiFiDHCPDNS  C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
15:00:08.0123 0x096c  MyWiFiDHCPDNS - ok
15:00:08.0154 0x096c  [ 8DF30698BDD9492A9D45A4B94FB4A82A, 26B1B2D7E785E29B8BCB74C467C66AE4EBDD481ACFF36334F3BDF4506B778244 ] napagent        C:\Windows\system32\qagentRT.dll
15:00:08.0248 0x096c  napagent - ok
15:00:08.0279 0x096c  [ 008F7CED69FD5B30CBDE1E03C6F36A27, D4ADA7834C470B17A3CD976012DC5A511B32545B9F91D23D09A85722E0B75320 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
15:00:08.0357 0x096c  NativeWifiP - ok
15:00:08.0420 0x096c  [ DF1A606A45C5280BD2DEFEFC17311489, 690656E73211BF34A1A839EAAA6B090D66040773228506C571E40699CB4927F4 ] NAUpdate        C:\Program Files (x86)\Nero\Update\NASvc.exe
15:00:08.0498 0x096c  NAUpdate - ok
15:00:08.0529 0x096c  [ BFCE1225D10619029E68946929CEB64C, 499F560331FFBA82E3D673B47F027FDAB7BEE4F2CB5B811D69E0218839F6E6A5 ] NcaSvc          C:\Windows\System32\ncasvc.dll
15:00:08.0576 0x096c  NcaSvc - ok
15:00:08.0591 0x096c  [ 267C97373110B7AFD3B46DF60B6CBB85, CEBB99F71D47634BB9C04DF2836DF6B47F15B3073FEFC237F85526DF01E4E38B ] NcbService      C:\Windows\System32\ncbservice.dll
15:00:08.0638 0x096c  NcbService - ok
15:00:08.0654 0x096c  [ 0813B71EAF097208DC76CE0605B48AF0, A93A2E6A8FB77B58AC4D580E6F8BF307A25BADC9493994F9BE235EBFB0E1DB22 ] NcdAutoSetup    C:\Windows\System32\NcdAutoSetup.dll
15:00:08.0685 0x096c  NcdAutoSetup - ok
15:00:08.0857 0x096c  [ 97DC5967F65503213FD1F1B3E4A6F983, 3EC515856C7CE9B30032F963DC04190F66EE62402A819781DC45B7D088C84229 ] NDIS            C:\Windows\system32\drivers\ndis.sys
15:00:08.0982 0x096c  NDIS - ok
15:00:09.0060 0x096c  [ 8CECC8DA55F3274181FD1EA28AD76664, 188112424CEF97FB926A0FB915260B803555A775DD2E1846725A9C8616300F42 ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
15:00:09.0092 0x096c  NdisCap - ok
15:00:09.0107 0x096c  [ 269882812E9A68FFF1AFE1283D428322, 50B99EBC42DA9B46A8C2C28C9BADCF58AE3079535CDD1227D0F5C86291C715FF ] NdisImPlatform  C:\Windows\system32\DRIVERS\NdisImPlatform.sys
15:00:09.0154 0x096c  NdisImPlatform - ok
15:00:09.0170 0x096c  [ 82821F4EEC776B4CF11695A38F3ABA46, 23184F9D31E662855DC4D23EFE7C2FE00E5487D3762B6024704A5D8C87762E1C ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
15:00:09.0217 0x096c  NdisTapi - ok
15:00:09.0232 0x096c  [ B832B35055BA2B7B4181861FF94D8E59, 2E60E5D503E88D27E35ECFEE265D51328E93A9C7B9B931F86D9CBC947636BB00 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
15:00:09.0279 0x096c  Ndisuio - ok
15:00:09.0310 0x096c  [ 1F58E48EF75F34C35D8E93A0DC535CFE, D65619A6C4B1747F8B05DA08A44EF0E46B5CC384880E04E4755A2BA6CDB3C4EA ] NdisVirtualBus  C:\Windows\System32\drivers\NdisVirtualBus.sys
15:00:09.0342 0x096c  NdisVirtualBus - ok
15:00:09.0388 0x096c  [ C3755FCF9A0B5C6FE8ED9E873B85D3CE, 4D3DAFAFA5FB2930522D6DA536E3A731BABE0C24613C190D2330DB415D1A6515 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
15:00:09.0451 0x096c  NdisWan - ok
15:00:09.0466 0x096c  [ C3755FCF9A0B5C6FE8ED9E873B85D3CE, 4D3DAFAFA5FB2930522D6DA536E3A731BABE0C24613C190D2330DB415D1A6515 ] NdisWanLegacy  C:\Windows\system32\DRIVERS\ndiswan.sys
15:00:09.0498 0x096c  NdisWanLegacy - ok
15:00:09.0513 0x096c  [ DDD7F92A83F74D1476B71FBA9530A8DC, D3F94FC9F48854E09B0B77CE5E1C1DB948D54EAC63C5583437051BB893B5A386 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
15:00:09.0560 0x096c  NDProxy - ok
15:00:09.0592 0x096c  [ 3083926D1CC5B56EA0786527B557DD1B, 3C3F0CA0D43398576DBE8F677B353ADDA7E8F56829874958CE668E31261C1590 ] Ndu            C:\Windows\system32\drivers\Ndu.sys
15:00:09.0638 0x096c  Ndu - ok
15:00:09.0654 0x096c  [ 42FF4975D032CAE558AE4BB8448F6E5A, 0B8FACF3382443DED79A8004A6AA14C32471A6A1C6BAA543AA9F3FEC52620A6D ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
15:00:09.0685 0x096c  NetBIOS - ok
15:00:09.0748 0x096c  [ 9DC17B7D9D84C37C102D379FCC7D4942, D522022ED4395686837E96F57EE29F8065FB749D1195B60D2A406FB33F696C09 ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
15:00:09.0842 0x096c  NetBT - ok
15:00:09.0873 0x096c  [ 382100E75B6F4668AEAEF228C6CEFFAD, 9C7229F10F11D18E1FED6395391A46225A84B421034B9AB6F81AF7430FDC556F ] Netlogon        C:\Windows\system32\lsass.exe
15:00:09.0888 0x096c  Netlogon - ok
15:00:09.0951 0x096c  [ 8F074B62E66B6117D9598C62A12069C5, 5FDB19045D3E2F6D0F0C5158AC2ECB0D5404CD2AF7A319755D7E3753CA3B7CF3 ] Netman          C:\Windows\System32\netman.dll
15:00:10.0013 0x096c  Netman - ok
15:00:10.0092 0x096c  [ 4A04B1CD5BFB4A978C5F60E86D6C3E45, A946922C1C38ADD3CF9D3B09DDCC301AE4DAC960A081B2F42B32BE1E7095B3FD ] netprofm        C:\Windows\System32\netprofmsvc.dll
15:00:10.0170 0x096c  netprofm - ok
15:00:10.0201 0x096c  [ 1092B3190E69E0C5ECBCE90F171DE047, C16106EEFC324EE80E5F659CB71A5DD69FA800D36D829F5B0E6AD3393BD1BAF7 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
15:00:10.0217 0x096c  NetTcpPortSharing - ok
15:00:10.0232 0x096c  [ D4DCE03870314D3354F3501F9DDD4123, 5BFE8299B3F72B8C39A4965365CBF5BA151024451F02DD872FAD1CC35CF94CEA ] netvsc          C:\Windows\System32\drivers\netvsc63.sys
15:00:10.0310 0x096c  netvsc - ok
15:00:10.0545 0x096c  [ B6EDB4D2BA55CA06FF679FA4B885B1F4, 3A5E509B52216DEFBEDE2CA35C77A2AB8114E41D702765F6712DD8D24B394826 ] NETwNb64        C:\Windows\system32\DRIVERS\NETwbw02.sys
15:00:10.0810 0x096c  NETwNb64 - ok
15:00:11.0045 0x096c  [ B636B4A8E59A73033B766EA7FD7C3B81, CAC8614DEE83623DE56C969C668A33366793779084B6A23F59ADC98392115F8C ] NETwNe64        C:\Windows\system32\DRIVERS\NETwew02.sys
15:00:11.0342 0x096c  NETwNe64 - ok
15:00:11.0388 0x096c  [ E94EB2A95D7D016E119C4D6868788831, 3E4A925D23262FBA0A6432DD635FBE94B0CEF76BD9BB323254B66977497FEE2A ] NlaSvc          C:\Windows\System32\nlasvc.dll
15:00:11.0435 0x096c  NlaSvc - ok
15:00:11.0467 0x096c  [ 8F44A2F57C9F1A19AC9C6288C10FB351, 310274DDBAC0FE4BE54ECD3B90C97D82A0F9F5CFCA7A35711A36164DE4B94074 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
15:00:11.0498 0x096c  Npfs - ok
15:00:11.0498 0x096c  [ CBDB4F0871C88DF930FC0E8588CA67FC, 7E4AA3EA81A9D532F236FD7896744F07ED07CA9B37A9F18A9778BCCCC67490F2 ] npsvctrig      C:\Windows\System32\drivers\npsvctrig.sys
15:00:11.0545 0x096c  npsvctrig - ok
15:00:11.0560 0x096c  [ 0F12A72A753CFD7FB0631EE8D08FE983, 860A96471F6CD90DDA9AB3A48E95CEAD826C87D2FA98A00EF91B61C44A4C8B82 ] nsi            C:\Windows\system32\nsisvc.dll
15:00:11.0623 0x096c  nsi - ok
15:00:11.0623 0x096c  [ 0E046FF5823B95326D10CF1B4AF23541, 39D22715003746527AB4BFEDED8C34B695DAF589091AE7F3A2A2C4B8A35675A9 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
15:00:11.0654 0x096c  nsiproxy - ok
15:00:11.0748 0x096c  [ 9980B262DBE439AE6BDC91AA985F19EE, E998E4CAE9CD103ADA9CA3C737C4DAD017D056828BFA42A41C7B4E4E108FB13C ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
15:00:11.0873 0x096c  Ntfs - ok
15:00:11.0888 0x096c  [ EF1B290FC9F0E47CC0B537292BEE5904, DBC07BBC54EBC2D2E576B23A4CE116B3DA988577AD0D96CB7289A6748A60F9EA ] Null            C:\Windows\system32\drivers\Null.sys
15:00:11.0935 0x096c  Null - ok
15:00:12.0607 0x096c  [ 86B50CE257C74E378FC2686B8A1F8B30, 944093E5182FD076A93D8D9C06979E2B031A310217DFF0B2723CB136EE517772 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
15:00:13.0373 0x096c  nvlddmkm - ok
15:00:13.0435 0x096c  [ BC6B5942AFF25EBAF62DE43C3807EDF8, CB0FA194084B8C309039D571B5760FDA800E9531B8660C499B4F9977BA5C36D5 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
15:00:13.0467 0x096c  nvraid - ok
15:00:13.0482 0x096c  [ 1F43ABFFAC3D6CA356851D517392966E, 6FD7621F67BA94B0E1D8F43BEC2951DBCDEEA1E848BB265AC169E27C01DA68F2 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
15:00:13.0513 0x096c  nvstor - ok
15:00:14.0342 0x096c  [ 63B5DCF3A9EEA1C418468A312B54E612, 1094032CA6D6C6E06868483667B454781C10E820E3A727B59FA9AF727D713360 ] NvStreamSvc    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
15:00:15.0185 0x096c  NvStreamSvc - ok
15:00:15.0310 0x096c  [ F44DF61D9B1C1269862CF4E135B64590, 7E6579A63A6E2E75C9CA752A5D16896C1677F6B7461C9ED9E1962B97946E716B ] nvsvc          C:\Windows\system32\nvvsvc.exe
15:00:15.0373 0x096c  nvsvc - ok
15:00:15.0701 0x096c  [ 005E474630A7AA05A617C574B702FEED, E7B8181232DAA787EE8B98DDB5775E4B33C82B4D2E4A27D3DCD9FBAA6663BD97 ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
15:00:15.0842 0x096c  nvUpdatusService - ok
15:00:15.0857 0x096c  [ 220B120EF4C36B4A3E23FAEC91E2FCE3, 84F34F8CF0B7040F0C6DCF3AF70533E9E2D7CBA5E422CD21A7BF831135E42453 ] nvvad_WaveExtensible C:\Windows\system32\drivers\nvvad64v.sys
15:00:15.0873 0x096c  nvvad_WaveExtensible - ok
15:00:15.0888 0x096c  [ 6934A936A7369DFE37B7DBA93F5E5E49, 0900FEEB0CE8D09F0FC60630B5B986034A8BCD3882ED66E47170810C32492892 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
15:00:15.0920 0x096c  nv_agp - ok
15:00:15.0951 0x096c  [ 30B5F9FB0C35AE6B4A0851D24CE2EE8B, 0340E77E8EC2ADC21B8DDD9C9CC95B3F4BCAFD54618A333C72D7D9587D593B83 ] ose            C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
15:00:15.0982 0x096c  ose - ok
15:00:16.0045 0x096c  [ 26657F3B4F39A0E64AF859278B599C4E, 3DD65E0BCEF3045DBA29FB8171CA3FCC9781AED3A1C7A160CF26388CE80A3683 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
15:00:16.0138 0x096c  p2pimsvc - ok
15:00:16.0170 0x096c  [ FD8F61F0D1F64BBB3D835F39A3F979C9, E5C5F86576488EA7F605E26C06EE5AFB36506A446F60C894D55E0A148BF7F02D ] p2psvc          C:\Windows\system32\p2psvc.dll
15:00:16.0248 0x096c  p2psvc - ok
15:00:16.0295 0x096c  [ 57DCE4FB0467986AE78E1C6FC5240D32, F7F3ADD1B48E4D6BB0A664A2FE556F71ED7453054B4FB667A29BE050C845045B ] Parport        C:\Windows\System32\drivers\parport.sys
15:00:16.0357 0x096c  Parport - ok
15:00:16.0373 0x096c  [ BAFF6122CFC9F95CA175AD8C348179A4, 079A912D951DF6A57BC1BDB0D182977EE9592751EC9DDCDA2932BDEDB333850C ] partmgr        C:\Windows\system32\drivers\partmgr.sys
15:00:16.0404 0x096c  partmgr - ok
15:00:16.0435 0x096c  [ ABE95ABE27A8BD9701782BBCD82C9925, AE3BA1E9ECDE692374D8DAC95A8DAA289DD2470E3D8D58EFAD9F83A37F3AC8E5 ] PcaSvc          C:\Windows\System32\pcasvc.dll
15:00:16.0498 0x096c  PcaSvc - ok
15:00:16.0529 0x096c  [ 91ED124E261EA8FAA1C0FFDF2A71B0C4, 20E41A38067395D03184938983A9BE459717A1941352972DBC28D83D542319EC ] pci            C:\Windows\system32\drivers\pci.sys
15:00:16.0576 0x096c  pci - ok
15:00:16.0576 0x096c  [ 346E38FCC6859A727DD28AFAD1F0AFF4, FF3DA26F79B3BC3A5B8A8AA0B9139B9EF70297F4EA1203B1E68FB5A212C3AA58 ] pciide          C:\Windows\system32\drivers\pciide.sys
15:00:16.0607 0x096c  pciide - ok
15:00:16.0623 0x096c  [ 4D3BDCC1C7B40C9D7B6AD990E6DEC397, 27A7AF2127B699F4579CB77936F38DC102211E26E5E2947DB808756FE06FC98E ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
15:00:16.0654 0x096c  pcmcia - ok
15:00:16.0654 0x096c  [ BF28771D1436C88BE1D297D3098B0F7D, 5F7630916A76A8CF31289E9C577F522B999C74C39E541CD40E62BD53004BEF74 ] pcw            C:\Windows\system32\drivers\pcw.sys
15:00:16.0685 0x096c  pcw - ok
15:00:16.0701 0x096c  [ 24A8DFC07E4BAF29AEA26E383D4CC886, 1B903FE52CD816662D37A8113930B4B7019B6996D49F1982D8F42933A3525A67 ] pdc            C:\Windows\system32\drivers\pdc.sys
15:00:16.0732 0x096c  pdc - ok
15:00:16.0857 0x096c  [ 0ECEE590F2E2EF969FB74A6FC583A1E6, 1C611D9225C863CF32125F684B324C58BDE1942F4F283F5674133200AC505D44 ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
15:00:16.0982 0x096c  PEAUTH - ok
15:00:16.0998 0x096c  [ EE926C59CBD4DC4DC9FBB85014A2F1A5, 777459BD30A480E03EA5D0BBA431C2CD573403687FAA0B29F172086A0304E230 ] PEGAGFN        C:\Program Files (x86)\PHotkey\PEGAGFN.sys
15:00:17.0013 0x096c  PEGAGFN - ok
15:00:17.0045 0x096c  [ 7BB4BD4E20221B6BFC0038851CF3A4F0, 29EECB0C2A8BFC315C5212AD26B871B02DF7B76B5097FF45BA5E5C78891F357C ] PegaRadioSwitch C:\Windows\System32\drivers\PegaRadioSwitch.sys
15:00:17.0076 0x096c  PegaRadioSwitch - ok
15:00:17.0185 0x096c  [ 8E3C640FFF5A963F570233AE99C0FFF3, 3DE978B005BF2E88BA858CE37D9E27BD3584642B8412E22C300A1E739743838A ] PerfHost        C:\Windows\SysWow64\perfhost.exe
15:00:17.0217 0x096c  PerfHost - ok
15:00:17.0326 0x096c  [ 70B39E7241F750A248798CE82C44596D, 54A72199EB277EE586611DCBC21654786FD2196F91D5884C4F531297893CC3EC ] pla            C:\Windows\system32\pla.dll
15:00:17.0467 0x096c  pla - ok
15:00:17.0482 0x096c  [ 2C02AFF8383D893F8DBEB07A84F6E77C, 7CC34BAC67E2988E3D16DD6EB6F6785CD2460E3EF7FBD0BD5F86E49793BD473E ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
15:00:17.0513 0x096c  PlugPlay - ok
15:00:17.0529 0x096c  [ 4570F8A37D221660F3A09D6F4DD4BA94, 0EA190CFFA53DF9CCA2D53A4EF1BCB837BA3F2489A3AC5BD11F6D6ED811D118E ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
15:00:17.0576 0x096c  PNRPAutoReg - ok
15:00:17.0638 0x096c  [ 26657F3B4F39A0E64AF859278B599C4E, 3DD65E0BCEF3045DBA29FB8171CA3FCC9781AED3A1C7A160CF26388CE80A3683 ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
15:00:17.0685 0x096c  PNRPsvc - ok
15:00:17.0732 0x096c  [ 0FF8507A8B901B904E98EB36B9E347EE, FE4A9A6159A8490F3155D166656748722EFDEDCDC447C09155A5AD6D9F5D294D ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
15:00:17.0779 0x096c  PolicyAgent - ok
15:00:17.0795 0x096c  [ C8DD82C3035E60D671B8CC5DF128D3A9, 6AABF632CBEDA9A7B553BC9134FF100CB6FDC88000D499D2883408FCEDD97576 ] Power          C:\Windows\system32\umpo.dll
15:00:17.0842 0x096c  Power - ok
15:00:17.0873 0x096c  [ E075CC071022BD4E9BE7C024717C0E0A, BE65A8C1082AE8DF8C37CA06B2BCC521478AC153EA7388B03F7FAE3913920E75 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
15:00:17.0904 0x096c  PptpMiniport - ok
15:00:18.0107 0x096c  [ F6EA63145C20A23732AD2CA1EBA65FA1, 0DD1164D37C1500258E9CCCE458778A3DA196D9A65919B2672E3C88383068F52 ] PrintNotify    C:\Windows\system32\spool\drivers\x64\3\PrintConfig.dll
15:00:18.0389 0x096c  PrintNotify - ok
15:00:18.0420 0x096c  [ ECD373F9571C745894367CC2635EA44F, E08B2A1017DAE1BF10B986DAFAD14BDE20D79703E0EF3A8C700A3753908C1392 ] Processor      C:\Windows\System32\drivers\processr.sys
15:00:18.0451 0x096c  Processor - ok
15:00:18.0482 0x096c  [ 6E409D818C6B342544EAE741B1422B85, B4ADFB7809FC42C432C984C3AC13FAFD1B7AD53BCC7FB16E86371DE4C829DD1A ] ProfSvc        C:\Windows\system32\profsvc.dll
15:00:18.0545 0x096c  ProfSvc - ok
15:00:18.0560 0x096c  [ FC0141B4A5AD6D637D883C1A89FC45C5, DCE8942C02EEDAE7A57707CA60CAC3A8CD6BA68E6571E405CA882D4DD6D69E43 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
15:00:18.0607 0x096c  Psched - ok
15:00:18.0638 0x096c  [ DAA9DEE0A5D5F238C4EE54C2C7FB67C5, 7EC8C603BD92699AC35BDCD294F13BEE90D5C2C195FD93A3F16928BFCF53CA93 ] QWAVE          C:\Windows\system32\qwave.dll
15:00:18.0701 0x096c  QWAVE - ok
15:00:18.0732 0x096c  [ 83868EB2924E6BC21A54337C65D614D1, 8D1BE01EBD190231153B867C32120DC8FBFBD32050448A778134D435D76A0B07 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
15:00:18.0763 0x096c  QWAVEdrv - ok
15:00:18.0779 0x096c  [ B337B1F1E82A83E20A1743E008E25C0F, A2E8AF041B4CAB78AEE28A2147A189FF0F9D2FCEFB167D60FBBA0A787A5A5BE7 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
15:00:18.0810 0x096c  RasAcd - ok
15:00:18.0826 0x096c  [ D5ECE7E7F349EB3C4B152AFF3577280D, 3A5D3E440D1ED72D654BBFE30A73667F055C0AD04375C22C202F21BF75B612B2 ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
15:00:18.0857 0x096c  RasAgileVpn - ok
15:00:18.0873 0x096c  [ 044638489B4A5FE5334F46C5314A0826, E06CC2A9EF369794DAD69FBB5AFD1676D4283DDAB2AD5E3EFE454C473F62F955 ] RasAuto        C:\Windows\System32\rasauto.dll
15:00:18.0920 0x096c  RasAuto - ok
15:00:18.0951 0x096c  [ 235624C147E3CB4C288D5D3D8E8D64A2, B3F182019DBAD9C761FE9F62EAED34AD5902B41A13A766D814FC3E2EA29D8D92 ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
15:00:18.0982 0x096c  Rasl2tp - ok
15:00:19.0060 0x096c  [ 15C0034561FE5B03FA376F1A6232478B, 0F9B5C2BD7D8803FF3C5ED957D3F0859F2A59B74510E4659FBF05EDCBF230208 ] RasMan          C:\Windows\System32\rasmans.dll
15:00:19.0107 0x096c  RasMan - ok
15:00:19.0123 0x096c  [ 5247F308C4103CDC4FE12AE1D235800A, E567CD33CA1897D53795E071B7AFBAF98B2C8F725F8BED0BA90F5EF611520E48 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
15:00:19.0170 0x096c  RasPppoe - ok
15:00:19.0185 0x096c  [ 41F631007A158FEBB67F0E2AD1601BBA, EB5EA7277F4178BC27E55BF850AEBCD84B6BED80B2383CFB29548824AAFED135 ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
15:00:19.0217 0x096c  RasSstp - ok
15:00:19.0248 0x096c  [ D67ED4AB59D1EF66B05AD1A81AC28B26, 72E750A9A6B484D8BEDE52FA6DABEF4D95765DE491152E1F6C856D0590B50C28 ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
15:00:19.0310 0x096c  rdbss - ok
15:00:19.0326 0x096c  [ 6B21EBF892CD8CACB71669B35AB5DE32, 0AD8E14FEF16FB2559F5FC8AFBC9D49E4E24F43CF65F480DBF9FAB593269B419 ] rdpbus          C:\Windows\System32\drivers\rdpbus.sys
15:00:19.0373 0x096c  rdpbus - ok
15:00:19.0404 0x096c  [ 680C1DAE268B6FB67FA21B389A8B79EF, 856911F77BDD8830C3D683EBE8AF399FB3A54C7D8D0B34EA37D903377F0A39BD ] RDPDR          C:\Windows\system32\drivers\rdpdr.sys
15:00:19.0451 0x096c  RDPDR - ok
15:00:19.0482 0x096c  [ BC8A79C625568DDB7DCA49D0C2741A64, AB0A7ED9EC2282EC0356D27EA4F70515943E41C2112428B787636B8BEC278933 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
15:00:19.0514 0x096c  RdpVideoMiniport - ok
15:00:19.0545 0x096c  [ A26AEC49F318FEE141DDDB2C5F99B3E6, 246AD79FF27E79DEDCB0AAA7C22A8EA6349DEDAC863413A1E378E68FD94C9C4F ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
15:00:19.0592 0x096c  rdyboost - ok
15:00:19.0654 0x096c  [ 2D39BCFA4DD1081B8F282B623456B858, DD8C433B66B6661F4DBD1784CBD334441B508BE84932DD443F7AD51CEA192BA9 ] ReFS            C:\Windows\system32\drivers\ReFS.sys
15:00:19.0748 0x096c  ReFS - ok
15:00:19.0779 0x096c  [ 5B1F724CBCA8E08DC9D4C158C9BC1C1C, D5B170CF4B5420213130E151AFBBD9B84C5F7E710F5F67066E07095DEC1BD4B9 ] RegSrvc        C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
15:00:19.0795 0x096c  RegSrvc - ok
15:00:19.0826 0x096c  [ DF78648AC3C8DC9D70E6714AF785382F, 56E104939ED0AB5B26AE07BAB1BBB7D15828DBD3A2AD35361423D7ADDA4BA551 ] RemoteAccess    C:\Windows\System32\mprdim.dll
15:00:19.0873 0x096c  RemoteAccess - ok
15:00:19.0889 0x096c  [ AC8785B53F8436058C90450DA1840AE7, CC1FFC2713910211F8A6AD532DBB9253ACD188CBD784F1BE6613DF382825A3C1 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
15:00:19.0951 0x096c  RemoteRegistry - ok
15:00:19.0982 0x096c  [ DC66AE45816614D2999DCD3834DCCC4E, 1C26225135E851DDD1307F52401DD7055B26B3F3B8FDD693B21042C2896E235A ] RFCOMM          C:\Windows\System32\drivers\rfcomm.sys
15:00:20.0014 0x096c  RFCOMM - ok
15:00:20.0029 0x096c  [ 65B9FDE300A6DECC03BA44C4616DCAD6, CAD992982733DD20282A3453DC4E554AE1FC077C35479C0CA4E8BC3A9DCD3BB0 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
15:00:20.0076 0x096c  RpcEptMapper - ok
15:00:20.0076 0x096c  [ A737B433ABAF3F2DCB2BD7B4CC582B26, 3B5706B0CF0969A9F82060FD4DCC745F2D83C066B663FE8A4F0F493B64032C9C ] RpcLocator      C:\Windows\system32\locator.exe
15:00:20.0139 0x096c  RpcLocator - ok
15:00:20.0201 0x096c  [ 7830CEA509693DE0817DF2F3F2D80E89, 7B1786CD225E2D6BCFA484D0BFB81DD162D5713EAEC80C53317CC6950E3D17F3 ] RpcSs          C:\Windows\system32\rpcss.dll
15:00:20.0279 0x096c  RpcSs - ok
15:00:20.0295 0x096c  [ 2D05A5508F4685412F2B89E8C2189ABC, 82F12B4E0E73411A121EFD35FBD3B44CBBC0AE96ACFBB45D8C3C3777E2EA320D ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
15:00:20.0342 0x096c  rspndr - ok
15:00:20.0389 0x096c  [ 9CF8593B62102545CB1652A1D8748FDD, 818639795720A7567CCE01EBC24A0119BFDCEA1B7A5ED4A11B5012D763C1B5CC ] RSUSBSTOR      C:\Windows\System32\Drivers\RtsUStor.sys
15:00:20.0420 0x096c  RSUSBSTOR - ok
15:00:20.0554 0x096c  [ 9F2A38C1170594CF493283CE0B987B70, 1CE15815DD54227C3C8ED4B2E4FA09EB3EB91D55379DC286AAC7A6001850CA98 ] RTL8168        C:\Windows\system32\DRIVERS\Rt630x64.sys
15:00:20.0695 0x096c  RTL8168 - ok
15:00:20.0836 0x096c  [ B0A0260A3C03156937ECDB67CE5C6FE5, 88102D22976398599FA6165E9DBC1213EF2A001C99602E2195C9A7BAB0A127D7 ] RtlWlanu        C:\Windows\system32\DRIVERS\rtwlanu.sys
15:00:20.0961 0x096c  RtlWlanu - ok
15:00:20.0976 0x096c  [ 1A063730F221B2746FF00457AE17E4F0, 39A3C258CBFE3BC566C63528C9020A3BC9409736AE5289C08A7BA471D8409263 ] s3cap          C:\Windows\System32\drivers\vms3cap.sys
15:00:21.0007 0x096c  s3cap - ok
15:00:21.0007 0x096c  [ 382100E75B6F4668AEAEF228C6CEFFAD, 9C7229F10F11D18E1FED6395391A46225A84B421034B9AB6F81AF7430FDC556F ] SamSs          C:\Windows\system32\lsass.exe
15:00:21.0039 0x096c  SamSs - ok
15:00:21.0070 0x096c  [ C624A1B32211C3166EDB3F4AB02A30B7, 6B2A4607DB52D74242787ED9DF9067058983D310431D8612D2B0236E6201E681 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
15:00:21.0101 0x096c  sbp2port - ok
15:00:21.0132 0x096c  [ 74A3B67F03877D06B09B1B40C5ED582E, A8FF9BF416F0BF365BFB4E1796859825C811A74B5E54DDDCE8345193BEEBE206 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
15:00:21.0179 0x096c  SCardSvr - ok
15:00:21.0211 0x096c  [ 8B9C4D55B4A536FB01C360DDB9533574, 9B939FE68F6F9C171ED0D91E2CE1E67515295D34EC23606BCDFD097DCC8CFD4A ] ScDeviceEnum    C:\Windows\System32\ScDeviceEnum.dll
15:00:21.0257 0x096c  ScDeviceEnum - ok
15:00:21.0273 0x096c  [ 13BEA6C882D4D877A5A85CA149C86BC1, 8E9BE5C2A36D5881D9985C3A31309FE03966EA13A3541D3C5B542AB67FA0D55F ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
15:00:21.0304 0x096c  scfilter - ok
15:00:21.0398 0x096c  [ 3151A020E03DDE31AAC49F35C5EFB4DB, 5ABB1103009979F86C862357E28F37C2744979F2C99F7CF6ABB4EB1B8416B3F6 ] Schedule        C:\Windows\system32\schedsvc.dll
15:00:21.0523 0x096c  Schedule - ok
15:00:21.0539 0x096c  [ 41C0D7B1A6D4AD119BA6AC0487EA5C8E, 516C2B34BA7507D0DA4148B4ABC0A8C36286570D4EA5C60B28647B1249C15018 ] SCPolicySvc    C:\Windows\System32\certprop.dll
15:00:21.0570 0x096c  SCPolicySvc - ok
15:00:21.0601 0x096c  [ C54B6B2170BF628FD42F799A66956D75, BCF460A124CAA6F1F1A9A7BCBDCC2D5E39B0404D96B7C9FFAC806E041782B91E ] sdbus          C:\Windows\System32\drivers\sdbus.sys
15:00:21.0648 0x096c  sdbus - ok
15:00:21.0664 0x096c  [ 0B1E929D11A8E358106955603FAC65E8, A5EC91BFC0873EC6AB1D0DB4E91654BD35339BD680E7E82DA2DC64996B4AE515 ] sdstor          C:\Windows\System32\drivers\sdstor.sys
15:00:21.0679 0x096c  sdstor - ok
15:00:21.0695 0x096c  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\Windows\system32\drivers\secdrv.sys
15:00:21.0742 0x096c  secdrv - ok
15:00:21.0757 0x096c  [ 6627154693B6C2B8A59727F5B38728E8, F08251EE3436400295F120D48F3763E6F11BBF4132D674AD3E8112B6B3538455 ] seclogon        C:\Windows\system32\seclogon.dll
15:00:21.0804 0x096c  seclogon - ok
15:00:21.0820 0x096c  [ 81FE9A81EDF8016816C9E91FBFBF7D35, 87FB92A3D15F312F0B9C423EF851061A944B013E5668D8C9A441B4DC0EB690AF ] SENS            C:\Windows\System32\sens.dll
15:00:21.0851 0x096c  SENS - ok
15:00:21.0882 0x096c  [ 6E4012AE67F09F867EF620C8D5524C0B, 63933E51F8E413E63481369CE2F9FD224560550FBD3BD2B4573E9F4AD88708A2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
15:00:21.0945 0x096c  SensrSvc - ok
15:00:21.0961 0x096c  [ DB2FF24CE0BDD15FE75870AFE312BA89, 7DB0D978C92CD0A0A81F7AB46FE323B4929CEA01585B0F330921E6DFA7DE1B85 ] SerCx          C:\Windows\system32\drivers\SerCx.sys
15:00:21.0976 0x096c  SerCx - ok
15:00:21.0992 0x096c  [ 0044B31F93946D5D41982314381FE431, 95B8A94BA9EF770F29ACD5B23D447EC2B6CF1CB3D0030343BA1550AC31F6E2A5 ] SerCx2          C:\Windows\system32\drivers\SerCx2.sys
15:00:22.0023 0x096c  SerCx2 - ok
15:00:22.0039 0x096c  [ 1F0135949A6AD6025F363F80FE268251, DB2D503863143F2251E589F7B0B3E9FBF997D7333D54C55856590B5080B5513D ] Serenum        C:\Windows\System32\drivers\serenum.sys
15:00:22.0070 0x096c  Serenum - ok
15:00:22.0086 0x096c  [ 81633C87B42B63BA484A6177179AC750, A22BA40E9EC74E88D8098CBDC954E1D63B832FCB789E3C7B731DE5DA39BEE2CA ] Serial          C:\Windows\System32\drivers\serial.sys
15:00:22.0179 0x096c  Serial - ok
15:00:22.0179 0x096c  [ 148195AE95D9BC7375A08846439FDAC1, 3A2F78FD18AA7A6D659921E19335E943894530874AC5AB5E7219CEF28FA54F7A ] sermouse        C:\Windows\System32\drivers\sermouse.sys
15:00:22.0211 0x096c  sermouse - ok
15:00:22.0273 0x096c  [ 389458EA0B5FAEBA325FAC47B9ED589E, F7F37A1F1E912069F65E4629FF733F080AE675DF6FE255AF48F5E23EB47D0622 ] SessionEnv      C:\Windows\system32\sessenv.dll
15:00:22.0382 0x096c  SessionEnv - ok
15:00:22.0398 0x096c  [ 472B7A5AC181C050888DB454663DD764, C950A8615D57BFD455E18880398350642B2E1D6B951EC9754FD8D429F3418835 ] sfloppy        C:\Windows\System32\drivers\sfloppy.sys
15:00:22.0414 0x096c  sfloppy - ok
15:00:22.0445 0x096c  [ 8081FF3DAE8159FE8956B09BC29CE983, AC0F305AEE8B1AB2E1275F1D33EC1D2F3E23F234F831BD9D41F415A94A19D3AB ] SharedAccess    C:\Windows\System32\ipnathlp.dll
15:00:22.0507 0x096c  SharedAccess - ok
15:00:22.0601 0x096c  [ 7FD9A61A3523A61FC135D61D6E160314, 409E1CF7A62FD90CBC31AEAFBB7230B02DBEC6CFCA2D266D221A7643FAEBA13B ] ShellHWDetection C:\Windows\System32\shsvcs.dll
15:00:22.0711 0x096c  ShellHWDetection - ok
15:00:22.0726 0x096c  [ 2F518D13DD6F3053837FE606F1A2EA1F, 64109296CE95BD233525688A350D575CF97B9464659AA07CF78B307B6ADBC835 ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys
15:00:22.0742 0x096c  SiSRaid2 - ok
15:00:22.0757 0x096c  [ 1AC9A200A9C49C4508F04AAFFCA34A3F, 972BCB2A39169155F74111FAC74ACCD8F50E34EADCF087833B0980827627BBF4 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
15:00:22.0789 0x096c  SiSRaid4 - ok
15:00:22.0789 0x096c  [ 1C429BC6FC2BE9D2158EC9D0FAAC041B, E49869D630055ADCE987857569C546E02BEFC08DFBC58E894BABDBC112C662AC ] SmbDrv          C:\Windows\System32\drivers\Smb_driver_AMDASF.sys
15:00:22.0804 0x096c  SmbDrv - ok
15:00:22.0836 0x096c  [ BAB947E6E0665EFACDDA2723268227FD, 6D52308E9DFA13B67607F99743B6332CE2DA00AF961A067E3F1313738D2BA7C5 ] SmbDrvI        C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys
15:00:22.0851 0x096c  SmbDrvI - ok
15:00:22.0867 0x096c  [ 3C84DCCE5B322F745A75CA8BA3A0F6B3, 1FB94A8A1C63D6FDB82E28ED5B696B3CB1F64183A89A3B5153B266C292CB7815 ] smphost        C:\Windows\System32\smphost.dll
15:00:22.0929 0x096c  smphost - ok
15:00:22.0945 0x096c  [ D0EB0DF8C603BBA084351A92732B1CBE, E24ED8F78EF41C1BC17386AE4BBCE0DC892C5B89B12C03FC9FB61D359B13F1B4 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
15:00:22.0992 0x096c  SNMPTRAP - ok
15:00:23.0054 0x096c  [ 546B88E6906EE9813EFE314DC95E3488, FC172C2DCC7ACDBBC9CE07CFCBAEDFAEAD2641A037E126174525DBE8BA660CC4 ] spaceport      C:\Windows\system32\drivers\spaceport.sys
15:00:23.0101 0x096c  spaceport - ok
15:00:23.0132 0x096c  [ F337BE11071818FC3F5DC2940B6BDE34, D5CFF00E5DF37045F71AEE101AC9B270EBB29F372F404757B58600E9966C7E4D ] SpbCx          C:\Windows\system32\drivers\SpbCx.sys
15:00:23.0164 0x096c  SpbCx - ok
15:00:23.0226 0x096c  [ FCB156A6745631A67DEA61827061D483, 9275ABFA1E1E595969A71C0DA228D18D1B868BF46E097E1276142BD80F8A32C9 ] Spooler        C:\Windows\System32\spoolsv.exe
15:00:23.0320 0x096c  Spooler - ok
15:00:23.0695 0x096c  [ F264662C057A54AA2DE41B3C7551712F, 2C123C6ACD967CDF1AD2855187CF3D8357B16A4FD9C2F18AE54CFA384165FA11 ] sppsvc          C:\Windows\system32\sppsvc.exe
15:00:24.0179 0x096c  sppsvc - ok
15:00:24.0226 0x096c  [ 36B082C7A764A34FB1DC72D975870B61, 572CB632D9FDC1183F7BF8BFCBC51765C647945E0C13D1C91ADE3D0E76DF83BC ] srv            C:\Windows\system32\DRIVERS\srv.sys
15:00:24.0304 0x096c  srv - ok
15:00:24.0351 0x096c  [ F5849909D4B29B4E3D4445F943E5C7E3, 3FCA1423753716FE1AFDD27EE1E13C4D779A3C976185B5C998EF1A9A39BFC186 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
15:00:24.0445 0x096c  srv2 - ok
15:00:24.0476 0x096c  [ FABC49666708EA562549E78E6FBF3191, BE1FEBFC259308B39C727915C41A67CD50720A6E2A68D148F4F2F926AED43B02 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
15:00:24.0523 0x096c  srvnet - ok
15:00:24.0554 0x096c  [ CF6C3037839CF78421A94F9060C2886F, CA98C180AE03F5BE8FEFFBA75BD98DEE2AD4FA975E1EF83215C9CD2476946811 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
15:00:24.0601 0x096c  SSDPSRV - ok
15:00:24.0632 0x096c  [ 198A737DBA666F4808D62E9A8277A6B7, 90B6E5E2ACE95D850C913A3A1DA1F966C44955C530004C228FA93B2A536F5C27 ] SstpSvc        C:\Windows\system32\sstpsvc.dll
15:00:24.0679 0x096c  SstpSvc - ok
15:00:24.0711 0x096c  [ 592FF34A2FD6C6351B8A3AA76B2C0A9E, 152B7472DE531AC45492F562DD470B2CE33F1EEF13BC78F26046AE5ABF54E32F ] ssudmdm        C:\Windows\system32\DRIVERS\ssudmdm.sys
15:00:24.0742 0x096c  ssudmdm - ok
15:00:24.0773 0x096c  [ 366DEA74BBA65B362BCCFC6FC2ADFD8B, 4D28122AB9D8DAB724021E6513B4474BD34FCEDF47769B1D27AC7551FCA002F8 ] stexstor        C:\Windows\system32\drivers\stexstor.sys
15:00:24.0789 0x096c  stexstor - ok
15:00:24.0836 0x096c  [ 63E9CE568CF1192771A5F0460DE7D2B9, C27B21FD2C14AD41A59EF62EB8AC95C08EB13CCB1CEECD8378B8CDD4DC352E69 ] stisvc          C:\Windows\System32\wiaservc.dll
15:00:24.0914 0x096c  stisvc - ok
15:00:24.0945 0x096c  [ 0ED2E318ABB68C1A35A8B8038BDB4C90, 5C3ABC245F4BCFE64E646D9C0E2F5E211244956C84D03084C71FF6A7E0CDED30 ] storahci        C:\Windows\system32\drivers\storahci.sys
15:00:24.0976 0x096c  storahci - ok
15:00:25.0007 0x096c  [ 8B9486B64E5FC17FB9CC04CA10B77A34, C1EAC9D27DC83E4C56B890D97988C3CCFAE3877309610601F2E3FFFE97686D43 ] storflt        C:\Windows\system32\drivers\vmstorfl.sys
15:00:25.0023 0x096c  storflt - ok
15:00:25.0039 0x096c  [ 0EDD1F4D470C775740625B06A60C9DD5, 94964D0A793B1C984E87095249EE383A5E669D05BA6BF9F655587887E6CE3C19 ] stornvme        C:\Windows\system32\drivers\stornvme.sys
15:00:25.0070 0x096c  stornvme - ok
15:00:25.0086 0x096c  [ A45F5AC9D8069D0EC66E3CA73103073B, 996788F1C58E016E8E5CF3FD1D220A3C40AFFD6C21361A34636415DB12E0D381 ] StorSvc        C:\Windows\system32\storsvc.dll
15:00:25.0132 0x096c  StorSvc - ok
15:00:25.0132 0x096c  [ 548759755BC73DAD663250239D7E0B9F, D31A05A8CE800B539420B6E545F1F4BF6E4B02EAF8366DE89CAF13A83C6CA48D ] storvsc        C:\Windows\system32\drivers\storvsc.sys
15:00:25.0164 0x096c  storvsc - ok
15:00:25.0179 0x096c  [ E395BE02F80A79A6CF973BA38DBB8135, 4C6F85B0EB8E7725BA720F9742561D229726C0D7C17505D1E79F19A5626F6325 ] svsvc          C:\Windows\system32\svsvc.dll
15:00:25.0226 0x096c  svsvc - ok
15:00:25.0242 0x096c  [ 65454187E0F8B6C0DCECB0287D06EC43, 87550000CF5B3C1DF3E69633934AFE8554AE40B6638F190D3185AD63F1D7A2EE ] swenum          C:\Windows\System32\drivers\swenum.sys
15:00:25.0273 0x096c  swenum - ok
15:00:25.0336 0x096c  [ 1C71D72D4997A284128FBEE770726330, 21682BDE74A1108FED1124FB1EA35A03CBFA94ABE1B89CC0FADB4DD82596C43E ] swprv          C:\Windows\System32\swprv.dll
15:00:25.0414 0x096c  swprv - ok
15:00:25.0507 0x096c  [ 5591FBDC2278E7DE20BF6E7E0E24AEEF, 47883703837206DC4E84B4870BFE9F8D989DDD3204F74435DC8A966BBDC88524 ] SynTP          C:\Windows\system32\DRIVERS\SynTP.sys
15:00:25.0554 0x096c  SynTP - ok
15:00:25.0648 0x096c  [ 7E85DB0463AD2403AE84AD162B162279, 996C42ECAFC6E24C623068AFAFCC0A2612526333AF9315F7536C6D40C2570632 ] SysMain        C:\Windows\system32\sysmain.dll
15:00:25.0773 0x096c  SysMain - ok
15:00:25.0836 0x096c  [ D73DBBB96CEE90C2856164AAD8543425, D11ADB5D4C5DD355314CA656D375D0062CAE7462E866F94F1B26D5803F65DCB2 ] SystemEventsBroker C:\Windows\System32\SystemEventsBrokerServer.dll
15:00:25.0898 0x096c  SystemEventsBroker - ok
15:00:25.0914 0x096c  [ D6A71B95ACF71ACA63B67232059F1BCD, C5CEC032E7AB507500D1CC7A4E65DA6322412C798201A9D770CBDE892E50DFC8 ] TabletInputService C:\Windows\System32\TabSvc.dll
15:00:25.0961 0x096c  TabletInputService - ok
15:00:26.0007 0x096c  [ 5A5BAB1CA9621E73E25EE4744B67CDA6, 479EBD7BAE1E2AD431153FDC016742F7A8D824716EAB1A4CA87EBBD21D61DECD ] TapiSrv        C:\Windows\System32\tapisrv.dll
15:00:26.0070 0x096c  TapiSrv - ok
15:00:26.0336 0x096c  [ 2F10C145F517419E17203632FCDA0A13, 143F5837AE79E3EDB98F17A4661ECD5BCBFEB317077286B51E765560339B53A8 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
15:00:26.0617 0x096c  Tcpip - ok
15:00:26.0773 0x096c  [ 2F10C145F517419E17203632FCDA0A13, 143F5837AE79E3EDB98F17A4661ECD5BCBFEB317077286B51E765560339B53A8 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
15:00:26.0929 0x096c  TCPIP6 - ok
15:00:26.0945 0x096c  [ 41CF802064F72E55F50CA0A221FD36D4, 70ABCDF9E96611E8C83042C581575E26649FE479475E8E118CD3FF6CB1C84C3F ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
15:00:26.0992 0x096c  tcpipreg - ok
15:00:27.0023 0x096c  [ E0BD2D83875464FEEEB242CBA8B7E073, A3067165128F36035FA9F3CBA55CFED736E180C495497FA7332B3D97908C3D90 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
15:00:27.0054 0x096c  tdx - ok
15:00:27.0070 0x096c  [ 232D185D2337F141311D0CF1983E1431, 02EB56D3F26174AF1741C1A444CE30DE84D5BAF583C1A52C7A953BCC52445547 ] terminpt        C:\Windows\System32\drivers\terminpt.sys
15:00:27.0101 0x096c  terminpt - ok
15:00:27.0179 0x096c  [ C50997E282576DA492EBA66B059D4196, EBD793CB396F9503376207FA60353F5672DEDB620C8E01C8D6AE0030B3B03339 ] TermService    C:\Windows\System32\termsrv.dll
15:00:27.0304 0x096c  TermService - ok
15:00:27.0320 0x096c  [ 2180DBCE75B914E5E5BBFFFAAE97AA21, 8000AECC8855903DB50ABA7E304396D1FCEAE8DC9ADD4FC50275CF24B4D914DE ] Themes          C:\Windows\system32\themeservice.dll
15:00:27.0367 0x096c  Themes - ok
15:00:27.0382 0x096c  [ 4C5179DB61B9E14BEC15CDC4B152B2E9, 9048BEC7AD6A3F4B640E99B1F0365AC9A46740B188758FBB2C160EF30AD6E64B ] THREADORDER    C:\Windows\system32\mmcss.dll
15:00:27.0398 0x096c  THREADORDER - ok
15:00:27.0429 0x096c  [ B5ED9CC61798C7D44BD535D40B89EFB5, 1BDCEAA9AF2096381870D92129C748F4EE06A1167ABA9367B9DD43BAF27E3F5B ] TimeBroker      C:\Windows\System32\TimeBrokerServer.dll
15:00:27.0492 0x096c  TimeBroker - ok
15:00:27.0539 0x096c  [ 80A2FC1A089A71F2DBE5D8394FFB009F, DEA30E751F6EA42E43E16869713FC7E37832B15DAFA0062B1798DFA476981385 ] TPM            C:\Windows\system32\drivers\tpm.sys
15:00:27.0570 0x096c  TPM - ok
15:00:27.0586 0x096c  [ 884113C2BB703FE806C8608B75F34831, 24DE5750CA4363455412BABB0B1FAB08497153E8F158ED44958F100410F93506 ] TrkWks          C:\Windows\System32\trkwks.dll
15:00:27.0632 0x096c  TrkWks - ok
15:00:27.0648 0x096c  [ 44A94FB4C76528D2382FFE04B05827C3, B0BCDF7CD1D65E61A9061D539D83527A89B69583958F8A26C6BF9766C1B61E0C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
15:00:27.0695 0x096c  TrustedInstaller - ok
15:00:27.0726 0x096c  [ BF8F54CA37E9C9D6582C31C5761F8C93, 337C566792F6FB9B7FD5D1D4384B767CFE4CF5DBB2E4688CCC36CBB018A0DD0F ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
15:00:27.0773 0x096c  TsUsbFlt - ok
15:00:27.0789 0x096c  [ 20185BEB7512EDE4EFECDFA148AC9F99, 6F539478493C0F87F3DDF67A4A6D4D41E9474EEF21434E856350CE149A34EA9F ] TsUsbGD        C:\Windows\System32\drivers\TsUsbGD.sys
15:00:27.0851 0x096c  TsUsbGD - ok
15:00:28.0133 0x096c  [ 2143A0EEF6A52AC90E703A38AA635A48, 047EA162392427E2034FDD359ED932F7CBC4C2EA0471A5124869F2D9588A9D76 ] TuneUp.UtilitiesSvc C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
15:00:28.0258 0x096c  TuneUp.UtilitiesSvc - ok
15:00:28.0289 0x096c  [ DB3C912A851FCA6358FED4D53DAA7E91, B35375EC9AF61D829489D9B278605E2098D6402419E79EB24C65D3B65816AEBC ] TuneUpUtilitiesDrv C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys
15:00:28.0304 0x096c  TuneUpUtilitiesDrv - ok
15:00:28.0320 0x096c  [ E85916632CD3B9E9B546968DB950BF42, DECE3852C763CC6293C7D1B772296C43A0AE1E47BBCC4979C96B3B2AD70413F3 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
15:00:28.0367 0x096c  tunnel - ok
15:00:28.0382 0x096c  [ F6EEAD052943B5A3104C1405BB856C54, FE422813E6C1012E9F392EFF2AE4C6D3A4DBD9CB2BD5E6A5CAB57D4E89A29468 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
15:00:28.0414 0x096c  uagp35 - ok
15:00:28.0414 0x096c  [ FE6067B1FD4E63650C667B33D080565B, 2C330ED00E49BA55E25564230E0DFB8A35F2B5320EB18D4AF7CAACFA9A449044 ] UASPStor        C:\Windows\System32\drivers\uaspstor.sys
15:00:28.0445 0x096c  UASPStor - ok
15:00:28.0461 0x096c  [ 807F8CF3E973305FC435C61CBBEE2A49, 43CDEAC2BFC5091C11DFC0E7F7171AF9A598AE56CB056C3CF382AE7807F79EF0 ] UCX01000        C:\Windows\System32\drivers\ucx01000.sys
15:00:28.0492 0x096c  UCX01000 - ok
15:00:28.0508 0x096c  [ C61EAF8E1E4B2F62BA4FDF457440B2C6, 961F76A789925234AC27F56AAE34556FA06088D71580B42C24B0BC209EAFD67E ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
15:00:28.0586 0x096c  udfs - ok
15:00:28.0586 0x096c  [ 9578691F297E1B1F519970FE6D47CB21, 080C352AAF22A16A4F3C4AB4DCEA5BFA656457C73F735CEBA30516FDACCF6301 ] UEFI            C:\Windows\System32\drivers\UEFI.sys
15:00:28.0601 0x096c  UEFI - ok
15:00:28.0617 0x096c  [ A867F0F978EE64C87FADC3B100869EE4, 2686BE85F963D0D0BB275E92E5B543280D8742CF10772303E3189D0719B6A277 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
15:00:28.0664 0x096c  UI0Detect - ok
15:00:28.0679 0x096c  [ 5EAB5117DDB24FC4D39E6FFFCF1837B9, 2BC709240867F161E94BE6625A04F478EAAA3EEE7BC7C37ED0DFA9EEA5928E98 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
15:00:28.0695 0x096c  uliagpkx - ok
15:00:28.0711 0x096c  [ DA34C39A18E60E7C3FA0630566408034, 2F162504214053894C72760D9933D01DBF3578609FE5E2376C3272818599FE32 ] umbus          C:\Windows\System32\drivers\umbus.sys
15:00:28.0742 0x096c  umbus - ok
15:00:28.0742 0x096c  [ AE8294875E5446E359B1E8035D40C05E, AE0357BAB47C07C3576BC76951CD258C009BC5A1B93259D2122A841BD9CDA8FA ] UmPass          C:\Windows\System32\drivers\umpass.sys
15:00:28.0773 0x096c  UmPass - ok
15:00:28.0789 0x096c  [ A023F267A262D5DA6CE1436D9C5E8FD9, 92AD7AF91184C244A7E392F49663143193A80D5D81114546A00F18227DE31D23 ] UmRdpService    C:\Windows\System32\umrdp.dll
15:00:28.0836 0x096c  UmRdpService - ok
15:00:28.0867 0x096c  [ C98493DD8E6A50154FAC75C15E1C36BB, CECD1C826C8F7AF05468871BF6A0ACDBB6B0202F4F87F48C6D367E5BD699E800 ] upnphost        C:\Windows\System32\upnphost.dll
15:00:28.0929 0x096c  upnphost - ok
15:00:28.0945 0x096c  [ FF78D053A05E5A394F4E3C1816CC65A8, 5DAE02414271231F5FDBB751AFEB99874779B467947020815D4AE54432D4269D ] usbccgp        C:\Windows\System32\drivers\usbccgp.sys
15:00:28.0961 0x096c  usbccgp - ok
15:00:28.0976 0x096c  [ 0139248F6B95CF0D837B5B46A2722D40, 38E3E704E0364F07732DB418AEBD126B040FB3CDB7D78EA36E8605D50D528A80 ] usbcir          C:\Windows\System32\drivers\usbcir.sys
15:00:29.0023 0x096c  usbcir - ok
15:00:29.0054 0x096c  [ C996CBEF922B5653A01E3F50DDCE2F86, 231EB5A36E7EE242197E796D3B4AB12F945D2C8570587BC8D57D45530A0C59B4 ] usbehci        C:\Windows\System32\drivers\usbehci.sys
15:00:29.0070 0x096c  usbehci - ok
15:00:29.0117 0x096c  [ CD81683F4553677B9BF5163A922153EB, 6B304B0D68B9BFF0245EC755CDAAF9DF59DF3A081727E32CB66672929F0DBC50 ] usbhub          C:\Windows\System32\drivers\usbhub.sys
15:00:29.0164 0x096c  usbhub - ok
15:00:29.0211 0x096c  [ 5C90D5379B53590FBB24BBAD4FA682EE, DC036340510C1C0999AB1CB845F8E6EB8B7696BAC9BBE6E936454C0000D1E9D4 ] USBHUB3        C:\Windows\System32\drivers\UsbHub3.sys
15:00:29.0273 0x096c  USBHUB3 - ok
15:00:29.0289 0x096c  [ A0F0484C97D6441ED6A75D7426ECCC9E, FF928ADE1C5464E581BF929F7383D5762D110EA6C7E31A6F0887EA7357ADBEFE ] usbohci        C:\Windows\System32\drivers\usbohci.sys
15:00:29.0336 0x096c  usbohci - ok
15:00:29.0336 0x096c  [ 4D655E3B684BE9B0F7FFD8A2935C348C, 3A7FC1748C5AEA8CFE0E7C22ADC77E3DCA475455FC16D9C6A5C16EB5E949A516 ] usbprint        C:\Windows\System32\drivers\usbprint.sys
15:00:29.0383 0x096c  usbprint - ok
15:00:29.0398 0x096c  [ 9D168BFA334D47BE404367EB58D4E130, 23279CBE6ACBD074E7B268BA2EDA14E2255C41F8117173B2BBE653D8259ECFA2 ] USBSTOR        C:\Windows\System32\drivers\USBSTOR.SYS
15:00:29.0429 0x096c  USBSTOR - ok
15:00:29.0445 0x096c  [ FC974B03C8B87455F44F734C8F31A3C8, D69F6EE8030F7DF96FF151D9EAA6AE65417ACAC5A267C7DB96E9611D5BC42D2C ] usbuhci        C:\Windows\System32\drivers\usbuhci.sys
15:00:29.0476 0x096c  usbuhci - ok
15:00:29.0508 0x096c  [ 5C8F604F6DC74177CDD8372D7B1ADFF0, C1DE9A37A7A01CCCBFCE13C1E5B26683F620AB21EDA5A14C82022E2F49C84484 ] usbvideo        C:\Windows\System32\Drivers\usbvideo.sys
15:00:29.0554 0x096c  usbvideo - ok
15:00:29.0586 0x096c  [ 44603DA5A87FB491EF59C889EBBB4DDB, 59AA9B6B0B5D66F9312CD3F999D0D9F12F1A2C5D230365AD7287CD71FD86961C ] USBXHCI        C:\Windows\System32\drivers\USBXHCI.SYS
15:00:29.0633 0x096c  USBXHCI - ok
15:00:29.0648 0x096c  [ 8F6990AC3BC7D0AD476780680EAB6AC7, 4AEC2960B41BA45A11B7FE910BDEFF2C0180B1196271AA657D3D074BE71BCFFC ] UxTuneUp        C:\Windows\System32\uxtuneup.dll
15:00:29.0664 0x096c  UxTuneUp - ok
15:00:29.0679 0x096c  [ 382100E75B6F4668AEAEF228C6CEFFAD, 9C7229F10F11D18E1FED6395391A46225A84B421034B9AB6F81AF7430FDC556F ] VaultSvc        C:\Windows\system32\lsass.exe
15:00:29.0711 0x096c  VaultSvc - ok
15:00:29.0711 0x096c  [ FEB26E3B8345A7E8D62F945C4AE86562, 3AAFE87C402FC8E92542DFE60EC9540559863065F88D429A16D7B1BF829223FF ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
15:00:29.0742 0x096c  vdrvroot - ok
15:00:29.0836 0x096c  [ 8A4D808D1EC7C1C47B2C8BF488A9A07A, 63C07312ADB6F8A8BDE93361C30AC63DAB4DE1141AF54630EEF11E54B0BF983D ] vds            C:\Windows\System32\vds.exe
15:00:29.0961 0x096c  vds - ok
15:00:29.0976 0x096c  [ A026EDEAA5EECAE0B08E2748B616D4BD, 2525A54DC7F49DDFBB999C22BF3FAB6D9E9F70C0806E58D81E90AC59F9F46089 ] VerifierExt    C:\Windows\system32\drivers\VerifierExt.sys
15:00:30.0007 0x096c  VerifierExt - ok
15:00:30.0070 0x096c  [ 8ABB4BABF59F092DF0B43778D8FD1884, 94C2100CE86448543A8DD586AD4A128AB9EB37959238D70F33EF59202270AC6C ] vhdmp          C:\Windows\System32\drivers\vhdmp.sys
15:00:30.0148 0x096c  vhdmp - ok
15:00:30.0164 0x096c  [ 06D38968028E9AB19DE9B618C7B6D199, 62022297A47F440D1C82CA0B0E57C0C8E9D5033D83DD3B40492B218DF65EBF68 ] viaide          C:\Windows\system32\drivers\viaide.sys
15:00:30.0195 0x096c  viaide - ok
15:00:30.0226 0x096c  [ 511AD3FF957A0127E6BD336FF6F89C38, 55325BFD0857A1204F7F6F8ED8C91C07B0E20A50402105708E7365ECD9E25A21 ] vmbus          C:\Windows\system32\drivers\vmbus.sys
15:00:30.0258 0x096c  vmbus - ok
15:00:30.0258 0x096c  [ DA40BEA0A863CE768C940CA9723BF81F, 567C0C3F422325635808B0CF76E05D3B6187F96845C33F85F92F98C9FE53A5B8 ] VMBusHID        C:\Windows\System32\drivers\VMBusHID.sys
15:00:30.0289 0x096c  VMBusHID - ok
15:00:30.0320 0x096c  [ C42C38E15C0DC39D4B0BDF34F733E468, 7264680C44FA68BB1FC0A490FE3988AFDE19892295F7458943D8CBEE6C01D4F0 ] vmicguestinterface C:\Windows\System32\ICSvc.dll
15:00:30.0398 0x096c  vmicguestinterface - ok
15:00:30.0429 0x096c  [ C42C38E15C0DC39D4B0BDF34F733E468, 7264680C44FA68BB1FC0A490FE3988AFDE19892295F7458943D8CBEE6C01D4F0 ] vmicheartbeat  C:\Windows\System32\ICSvc.dll
15:00:30.0476 0x096c  vmicheartbeat - ok
15:00:30.0523 0x096c  [ C42C38E15C0DC39D4B0BDF34F733E468, 7264680C44FA68BB1FC0A490FE3988AFDE19892295F7458943D8CBEE6C01D4F0 ] vmickvpexchange C:\Windows\System32\ICSvc.dll
15:00:30.0570 0x096c  vmickvpexchange - ok
15:00:30.0601 0x096c  [ C42C38E15C0DC39D4B0BDF34F733E468, 7264680C44FA68BB1FC0A490FE3988AFDE19892295F7458943D8CBEE6C01D4F0 ] vmicrdv        C:\Windows\System32\ICSvc.dll
15:00:30.0664 0x096c  vmicrdv - ok
15:00:30.0695 0x096c  [ C42C38E15C0DC39D4B0BDF34F733E468, 7264680C44FA68BB1FC0A490FE3988AFDE19892295F7458943D8CBEE6C01D4F0 ] vmicshutdown    C:\Windows\System32\ICSvc.dll
15:00:30.0742 0x096c  vmicshutdown - ok
15:00:30.0789 0x096c  [ C42C38E15C0DC39D4B0BDF34F733E468, 7264680C44FA68BB1FC0A490FE3988AFDE19892295F7458943D8CBEE6C01D4F0 ] vmictimesync    C:\Windows\System32\ICSvc.dll
15:00:30.0836 0x096c  vmictimesync - ok
15:00:30.0867 0x096c  [ C42C38E15C0DC39D4B0BDF34F733E468, 7264680C44FA68BB1FC0A490FE3988AFDE19892295F7458943D8CBEE6C01D4F0 ] vmicvss        C:\Windows\System32\ICSvc.dll
15:00:30.0929 0x096c  vmicvss - ok
15:00:30.0945 0x096c  [ 436E1A724E7E683F6B612D3D58F04241, 939B5EF0090DF3759295F88402FD0EA33F499DDA9F89E5D0E90D1F9AED65D491 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
15:00:30.0961 0x096c  volmgr - ok
15:00:30.0992 0x096c  [ CCB9E901F7254BF96D28EB1B0E5329B7, F0E3CA4EFA544CDAEF4092284CF3EC7DF07F806A770285E281816457AD8813F5 ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
15:00:31.0039 0x096c  volmgrx - ok
15:00:31.0086 0x096c  [ 17F7B0F2298D97F4B6C7A69511033D3D, 5BDFC225F31553786726808FB7952940FC05CA72B3977D684056F42AFAA59565 ] volsnap        C:\Windows\system32\drivers\volsnap.sys
15:00:31.0133 0x096c  volsnap - ok
15:00:31.0164 0x096c  [ DAC438FB5FF85A9E72806E2341D5D732, B1D1EFCA8C588A6BF53CEC941CC59702C366F15C7D5943431736EC857E57C0A2 ] vpci            C:\Windows\System32\drivers\vpci.sys
15:00:31.0195 0x096c  vpci - ok
15:00:31.0211 0x096c  [ 4539F45F9F4C9757A86A56C949421E07, DEC362314B2C66414F39354AFE79C02B18BF4EEF90787FB58307F6EB62237E2C ] vsmraid        C:\Windows\system32\drivers\vsmraid.sys
15:00:31.0242 0x096c  vsmraid - ok
15:00:31.0336 0x096c  [ D0CBA7B3531CCF2ADB985856D5F92434, 7FCBBCAF1AA85DCE8D75FB38DC4848AE12E8DD913CEBBC37BCD3D0123F0A3CAB ] VSS            C:\Windows\system32\vssvc.exe
15:00:31.0492 0x096c  VSS - ok
15:00:31.0523 0x096c  [ 0849B7260F26FE05EA56DED0672E2F4B, 7EAC0E7988F45CB4133A15932955B7B03CE715C967A3BAC9999D81543EBCAEC5 ] VSTXRAID        C:\Windows\system32\drivers\vstxraid.sys
15:00:31.0554 0x096c  VSTXRAID - ok
15:00:31.0570 0x096c  [ 71066FF95C487327E44C8AF1B72EBE8B, EA2729126B452CAE0C80D07501779D804B08E47F1217B61D53277B40869FEC25 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
15:00:31.0664 0x096c  vwifibus - ok
15:00:31.0679 0x096c  [ 29AB43937FFDA0B0FB56984226E698C6, 6A1A559964FE5D594E54988C46149969E6FFD5A8D5A6862E14648B608794CC29 ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
15:00:31.0726 0x096c  vwififlt - ok
15:00:31.0742 0x096c  [ 8B8624A93E3F88CB923AEB05B6313227, 2856B63CD376BF2B1A9129581E7B9207588D4EAFD29A2C8D98F176FEAFDE26A9 ] vwifimp        C:\Windows\system32\DRIVERS\vwifimp.sys
15:00:31.0773 0x096c  vwifimp - ok
15:00:31.0804 0x096c  [ DC821E811EFBB65CDD77FBB8B6ECA385, B7C8AACDF81DBA298F2F384983D36B269876C31F0398D89BF9070217A069B96F ] W32Time        C:\Windows\system32\w32time.dll
15:00:31.0883 0x096c  W32Time - ok
15:00:31.0898 0x096c  [ 0910AB9ED404C1434E2D0376C2AD5D8B, 62585CA5F1375BDA440D28D5DF1ADDC9DE3DDFA196D49BBFF3456A5A09EE1C6B ] WacomPen        C:\Windows\System32\drivers\wacompen.sys
15:00:31.0929 0x096c  WacomPen - ok
15:00:31.0945 0x096c  [ 6505C9E72910F91D4C317EECF22D1DE6, 838BAEA6F0BBA916B3291EB165F65DA2F4EC35395678D450EEEB1E540A123FC4 ] Wanarp          C:\Windows\system32\DRIVERS\wanarp.sys
15:00:31.0976 0x096c  Wanarp - ok
15:00:31.0992 0x096c  [ 6505C9E72910F91D4C317EECF22D1DE6, 838BAEA6F0BBA916B3291EB165F65DA2F4EC35395678D450EEEB1E540A123FC4 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
15:00:32.0023 0x096c  Wanarpv6 - ok
15:00:32.0133 0x096c  [ 841345442390953CBC8801B95D3D0540, FD4F9FD2C4C60A1A580177FFF2E9035009AC6A38E78D4236B0ED4773E3B263EE ] wbengine        C:\Windows\system32\wbengine.exe
15:00:32.0304 0x096c  wbengine - ok
15:00:32.0367 0x096c  [ 0F1DFA2FED73FA78B8C3CDE332A870F6, 1089F6F585F5350D349A640EBD3117832DF6B3657EB6667CB00AE217E04ACA17 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
15:00:32.0461 0x096c  WbioSrvc - ok
15:00:32.0523 0x096c  [ 0EAEC313B24837613621B4A2536ED382, 61C194ED7FA7D65BBE61A546D5FCA52F52AB08324E084D3EC23C9706E9BF0175 ] Wcmsvc          C:\Windows\System32\wcmsvc.dll
15:00:32.0601 0x096c  Wcmsvc - ok
15:00:32.0648 0x096c  [ F6B4C2280FF7C7156AC8A4687B9DA35E, 1899D584D7469BB49355D84080051E2575B033E6312009D9C6C1DD3F7F9AA4C5 ] wcncsvc        C:\Windows\System32\wcncsvc.dll
15:00:32.0711 0x096c  wcncsvc - ok
15:00:32.0742 0x096c  [ B7BF1D783F5B2484E8CE1C0C78257F16, 468601199FCCF63DBAE86EE6B8825EA85B2A1EE177413353FFA2CC9CA5249FCD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
15:00:32.0820 0x096c  WcsPlugInService - ok
15:00:32.0836 0x096c  [ 694B28DE12AD47031FFB4B052662131A, FF3B1B1A69C82BB123073E10D9F1322ED8587F5BAC36F8AB7DAED22C7DD5C7DB ] WdBoot          C:\Windows\system32\drivers\WdBoot.sys
15:00:32.0851 0x096c  WdBoot - ok
15:00:32.0914 0x096c  [ CB6C63FF8342B467E2EF76E98D5B934D, BE017CE91E3BAB293DE6ECF143797CCE3F33CC63024437472B4E38C6961AD884 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
15:00:32.0992 0x096c  Wdf01000 - ok
15:00:33.0008 0x096c  [ 0B99529A3BECC3528D865DDECB62503B, 28E6B44BDC52E212D2EB269491D3574B45EE9B19821FE15167D7FA05566C89F4 ] WdFilter        C:\Windows\system32\drivers\WdFilter.sys
15:00:33.0054 0x096c  WdFilter - ok
15:00:33.0070 0x096c  [ F581F9C9D6953FABFA24E67105F0B614, 5A7BB72523D1C53BBE68700537D7AE0D150BC7E4B8227A916B2E29EE4CA267A9 ] WdiServiceHost  C:\Windows\system32\wdi.dll
15:00:33.0117 0x096c  WdiServiceHost - ok
15:00:33.0117 0x096c  [ F581F9C9D6953FABFA24E67105F0B614, 5A7BB72523D1C53BBE68700537D7AE0D150BC7E4B8227A916B2E29EE4CA267A9 ] WdiSystemHost  C:\Windows\system32\wdi.dll
15:00:33.0148 0x096c  WdiSystemHost - ok
15:00:33.0164 0x096c  [ 282E7D46310338FF4A6B7680440EB0DA, 04242798DD82F583154AEA3D775C9BFD574FC471D01CDEB9D070872425094D82 ] WdNisDrv        C:\Windows\system32\Drivers\WdNisDrv.sys
15:00:33.0195 0x096c  WdNisDrv - ok
15:00:33.0211 0x096c  WdNisSvc - ok
15:00:33.0258 0x096c  [ A70CAF5EA36CBA5FCA24244306D4D5C6, 76C3E20B62B89D9699A1E817377FAD70B144B877BCC5C850A5B64CC68184D8DA ] WebClient      C:\Windows\System32\webclnt.dll
15:00:33.0321 0x096c  WebClient - ok
15:00:33.0351 0x096c  [ 384E1D04FE20845B2559D292F17A9FA1, AD3B0B2B2219691AC30FEEC8AFDB3BBB74B51BB7D02038AE2B4DEA514E245315 ] Wecsvc          C:\Windows\system32\wecsvc.dll
15:00:33.0398 0x096c  Wecsvc - ok
15:00:33.0414 0x096c  [ 455014F4E48B67EBE0F032E2B0E06BF2, A36435784A034B27056A0E606683A20C69F1B0AB2B6BAEDEAEAA190F6287CAEF ] WEPHOSTSVC      C:\Windows\system32\wephostsvc.dll
15:00:33.0461 0x096c  WEPHOSTSVC - ok
15:00:33.0476 0x096c  [ F13DBA57CEA9B7074B95EDCA6AD2635E, 1D9BA4841EF1343A5D9096B5FE27FC65DC1901D6683DD13516171638549666B5 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
15:00:33.0570 0x096c  wercplsupport - ok
15:00:33.0586 0x096c  [ FD7E58B6AA3EABF2D12B9762A20E11E4, 4C5E2E246C5C70074866BB3DBC2AAF483ECE4345004CCB8D1FE285047268685D ] WerSvc          C:\Windows\System32\WerSvc.dll
15:00:33.0633 0x096c  WerSvc - ok
15:00:33.0648 0x096c  [ 715ABA3DD164D06457A2A3C92F6EA9D5, E6F8269D2FFC4A548B65724C0A3F53756ED15E47229861FBD40B656EE40FE166 ] WFPLWFS        C:\Windows\system32\DRIVERS\wfplwfs.sys
15:00:33.0679 0x096c  WFPLWFS - ok
15:00:33.0695 0x096c  [ 8C840E1FD7584E74BD0CC1EA581EC187, 148E534A94B4882E7396B13FABE17407802292E7890713540080D03D5629C81D ] WiaRpc          C:\Windows\System32\wiarpc.dll
15:00:33.0726 0x096c  WiaRpc - ok
15:00:33.0758 0x096c  [ 5F66B7BB330AA80067FC66149A692620, 92C5D7115A168A23108B65EEEB5FBA8FA43D781855355792596D2419160263C2 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
15:00:33.0773 0x096c  WIMMount - ok
15:00:33.0789 0x096c  WinDefend - ok
15:00:33.0851 0x096c  [ 0E70990EC2E5D2331AA5E88DB0CFB826, 79DFF565C3FCBC691E8FEB669CEC00E340FD2A2AFA4488D23A7CC63A2A98A5C1 ] WinHttpAutoProxySvc C:\Windows\system32\winhttp.dll
15:00:33.0945 0x096c  WinHttpAutoProxySvc - ok
15:00:33.0976 0x096c  [ FC8BD690321216C32BB58B035B6D5674, D61698DB19D9DB2593B60B6BA13F7B7735667206F41D751D507135469D6D3CDD ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
15:00:34.0054 0x096c  Winmgmt - ok
15:00:34.0242 0x096c  [ 427873F889F2F508BE8BE982219CE578, CA8DCFB774BF0F747295A7A0CB46A6177DE12AD6BD58266182206C41A3C9001E ] WinRM          C:\Windows\system32\WsmSvc.dll
15:00:34.0523 0x096c  WinRM - ok
15:00:34.0539 0x096c  [ 3AF1FA17F1C4ACBDB660D8F98B1A9C13, 99B0851410B462685F6705EBF832D10943FB9634030B02D15BF5D0C66F26F2C2 ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
15:00:34.0586 0x096c  WinUsb - ok
15:00:34.0695 0x096c  [ DC079BA8390089E4EBCA63D27EEA3ECB, 4D549217A68292E2B16C09FD9F84317011EE54A2DAF4E2AB85554267DF0D3249 ] WlanSvc        C:\Windows\System32\wlansvc.dll
15:00:34.0836 0x096c  WlanSvc - ok
15:00:35.0008 0x096c  [ 06BF5897949A8F24893F792E876B71F5, 9D3719492A86BF52A56E2EA798FD6FDB5862A03F6D360FCC4B0CEA9BE9792AE4 ] wlidsvc        C:\Windows\system32\wlidsvc.dll
15:00:35.0133 0x096c  wlidsvc - ok
15:00:35.0148 0x096c  [ 2834D9D3B4F554A39C72F00EA3F0E128, D10124343C67FE9A0B711AD569BB8080495FCEA0ECEF9AC3F3FBD6865F436A44 ] WmiAcpi        C:\Windows\System32\drivers\wmiacpi.sys
15:00:35.0179 0x096c  WmiAcpi - ok
15:00:35.0211 0x096c  [ B96F7A1236C3F21212DE2C40A3DDB005, 5A29EBB6DA036E303611EB1304192655021405BB05452FD37886DDE604FF0D9D ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
15:00:35.0258 0x096c  wmiApSrv - ok
15:00:35.0273 0x096c  WMPNetworkSvc - ok
15:00:35.0289 0x096c  [ 7FC5667DF73D4B04AA457CC3A4180E09, CB7B014945DCA16B6D120DBE0E5876C4C867A4ACD3C3536AEADC14B908613D4E ] Wof            C:\Windows\system32\drivers\Wof.sys
15:00:35.0320 0x096c  Wof - ok
15:00:35.0445 0x096c  [ EDFA5CEDBE174FAAA4A09A6B297AEA42, 5998FE15462E4AD9C7B1444E5E2C17BD470DA3A5D474A0A118E02E47DADC678A ] workfolderssvc  C:\Windows\system32\workfolderssvc.dll
15:00:35.0586 0x096c  workfolderssvc - ok
15:00:35.0617 0x096c  [ A2468CC3509394A33C4C32F99563D845, 62690C7D41F382DF74B8F4B942647842858E37DE35FF2DE028192E4D09ABB2C5 ] wpcfltr        C:\Windows\system32\DRIVERS\wpcfltr.sys
15:00:35.0633 0x096c  wpcfltr - ok
15:00:35.0664 0x096c  [ 19F4DF69876DA7E9C4965351560FE6B7, 127247A7964F55EE3AF842D25120F5ACD387632BEE2BF3D28FAC05840CEA19BA ] WPCSvc          C:\Windows\System32\wpcsvc.dll
15:00:35.0711 0x096c  WPCSvc - ok
15:00:35.0726 0x096c  [ DBDCE2378F65F0A07D4644AC103037E7, 99714F0CD31297C9831BAF04768F467F6E0BF710C859CEDCA83069226BF1A68A ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
15:00:35.0789 0x096c  WPDBusEnum - ok
15:00:35.0804 0x096c  [ 9F2904B55F6CECCD1A8D986B5CE2609A, E19ED4DD3CEF3A22C058FC324824604FB3FC98A029C94E6C2A3389F938D680B6 ] WpdUpFltr      C:\Windows\system32\drivers\WpdUpFltr.sys
15:00:35.0836 0x096c  WpdUpFltr - ok
15:00:35.0836 0x096c  [ AE072B0339D0A18E455DC21666CAD572, AB1DAEA25E2C7AD610818D4B4783F6D4190D85EBB3963BBAD410E8CEA7899EDB ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
15:00:35.0867 0x096c  ws2ifsl - ok
15:00:35.0898 0x096c  [ 501D5EFAB9711039479AE48401386D2B, C8C1184DE93E9D2C4E8A60E4E9980745C4E5470E5DA9B59165D18705330ADEFE ] wscsvc          C:\Windows\System32\wscsvc.dll
15:00:35.0945 0x096c  wscsvc - ok
15:00:35.0961 0x096c  WSearch - ok
15:00:36.0179 0x096c  [ 6B2D71124C1EA86B74412F414C42431D, 078CC6C9667EF6BDA3E6900BC26A5A5B030CAA66928A6BBB7B7DC43C5C199EDC ] WSService      C:\Windows\System32\WSService.dll
15:00:36.0414 0x096c  WSService - ok
15:00:36.0664 0x096c  [ F3F60C88A6BBC8D0C68FE5B1C91181AF, AF9A4D282CD4BB1127BC3F48AB89DC294408D96F7906553C636F37D1503CFA48 ] wuauserv        C:\Windows\system32\wuaueng.dll
15:00:36.0961 0x096c  wuauserv - ok
15:00:36.0992 0x096c  [ 481286719402E4BAEFEA0604AB1B5113, F3CF65DF2AB39F79AE4C1335831408418E40726706E0242677E8B96B0FAD988F ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
15:00:37.0039 0x096c  WudfPf - ok
15:00:37.0086 0x096c  [ D7B4859227B02BCC1055B279A63C937F, 82C99844CC596C2723523B1B98573488FF23337947B78AA04BA21E58394BB751 ] WUDFRd          C:\Windows\System32\drivers\WUDFRd.sys
15:00:37.0133 0x096c  WUDFRd - ok
15:00:37.0148 0x096c  [ D7B4859227B02BCC1055B279A63C937F, 82C99844CC596C2723523B1B98573488FF23337947B78AA04BA21E58394BB751 ] WUDFSensorLP    C:\Windows\System32\drivers\WUDFRd.sys
15:00:37.0179 0x096c  WUDFSensorLP - ok
15:00:37.0211 0x096c  [ 51D28F7F1F888DDCF2C67DCF3B79A5D3, 74FF2936AFCEB9A36175D5B00EB91A5AD614B52BE3FB3FA9B994A025A484D2B7 ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
15:00:37.0273 0x096c  wudfsvc - ok
15:00:37.0289 0x096c  [ D7B4859227B02BCC1055B279A63C937F, 82C99844CC596C2723523B1B98573488FF23337947B78AA04BA21E58394BB751 ] WUDFWpdFs      C:\Windows\System32\drivers\WUDFRd.sys
15:00:37.0320 0x096c  WUDFWpdFs - ok
15:00:37.0336 0x096c  [ D7B4859227B02BCC1055B279A63C937F, 82C99844CC596C2723523B1B98573488FF23337947B78AA04BA21E58394BB751 ] WUDFWpdMtp      C:\Windows\system32\DRIVERS\WUDFRd.sys
15:00:37.0367 0x096c  WUDFWpdMtp - ok
15:00:37.0414 0x096c  [ A0900F8F628B5AF6841414EB3CF11E50, 8A531F2472FF4B4D895D469D28C215C834ECADBEF539894B8F3F606079A86184 ] WwanSvc        C:\Windows\System32\wwansvc.dll
15:00:37.0492 0x096c  WwanSvc - ok
15:00:37.0929 0x096c  [ C4C5C3198C3261BEC89E6C3631047BAF, 78E5604B4B2A184B328C0669781DF11A35AFC04E7375CAB4DB9A48D74929137D ] ZeroConfigService C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
15:00:38.0164 0x096c  ZeroConfigService - ok
15:00:38.0195 0x096c  ================ Scan global ===============================
15:00:38.0211 0x096c  [ 3500AF0BA2EF095BF313EEB75D2366C6, C755E57B02BFA82151A182DF964349859575570EA5C3FBA81F747B8D2134A4D0 ] C:\Windows\system32\basesrv.dll
15:00:38.0242 0x096c  [ EAB311B0A7A8EA0346F14F08D4BC8F46, 11168E4074679F8A69DA714C0ABD0C68BA49D171B379343F14783C9C563202CA ] C:\Windows\system32\winsrv.dll
15:00:38.0273 0x096c  [ 3600ED7EA8AED849E20700551C0BD63B, 4A8C346C1646E80B58EF93F87F915A41E05CA2E993BB1C96955AE62A0669AF66 ] C:\Windows\system32\sxssrv.dll
15:00:38.0304 0x096c  [ E0C7813A97CA7947FF5C18A8F3B61A45, 083BB4F3B20419C87DB656F1465E5F782ACDE76838CDE6207F26AAD035C69DE0 ] C:\Windows\system32\services.exe
15:00:38.0336 0x096c  [ Global ] - ok
15:00:38.0336 0x096c  ================ Scan MBR ==================================
15:00:38.0336 0x096c  [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk0\DR0
15:00:38.0476 0x096c  \Device\Harddisk0\DR0 - ok
15:00:38.0476 0x096c  ================ Scan VBR ==================================
15:00:38.0492 0x096c  [ 5BF8AE4EEB294644522E361E89B347D6 ] \Device\Harddisk0\DR0\Partition1
15:00:38.0492 0x096c  \Device\Harddisk0\DR0\Partition1 - ok
15:00:38.0492 0x096c  [ C31DE1E56AAB082E960210D96C44C42E ] \Device\Harddisk0\DR0\Partition2
15:00:38.0492 0x096c  \Device\Harddisk0\DR0\Partition2 - ok
15:00:38.0508 0x096c  [ B1E27AA018409DE6BFD73F8AFB883A65 ] \Device\Harddisk0\DR0\Partition3
15:00:38.0508 0x096c  \Device\Harddisk0\DR0\Partition3 - ok
15:00:38.0508 0x096c  [ C41D304B4B0E4A9AF9F9EA39F49C590D ] \Device\Harddisk0\DR0\Partition4
15:00:38.0508 0x096c  \Device\Harddisk0\DR0\Partition4 - ok
15:00:38.0523 0x096c  [ 79527E98DD6ECD7BC8479F834B899188 ] \Device\Harddisk0\DR0\Partition5
15:00:38.0523 0x096c  \Device\Harddisk0\DR0\Partition5 - ok
15:00:38.0523 0x096c  [ 70D5882E683E1ABCC4BA02A79B1A735B ] \Device\Harddisk0\DR0\Partition6
15:00:38.0539 0x096c  \Device\Harddisk0\DR0\Partition6 - ok
15:00:38.0539 0x096c  ================ Scan generic autorun ======================
15:00:38.0555 0x096c  [ BAD24090378CD1D9D70DD21CF21D1BFB, A5FB5F8DCF33BB252304D6DA7CB62906E5A437A561A066A647C8D199EE3C57B8 ] C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe
15:00:38.0570 0x096c  IAStorIcon - detected UnsignedFile.Multi.Generic ( 1 )
15:00:38.0898 0x096c  Detect skipped due to KSN trusted
15:00:38.0898 0x096c  IAStorIcon - ok
15:00:38.0914 0x096c  BTMTrayAgent - ok
15:00:38.0976 0x096c  [ 1775BDBEF28FD1B0F0AC43F10F483E08, F7E6C3177CFFABF605CC86F585CBF1DE541732DD92F92D1AB97B9BFFB3F2C5A6 ] C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe
15:00:39.0054 0x096c  Nvtmru - ok
15:00:39.0070 0x096c  SynTPEnh - ok
15:00:39.0820 0x096c  [ 16438B000BF56F2CD7FDB5E6C3B38C7E, 32D6E69E6367D3ADB2189DA89103CB9910CE791EFB0879515DDD380A96D85BAE ] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
15:00:40.0758 0x096c  RtHDVCpl - ok
15:00:40.0883 0x096c  [ AF69A9A2556617801630965F52224F63, 243CD3E6FCD38B1577E637ACE2FF40F78919E0C5E9D0F26FB5C711A9145316DD ] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
15:00:40.0976 0x096c  RtHDVBg_Dolby - ok
15:00:41.0039 0x096c  [ 19BED3BBFBC6F9996F17818BB8D8EB85, AA80DC37278ED59B3DD4A5CD080678213CD8B19A95BC755C4775B9016789C9ED ] C:\Windows\system32\igfxtray.exe
15:00:41.0070 0x096c  IgfxTray - ok
15:00:41.0133 0x096c  [ D347BF7C38FEE4C3D95851C14B086BF8, 6D776CA27515B41E1965B10C076325A6B6B0185065572527D8DB8DE4620F5813 ] C:\Windows\system32\hkcmd.exe
15:00:41.0195 0x096c  HotKeysCmds - ok
15:00:41.0258 0x096c  [ 3E6D2FD2E81007DFC4BD373A70A93E25, B541B97F4E6261EC251A03B272C803EDF33C7F78B2671ECF281C8E09705078FB ] C:\Windows\system32\igfxpers.exe
15:00:41.0304 0x096c  Persistence - ok
15:00:41.0445 0x096c  [ 4E9AF25BA5E8219310E384AEA5B0EED8, 743062F755E7A88BA394E96CA26A988CCFDF73B441B779B3149D54A769CBC411 ] C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
15:00:41.0461 0x096c  CLMLServer_For_P2G8 - ok
15:00:41.0508 0x096c  [ 40A558E0B7913E7909CDABEA182F8A06, 9B67B8660FEC730F259C4438559CFBDE66427F58BEEF508BACCCB2C00C45A934 ] C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe
15:00:41.0555 0x096c  CLVirtualDrive - ok
15:00:41.0570 0x096c  [ 0966408A384E8B0FE57B0008E18D561C, 045AB5798CAFA7D27E7D02F780B3508EBF34C0991C8EF166A61CF869D9399B70 ] C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
15:00:41.0601 0x096c  RemoteControl10 - ok
15:00:41.0617 0x096c  [ 02E1E65A7E36D6A3A8A30451612DC0DF, 5984D7DD4AD77D40856EC4FF5047AD277FD00CBB886B863DD970765DA7E39C79 ] C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
15:00:41.0648 0x096c  YouCam Service - ok
15:00:41.0679 0x096c  Dropbox - ok
15:00:41.0726 0x096c  [ CD0362AEE36CFE1EF5DF973230742E67, 9F1D8AD4E09D16C39CD6A35CB298456468C1808226FFA8AD65BF9562A6ECC07D ] C:\Program Files (x86)\PDF24\pdf24.exe
15:00:41.0758 0x096c  PDFPrint - ok
15:00:41.0773 0x096c  Power2GoExpress8 - ok
15:00:41.0836 0x096c  [ F51BB12D8977D26C1A4CDA348770D9F1, DDA35CD8F8A6591B83821B5180D457740E0B820CCE000BC7FB1B78FB4AEAD3BA ] C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe
15:00:41.0930 0x096c  SpybotPostWindows10UpgradeReInstall - detected UnsignedFile.Multi.Generic ( 1 )
15:00:42.0242 0x096c  Detect skipped due to KSN trusted
15:00:42.0242 0x096c  SpybotPostWindows10UpgradeReInstall - ok
15:00:42.0242 0x096c  Waiting for KSN requests completion. In queue: 161
15:00:43.0289 0x096c  AV detected via SS2: Windows Defender, C:\Program Files\Windows Defender\MSASCui.exe ( 4.3.9600.16384 ), 0x60100 ( disabled : updated )
15:00:43.0289 0x096c  Win FW state via NFP2: enabled ( trusted )
15:00:43.0414 0x096c  ============================================================
15:00:43.0414 0x096c  Scan finished
15:00:43.0414 0x096c  ============================================================
15:00:43.0414 0x12dc  Detected object count: 1
15:00:43.0414 0x12dc  Actual detected object count: 1
15:01:10.0945 0x12dc  GFNEXSrv ( UnsignedFile.Multi.Generic ) - skipped by user
15:01:10.0945 0x12dc  GFNEXSrv ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 05.01.2017 16:50
Adware/Junkware/Toolbars entfernen

Alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!
Virenscanner jetzt vor dem Einsatz dieser Tools bitte komplett deaktivieren!

1. Schritt: adwCleaner

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).




2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


Schnuckibaer 05.01.2017 21:27
Code:
# AdwCleaner v6.041 - Bericht erstellt am 05/01/2017 um 21:17:51
# Aktualisiert am 16/12/2016 von Malwarebytes
# Datenbank : 2017-01-05.2 [Server]
# Betriebssystem : Windows 8.1  (X64)
# Benutzername : Denise - WOMBAT
# Gestartet von : C:\Users\Denise\Downloads\AdwCleaner_6.041.exe
# Modus: Löschen
# Unterstützung : https://www.malwarebytes.com/support



***** [ Dienste ] *****



***** [ Ordner ] *****



***** [ Dateien ] *****



***** [ DLL ] *****



***** [ WMI ] *****



***** [ Verknüpfungen ] *****



***** [ Aufgabenplanung ] *****



***** [ Registrierungsdatenbank ] *****

[-] Schlüssel gelöscht: HKU\.DEFAULT\Software\jhtrsq
[-] Schlüssel gelöscht: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\Software\AppDataLow\Software\adawarebp
[#] Schlüssel mit Neustart gelöscht: HKU\S-1-5-18\Software\jhtrsq
[#] Schlüssel mit Neustart gelöscht: HKCU\Software\AppDataLow\Software\adawarebp
[-] Schlüssel gelöscht: HKLM\SOFTWARE\jhtrsq
[#] Schlüssel mit Neustart gelöscht: [x64] HKCU\Software\AppDataLow\Software\adawarebp
[-] Schlüssel gelöscht: [x64] HKLM\SOFTWARE\jhtrsq


***** [ Browser ] *****



*************************

:: "Tracing" Schlüssel gelöscht
:: Winsock Einstellungen zurückgesetzt
:: Proxy Einstellungen zurückgesetzt
:: Internet Explorer Richtlinien gelöscht
:: Chrome Richtlinien gelöscht

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [8781 Bytes] - [26/12/2016 15:56:21]
C:\AdwCleaner\AdwCleaner[C2].txt - [1507 Bytes] - [05/01/2017 21:17:51]
C:\AdwCleaner\AdwCleaner[S0].txt - [8745 Bytes] - [26/12/2016 15:54:08]
C:\AdwCleaner\AdwCleaner[S1].txt - [1857 Bytes] - [05/01/2017 21:16:02]

########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt - [1726 Bytes] ##########
Und hier die JRT-Datei
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.0 (12.05.2016)
Operating System: Windows 8.1 x64
Ran by Denise (Administrator) on 05.01.2017 at 21:23:12,37
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 8

Successfully deleted: C:\ProgramData\Start Menu\Programs\tuneup utilities 2014 (Folder)
Successfully deleted: C:\ProgramData\Start Menu\Programs\tuneup utilities 2014.lnk (Shortcut)
Successfully deleted: C:\Users\Denise\AppData\Local\crashrpt (Folder)
Successfully deleted: C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\user.js (File)
Successfully deleted: C:\Users\Denise\AppData\Roaming\spi (Folder)
Successfully deleted: C:\Users\Public\Desktop\tuneup utilities 2014.lnk (Shortcut)
Successfully deleted: C:\Windows\system32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 (Task)
Successfully deleted: C:\Windows\wininit.ini (File)

Deleted the following from C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\prefs.js
user_pref(browser.search.searchengine.uid, ST1000LM014-1EJ164_W380TBM4XXXXW380TBM4);
user_pref(browser.urlbar.suggest.searches, true);



Registry: 0





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 05.01.2017 at 21:25:36,02
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

cosinus 05.01.2017 22:08
Dann zeig mal frische FRST Logs. Haken setzen bei addition.txt dann auf Untersuchen klicken

http://www.trojaner-board.de/picture...&pictureid=611

Schnuckibaer 05.01.2017 22:17
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.0 (12.05.2016)
Operating System: Windows 8.1 x64
Ran by Denise (Administrator) on 05.01.2017 at 21:23:12,37
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 8

Successfully deleted: C:\ProgramData\Start Menu\Programs\tuneup utilities 2014 (Folder)
Successfully deleted: C:\ProgramData\Start Menu\Programs\tuneup utilities 2014.lnk (Shortcut)
Successfully deleted: C:\Users\Denise\AppData\Local\crashrpt (Folder)
Successfully deleted: C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\user.js (File)
Successfully deleted: C:\Users\Denise\AppData\Roaming\spi (Folder)
Successfully deleted: C:\Users\Public\Desktop\tuneup utilities 2014.lnk (Shortcut)
Successfully deleted: C:\Windows\system32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 (Task)
Successfully deleted: C:\Windows\wininit.ini (File)

Deleted the following from C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\prefs.js
user_pref(browser.search.searchengine.uid, ST1000LM014-1EJ164_W380TBM4XXXXW380TBM4);
user_pref(browser.urlbar.suggest.searches, true);



Registry: 0





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 05.01.2017 at 21:25:36,02
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 01-01-2017
durchgeführt von Denise (05-01-2017 22:11:46)
Gestartet von C:\Users\Denise\Desktop\Trojanerboard
Windows 8.1 (Update) (X64) (2016-07-19 20:05:43)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-3531133450-1765533330-4211851364-500 - Administrator - Disabled)
Denise (S-1-5-21-3531133450-1765533330-4211851364-1002 - Administrator - Enabled) => C:\Users\Denise
Gast (S-1-5-21-3531133450-1765533330-4211851364-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3531133450-1765533330-4211851364-1004 - Limited - Enabled)
UpdatusUser (S-1-5-21-3531133450-1765533330-4211851364-1001 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.020.20042 - Adobe Systems Incorporated)
Adobe Digital Editions 4.5 (HKLM-x32\...\Adobe Digital Editions 4.5) (Version: 4.5.1 - Adobe Systems Incorporated)
Adobe Flash Player 23 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 23.0.0.207 - Adobe Systems Incorporated)
Amazon Kindle (HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\Amazon Kindle) (Version: 1.17.1.44183 - Amazon)
Ashampoo Snap 2017 (HKLM-x32\...\{0A11EA01-F22C-84C3-9723-53CA58DB6F9C}_is1) (Version: 1.0.1 - Ashampoo GmbH & Co. KG)
calibre (HKLM-x32\...\{F6BB454A-E737-4A1C-A5D4-0E2834E24905}) (Version: 2.62.0 - Kovid Goyal)
ConvertHelper 3.2 (HKLM\...\{27CC6AB1-E72B-4179-AF1A-EAE507EBAF52}}_is1) (Version:  - DownloadHelper)
CyberLink Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
CyberLink PowerRecover (HKLM-x32\...\InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.7.0.2103 - CyberLink Corp.)
CyberLink PowerRecover (Version: 5.7.0.2103 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Digital Plus Home Theater (HKLM\...\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.5.1.1 - Dolby Laboratories Inc)
Dropbox (HKLM-x32\...\Dropbox) (Version: 16.4.30 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.59.1 - Dropbox, Inc.) Hidden
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotogalerija (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotogalleri (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotogalleriet (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotoğraf Galerisi (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotótár (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galeria de Fotografias (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galería de fotos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galeria fotografii (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
GeForce Experience NvStream Client Components (Version: 0.1.87 - NVIDIA Corporation) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3355 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{302600C1-6BDF-4FD1-1309-148929CC1385}) (Version: 3.1.1309.0390 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.2.1000 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{105fa5c4-72e1-41f2-a82c-884d8aa4b381}) (Version: 16.6.0 - Intel Corporation)
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft Office Professional Plus 2013 - de-de (HKLM\...\ProPlusRetail - de-de) (Version: 15.0.4885.1001 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 50.1.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 50.1.0 (x86 de)) (Version: 50.1.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 50.1.0 - Mozilla)
Nero 2015 (HKLM-x32\...\{847D6818-3BA4-4F41-B5B7-4505D8E012B7}) (Version: 16.0.01300 - Nero AG)
Nero Info (HKLM-x32\...\{B791E0AB-87A9-41A4-8D98-D13C2E37D928}) (Version: 16.0.1002 - Nero AG)
NVIDIA GeForce Experience 1.6.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.6.1 - NVIDIA Corporation)
NVIDIA Graphics Driver 327.62 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.62 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA Virtual Audio 1.2.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.5 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4885.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4885.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4885.1001 - Microsoft Corporation) Hidden
PDF24 Creator 7.9.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0092 - Pegatron Corporation)
Podstawowe programy Windows Live (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Prerequisite installer (x32 Version: 16.0.0000 - Nero AG) Hidden
Raccolta foto (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.30164 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.19.726.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7076 - Realtek Semiconductor Corp.)
SHIELD Streaming (Version: 1.05.28 - NVIDIA Corporation) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.15.0 - Synaptics Incorporated)
tiptoi® Manager 3.1.6 (HKLM-x32\...\9978-5763-2995-5228) (Version: 3.1.6 - Ravensburger AG)
TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.354 - TuneUp Software) Hidden
TuneUp Utilities 2014 (HKLM-x32\...\TuneUp Utilities) (Version: 14.0.1000.354 - TuneUp Software)
TuneUp Utilities 2014 (x32 Version: 14.0.1000.354 - TuneUp Software) Hidden
Valokuvavalikoima (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
XMedia Recode Version 3.3.3.3 (HKLM-x32\...\{DDA3C325-47B2-4730-9672-BF3771C08799}_is1) (Version: 3.3.3.3 - XMedia Recode)
Συλλογή φωτογραφιών (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {0C353ECE-7C42-4EDF-9E78-7F60D3E609D4} - System32\Tasks\Nero\Nero Info => C:\Program Files (x86)\Common Files\Nero\Nero Info\NeroInfo.exe [2014-05-20] (Nero AG)
Task: {6DD7B98D-691E-4C99-A942-BB379DBA5CD9} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2016-11-01] (Microsoft Corporation)
Task: {98209A60-AC79-456E-8CFB-EA8D24C38CDD} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-09-19] (Synaptics Incorporated)
Task: {AE3A986E-65D2-4E77-82E1-2D9546986C36} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-11-01] (Microsoft Corporation)
Task: {BCEDF6AA-DC6E-47EE-A7A8-CAC36707ADC2} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-07-19] (Dropbox, Inc.)
Task: {E0948293-2279-4D6B-8E77-F3AA3CA9A980} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-11-01] (Microsoft Corporation)
Task: {E1189ACB-8FE2-4F21-B9A3-00274A542B91} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2016-11-01] (Microsoft Corporation)
Task: {E7A91B92-EF72-4400-A58F-7BA85A14B0CB} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-07-19] (Dropbox, Inc.)
Task: {FEA5CC20-2042-4BC8-A122-F29B40BF89BC} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-10-21] (Adobe Systems Incorporated)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

Shortcut: C:\Users\Denise\AppData\Local\Microsoft\Windows\ConnectedSearch\History\site_1691182358_de-de.lnk -> hxxp://www.windowssearch.com:80/suggestions?qry=spotify&cc=DE&setlang=de-DE&inlang=de-DE&adlt=moderate&scale=100&contrast=none&hw=768%2C1366&CVID=7075BBFFD9B4452CA755DE3838E3C42

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MEDIONhome.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.medion.com

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2013-11-20 15:17 - 2013-06-27 10:56 - 00160768 _____ () C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
2016-07-26 06:27 - 2016-05-24 08:51 - 00116416 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-06-25 06:53 - 2015-06-25 06:53 - 00699704 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\avgrepliba.dll
2013-11-15 16:39 - 2013-09-16 12:20 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

Da befinden sich 7922 mehr Seiten.

IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\123simsen.com -> www.123simsen.com

Da befinden sich 7922 mehr Seiten.

IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\123simsen.com -> www.123simsen.com

Da befinden sich 7922 mehr Seiten.


==================== Hosts Inhalt: ==========================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2013-08-22 14:25 - 2016-12-26 15:12 - 00454135 ____R C:\Windows\system32\Drivers\etc\hosts

127.0.0.1        clients2.google.com
127.0.0.1        v1.ff.avast.com
127.0.0.1        vlcproxy.ff.avast.com
127.0.0.1        down.baidu2016.com
127.0.0.1        123.sogou.com
127.0.0.1        www.czzsyzgm.com
127.0.0.1        www.czzsyzxl.com
127.0.0.1        union.baidu2019.com
127.0.0.1        down.baidu2016.com
127.0.0.1        123.sogou.com
127.0.0.1        www.czzsyzgm.com
127.0.0.1        www.czzsyzxl.com
127.0.0.1        union.baidu2019.com127.0.0.1        www.007guard.com
127.0.0.1        007guard.com
127.0.0.1        008i.com
127.0.0.1        www.008k.com
127.0.0.1        008k.com
127.0.0.1        www.00hq.com
127.0.0.1        00hq.com
127.0.0.1        010402.com
127.0.0.1        www.032439.com
127.0.0.1        032439.com
127.0.0.1        www.0scan.com
127.0.0.1        0scan.com
127.0.0.1        1000gratisproben.com
127.0.0.1        www.1000gratisproben.com
127.0.0.1        1001namen.com
127.0.0.1        www.1001namen.com
127.0.0.1        100888290cs.com
127.0.0.1        www.100888290cs.com

Da befinden sich 15582 zusätzliche Einträge.


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\Control Panel\Desktop\\Wallpaper -> C:\Puh\Puh Privat\Nice Day\nAKED MOUSE\Spaziergang\BILD5294.JPG
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

HKLM\...\StartupApproved\StartupFolder: => "MCtlSvc.lnk"
HKLM\...\StartupApproved\StartupFolder: => "NeroDesktopSwitcher.scf"
HKLM\...\StartupApproved\Run: => "IAStorIcon"
HKLM\...\StartupApproved\Run: => "BTMTrayAgent"
HKLM\...\StartupApproved\Run: => "Nvtmru"
HKLM\...\StartupApproved\Run: => "SynTPEnh"
HKLM\...\StartupApproved\Run: => "RtHDVCpl"
HKLM\...\StartupApproved\Run: => "RtHDVBg_Dolby"
HKLM\...\StartupApproved\Run: => "IgfxTray"
HKLM\...\StartupApproved\Run: => "HotKeysCmds"
HKLM\...\StartupApproved\Run: => "Persistence"
HKLM\...\StartupApproved\Run32: => "CLMLServer_For_P2G8"
HKLM\...\StartupApproved\Run32: => "CLVirtualDrive"
HKLM\...\StartupApproved\Run32: => "RemoteControl10"
HKLM\...\StartupApproved\Run32: => "YouCam Service"
HKLM\...\StartupApproved\Run32: => "PDFPrint"
HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\StartupApproved\Run: => "SpybotPostWindows10UpgradeReInstall"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [vm-monitoring-nb-session] => LPort=139
FirewallRules: [{C6681879-51CB-4FD8-9A84-483DBB792DD9}] => C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{BF03DCCD-DD4D-400A-83DE-6EBD26343BBF}] => LPort=2869
FirewallRules: [{DF5F9400-8B73-4381-B95F-52AF8036BC90}] => LPort=1900
FirewallRules: [{6AE7B4B4-D8EC-4095-9EDE-1D0407493CB4}] => C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{77936D80-6A89-494F-A543-3C0D774614C7}] => C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{8C8323B7-A320-497D-AA70-C0FD492FAAC6}] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
FirewallRules: [{7C57A8A5-6887-4930-B692-5BDA66AD2CE3}] => C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
FirewallRules: [{BC1581EF-EB52-4DB3-806D-6AB1A096F9F0}] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{B090FAC3-34CA-4D99-8374-176423707E40}] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{BD8567CD-18AF-4F3B-9890-47FAD209DC7A}] => C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{AD3D86C8-9D08-4282-B600-06D66D58F91E}] => C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{B1D6920A-FDB1-460D-8785-F074E9A97829}] => C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{5C60FF39-F4AA-45AB-8D65-47390638EE55}] => C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{97D0BC8D-D025-4BD4-B9AB-97DA6D31A164}] => C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{571B4EB1-F5A3-479F-B707-957C19186B6D}] => C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{C8EB4CB1-D30F-4E62-A13B-8B9D04B9CB27}] => C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{ECDACF61-2598-47B3-9446-18AF27FA44EA}] => C:\Program Files (x86)\Nero\Nero Blu-ray Player\Blu-rayPlayer.exe
FirewallRules: [{AF658A1F-622E-4246-9E9F-4386AA84635B}] => C:\Program Files (x86)\Nero\Nero Blu-ray Player\Blu-rayPlayer.exe
FirewallRules: [{F1F82B8E-47E1-4734-B764-1BE0D30FF586}] => C:\Program Files (x86)\Nero\Nero 2015\Nero Burning ROM\StartNBR.exe
FirewallRules: [{FB3533A3-2370-4DFE-83B1-5AA7E5DCC5D6}] => C:\Program Files (x86)\Nero\KM\NMDllHost.exe
FirewallRules: [{896FE7D5-BB83-4ADA-BAE8-190C9C93425A}] => C:\Program Files (x86)\Nero\Nero 2015\Nero Burning ROM\nero.exe
FirewallRules: [{590C04BB-BEBC-4F39-A26E-CA240E6AEABB}] => C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{9226EE8C-D70E-46CB-86C6-FEF3B19528C5}] => C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{5AE195CA-2F53-41A0-9EE8-7EFE42A428B2}] => C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{4393D29C-BCFA-4D99-BDFB-D052C7BABC30}] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
FirewallRules: [{E6BD649F-7312-477E-B04C-F531D47FFFE9}] => C:\Windows\system32\rundll32.exe
FirewallRules: [{DDE35257-478B-4C15-830C-F3BCA8B62E5F}] => C:\Windows\System32\rundll32.exe
FirewallRules: [{16749CA5-9553-44D1-976F-2CA2CD95A67B}] => C:\Windows\System32\rundll32.exe
FirewallRules: [{434BD66E-2F89-474B-A37A-C056D1C7F5CA}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{DBC6CABE-2B06-434E-B577-9497E53E549C}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{A3B7F349-F50C-4684-939B-1D3CACE158F2}] => C:\Windows\System32\rundll32.exe
FirewallRules: [{DEC7CDB3-D197-4AC7-955C-EC896BD4D87A}] => C:\Windows\System32\rundll32.exe

==================== Wiederherstellungspunkte =========================

04-01-2017 08:10:21 Geplanter Prüfpunkt
05-01-2017 13:38:00 AA11
05-01-2017 14:32:06 Malwarebytes Anti-Rootkit Restore Point
05-01-2017 21:23:16 JRT Pre-Junkware Removal

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (01/05/2017 09:18:51 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (01/05/2017 02:33:59 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (01/05/2017 01:42:35 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (01/04/2017 07:15:23 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (01/02/2017 04:35:14 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (12/29/2016 09:04:29 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Explorer.EXE, Version 6.3.9600.18460 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 130c

Startzeit: 01d2620c2e667e36

Endzeit: 0

Anwendungspfad: C:\Windows\Explorer.EXE

Berichts-ID: e14a6ce5-ce01-11e6-82a7-0c54a5f0a527

Vollständiger Name des fehlerhaften Pakets:

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (12/27/2016 10:03:54 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={DE254671-4ECE-4FAA-AE04-9583C6D96084}: Der Benutzer "SYSTEM" hat eine Verbindung mit dem Namen "congstar" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 797.

Error: (12/27/2016 10:01:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ZeroConfigService.exe, Version: 16.6.0.0, Zeitstempel: 0x52585e22
Name des fehlerhaften Moduls: MurocApi.dll, Version: 16.6.0.0, Zeitstempel: 0x52585cf1
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000002bcc5
ID des fehlerhaften Prozesses: 0xbec
Startzeit der fehlerhaften Anwendung: 0x01d26084408bc029
Pfad der fehlerhaften Anwendung: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
Pfad des fehlerhaften Moduls: C:\Program Files\Intel\WiFi\bin\MurocApi.dll
Berichtskennung: 932c00af-cc77-11e6-82a7-0c54a5f0a527
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (12/27/2016 10:00:14 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (12/27/2016 09:55:54 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".

Details:
AddLegacyDriverFiles: Unable to back up image of binary Bytemobile Kernel Network Provider.

System Error:
Das System kann die angegebene Datei nicht finden.
.


Systemfehler:
=============
Error: (01/05/2017 09:23:58 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "NVIDIA Streamer Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/05/2017 09:23:58 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "NVIDIA Display Driver Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/05/2017 09:18:18 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.

Modulpfad: C:\Windows\System32\IWMSSvc.dll

Error: (01/05/2017 09:18:18 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.

Modulpfad: C:\Windows\System32\IWMSSvc.dll

Error: (01/05/2017 09:18:15 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.

Modulpfad: C:\Windows\System32\IWMSSvc.dll

Error: (01/05/2017 09:17:56 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Intel(R) Capability Licensing Service Interface" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.

Error: (01/05/2017 09:17:56 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Dynamic Application Loader Host Interface Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/05/2017 09:17:56 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Nero Update" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/05/2017 09:17:56 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/05/2017 09:17:56 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.


CodeIntegrity:
===================================
  Date: 2017-01-04 20:43:31.246
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-12-26 17:22:16.672
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-12-26 16:34:58.481
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-12-26 16:13:53.405
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-12-26 16:12:21.560
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-12-25 22:41:42.989
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-12-25 22:41:42.739
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-12-25 22:41:42.489
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-12-25 22:41:41.942
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-12-25 22:41:41.692
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Speicherinformationen ===========================

Prozessor: Intel(R) Core(TM) i3-4000M CPU @ 2.40GHz
Prozentuale Nutzung des RAM: 29%
Installierter physikalischer RAM: 8100.68 MB
Verfügbarer physikalischer RAM: 5725.36 MB
Summe virtueller Speicher: 9380.68 MB
Verfügbarer virtueller Speicher: 7112.58 MB

==================== Laufwerke ================================

Drive c: (Boot) (Fixed) (Total:869.8 GB) (Free:434.07 GB) NTFS
Drive d: (Recover) (Fixed) (Total:60 GB) (Free:42.06 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: F2E9FFFD)

Partition: GPT.

==================== Ende von Addition.txt ============================

Schnuckibaer 06.01.2017 12:25
Hallo Cosinus,

ich habe per Mail folgende Benachrichtigung bekommen:
"Dies ist der Beitrag, der gerade geschrieben wurde:
***************
*FRST-Fix

Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft!*


Code:
---------
emptytemp:
---------


***************"
Habe die Nachricht hier im Board nicht gesehen, zur Sicherheit aber Malwarebytes geschlossen und erneuten Suchlauf gestartet, es sollte jetzt also kein Virenscanner aktiv gewesen sein.

Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 01-01-2017
durchgeführt von Denise (Administrator) auf WOMBAT (06-01-2017 12:17:14)
Gestartet von C:\Users\Denise\Desktop\Trojanerboard
Geladene Profile: UpdatusUser & Denise (Verfügbare Profile: UpdatusUser & Denise)
Platform: Windows 8.1 (Update) (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
() C:\Program Files (x86)\PHotkey\Atouch64.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Program Files (x86)\PHotkey\POsd.exe
() C:\Program Files (x86)\PHotkey\GPMTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.18384_none_fa1d93c39b41b41a\TiWorker.exe

==================== Registry (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-30] (Intel Corporation)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028896 2013-08-28] (NVIDIA Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2780912 2013-09-19] (Synaptics Incorporated)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13662936 2013-10-24] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1360600 2013-10-29] (Realtek Semiconductor)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111576 2013-08-05] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [490760 2013-09-23] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-11] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-09-18] (CyberLink Corp.)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [25779624 2016-12-21] (Dropbox, Inc.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [210432 2016-07-05] (Geek Software GmbH)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1
HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\Run: [Power2GoExpress8] => NA
HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\MountPoints2: {a3baa892-5369-11e6-828f-0c8bfddd15ac} - "F:\windows\Data\setup.exe"
HKU\S-1-5-18\...\Run: [AppLauncher] => C:\Program Files (x86)\Ashampoo\Ashampoo AppLauncher\AppLauncher.exe
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt9] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt10] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt9] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-11-01] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-11-01] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-11-01] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NeroDesktopSwitcher.scf [2014-01-09] ()

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{2D7D7085-9498-4093-AC34-2DBFD52ED2F0}: [DhcpNameServer] 192.168.178.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2016-10-11] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2016-11-01] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2016-07-26] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-11-01] (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2016-07-26] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default [2017-01-06]
FF Homepage: Mozilla\Firefox\Profiles\ytdyifhp.default -> www.google.de
FF Extension: (Firefox Hotfix) - C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\Extensions\firefox-hotfix@mozilla.org.xpi [2016-08-31]
FF Extension: (Video DownloadHelper) - C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2017-01-04]
FF Extension: (Adblock Plus) - C:\Users\Denise\AppData\Roaming\Mozilla\Firefox\Profiles\ytdyifhp.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-24]
FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files (x86)\congstar\Internet-Manager\Bin\addon => nicht gefunden
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_23_0_0_207.dll [2016-11-11] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_207.dll [2016-11-11] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-07-12] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2016-07-26] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-05] (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL [2014-07-24] (Nero AG)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\browser\defaults\preferences\firefox.js [2016-12-25]

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [3042032 2016-11-01] (Microsoft Corporation)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [74712 2013-03-11] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [316376 2013-03-11] (CyberLink)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-07-19] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-07-19] (Dropbox, Inc.)
R2 DbxSvc; C:\Windows\system32\DbxSvc.exe [42096 2016-12-21] (Dropbox, Inc.)
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [160768 2013-06-27] () [Datei ist nicht signiert]
S4 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-30] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [Datei ist nicht signiert]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 Intel(R) Wireless Bluetooth(R) 4.0 Radio Management; C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe [157128 2013-09-18] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2013-10-11] ()
S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14997280 2013-08-28] (NVIDIA Corporation)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2145080 2015-06-25] (TuneUp Software)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3671792 2013-10-11] (Intel® Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [140600 2013-07-22] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1390904 2013-09-05] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [118728 2013-09-18] (Intel Corporation)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [65408 2016-03-10] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
R3 NETwNb64; C:\Windows\system32\DRIVERS\NETwbw02.sys [3607520 2013-10-14] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-08-20] (NVIDIA Corporation)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R3 PegaRadioSwitch; C:\Windows\System32\drivers\PegaRadioSwitch.sys [23552 2013-08-22] (Windows (R) Win 7 DDK provider)
S3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1975000 2013-07-31] (Realtek Semiconductor Corporation                          )
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2013-09-19] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-09-19] (Synaptics Incorporated)
S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [31144 2015-06-04] (TuneUp Software)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [34760 2013-08-22] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [265056 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
S3 dbx; system32\DRIVERS\dbx.sys [X]
S3 HSPADataCardusbmdm; \SystemRoot\system32\DRIVERS\HSPADataCardusbmdm.sys [X]
S3 HSPADataCardusbnmea; \SystemRoot\system32\DRIVERS\HSPADataCardusbnmea.sys [X]
S3 HSPADataCardusbser; \SystemRoot\system32\DRIVERS\HSPADataCardusbser.sys [X]
S3 massfilter; \SystemRoot\System32\drivers\massfilter.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-01-05 21:25 - 2017-01-05 21:25 - 00001471 _____ C:\Users\Denise\Desktop\JRT.txt
2017-01-05 21:22 - 2017-01-05 21:22 - 01663040 _____ (Malwarebytes) C:\Users\Denise\Downloads\JRT.exe
2017-01-05 21:09 - 2017-01-05 21:10 - 03977168 _____ C:\Users\Denise\Downloads\AdwCleaner_6.041.exe
2017-01-05 14:58 - 2017-01-05 15:01 - 00235758 _____ C:\TDSSKiller.3.1.0.12_05.01.2017_14.58.41_log.txt
2017-01-05 14:11 - 2017-01-05 21:18 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2017-01-05 14:07 - 2017-01-05 14:07 - 04747704 _____ (AO Kaspersky Lab) C:\Users\Denise\Downloads\tdsskiller31012.exe
2017-01-05 14:06 - 2017-01-05 14:06 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Denise\Downloads\mbar-1.09.3.1001.exe
2017-01-04 20:50 - 2017-01-05 14:58 - 00000000 ____D C:\Users\Denise\Desktop\Trojanerboard
2017-01-04 20:24 - 2017-01-04 20:24 - 00000000 ____D C:\Users\Denise\Downloads\FRST-OlderVersion
2017-01-04 19:30 - 2017-01-04 19:30 - 00000000 ___HD C:\ProgramData\8663r261o3m395
2016-12-29 20:49 - 2016-12-29 20:52 - 00000000 ____D C:\Users\Denise\Desktop\Handy Urlaub
2016-12-27 21:55 - 2016-12-27 21:55 - 00000000 ____D C:\Users\Denise\AppData\Roaming\Internet-Manager
2016-12-26 17:46 - 2017-01-06 12:17 - 00000000 ____D C:\FRST
2016-12-26 16:46 - 2017-01-06 11:58 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-12-26 16:45 - 2017-01-05 14:35 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-12-26 16:45 - 2016-12-26 17:18 - 00001116 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-12-26 16:45 - 2016-12-26 16:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-12-26 16:45 - 2016-12-26 16:45 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-12-26 16:45 - 2016-12-26 16:45 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-12-26 16:45 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-12-26 16:45 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-12-26 15:53 - 2017-01-05 21:17 - 00000000 ____D C:\AdwCleaner
2016-12-26 15:12 - 2016-12-25 22:34 - 00001282 _____ C:\Windows\system32\Drivers\etc\hosts.20161226-151245.backup
2016-12-26 12:47 - 2016-12-26 17:18 - 00001081 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-12-26 12:47 - 2016-12-26 17:18 - 00001063 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-12-26 12:47 - 2016-12-26 12:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-12-26 12:44 - 2016-12-26 12:44 - 00243720 _____ C:\Users\Denise\Downloads\Firefox Setup Stub 50.1.0.exe
2016-12-25 22:46 - 2017-01-05 21:18 - 00065490 _____ C:\Windows\PFRO.log
2016-12-25 22:46 - 2016-12-27 21:59 - 00477328 _____ C:\Windows\system32\FNTCACHE.DAT
2016-12-25 22:38 - 2016-12-25 22:41 - 00001058 _____ C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-12-25 22:36 - 2009-09-27 09:39 - 00415744 ___SH (The Public) C:\Windows\SysWOW64\avisynth.dll
2016-12-25 22:36 - 2005-07-14 12:31 - 00032256 ___SH C:\Windows\SysWOW64\AVSredirect.dll
2016-12-25 22:36 - 2004-02-22 10:11 - 00764416 ___SH (Abysmal Software) C:\Windows\SysWOW64\devil.dll
2016-12-25 22:36 - 2004-01-25 00:00 - 00070656 ___SH (www.helixcommunity.org) C:\Windows\SysWOW64\yv12vfw.dll
2016-12-25 22:36 - 2004-01-25 00:00 - 00070656 ___SH (www.helixcommunity.org) C:\Windows\SysWOW64\i420vfw.dll
2016-12-25 22:34 - 2016-12-26 00:08 - 00000000 ____D C:\Program Files (x86)\Cherciingnazak Schedule
2016-12-25 22:33 - 2017-01-05 13:19 - 00000000 ____D C:\Program Files (x86)\Drowiing
2016-12-25 22:33 - 2016-12-25 22:46 - 00000000 ____D C:\Users\Denise\AppData\Roaming\Dripied
2016-12-25 22:33 - 2016-12-25 22:34 - 00000000 ____D C:\Users\Denise\AppData\Roaming\Profiles
2016-12-25 22:33 - 2016-12-25 22:33 - 00000000 ____D C:\Users\Denise\Documents\eRightSoft
2016-12-25 22:33 - 2016-12-25 22:33 - 00000000 ____D C:\Users\Denise\AppData\Local\Steqiwardeadom
2016-12-25 22:33 - 2016-05-05 12:23 - 00556216 __RSH (FFmpeg Project) C:\Windows\SysWOW64\avutil-lav-55.dll
2016-12-25 22:33 - 2016-05-05 12:23 - 00537784 __RSH (FFmpeg Project) C:\Windows\SysWOW64\swscale-lav-4.dll
2016-12-25 22:33 - 2016-05-05 12:23 - 00405176 __RSH (Intel Corp.) C:\Windows\SysWOW64\IntelQuickSyncDecoder.dll
2016-12-25 22:33 - 2016-05-05 12:23 - 00276152 __RSH C:\Windows\SysWOW64\libbluray.dll
2016-12-25 22:33 - 2016-05-05 12:23 - 00000493 __RSH C:\Windows\SysWOW64\LAVFilters.Dependencies.manifest
2016-12-25 22:33 - 2016-05-05 12:22 - 10766520 __RSH (FFmpeg Project) C:\Windows\SysWOW64\avcodec-lav-57.dll
2016-12-25 22:33 - 2016-05-05 12:22 - 01699000 __RSH (FFmpeg Project) C:\Windows\SysWOW64\avformat-lav-57.dll
2016-12-25 22:33 - 2016-05-05 12:22 - 00188088 __RSH (FFmpeg Project) C:\Windows\SysWOW64\avfilter-lav-6.dll
2016-12-25 22:33 - 2016-05-05 12:22 - 00160440 __RSH (FFmpeg Project) C:\Windows\SysWOW64\avresample-lav-3.dll
2016-12-25 22:33 - 2004-10-10 08:50 - 00278528 _____ (Real Networks, Inc) C:\Windows\SysWOW64\pncrt.dll
2016-12-25 22:33 - 2004-07-02 16:33 - 00327749 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\drvc.dll
2016-12-25 22:32 - 2017-01-04 19:30 - 00000000 ___HD C:\ProgramData\93066184d64t1179994
2016-12-25 22:32 - 2016-12-25 22:44 - 00000000 ____D C:\Program Files (x86)\eRightSoft
2016-12-25 22:32 - 2016-12-25 22:43 - 00000000 ____D C:\Windows\system32\SSL
2016-12-25 22:31 - 2016-12-26 00:07 - 00000000 ___HD C:\Users\Denise\AppData\Roaming\DIFX
2016-12-25 22:06 - 2017-01-02 08:51 - 00000000 ____D C:\Users\Denise\Desktop\DVD Player Auto
2016-12-23 21:22 - 2016-12-23 21:22 - 00000000 ____D C:\ProgramData\Oracle
2016-12-23 21:21 - 2016-10-27 14:22 - 59890688 _____ (Ravensburger AG) C:\Users\Denise\Desktop\tiptoi_3.1.6.exe
2016-12-23 15:40 - 2016-12-23 15:40 - 00026306 _____ C:\Users\Denise\Desktop\Gutschein.docx
2016-12-22 14:13 - 2016-12-26 00:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2016-12-21 19:15 - 2016-12-21 19:15 - 00075888 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-stable.sys
2016-12-21 19:15 - 2016-12-21 19:15 - 00075888 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-dev.sys
2016-12-21 19:15 - 2016-12-21 19:15 - 00075888 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-canary.sys
2016-12-21 19:15 - 2016-12-21 19:15 - 00042096 _____ (Dropbox, Inc.) C:\Windows\system32\DbxSvc.exe
2016-12-18 11:54 - 2016-12-18 11:54 - 00106441 _____ C:\Users\Denise\Downloads\PMP_Order_1.pdf
2016-12-18 07:44 - 2017-01-05 21:18 - 00013871 _____ C:\Windows\setupact.log
2016-12-18 07:44 - 2016-12-18 07:44 - 00000000 _____ C:\Windows\setuperr.log
2016-12-17 08:31 - 2017-01-05 22:58 - 00063985 ____H C:\Users\Denise\AppData\Local\IconCache.db
2016-12-16 11:43 - 2016-12-26 17:18 - 00001219 _____ C:\Users\Public\Desktop\Ashampoo Snap 2017.lnk
2016-12-16 11:43 - 2016-12-26 00:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
2016-12-16 11:39 - 2016-12-16 11:40 - 54653776 _____ (Ashampoo GmbH & Co. KG ) C:\Users\Denise\Downloads\ashampoo_snap_2017_23536.exe
2016-12-16 11:19 - 2016-12-16 11:19 - 00292995 _____ C:\Users\Denise\Downloads\mp3DC222.exe
2016-12-16 07:54 - 2016-12-16 07:54 - 02586928 _____ C:\Users\Denise\Downloads\Adaware_Installer(1).exe
2016-12-15 14:20 - 2016-12-26 17:17 - 00002276 _____ C:\Users\Denise\Desktop\Kindle.lnk
2016-12-15 14:20 - 2016-12-26 00:07 - 00000000 ____D C:\Users\Denise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon
2016-12-15 14:20 - 2016-12-15 14:21 - 00000000 ____D C:\Users\Denise\Documents\My Kindle Content
2016-12-15 14:20 - 2016-12-15 14:20 - 00000000 ____D C:\Users\Denise\AppData\Local\Amazon
2016-12-15 14:19 - 2016-12-15 14:20 - 66693792 _____ (Amazon.com) C:\Users\Denise\Downloads\KindleForPC-installer-1.17.44183.exe
2016-12-15 13:28 - 2016-12-15 13:28 - 00045532 _____ C:\Users\Denise\Downloads\PB_KAZ_KtoNr_0987363857_03-11-2016_0635.pdf
2016-12-15 13:28 - 2016-12-15 13:28 - 00042838 _____ C:\Users\Denise\Downloads\PB_KAZ_KtoNr_0987363857_05-12-2016_0620.pdf
2016-12-14 07:58 - 2016-12-01 15:13 - 00869576 _____ (Microsoft Corporation) C:\Windows\system32\msvcr120_clr0400.dll
2016-12-14 07:58 - 2016-12-01 15:13 - 00678592 _____ (Microsoft Corporation) C:\Windows\system32\msvcp120_clr0400.dll
2016-12-14 07:58 - 2016-12-01 15:11 - 00875720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr120_clr0400.dll
2016-12-14 07:58 - 2016-12-01 15:11 - 00536768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp120_clr0400.dll
2016-12-14 07:58 - 2016-10-20 14:14 - 00029888 _____ (Microsoft Corporation) C:\Windows\system32\aspnet_counters.dll
2016-12-14 07:58 - 2016-10-20 14:10 - 00028352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aspnet_counters.dll
2016-12-14 07:56 - 2016-11-19 22:24 - 00567152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2016-12-14 07:56 - 2016-11-19 22:24 - 00152856 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2016-12-14 07:56 - 2016-11-19 20:29 - 00401408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-12-14 07:56 - 2016-11-19 19:44 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2016-12-14 07:56 - 2016-11-19 18:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2016-12-14 07:56 - 2016-11-19 18:22 - 00111104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2016-12-14 07:56 - 2016-11-16 22:49 - 00377176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
2016-12-14 07:56 - 2016-11-12 22:06 - 00738104 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2016-12-14 07:56 - 2016-11-12 20:38 - 00613632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2016-12-14 07:56 - 2016-11-12 20:25 - 00576000 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-12-14 07:56 - 2016-11-12 20:08 - 25759744 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-12-14 07:56 - 2016-11-12 20:07 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-12-14 07:56 - 2016-11-12 19:53 - 06049280 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-12-14 07:56 - 2016-11-12 19:29 - 00498688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-12-14 07:56 - 2016-11-12 19:23 - 01033216 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2016-12-14 07:56 - 2016-11-12 19:17 - 20302848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-12-14 07:56 - 2016-11-12 19:14 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-12-14 07:56 - 2016-11-12 19:10 - 00806912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-12-14 07:56 - 2016-11-12 18:45 - 00880640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2016-12-14 07:56 - 2016-11-12 18:41 - 15257088 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-12-14 07:56 - 2016-11-12 18:38 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-12-14 07:56 - 2016-11-12 18:37 - 04608000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-12-14 07:56 - 2016-11-12 18:35 - 02920960 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-12-14 07:56 - 2016-11-12 18:21 - 13653504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-12-14 07:56 - 2016-11-12 18:20 - 01543680 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-12-14 07:56 - 2016-11-12 18:11 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-12-14 07:56 - 2016-11-12 18:05 - 02444800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-12-14 07:56 - 2016-11-12 18:02 - 01312256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-12-14 07:56 - 2016-11-12 18:02 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-12-14 07:56 - 2016-11-11 03:33 - 01541240 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2016-12-14 07:56 - 2016-11-09 18:25 - 01376768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2016-12-14 07:56 - 2016-11-05 21:46 - 00422744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\spaceport.sys
2016-12-14 07:56 - 2016-11-05 19:35 - 04169216 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-12-14 07:56 - 2016-11-05 18:57 - 03320320 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2016-12-14 07:56 - 2016-11-05 18:11 - 03606528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2016-12-14 07:56 - 2016-11-05 16:56 - 02778624 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2016-12-14 07:56 - 2016-11-05 16:46 - 02463744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2016-12-14 07:56 - 2016-10-28 03:56 - 01380048 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-12-14 07:56 - 2016-10-27 15:28 - 01097728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2016-12-14 07:56 - 2016-10-12 22:49 - 00379224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2016-12-14 07:56 - 2016-10-12 22:11 - 00922968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\refs.sys
2016-12-14 07:56 - 2016-10-11 17:45 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\TpmTasks.dll
2016-12-14 07:56 - 2016-10-11 00:31 - 00990040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2016-12-14 07:56 - 2016-10-10 19:18 - 00069976 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2016-12-14 07:56 - 2016-10-10 19:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cmimcext.sys
2016-12-14 07:56 - 2016-10-09 15:17 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\ActionQueue.dll
2016-12-14 07:56 - 2016-10-09 15:08 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\shsetup.dll
2016-12-14 07:56 - 2016-10-09 15:08 - 00095232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shsetup.dll
2016-12-14 07:56 - 2016-10-08 23:24 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll
2016-12-14 07:56 - 2016-10-08 22:31 - 00498688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll
2016-12-14 07:56 - 2016-10-08 22:10 - 03547648 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2016-12-14 07:56 - 2016-10-05 15:01 - 01200128 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Globalization.dll
2016-12-14 07:56 - 2016-10-05 15:00 - 00868864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Globalization.dll
2016-12-14 07:56 - 2016-10-05 15:00 - 00323072 _____ (Microsoft Corporation) C:\Windows\system32\GlobCollationHost.dll
2016-12-14 07:56 - 2016-10-05 14:52 - 00513456 _____ C:\Windows\SysWOW64\locale.nls
2016-12-14 07:56 - 2016-10-05 14:52 - 00513456 _____ C:\Windows\system32\locale.nls
2016-12-14 07:56 - 2016-10-05 05:15 - 01969944 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2016-12-14 07:56 - 2016-10-05 05:15 - 01613528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2016-12-14 07:56 - 2016-10-05 05:15 - 00324896 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2016-12-14 07:56 - 2016-10-05 05:15 - 00245320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2016-12-14 07:56 - 2016-09-27 21:16 - 00445873 _____ C:\Windows\system32\ApnDatabase.xml
2016-12-14 07:56 - 2016-09-20 23:30 - 02462040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2016-12-14 07:56 - 2015-10-22 16:58 - 00200704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GlobCollationHost.dll
2016-12-12 12:09 - 2016-12-12 12:19 - 01037434 _____ C:\Users\Denise\Downloads\20161108_214140.jpg
2016-12-12 12:09 - 2016-12-12 12:09 - 00944227 _____ C:\Users\Denise\Downloads\20161108_214126.jpg
2016-12-12 12:09 - 2016-12-12 12:09 - 00905302 _____ C:\Users\Denise\Downloads\20161108_214019.jpg
2016-12-12 12:09 - 2016-12-12 12:09 - 00810842 _____ C:\Users\Denise\Downloads\20161108_214004.jpg
2016-12-12 11:53 - 2016-12-12 11:53 - 00431690 _____ C:\Users\Denise\Downloads\3907_buildinginstruction
2016-12-11 21:32 - 2016-12-11 21:32 - 00117357 _____ C:\Users\Denise\Downloads\ZIAUFEIN_1481058355529JAOOW1ESAIGW.pdf
2016-12-11 16:05 - 2016-12-11 16:05 - 00104263 _____ C:\Users\Denise\Downloads\PMP_Order_19(1).pdf
2016-12-10 21:34 - 2016-12-10 21:34 - 00104266 _____ C:\Users\Denise\Downloads\PMP_Order_19.pdf
2016-12-08 13:26 - 2016-12-08 13:26 - 00049590 _____ C:\Users\Denise\Downloads\KleinunternehmerUmsatzsteuerrecht.pdf
2016-12-07 07:34 - 2016-12-07 07:34 - 02587440 _____ C:\Users\Denise\Downloads\Adaware_Installer.exe

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-01-06 12:11 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\tracing
2017-01-06 12:06 - 2016-07-19 21:46 - 00001220 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
2017-01-06 11:49 - 2016-11-20 07:49 - 00000000 ____D C:\Users\Denise\AppData\LocalLow\Mozilla
2017-01-06 07:15 - 2016-07-19 21:54 - 00000000 ___RD C:\Users\Denise\Dropbox
2017-01-06 07:15 - 2016-07-19 21:46 - 00001216 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
2017-01-06 07:15 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\Inf
2017-01-05 21:43 - 2016-07-19 21:11 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3531133450-1765533330-4211851364-1002
2017-01-05 21:23 - 2013-09-12 12:28 - 00766620 _____ C:\Windows\system32\perfh007.dat
2017-01-05 21:23 - 2013-09-12 12:28 - 00159902 _____ C:\Windows\system32\perfc007.dat
2017-01-05 21:23 - 2013-09-12 12:00 - 01780340 _____ C:\Windows\system32\PerfStringBackup.INI
2017-01-05 21:18 - 2013-08-22 15:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-01-05 14:33 - 2013-08-22 14:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2017-01-05 13:42 - 2016-10-19 17:36 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2017-01-05 13:40 - 2016-10-19 17:36 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2017-01-04 19:16 - 2016-07-19 21:12 - 00000000 ___DO C:\Users\Denise\SkyDrive
2017-01-04 09:01 - 2016-08-20 13:36 - 00000000 ____D C:\Users\Denise\AppData\Roaming\vlc
2017-01-02 16:34 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\registration
2017-01-01 21:20 - 2016-10-07 11:46 - 00000000 ____D C:\Users\Denise\Documents\Calibre Bibliothek
2016-12-31 22:01 - 2016-07-19 21:05 - 00000000 ___RD C:\Users\Denise\Pictures
2016-12-28 11:17 - 2016-07-19 21:05 - 00000000 ___RD C:\Users\Denise\Music
2016-12-27 21:59 - 2013-08-22 14:36 - 00000000 __RSD C:\Windows\Fonts
2016-12-27 21:56 - 2016-07-27 19:10 - 00000000 ____D C:\Windows\SysWOW64\SupportAppZXH
2016-12-27 21:56 - 2013-08-22 16:36 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
2016-12-27 21:56 - 2013-08-22 14:36 - 00000000 ___RD C:\Program Files (x86)
2016-12-27 20:10 - 2013-11-13 16:02 - 00000000 ____D C:\ProgramData\CyberLink
2016-12-26 22:30 - 2016-07-24 08:40 - 00000000 ____D C:\Users\Denise\dwhelper
2016-12-26 22:26 - 2016-09-02 08:21 - 00000000 ____D C:\Users\Denise\Desktop\Tupperware
2016-12-26 17:18 - 2016-11-27 00:10 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-12-26 17:18 - 2016-11-27 00:10 - 00002065 _____ C:\Users\Public\Desktop\Acrobat Reader DC.lnk
2016-12-26 17:18 - 2016-08-20 13:35 - 00001084 _____ C:\Users\Public\Desktop\VLC media player.lnk
2016-12-26 17:18 - 2016-07-25 21:32 - 00002923 _____ C:\Users\Public\Desktop\Nero 2015.lnk
2016-12-26 17:18 - 2016-07-23 19:24 - 00002223 _____ C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2016-12-26 17:18 - 2016-07-23 10:49 - 00002068 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\tiptoi® Manager Deinstallationsprogramm.lnk
2016-12-26 17:18 - 2016-07-23 10:49 - 00002000 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\tiptoi.lnk
2016-12-26 17:18 - 2016-07-21 20:13 - 00001081 _____ C:\Users\Public\Desktop\XMedia Recode.lnk
2016-12-26 17:18 - 2016-07-19 22:19 - 00002210 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions 4.5.lnk
2016-12-26 17:18 - 2016-07-19 22:19 - 00002192 _____ C:\Users\Public\Desktop\Adobe Digital Editions 4.5.lnk
2016-12-26 17:18 - 2016-07-19 22:07 - 00000970 _____ C:\Users\Public\Desktop\calibre - E-book management.lnk
2016-12-26 17:18 - 2013-09-13 08:14 - 00001394 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2016-12-26 17:18 - 2013-09-13 08:14 - 00001325 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2016-12-26 17:17 - 2016-07-19 22:56 - 00002497 _____ C:\Users\Denise\Desktop\Word 2013.lnk
2016-12-26 17:17 - 2016-07-19 22:56 - 00002493 _____ C:\Users\Denise\Desktop\Excel 2013.lnk
2016-12-26 17:17 - 2016-07-19 22:56 - 00002383 _____ C:\Users\Denise\Desktop\Outlook 2013.lnk
2016-12-26 17:17 - 2016-07-19 21:06 - 00001057 _____ C:\Users\Denise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-12-26 17:16 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\schemas
2016-12-26 17:15 - 2013-08-22 16:20 - 00000000 ____D C:\Windows\CbsTemp
2016-12-26 15:57 - 2016-11-19 19:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-12-26 15:55 - 2016-07-19 21:05 - 00000000 ___RD C:\Users\Denise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
2016-12-26 15:12 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\system32\Drivers\etc
2016-12-26 15:12 - 2013-08-22 14:25 - 00454135 ____R C:\Windows\system32\Drivers\etc\hosts
2016-12-26 12:12 - 2016-07-19 22:35 - 00000000 ____D C:\Users\Denise\Documents\Outlook-Dateien
2016-12-26 12:11 - 2016-08-26 07:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
2016-12-26 12:11 - 2016-07-25 21:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero
2016-12-26 12:11 - 2016-07-21 20:19 - 00000000 ____D C:\Maus
2016-12-26 08:47 - 2013-11-26 14:46 - 00000000 ___RD C:\Users\UpdatusUser\Desktop
2016-12-26 07:38 - 2016-11-25 17:17 - 00000000 ____D C:\Users\Denise\AppData\Roaming\ActivePresenter
2016-12-26 07:38 - 2016-07-19 21:05 - 00000000 ____D C:\Users\Denise
2016-12-26 00:27 - 2013-08-22 16:36 - 00000000 ___RD C:\Windows\assembly
2016-12-26 00:26 - 2013-08-22 16:31 - 00000000 ____D C:\Windows\system32\DriverStore
2016-12-26 00:14 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\system32\wbem
2016-12-26 00:08 - 2016-07-23 10:49 - 00000000 ____D C:\Program Files (x86)\Ravensburger tiptoi
2016-12-26 00:08 - 2016-07-19 22:19 - 00000000 ____D C:\Users\Denise\AppData\Local\Adobe_Systems_Incorporate
2016-12-26 00:08 - 2013-11-13 15:58 - 00000000 ____D C:\ProgramData\ashampoo
2016-12-26 00:08 - 2013-08-22 16:36 - 00000000 ____D C:\Program Files\Windows Defender
2016-12-26 00:08 - 2013-08-22 16:36 - 00000000 ____D C:\Program Files\Internet Explorer
2016-12-26 00:07 - 2016-08-13 15:42 - 00000000 ____D C:\Windows\system32\appraiser
2016-12-26 00:07 - 2016-07-26 07:43 - 00000000 ____D C:\Users\Denise\AppData\Roaming\XMedia Recode
2016-12-26 00:07 - 2016-07-23 10:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\tiptoi® Manager
2016-12-26 00:07 - 2013-11-26 14:46 - 00000000 ____D C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
2016-12-26 00:07 - 2013-11-15 17:10 - 00000000 ___HD C:\Windows\system32\WLANProfiles
2016-12-26 00:07 - 2013-09-20 10:35 - 00000000 ____D C:\Windows\system32\catroot2
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 __RSD C:\Windows\Media
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\SysWOW64\de-DE
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\SystemResources
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\System32\Tasks\Microsoft
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\system32\de-DE
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\system32\CodeIntegrity
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\rescache
2016-12-26 00:07 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\PolicyDefinitions
2016-12-26 00:07 - 2013-08-22 16:33 - 00000000 ____D C:\Windows\system32\Drivers\UMDF
2016-12-26 00:07 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\system32\Sysprep
2016-12-26 00:07 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\system32\oobe
2016-12-26 00:07 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\system32\migration
2016-12-25 22:57 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\Logs
2016-12-25 22:46 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\debug
2016-12-25 22:33 - 2016-07-19 21:05 - 00000000 ___RD C:\Users\Denise\Documents
2016-12-25 22:32 - 2016-07-19 21:05 - 00000000 ____D C:\Users\Denise\AppData\Local\Microsoft
2016-12-25 15:13 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\AppReadiness
2016-12-24 22:14 - 2016-07-19 21:05 - 00000000 ____D C:\Users\Denise\AppData\Local\Packages
2016-12-24 22:10 - 2016-07-19 22:19 - 00000000 ____D C:\Users\Denise\Documents\My Digital Editions
2016-12-23 21:24 - 2016-07-23 10:49 - 00000000 ____D C:\Users\Denise\AppData\Roaming\RavensburgerTipToi3
2016-12-23 21:23 - 2016-07-23 10:49 - 00000000 ____D C:\ProgramData\RavensburgerTipToi3
2016-12-22 14:14 - 2016-07-19 21:46 - 00000000 ____D C:\Program Files (x86)\Dropbox
2016-12-20 08:33 - 2013-08-22 16:36 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-12-20 08:32 - 2016-07-19 22:23 - 00000000 ____D C:\Program Files\Microsoft Office 15
2016-12-17 07:04 - 2013-11-13 16:04 - 00000000 ____D C:\ProgramData\install_clap
2016-12-17 07:04 - 2013-09-12 12:52 - 00000000 ____D C:\Windows\Panther
2016-12-16 13:32 - 2016-08-23 20:20 - 00217600 ___SH C:\Users\Denise\Desktop\Thumbs.db
2016-12-16 11:43 - 2013-11-13 15:56 - 00000000 ____D C:\Program Files (x86)\Ashampoo
2016-12-16 10:57 - 2013-09-12 11:53 - 00524288 ___SH C:\Windows\system32\config\COMPONENTS{42b82173-0b2e-11e3-93f4-90b11c2eb9f2}.TMContainer00000000000000000001.regtrans-ms
2016-12-16 10:57 - 2013-09-12 11:53 - 00065536 ___SH C:\Windows\system32\config\COMPONENTS{42b82173-0b2e-11e3-93f4-90b11c2eb9f2}.TM.blf
2016-12-15 09:47 - 2013-09-12 11:53 - 00524288 ___SH C:\Windows\system32\config\DRIVERS{e1793794-0b3d-11e3-9dfe-80de722c933b}.TMContainer00000000000000000001.regtrans-ms
2016-12-15 09:47 - 2013-09-12 11:53 - 00065536 ___SH C:\Windows\system32\config\DRIVERS{e1793794-0b3d-11e3-9dfe-80de722c933b}.TM.blf
2016-12-14 08:02 - 2016-07-23 14:30 - 00000000 ____D C:\Windows\system32\MRT
2016-12-14 08:02 - 2013-09-12 11:53 - 00524288 ___SH C:\Windows\system32\config\COMPONENTS{42b82173-0b2e-11e3-93f4-90b11c2eb9f2}.TMContainer00000000000000000002.regtrans-ms
2016-12-14 08:00 - 2013-11-15 16:01 - 135632432 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-12-14 07:40 - 2016-07-19 21:16 - 00003910 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{CD913E81-9733-4F87-B61C-593DA3D3B538}
2016-12-12 00:00 - 2016-11-10 07:59 - 00835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-12-12 00:00 - 2016-11-10 07:59 - 00177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-12-10 22:10 - 2016-07-19 21:05 - 00000000 ___SD C:\Users\Denise\AppData\Roaming\Microsoft
2016-12-09 23:40 - 2013-08-22 16:36 - 00000000 ___HD C:\Program Files\WindowsApps
2016-12-09 15:35 - 2013-11-26 14:46 - 00000000 ____D C:\Users\UpdatusUser

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2016-11-25 16:39 - 2016-11-25 16:48 - 0003584 _____ () C:\Users\Denise\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-11-26 14:54 - 2013-11-26 14:54 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2013-11-13 16:08 - 2013-11-13 16:09 - 0000104 _____ () C:\ProgramData\{01FB4998-33C4-4431-85ED-079E3EEFE75D}.log
2013-11-13 16:09 - 2013-11-13 16:10 - 0000119 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2013-11-13 16:04 - 2013-11-13 16:06 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2013-11-13 16:02 - 2013-11-13 16:02 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2013-11-13 16:07 - 2013-11-13 16:08 - 0000108 _____ () C:\ProgramData\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}.log
2013-11-13 16:02 - 2013-11-13 16:04 - 0000110 _____ () C:\ProgramData\{E3739848-5329-48E3-8D28-5BBD6E8BE384}.log
2013-11-13 16:06 - 2013-11-13 16:06 - 0000110 _____ () C:\ProgramData\{E3D04529-6EDB-11D8-A372-0050BAE317E1}.log

Einige Dateien in TEMP:
====================
C:\Users\Denise\AppData\Local\Temp\AppLauncher.exe
C:\Users\Denise\AppData\Local\Temp\libeay32.dll
C:\Users\Denise\AppData\Local\Temp\msvcr120.dll
C:\Users\Denise\AppData\Local\Temp\sqlite3.dll
C:\Users\Denise\AppData\Local\Temp\tu17p84.exe


==================== Bamital & volsnap ======================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert

LastRegBack: 2017-01-04 07:56

==================== Ende von FRST.txt ============================
Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 01-01-2017
durchgeführt von Denise (06-01-2017 12:17:58)
Gestartet von C:\Users\Denise\Desktop\Trojanerboard
Windows 8.1 (Update) (X64) (2016-07-19 20:05:43)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-3531133450-1765533330-4211851364-500 - Administrator - Disabled)
Denise (S-1-5-21-3531133450-1765533330-4211851364-1002 - Administrator - Enabled) => C:\Users\Denise
Gast (S-1-5-21-3531133450-1765533330-4211851364-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3531133450-1765533330-4211851364-1004 - Limited - Enabled)
UpdatusUser (S-1-5-21-3531133450-1765533330-4211851364-1001 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.020.20042 - Adobe Systems Incorporated)
Adobe Digital Editions 4.5 (HKLM-x32\...\Adobe Digital Editions 4.5) (Version: 4.5.1 - Adobe Systems Incorporated)
Adobe Flash Player 23 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 23.0.0.207 - Adobe Systems Incorporated)
Amazon Kindle (HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\Amazon Kindle) (Version: 1.17.1.44183 - Amazon)
Ashampoo Snap 2017 (HKLM-x32\...\{0A11EA01-F22C-84C3-9723-53CA58DB6F9C}_is1) (Version: 1.0.1 - Ashampoo GmbH & Co. KG)
calibre (HKLM-x32\...\{F6BB454A-E737-4A1C-A5D4-0E2834E24905}) (Version: 2.62.0 - Kovid Goyal)
ConvertHelper 3.2 (HKLM\...\{27CC6AB1-E72B-4179-AF1A-EAE507EBAF52}}_is1) (Version:  - DownloadHelper)
CyberLink Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
CyberLink PowerRecover (HKLM-x32\...\InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.7.0.2103 - CyberLink Corp.)
CyberLink PowerRecover (Version: 5.7.0.2103 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Digital Plus Home Theater (HKLM\...\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.5.1.1 - Dolby Laboratories Inc)
Dropbox (HKLM-x32\...\Dropbox) (Version: 16.4.30 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.59.1 - Dropbox, Inc.) Hidden
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotogalerija (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotogalleri (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotogalleriet (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotoğraf Galerisi (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotótár (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galeria de Fotografias (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galería de fotos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galeria fotografii (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
GeForce Experience NvStream Client Components (Version: 0.1.87 - NVIDIA Corporation) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3355 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{302600C1-6BDF-4FD1-1309-148929CC1385}) (Version: 3.1.1309.0390 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.2.1000 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{105fa5c4-72e1-41f2-a82c-884d8aa4b381}) (Version: 16.6.0 - Intel Corporation)
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft Office Professional Plus 2013 - de-de (HKLM\...\ProPlusRetail - de-de) (Version: 15.0.4885.1001 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 50.1.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 50.1.0 (x86 de)) (Version: 50.1.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 50.1.0 - Mozilla)
Nero 2015 (HKLM-x32\...\{847D6818-3BA4-4F41-B5B7-4505D8E012B7}) (Version: 16.0.01300 - Nero AG)
Nero Info (HKLM-x32\...\{B791E0AB-87A9-41A4-8D98-D13C2E37D928}) (Version: 16.0.1002 - Nero AG)
NVIDIA GeForce Experience 1.6.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.6.1 - NVIDIA Corporation)
NVIDIA Graphics Driver 327.62 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.62 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA Virtual Audio 1.2.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.5 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4885.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4885.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4885.1001 - Microsoft Corporation) Hidden
PDF24 Creator 7.9.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0092 - Pegatron Corporation)
Podstawowe programy Windows Live (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Prerequisite installer (x32 Version: 16.0.0000 - Nero AG) Hidden
Raccolta foto (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.30164 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.19.726.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7076 - Realtek Semiconductor Corp.)
SHIELD Streaming (Version: 1.05.28 - NVIDIA Corporation) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.15.0 - Synaptics Incorporated)
tiptoi® Manager 3.1.6 (HKLM-x32\...\9978-5763-2995-5228) (Version: 3.1.6 - Ravensburger AG)
TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.354 - TuneUp Software) Hidden
TuneUp Utilities 2014 (HKLM-x32\...\TuneUp Utilities) (Version: 14.0.1000.354 - TuneUp Software)
TuneUp Utilities 2014 (x32 Version: 14.0.1000.354 - TuneUp Software) Hidden
Valokuvavalikoima (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
XMedia Recode Version 3.3.3.3 (HKLM-x32\...\{DDA3C325-47B2-4730-9672-BF3771C08799}_is1) (Version: 3.3.3.3 - XMedia Recode)
Συλλογή φωτογραφιών (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {0C353ECE-7C42-4EDF-9E78-7F60D3E609D4} - System32\Tasks\Nero\Nero Info => C:\Program Files (x86)\Common Files\Nero\Nero Info\NeroInfo.exe [2014-05-20] (Nero AG)
Task: {6DD7B98D-691E-4C99-A942-BB379DBA5CD9} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2016-11-01] (Microsoft Corporation)
Task: {98209A60-AC79-456E-8CFB-EA8D24C38CDD} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-09-19] (Synaptics Incorporated)
Task: {AE3A986E-65D2-4E77-82E1-2D9546986C36} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-11-01] (Microsoft Corporation)
Task: {BCEDF6AA-DC6E-47EE-A7A8-CAC36707ADC2} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-07-19] (Dropbox, Inc.)
Task: {E0948293-2279-4D6B-8E77-F3AA3CA9A980} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-11-01] (Microsoft Corporation)
Task: {E1189ACB-8FE2-4F21-B9A3-00274A542B91} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2016-11-01] (Microsoft Corporation)
Task: {E7A91B92-EF72-4400-A58F-7BA85A14B0CB} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-07-19] (Dropbox, Inc.)
Task: {FEA5CC20-2042-4BC8-A122-F29B40BF89BC} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-10-21] (Adobe Systems Incorporated)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

Shortcut: C:\Users\Denise\AppData\Local\Microsoft\Windows\ConnectedSearch\History\site_1691182358_de-de.lnk -> hxxp://www.windowssearch.com:80/suggestions?qry=spotify&cc=DE&setlang=de-DE&inlang=de-DE&adlt=moderate&scale=100&contrast=none&hw=768%2C1366&CVID=7075BBFFD9B4452CA755DE3838E3C42

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MEDIONhome.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.medion.com

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2013-11-20 15:17 - 2013-06-27 10:56 - 00160768 _____ () C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
2016-07-26 06:27 - 2016-05-24 08:51 - 00116416 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-06-25 06:53 - 2015-06-25 06:53 - 00699704 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\avgrepliba.dll
2013-11-20 15:17 - 2013-09-02 16:15 - 02216960 _____ () C:\Program Files (x86)\PHotkey\PHotkey.exe
2013-11-20 15:17 - 2010-12-17 15:04 - 00449032 _____ () C:\Program Files (x86)\PHotkey\ATouch64.exe
2013-11-20 15:17 - 2012-10-23 19:07 - 03471872 _____ () C:\Program Files (x86)\PHotkey\POSD.exe
2013-11-20 15:17 - 2013-07-18 16:41 - 08856576 _____ () C:\Program Files (x86)\PHotkey\GPMTray.exe
2013-11-15 16:39 - 2013-09-16 12:20 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2013-11-20 15:17 - 2009-12-18 16:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll
2013-11-20 15:17 - 2009-12-18 16:41 - 00129544 _____ () C:\Program Files (x86)\PHotkey\GFNEX.dll
2016-12-16 07:56 - 2016-11-11 21:36 - 00035792 _____ () C:\Program Files (x86)\Dropbox\Client\_multiprocessing.pyd
2016-12-16 07:56 - 2016-11-11 21:36 - 00100296 _____ () C:\Program Files (x86)\Dropbox\Client\_ctypes.pyd
2016-12-16 07:56 - 2016-11-11 21:36 - 00018888 _____ () C:\Program Files (x86)\Dropbox\Client\select.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00019760 _____ () C:\Program Files (x86)\Dropbox\Client\tornado.speedups.pyd
2016-12-16 07:56 - 2016-11-11 21:36 - 00694224 _____ () C:\Program Files (x86)\Dropbox\Client\unicodedata.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00020816 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._constant_time.pyd
2016-12-16 07:56 - 2016-11-11 21:37 - 00123856 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_backend.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 01682760 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._openssl.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00020808 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._padding.pyd
2016-12-22 14:12 - 2016-11-11 21:36 - 00145864 _____ () C:\Program Files (x86)\Dropbox\Client\pyexpat.pyd
2016-12-22 14:12 - 2016-11-11 21:37 - 00019408 _____ () C:\Program Files (x86)\Dropbox\Client\faulthandler.pyd
2016-12-22 14:12 - 2016-11-11 21:36 - 00116688 _____ () C:\Program Files (x86)\Dropbox\Client\pywintypes27.dll
2016-12-16 07:56 - 2016-11-11 21:38 - 00105928 _____ () C:\Program Files (x86)\Dropbox\Client\win32api.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00021312 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.crt.compiled._winffi_crt.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00052024 _____ () C:\Program Files (x86)\Dropbox\Client\psutil._psutil_windows.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00038696 _____ () C:\Program Files (x86)\Dropbox\Client\fastpath.pyd
2016-12-22 14:12 - 2016-11-11 21:36 - 00392144 _____ () C:\Program Files (x86)\Dropbox\Client\pythoncom27.dll
2016-12-22 14:12 - 2016-11-11 21:38 - 00020936 _____ () C:\Program Files (x86)\Dropbox\Client\mmapfile.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00024528 _____ () C:\Program Files (x86)\Dropbox\Client\win32event.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00116176 _____ () C:\Program Files (x86)\Dropbox\Client\win32security.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00381752 _____ () C:\Program Files (x86)\Dropbox\Client\win32com.shell.shell.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00124880 _____ () C:\Program Files (x86)\Dropbox\Client\win32file.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00025424 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.kernel32.compiled._winffi_kernel32.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32clipboard.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00175560 _____ () C:\Program Files (x86)\Dropbox\Client\win32gui.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00030160 _____ () C:\Program Files (x86)\Dropbox\Client\win32pipe.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00043472 _____ () C:\Program Files (x86)\Dropbox\Client\win32process.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00048592 _____ () C:\Program Files (x86)\Dropbox\Client\win32service.pyd
2016-12-16 07:56 - 2016-11-11 21:38 - 00057808 _____ () C:\Program Files (x86)\Dropbox\Client\win32evtlog.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32profile.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00246592 _____ () C:\Program Files (x86)\Dropbox\Client\breakpad.client.windows.handler.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00026456 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox.infinite.win.compiled._driverinstallation.pyd
2016-12-16 07:56 - 2016-11-11 21:37 - 00241104 _____ () C:\Program Files (x86)\Dropbox\Client\_jpegtran.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00020280 _____ () C:\Program Files (x86)\Dropbox\Client\cpuid.compiled._cpuid.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00028616 _____ () C:\Program Files (x86)\Dropbox\Client\win32ts.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00023376 _____ () C:\Program Files (x86)\Dropbox\Client\winscreenshot.compiled._CaptureScreenshot.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00020800 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.iphlpapi._winffi_iphlpapi.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00019776 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winerror._winffi_winerror.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00020800 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.wininet._winffi_wininet.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00350152 _____ () C:\Program Files (x86)\Dropbox\Client\winxpgui.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00022352 _____ () C:\Program Files (x86)\Dropbox\Client\winverifysignature.compiled._VerifySignature.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00024392 _____ () C:\Program Files (x86)\Dropbox\Client\librsyncffi.compiled._librsyncffi.pyd
2016-12-22 14:12 - 2016-11-11 21:35 - 00036296 _____ () C:\Program Files (x86)\Dropbox\Client\librsync.dll
2016-12-22 14:12 - 2016-12-21 19:26 - 00084280 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_sqlite_ext.DLL
2016-12-22 14:12 - 2016-12-21 19:26 - 01826096 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtCore.pyd
2016-12-16 07:56 - 2016-11-11 21:37 - 00083912 _____ () C:\Program Files (x86)\Dropbox\Client\sip.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00531248 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtNetwork.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 03928880 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWidgets.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 01972528 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtGui.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00133424 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKit.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00224056 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKitWidgets.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00207672 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtPrintSupport.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00020288 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.user32._winffi_user32.pyd
2016-12-22 14:12 - 2016-11-11 21:42 - 00017864 _____ () C:\Program Files (x86)\Dropbox\Client\libEGL.dll
2016-12-22 14:12 - 2016-11-11 21:42 - 01631184 _____ () C:\Program Files (x86)\Dropbox\Client\libGLESv2.dll
2016-12-22 14:12 - 2016-12-21 19:26 - 00042808 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebChannel.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00171320 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngineWidgets.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00357680 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQml.pyd
2016-12-16 07:56 - 2016-11-11 21:39 - 00060880 _____ () C:\Program Files (x86)\Dropbox\Client\win32print.pyd
2016-12-16 07:56 - 2016-12-21 19:26 - 00024904 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winhttp.compiled._winffi_winhttp.pyd
2016-12-22 14:12 - 2016-12-21 19:26 - 00546096 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQuick.pyd

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

Da befinden sich 7922 mehr Seiten.

IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1001\...\123simsen.com -> www.123simsen.com

Da befinden sich 7922 mehr Seiten.

IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\123simsen.com -> www.123simsen.com

Da befinden sich 7922 mehr Seiten.


==================== Hosts Inhalt: ==========================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2013-08-22 14:25 - 2016-12-26 15:12 - 00454135 ____R C:\Windows\system32\Drivers\etc\hosts

127.0.0.1        clients2.google.com
127.0.0.1        v1.ff.avast.com
127.0.0.1        vlcproxy.ff.avast.com
127.0.0.1        down.baidu2016.com
127.0.0.1        123.sogou.com
127.0.0.1        www.czzsyzgm.com
127.0.0.1        www.czzsyzxl.com
127.0.0.1        union.baidu2019.com
127.0.0.1        down.baidu2016.com
127.0.0.1        123.sogou.com
127.0.0.1        www.czzsyzgm.com
127.0.0.1        www.czzsyzxl.com
127.0.0.1        union.baidu2019.com127.0.0.1        www.007guard.com
127.0.0.1        007guard.com
127.0.0.1        008i.com
127.0.0.1        www.008k.com
127.0.0.1        008k.com
127.0.0.1        www.00hq.com
127.0.0.1        00hq.com
127.0.0.1        010402.com
127.0.0.1        www.032439.com
127.0.0.1        032439.com
127.0.0.1        www.0scan.com
127.0.0.1        0scan.com
127.0.0.1        1000gratisproben.com
127.0.0.1        www.1000gratisproben.com
127.0.0.1        1001namen.com
127.0.0.1        www.1001namen.com
127.0.0.1        100888290cs.com
127.0.0.1        www.100888290cs.com

Da befinden sich 15582 zusätzliche Einträge.


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\Control Panel\Desktop\\Wallpaper -> C:\Puh\Puh Privat\Nice Day\nAKED MOUSE\Spaziergang\BILD5294.JPG
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

HKLM\...\StartupApproved\StartupFolder: => "MCtlSvc.lnk"
HKLM\...\StartupApproved\StartupFolder: => "NeroDesktopSwitcher.scf"
HKLM\...\StartupApproved\Run: => "IAStorIcon"
HKLM\...\StartupApproved\Run: => "BTMTrayAgent"
HKLM\...\StartupApproved\Run: => "Nvtmru"
HKLM\...\StartupApproved\Run: => "SynTPEnh"
HKLM\...\StartupApproved\Run: => "RtHDVCpl"
HKLM\...\StartupApproved\Run: => "RtHDVBg_Dolby"
HKLM\...\StartupApproved\Run: => "IgfxTray"
HKLM\...\StartupApproved\Run: => "HotKeysCmds"
HKLM\...\StartupApproved\Run: => "Persistence"
HKLM\...\StartupApproved\Run32: => "CLMLServer_For_P2G8"
HKLM\...\StartupApproved\Run32: => "CLVirtualDrive"
HKLM\...\StartupApproved\Run32: => "RemoteControl10"
HKLM\...\StartupApproved\Run32: => "YouCam Service"
HKLM\...\StartupApproved\Run32: => "PDFPrint"
HKU\S-1-5-21-3531133450-1765533330-4211851364-1002\...\StartupApproved\Run: => "SpybotPostWindows10UpgradeReInstall"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [vm-monitoring-nb-session] => LPort=139
FirewallRules: [{C6681879-51CB-4FD8-9A84-483DBB792DD9}] => C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{BF03DCCD-DD4D-400A-83DE-6EBD26343BBF}] => LPort=2869
FirewallRules: [{DF5F9400-8B73-4381-B95F-52AF8036BC90}] => LPort=1900
FirewallRules: [{6AE7B4B4-D8EC-4095-9EDE-1D0407493CB4}] => C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{77936D80-6A89-494F-A543-3C0D774614C7}] => C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{8C8323B7-A320-497D-AA70-C0FD492FAAC6}] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
FirewallRules: [{7C57A8A5-6887-4930-B692-5BDA66AD2CE3}] => C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
FirewallRules: [{BC1581EF-EB52-4DB3-806D-6AB1A096F9F0}] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{B090FAC3-34CA-4D99-8374-176423707E40}] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{BD8567CD-18AF-4F3B-9890-47FAD209DC7A}] => C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{AD3D86C8-9D08-4282-B600-06D66D58F91E}] => C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{B1D6920A-FDB1-460D-8785-F074E9A97829}] => C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{5C60FF39-F4AA-45AB-8D65-47390638EE55}] => C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{97D0BC8D-D025-4BD4-B9AB-97DA6D31A164}] => C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{571B4EB1-F5A3-479F-B707-957C19186B6D}] => C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{C8EB4CB1-D30F-4E62-A13B-8B9D04B9CB27}] => C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{ECDACF61-2598-47B3-9446-18AF27FA44EA}] => C:\Program Files (x86)\Nero\Nero Blu-ray Player\Blu-rayPlayer.exe
FirewallRules: [{AF658A1F-622E-4246-9E9F-4386AA84635B}] => C:\Program Files (x86)\Nero\Nero Blu-ray Player\Blu-rayPlayer.exe
FirewallRules: [{F1F82B8E-47E1-4734-B764-1BE0D30FF586}] => C:\Program Files (x86)\Nero\Nero 2015\Nero Burning ROM\StartNBR.exe
FirewallRules: [{FB3533A3-2370-4DFE-83B1-5AA7E5DCC5D6}] => C:\Program Files (x86)\Nero\KM\NMDllHost.exe
FirewallRules: [{896FE7D5-BB83-4ADA-BAE8-190C9C93425A}] => C:\Program Files (x86)\Nero\Nero 2015\Nero Burning ROM\nero.exe
FirewallRules: [{590C04BB-BEBC-4F39-A26E-CA240E6AEABB}] => C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{9226EE8C-D70E-46CB-86C6-FEF3B19528C5}] => C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{5AE195CA-2F53-41A0-9EE8-7EFE42A428B2}] => C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{4393D29C-BCFA-4D99-BDFB-D052C7BABC30}] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
FirewallRules: [{E6BD649F-7312-477E-B04C-F531D47FFFE9}] => C:\Windows\system32\rundll32.exe
FirewallRules: [{DDE35257-478B-4C15-830C-F3BCA8B62E5F}] => C:\Windows\System32\rundll32.exe
FirewallRules: [{16749CA5-9553-44D1-976F-2CA2CD95A67B}] => C:\Windows\System32\rundll32.exe
FirewallRules: [{434BD66E-2F89-474B-A37A-C056D1C7F5CA}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{DBC6CABE-2B06-434E-B577-9497E53E549C}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{A3B7F349-F50C-4684-939B-1D3CACE158F2}] => C:\Windows\System32\rundll32.exe
FirewallRules: [{DEC7CDB3-D197-4AC7-955C-EC896BD4D87A}] => C:\Windows\System32\rundll32.exe

==================== Wiederherstellungspunkte =========================

05-01-2017 13:38:00 AA11
05-01-2017 14:32:06 Malwarebytes Anti-Rootkit Restore Point
05-01-2017 21:23:16 JRT Pre-Junkware Removal

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (01/05/2017 09:18:51 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (01/05/2017 02:33:59 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (01/05/2017 01:42:35 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (01/04/2017 07:15:23 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (01/02/2017 04:35:14 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (12/29/2016 09:04:29 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Explorer.EXE, Version 6.3.9600.18460 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 130c

Startzeit: 01d2620c2e667e36

Endzeit: 0

Anwendungspfad: C:\Windows\Explorer.EXE

Berichts-ID: e14a6ce5-ce01-11e6-82a7-0c54a5f0a527

Vollständiger Name des fehlerhaften Pakets:

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (12/27/2016 10:03:54 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={DE254671-4ECE-4FAA-AE04-9583C6D96084}: Der Benutzer "SYSTEM" hat eine Verbindung mit dem Namen "congstar" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 797.

Error: (12/27/2016 10:01:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ZeroConfigService.exe, Version: 16.6.0.0, Zeitstempel: 0x52585e22
Name des fehlerhaften Moduls: MurocApi.dll, Version: 16.6.0.0, Zeitstempel: 0x52585cf1
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000002bcc5
ID des fehlerhaften Prozesses: 0xbec
Startzeit der fehlerhaften Anwendung: 0x01d26084408bc029
Pfad der fehlerhaften Anwendung: C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
Pfad des fehlerhaften Moduls: C:\Program Files\Intel\WiFi\bin\MurocApi.dll
Berichtskennung: 932c00af-cc77-11e6-82a7-0c54a5f0a527
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (12/27/2016 10:00:14 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (12/27/2016 09:55:54 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".

Details:
AddLegacyDriverFiles: Unable to back up image of binary Bytemobile Kernel Network Provider.

System Error:
Das System kann die angegebene Datei nicht finden.
.


Systemfehler:
=============
Error: (01/06/2017 12:17:18 PM) (Source: DCOM) (EventID: 10010) (User: WOMBAT)
Description: Der Server "{BF6C1E47-86EC-4194-9CE5-13C15DCB2001}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (01/06/2017 12:16:48 PM) (Source: DCOM) (EventID: 10010) (User: WOMBAT)
Description: Der Server "{1B1F472E-3221-4826-97DB-2C2324D389AE}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (01/06/2017 12:09:10 PM) (Source: DCOM) (EventID: 10010) (User: WOMBAT)
Description: Der Server "{BF6C1E47-86EC-4194-9CE5-13C15DCB2001}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (01/06/2017 12:08:40 PM) (Source: DCOM) (EventID: 10010) (User: WOMBAT)
Description: Der Server "{1B1F472E-3221-4826-97DB-2C2324D389AE}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (01/06/2017 11:25:30 AM) (Source: DCOM) (EventID: 10010) (User: WOMBAT)
Description: Der Server "{1B1F472E-3221-4826-97DB-2C2324D389AE}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (01/06/2017 11:25:00 AM) (Source: DCOM) (EventID: 10010) (User: WOMBAT)
Description: Der Server "{BF6C1E47-86EC-4194-9CE5-13C15DCB2001}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (01/06/2017 08:31:38 AM) (Source: DCOM) (EventID: 10010) (User: WOMBAT)
Description: Der Server "{1B1F472E-3221-4826-97DB-2C2324D389AE}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (01/06/2017 08:31:08 AM) (Source: DCOM) (EventID: 10010) (User: WOMBAT)
Description: Der Server "{BF6C1E47-86EC-4194-9CE5-13C15DCB2001}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (01/06/2017 07:30:42 AM) (Source: DCOM) (EventID: 10010) (User: WOMBAT)
Description: Der Server "{1B1F472E-3221-4826-97DB-2C2324D389AE}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (01/06/2017 07:30:12 AM) (Source: DCOM) (EventID: 10010) (User: WOMBAT)
Description: Der Server "{BF6C1E47-86EC-4194-9CE5-13C15DCB2001}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.


CodeIntegrity:
===================================
  Date: 2017-01-04 20:43:31.246
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-12-26 17:22:16.672
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-12-26 16:34:58.481
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-12-26 16:13:53.405
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-12-26 16:12:21.560
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-12-25 22:41:42.989
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-12-25 22:41:42.739
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-12-25 22:41:42.489
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-12-25 22:41:41.942
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-12-25 22:41:41.692
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Speicherinformationen ===========================

Prozessor: Intel(R) Core(TM) i3-4000M CPU @ 2.40GHz
Prozentuale Nutzung des RAM: 30%
Installierter physikalischer RAM: 8100.68 MB
Verfügbarer physikalischer RAM: 5640.95 MB
Summe virtueller Speicher: 9380.68 MB
Verfügbarer virtueller Speicher: 6992.35 MB

==================== Laufwerke ================================

Drive c: (Boot) (Fixed) (Total:869.8 GB) (Free:437.32 GB) NTFS
Drive d: (Recover) (Fixed) (Total:60 GB) (Free:42.06 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: F2E9FFFD)

Partition: GPT.

==================== Ende von Addition.txt ============================

cosinus 06.01.2017 13:27
Kontrollscans mit (1) MBAM, (2) ESET und (3) SecurityCheck bitte:


1. Schritt: MBAM

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.




2. Schritt: ESET

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset




3. Schritt: SecurityCheck

Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

Schnuckibaer 06.01.2017 19:07
Malwarebytes-Log
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlaufdatum: 06.01.2017
Suchlaufzeit: 15:01
Protokolldatei: Malwarebytes 2017-01-06.txt
Administrator: Ja

Version: 2.2.1.1043
Malware-Datenbank: v2017.01.06.05
Rootkit-Datenbank: v2016.11.20.01
Lizenz: Testversion
Malware-Schutz: Aktiviert
Schutz vor bösartigen Websites: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Denise

Suchlauftyp: Bedrohungssuchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 323347
Abgelaufene Zeit: 10 Min., 29 Sek.

Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(keine bösartigen Elemente erkannt)

Module: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)

Registrierungswerte: 0
(keine bösartigen Elemente erkannt)

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Ordner: 1
Adware.Elex.Generic, C:\Program Files (x86)\Cherciingnazak Schedule, In Quarantäne, [8d200b6dd3d5be78f318abfe55abd32d],

Dateien: 6
Adware.Elex, C:\Program Files (x86)\Cherciingnazak Schedule\local64spl.dll, In Quarantäne, [b2fb58207434d1650fb34664fa0659a7],
Adware.Elex.Generic, C:\Program Files (x86)\Cherciingnazak Schedule\local64spl.dll.ini, In Quarantäne, [8d200b6dd3d5be78f318abfe55abd32d],
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Profiles\Atdaght.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.search.searchengine.sp", "hxxp://www.trotux.com/search/?from=isr&q={searchTerms}&type=sp&uid=ST1000LM014-1EJ164_W380TBM4XXXXW380TBM4&z=d905852e00ab93a275b7190g7z3beoam9e0gew8b8t");), Ersetzt,[4f5e3345beeafa3cf0f5d267bf410af6]
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Profiles\Atdaght.default\prefs.js, Gut: (), Schlecht: (, 1482676242);
user_pref("app.update.lastUpdateTime.experiments-update-timer", 1482613894);
user_pref("app.update.lastUpdateTime.search-engine-update-timxpi-signature-verification", 1482613774);
us), Ersetzt,[a409f88037710432d51025143cc41ce4]
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Profiles\Atdaght.default\prefs.js, Gut: (), Schlecht: (ate-timer", 1482613654);
user_pref("app.update.lastU), Ersetzt,[644945338127989e8d583504728ed12f]
PUP.Optional.Trotux, C:\Users\Denise\AppData\Roaming\Profiles\Atdaght.default\prefs.js, Gut: (), Schlecht: (2613894);
user_pref("app.update.lastUpdateTime.search-engine-update-timxpi-signature-verification", 1482613774);
user_pref("browser.bookmarks.restore_default_bookmarks"), Ersetzt,[1f8e93e595133501cd18a2978a76a759]

Physische Sektoren: 0
(keine bösartigen Elemente erkannt)


(end)
Eset-Log
Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=d7684d2ce06a874484a0fb1cdd8245d4
# end=init
# utc_time=2017-01-06 02:32:27
# local_time=2017-01-06 03:32:27 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# osver=6.2.9200 NT
Update Init
Update Download
Update Finalize
Updated modules version: 31978
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=d7684d2ce06a874484a0fb1cdd8245d4
# end=updated
# utc_time=2017-01-06 02:37:52
# local_time=2017-01-06 03:37:52 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# osver=6.2.9200 NT
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=d7684d2ce06a874484a0fb1cdd8245d4
# engine=31978
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2017-01-06 04:26:58
# local_time=2017-01-06 05:26:58 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 1016338 106553720 0 0
# scanned=84625
# found=6
# cleaned=0
# scan_time=6544
sh=39FAE865E8D95F090F8B3D598F7ABFAD74F43724 ft=1 fh=72a4aca50e29c2c2 vn="Variante von Win32/Adware.ConvertAd.AJQ.gen Anwendung" ac=I fn="C:\AdwCleaner\quarantine\files\jjuzxctzybtdvqtgotbzunnqzbynenzv\Uninstall.exe"
sh=D57A7A7292E867C013A826B89130D28B1FFAC476 ft=0 fh=0000000000000000 vn="BAT/Starter.NCH Trojaner" ac=I fn="C:\AdwCleaner\quarantine\files\xvxjipbzkxrvbfubafkqudxnblthweqm\exe.erolpxei.bat"
sh=17B9B4D6CE699177BDA5B2A40730C80666B23D36 ft=0 fh=0000000000000000 vn="BAT/Starter.NCH Trojaner" ac=I fn="C:\AdwCleaner\quarantine\files\xvxjipbzkxrvbfubafkqudxnblthweqm\exe.rehcnual-42fdp.bat"
sh=87277DA8B94DFE76424560D12005CD76A849B087 ft=0 fh=0000000000000000 vn="BAT/Starter.NCH Trojaner" ac=I fn="C:\AdwCleaner\quarantine\files\xvxjipbzkxrvbfubafkqudxnblthweqm\exe.resworbaidem.bat"
sh=B1CB612B9DA069792DDA740A2B2C6AF560BF8A22 ft=0 fh=0000000000000000 vn="BAT/Starter.NCH Trojaner" ac=I fn="C:\AdwCleaner\quarantine\files\xvxjipbzkxrvbfubafkqudxnblthweqm\exe.xoferif.bat"
sh=D3149D8E82E07C55BFD229FCCAB86993C29A42D3 ft=1 fh=787969f47fbd3ee3 vn="Variante von Win32/DownloadSponsor.C eventuell unerwünschte Anwendung" ac=I fn="C:\Maus\Software\XMedia Recode - CHIP-Installer.exe"
Security-Check-Log
Code:
Results of screen317's Security Check version 1.009 
  x64 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
Windows Defender 
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 MVPS Hosts File 
 TuneUp Utilities 2014 
 TuneUp Utilities 2014 (de-DE) 
 TuneUp Utilities 2014 
 Adobe Flash Player        23.0.0.207 
 Mozilla Firefox (50.1.0)
````````Process Check: objlist.exe by Laurent```````` 
 Malwarebytes Anti-Malware mbamservice.exe 
 Malwarebytes Anti-Malware mbam.exe 
 Malwarebytes Anti-Malware mbamscheduler.exe 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C:  %
````````````````````End of Log``````````````````````


Alle Zeitangaben in WEZ +1. Es ist jetzt 08:33 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131