Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Systemcheck: Touchpad / Mauszeiger spinnt (https://www.trojaner-board.de/184023-systemcheck-touchpad-mauszeiger-spinnt.html)

Dominik H. 19.01.2017 12:40
Systemcheck: Touchpad / Mauszeiger spinnt
 
Hallo zusammen,

ich würde gerne einen Systemcheck machen, da sich mein Touchpad bzw. der Mauszeiger seltsam verhält. Mal kann ich mit der Maus Fenster öffnen und schließen, mal nicht. Mal gibt es Klickoptionen mal nicht. Der Rechtsklick ist plötzlich Linksklick und umgekehrt. Seltsamerweise funktioniert der Mauszeiger ordnungsgemäß, wenn ich eine USB-Maus anschließe.

Ohne es mit Fakten unterlegen zu können, habe ich den Eindruck, dass das Problem insbesondere beim Verwenden von Thunderbird auftritt.

Ich freue mich über Unterstützung.
Herzlichen Dank und viele Grüße
Dominik

M-K-D-B 19.01.2017 21:45
:hallo:


Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.


Bitte beachte folgende Hinweise:
  • Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support unterbrechen bis jegliche Art von illegaler Software vom Rechner entfernt wurde.
  • Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
  • Solltest du mir nicht innerhalb von 3 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo. Solltest du einmal länger abwesend sein, so gib mir bitte Bescheid!
  • Während der Bereinigung bitte nichts installieren oder deinstallieren, außer ich bitte dich darum!
  • Bitte beachten: Download bei filepony.de: So ladet Ihr unsere Tools richtig!
  • Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort als Administrator zu starten!
  • Einige Programme, die wir hier verwenden, können unter Umständen von deinem Antiviren- oder Anti-Malwareprogramm fälschlicherweise als Bedrohung eingestuft werden. Die Sicherheitsprogramme können aufgrund eines bestimmten Programmverhaltens nicht zwischen "gut" oder "böse" unterscheiden und schlagen Alarm. Dabei handelt es sich um Fehlalarme, welche du getrost ignorieren kannst. Gegebenenfalls musst du deine Sicherheitssoftware vor der Ausführung eines Programms deaktivieren, damit unsere Bereinigungsvorgänge nicht beeinträchtigt werden.



Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags:
So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke aauf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

Danke für deine Mitarbeit!




Zur ersten Analyse bitte FRST und TDSS-Killer ausführen:


Schritt 1
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)






Schritt 2
Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.







Bitte poste mit deiner nächsten Antwort
  • die Logdatei von TDSS-Killer,
  • die beiden neuen Logdateien von FRST.

Dominik H. 20.01.2017 18:36
Vielen Dank für die Hilfe!(!).

Hier die gewünschen Codes:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 18-01-2017
Ran by user (administrator) on USER-PC (20-01-2017 17:51:00)
Running from C:\Users\user\Desktop
Loaded Profiles: user (Available Profiles: user & Guest)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
() C:\Program Files\Cold Turkey\CTService.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler64.exe
() C:\Program Files\Cold Turkey\CTConfigServer.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(© 2015 Microsoft Corporation) C:\Users\user\AppData\Local\Microsoft\BingSvc\BingSvc.exe
(Spotify Ltd) C:\Users\user\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Spotify Ltd) C:\Users\user\AppData\Roaming\Spotify\Spotify.exe
(Dropbox, Inc.) C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\acrotray.exe
(Cisco Systems, Inc.) C:\Dominik\Programme\ciscoclient\cvpnd.exe
(Spotify Ltd) C:\Users\user\AppData\Roaming\Spotify\SpotifyCrashService.exe
(Spotify Ltd) C:\Users\user\AppData\Roaming\Spotify\Spotify.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
() C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
() C:\Program Files (x86)\XSManager\WTGService.exe
() C:\ProgramData\ZDSupport\ZDServ\ZDServ.exe
() C:\ProgramData\ZDSupport\ZDServ\CancelAutoPlay_Server.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
() C:\ProgramData\Mobile Partner\OnlineUpdate\LiveUpd.exe
(Farbar) C:\Users\user\Desktop\FRST64(1).exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1353680 2016-11-14] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-07-01] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Acrotray.exe [1870928 2016-12-23] (Adobe Systems Inc.)
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Run: [Dropbox Update] => C:\Users\user\AppData\Local\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-05] (Dropbox, Inc.)
HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Run: [BingSvc] => C:\Users\user\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-17] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Run: [Spotify Web Helper] => C:\Users\user\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1444976 2016-12-25] (Spotify Ltd)
HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [50605696 2016-02-02] (Skype Technologies S.A.)
HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Run: [Adobe Acrobat Synchronizer] => C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe [886352 2016-12-23] (Adobe Systems Incorporated)
HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Run: [Spotify] => C:\Users\user\AppData\Roaming\Spotify\Spotify.exe [7153264 2016-12-25] (Spotify Ltd)
ShellIconOverlayIdentifiers: [  DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2017-01-13]
ShortcutTarget: Dropbox.lnk -> C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{E1796407-EE12-4BF9-A2CF-56DFA7F556C0}: [DhcpNameServer] 192.168.0.1 192.168.0.1
Tcpip\..\Interfaces\{F803A312-9FB2-4B80-830E-D0882C84BC70}: [DhcpNameServer] 192.168.178.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000 -> OldSearch URL = hxxp://www.bing.com/search?FORM=SK2MDF&PC=SK2M&q={searchTerms}&src=IE-SearchBox
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2016-12-28] (Microsoft Corporation)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\URLREDIR.DLL [2016-12-28] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2016-12-28] (Microsoft Corporation)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2016-12-28] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-01-26] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\URLREDIR.DLL [2016-12-28] (Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2016-12-28] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-01-26] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

FireFox:
========
FF DefaultProfile: 2dz2xpoy.default-1414599074507
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\g2mr5o1m.default-1413196550790 [2015-08-13]
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\g2mr5o1m.default-1413196550790 -> Yahoo Search!
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\g2mr5o1m.default-1413196550790 -> Yahoo Search!
FF Homepage: Mozilla\Firefox\Profiles\g2mr5o1m.default-1413196550790 -> hxxps://www.malwarebytes.org/restorebrowser/-bfr-sm-rhb-30__alt__ddc_dsssyc_bd_com
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507 [2017-01-20]
FF user.js: detected! => C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\user.js [2016-03-04]
FF Extension: (Flash Video Downloader - YouTube HD Download [4K]) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\artur.dubovoy@gmail.com [2017-01-07]
FF Extension: (Bing Search Engine) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\bingsearch.full@microsoft.com [2015-04-08] [not signed]
FF Extension: (Grooveshark Unlocker) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\groovesharkUnlocker@overlord1337.xpi [2016-05-01]
FF Extension: (ProxTube) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\ich@maltegoetz.de.xpi [2016-10-18]
FF Extension: (1-Click YouTube Video Downloader) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\YoutubeDownloader@PeterOlayev.com.xpi [2016-08-25]
FF Extension: (EPUBReader) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F} [2017-01-18]
FF Extension: (hd shield) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\{aa991923-b0b8-4938-b763-2aacc9c6992f}.xpi [2015-12-19] [not signed]
FF Extension: (Adblock Plus) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-24]
FF Extension: (DivX Wizard) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\{e93aa736-6c93-453a-a708-2fd62fbd573e}.xpi [2016-05-25] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension.15@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn
FF Extension: (Adobe Acrobat DC - Create PDF) - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn [2017-01-13]
FF HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: (Download videos and MP3s from YouTube) - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-08-01] [not signed]
FF HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\hxod2v34.default-1408804336995\extensions\cliqz@cliqz.com => not found
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-19] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2015-07-29] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-19] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2016-10-06] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-01-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-01-26] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-12-28] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-12-28] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2013-11-11] (VideoLAN)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-12-21] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2015-07-29] (Adobe Systems)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)

Chrome:
=======
CHR DefaultProfile: Default
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2207960 2016-09-26] (Adobe Systems, Incorporated)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [3699904 2016-12-28] (Microsoft Corporation)
R2 CTService; C:\Program Files\Cold Turkey\CTService.exe [62976 2013-12-08] () [File not signed]
R2 CVPND; C:\Dominik\Programme\ciscoclient\cvpnd.exe [1529856 2011-03-04] (Cisco Systems, Inc.)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [351824 2014-01-15] ()
S2 Mobile Partner. RunOuc; C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [651856 2014-12-02] ()
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [7500048 2016-09-20] (TeamViewer GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WTGService; C:\Program Files (x86)\XSManager\WTGService.exe [329848 2013-05-06] ()
R2 ZDServ; C:\ProgramData\ZDSupport\ZDServ\ZDServ.exe [427264 2014-07-07] ()

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 atmeltpm; C:\Windows\System32\DRIVERS\atmeltpm64.sys [19456 2011-08-05] (Atmel, Inc.)
S3 cmnsusbser; C:\Windows\System32\DRIVERS\cmnsusbser.sys [126080 2015-03-12] (QUALCOMM Incorporated)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
S3 hwusb_cdcacm; C:\Windows\System32\DRIVERS\ew_cdcacm.sys [125952 2014-07-25] (Huawei Technologies Co., Ltd.)
S3 hwusb_wwanecm; C:\Windows\System32\DRIVERS\ew_wwanecm.sys [380672 2014-09-30] (Huawei Technologies Co., Ltd.)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-31] (Intel Corporation)
S3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv.sys [49304 2014-12-29] (Visicom Media Inc.)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-08-25] (Malwarebytes Corporation)
S3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [35992 2014-12-29] (Visicom Media Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation)
S3 TPPWRIF; C:\Dominik\Programme\Lenovo Battery Utility 2014\TPPWR64V.sys [20736 2014-03-05] (Lenovo Group Limited)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-20 17:51 - 2017-01-20 17:51 - 00025726 _____ C:\Users\user\Desktop\FRST.txt
2017-01-20 17:49 - 2017-01-20 17:50 - 02419712 _____ (Farbar) C:\Users\user\Desktop\FRST64(1).exe
2017-01-17 16:26 - 2017-01-19 07:30 - 56355840 _____ C:\Users\user\Desktop\Lüneburg.ppt
2017-01-15 20:59 - 2017-01-15 20:59 - 00000040 ____H C:\6A4F84AA7F7F
2017-01-13 10:28 - 2017-01-13 10:28 - 00000000 ____D C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2017-01-11 21:34 - 2017-01-05 19:55 - 00154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2017-01-11 21:34 - 2017-01-05 19:55 - 00095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2017-01-11 21:34 - 2017-01-05 19:52 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00730624 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2017-01-11 21:34 - 2017-01-05 18:42 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2017-01-11 21:34 - 2017-01-05 18:32 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2017-01-11 21:34 - 2017-01-05 18:25 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-01-11 21:34 - 2017-01-05 18:24 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-01-11 21:34 - 2017-01-05 18:24 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-01-11 21:34 - 2017-01-05 18:24 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2017-01-11 21:34 - 2017-01-05 18:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2017-01-11 21:34 - 2017-01-05 18:19 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2017-01-08 02:10 - 2016-11-21 19:12 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\hlink.dll
2017-01-08 02:10 - 2016-11-20 17:19 - 00084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hlink.dll
2017-01-08 02:10 - 2016-11-20 15:07 - 00467392 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2017-01-08 02:10 - 2016-11-17 17:41 - 00370920 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2017-01-08 02:10 - 2016-11-15 00:27 - 00394448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-01-08 02:10 - 2016-11-14 23:39 - 00346320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2017-01-08 02:10 - 2016-11-12 20:48 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2017-01-08 02:10 - 2016-11-12 20:48 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2017-01-08 02:10 - 2016-11-12 20:28 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2017-01-08 02:10 - 2016-11-12 20:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2017-01-08 02:10 - 2016-11-12 20:26 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2017-01-08 02:10 - 2016-11-12 20:25 - 00576000 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-01-08 02:10 - 2016-11-12 20:25 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-01-08 02:10 - 2016-11-12 20:21 - 02896384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-01-08 02:10 - 2016-11-12 20:15 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2017-01-08 02:10 - 2016-11-12 20:14 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2017-01-08 02:10 - 2016-11-12 20:09 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2017-01-08 02:10 - 2016-11-12 20:08 - 25759744 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-01-08 02:10 - 2016-11-12 20:08 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2017-01-08 02:10 - 2016-11-12 20:08 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2017-01-08 02:10 - 2016-11-12 20:07 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-01-08 02:10 - 2016-11-12 20:07 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2017-01-08 02:10 - 2016-11-12 19:56 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2017-01-08 02:10 - 2016-11-12 19:53 - 06049280 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-01-08 02:10 - 2016-11-12 19:52 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2017-01-08 02:10 - 2016-11-12 19:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2017-01-08 02:10 - 2016-11-12 19:41 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-01-08 02:10 - 2016-11-12 19:40 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2017-01-08 02:10 - 2016-11-12 19:35 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2017-01-08 02:10 - 2016-11-12 19:34 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-01-08 02:10 - 2016-11-12 19:31 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-01-08 02:10 - 2016-11-12 19:30 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2017-01-08 02:10 - 2016-11-12 19:29 - 00498688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2017-01-08 02:10 - 2016-11-12 19:29 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2017-01-08 02:10 - 2016-11-12 19:29 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2017-01-08 02:10 - 2016-11-12 19:28 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2017-01-08 02:10 - 2016-11-12 19:27 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2017-01-08 02:10 - 2016-11-12 19:20 - 02287616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2017-01-08 02:10 - 2016-11-12 19:20 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2017-01-08 02:10 - 2016-11-12 19:19 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2017-01-08 02:10 - 2016-11-12 19:17 - 20302848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-01-08 02:10 - 2016-11-12 19:15 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2017-01-08 02:10 - 2016-11-12 19:14 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2017-01-08 02:10 - 2016-11-12 19:14 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2017-01-08 02:10 - 2016-11-12 19:14 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-01-08 02:10 - 2016-11-12 19:14 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2017-01-08 02:10 - 2016-11-12 19:11 - 00725504 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-01-08 02:10 - 2016-11-12 19:10 - 00806912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-01-08 02:10 - 2016-11-12 19:08 - 02131456 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-01-08 02:10 - 2016-11-12 19:08 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2017-01-08 02:10 - 2016-11-12 19:03 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2017-01-08 02:10 - 2016-11-12 18:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2017-01-08 02:10 - 2016-11-12 18:56 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2017-01-08 02:10 - 2016-11-12 18:52 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2017-01-08 02:10 - 2016-11-12 18:51 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2017-01-08 02:10 - 2016-11-12 18:49 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2017-01-08 02:10 - 2016-11-12 18:47 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2017-01-08 02:10 - 2016-11-12 18:41 - 15257088 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-01-08 02:10 - 2016-11-12 18:40 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2017-01-08 02:10 - 2016-11-12 18:38 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2017-01-08 02:10 - 2016-11-12 18:37 - 04608000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-01-08 02:10 - 2016-11-12 18:36 - 02055680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2017-01-08 02:10 - 2016-11-12 18:36 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2017-01-08 02:10 - 2016-11-12 18:35 - 02920960 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-01-08 02:10 - 2016-11-12 18:21 - 13653504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-01-08 02:10 - 2016-11-12 18:20 - 01543680 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-01-08 02:10 - 2016-11-12 18:11 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-01-08 02:10 - 2016-11-12 18:05 - 02444800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-01-08 02:10 - 2016-11-12 18:02 - 01312256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-01-08 02:10 - 2016-11-12 18:02 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2017-01-08 02:10 - 2016-11-10 17:32 - 01009152 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2017-01-08 02:10 - 2016-11-10 17:19 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2017-01-08 02:10 - 2016-11-09 17:41 - 00114408 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2017-01-08 02:10 - 2016-11-09 17:33 - 03244032 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2017-01-08 02:10 - 2016-11-09 17:33 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2017-01-08 02:10 - 2016-11-09 17:33 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2017-01-08 02:10 - 2016-11-09 17:33 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2017-01-08 02:10 - 2016-11-09 17:33 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2017-01-08 02:10 - 2016-11-09 17:33 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2017-01-08 02:10 - 2016-11-09 17:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2017-01-08 02:10 - 2016-11-09 17:17 - 01806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2017-01-08 02:10 - 2016-11-09 17:17 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2017-01-08 02:10 - 2016-11-09 17:17 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2017-01-08 02:10 - 2016-11-09 17:17 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2017-01-08 02:10 - 2016-11-09 17:02 - 00128512 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2017-01-08 02:10 - 2016-11-09 16:55 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2017-01-08 02:10 - 2016-11-06 17:33 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2017-01-08 02:10 - 2016-11-06 17:16 - 00312832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2017-01-08 02:10 - 2016-11-06 17:01 - 03219456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-01-08 02:10 - 2016-10-27 16:33 - 00802304 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2017-01-08 02:10 - 2016-10-27 16:20 - 00627712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2017-01-08 02:10 - 2016-10-11 16:40 - 00631176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2017-01-08 02:10 - 2016-10-11 16:37 - 05547752 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-01-08 02:10 - 2016-10-11 16:37 - 00706792 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2017-01-08 02:10 - 2016-10-11 16:34 - 01732864 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\nlsbres.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:24 - 04000488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2017-01-08 02:10 - 2016-10-11 16:24 - 03944680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2017-01-08 02:10 - 2016-10-11 16:21 - 01314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlsbres.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:03 - 00148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2017-01-08 02:10 - 2016-10-11 16:03 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2017-01-08 02:10 - 2016-10-11 16:03 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2017-01-08 02:10 - 2016-10-11 15:59 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2017-01-08 02:10 - 2016-10-11 15:59 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2017-01-08 02:10 - 2016-10-11 15:55 - 00346112 _____ (Microsoft Corporation) C:\Windows\system32\bcdedit.exe
2017-01-08 02:10 - 2016-10-11 15:55 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2017-01-08 02:10 - 2016-10-11 15:51 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2017-01-08 02:10 - 2016-10-11 15:51 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2017-01-08 02:10 - 2016-10-11 15:51 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2017-01-08 02:10 - 2016-10-11 15:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2017-01-08 02:10 - 2016-10-11 15:50 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 15:50 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 15:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 15:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 14:18 - 00419648 _____ C:\Windows\SysWOW64\locale.nls
2017-01-08 02:10 - 2016-10-11 14:17 - 00419648 _____ C:\Windows\system32\locale.nls
2017-01-08 02:10 - 2016-10-08 14:06 - 00633296 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2017-01-08 02:10 - 2016-10-04 16:31 - 01483264 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2017-01-08 02:10 - 2016-10-04 16:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2017-01-08 02:10 - 2016-10-04 16:31 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2017-01-08 02:10 - 2016-10-04 16:31 - 00141824 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2017-01-08 02:10 - 2016-10-04 16:13 - 01176064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2017-01-08 02:10 - 2016-10-04 16:13 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2017-01-08 02:10 - 2016-10-04 16:13 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2017-01-08 02:10 - 2016-10-04 16:13 - 00106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2016-12-31 16:54 - 2016-12-31 16:54 - 00002423 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access 2016.lnk
2016-12-28 15:02 - 2016-11-02 16:36 - 00382696 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2016-12-28 15:02 - 2016-11-02 16:22 - 00308456 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2016-12-28 15:02 - 2016-10-15 16:31 - 00976896 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2016-12-28 15:02 - 2016-10-15 16:13 - 00741888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2016-12-28 15:02 - 2016-10-11 16:31 - 01148416 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10.IME
2016-12-28 15:02 - 2016-10-11 16:31 - 01068544 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2016-12-28 15:02 - 2016-10-11 16:31 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2016-12-28 15:02 - 2016-10-11 16:31 - 00457216 _____ (Microsoft Corporation) C:\Windows\system32\imkr80.ime
2016-12-28 15:02 - 2016-10-11 16:31 - 00246784 _____ (Microsoft Corporation) C:\Windows\system32\input.dll
2016-12-28 15:02 - 2016-10-11 16:31 - 00176128 _____ (Microsoft Corporation) C:\Windows\system32\tintlgnt.ime
2016-12-28 15:02 - 2016-10-11 16:31 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\quick.ime
2016-12-28 15:02 - 2016-10-11 16:31 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\qintlgnt.ime
2016-12-28 15:02 - 2016-10-11 16:31 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\phon.ime
2016-12-28 15:02 - 2016-10-11 16:31 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\cintlgnt.ime
2016-12-28 15:02 - 2016-10-11 16:31 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\chajei.ime
2016-12-28 15:02 - 2016-10-11 16:31 - 00132608 _____ (Microsoft Corporation) C:\Windows\system32\pintlgnt.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 01027584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10.IME
2016-12-28 15:02 - 2016-10-11 16:18 - 00829952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2016-12-28 15:02 - 2016-10-11 16:18 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL
2016-12-28 15:02 - 2016-10-11 16:18 - 00430080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imkr80.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 00202240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\input.dll
2016-12-28 15:02 - 2016-10-11 16:18 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tintlgnt.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quick.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qintlgnt.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\phon.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cintlgnt.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\chajei.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 00090112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pintlgnt.ime
2016-12-28 15:02 - 2016-10-11 14:33 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2016-12-28 15:02 - 2016-10-11 14:06 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2016-12-28 15:02 - 2016-10-07 16:32 - 03649536 _____ (Microsoft Corporation) C:\Windows\system32\MSVidCtl.dll
2016-12-28 15:02 - 2016-10-07 16:32 - 00877056 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2016-12-28 15:02 - 2016-10-07 16:32 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2016-12-28 15:02 - 2016-10-07 16:12 - 02291712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVidCtl.dll
2016-12-28 15:02 - 2016-10-07 16:12 - 00581632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2016-12-28 15:02 - 2016-10-07 16:12 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\asycfilt.dll
2016-12-28 15:02 - 2016-10-05 15:54 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bowser.sys
2016-12-28 15:02 - 2016-09-15 15:56 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2016-12-28 15:02 - 2016-09-09 19:20 - 00756736 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2016-12-28 15:02 - 2016-09-09 19:00 - 00497152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2016-12-28 15:02 - 2016-08-22 17:19 - 01386496 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2016-12-28 15:01 - 2016-11-02 16:32 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2016-12-28 15:01 - 2016-11-02 16:32 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2016-12-28 15:01 - 2016-11-02 16:32 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2016-12-28 15:01 - 2016-11-02 16:32 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2016-12-28 15:01 - 2016-11-02 16:16 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2016-12-28 15:01 - 2016-11-02 16:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2016-12-28 15:01 - 2016-11-02 16:16 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2016-12-28 15:01 - 2016-11-02 15:53 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2016-12-28 15:01 - 2016-10-15 16:31 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll
2016-12-28 15:01 - 2016-10-15 16:13 - 00084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\INETRES.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-20 17:51 - 2014-08-20 11:40 - 00000000 ____D C:\FRST
2017-01-20 17:23 - 2015-06-20 10:07 - 00001220 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3705937506-1407253618-1579061599-1000UA.job
2017-01-20 16:36 - 2014-01-15 19:26 - 00000000 ____D C:\Users\user\AppData\Roaming\Skype
2017-01-20 15:00 - 2016-08-12 20:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-01-19 21:30 - 2015-06-20 10:07 - 00001168 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3705937506-1407253618-1579061599-1000Core.job
2017-01-19 19:41 - 2014-08-05 22:41 - 00811108 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2017-01-19 12:07 - 2016-05-26 18:16 - 00003844 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1464282961
2017-01-19 12:07 - 2016-05-26 18:15 - 00000000 ____D C:\Program Files (x86)\Opera
2017-01-19 12:06 - 2016-10-12 19:58 - 00000000 ____D C:\Users\Public\Documents\AdobeGC
2017-01-19 12:05 - 2009-07-14 05:45 - 00022080 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-01-19 12:05 - 2009-07-14 05:45 - 00022080 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-01-19 12:02 - 2009-07-14 06:13 - 00793522 _____ C:\Windows\system32\PerfStringBackup.INI
2017-01-19 12:02 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2017-01-19 12:01 - 2014-04-10 10:59 - 00000000 ___RD C:\Users\user\Dropbox
2017-01-19 11:57 - 2015-09-18 21:50 - 00000000 ____D C:\Users\user\AppData\Local\Spotify
2017-01-19 11:57 - 2015-09-18 21:49 - 00000000 ____D C:\Users\user\AppData\Roaming\Spotify
2017-01-19 11:56 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-01-19 08:35 - 2014-01-18 08:16 - 00000000 ____D C:\Users\user\AppData\Roaming\vlc
2017-01-15 20:59 - 2013-12-08 03:14 - 00000000 ____D C:\Users\user\AppData\Roaming\Adobe
2017-01-14 20:45 - 2016-02-03 21:56 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-01-14 20:41 - 2016-02-03 21:53 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2017-01-14 12:09 - 2013-12-08 02:11 - 00000000 ____D C:\Windows\system32\MRT
2017-01-14 12:05 - 2013-12-08 02:11 - 135657872 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-01-13 13:18 - 2016-01-12 20:23 - 00002453 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat DC.lnk
2017-01-13 13:18 - 2016-01-12 20:23 - 00002037 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller DC.lnk
2017-01-13 10:29 - 2014-04-10 10:55 - 00000000 ____D C:\Users\user\AppData\Roaming\Dropbox
2017-01-13 10:24 - 2014-12-25 13:21 - 00004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2017-01-08 11:39 - 2009-07-14 05:45 - 00455784 _____ C:\Windows\system32\FNTCACHE.DAT
2017-01-08 11:14 - 2016-09-17 11:44 - 02697708 ____H C:\Users\user\AppData\Local\IconCache.db.backup
2016-12-29 10:07 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\catroot
2016-12-29 10:06 - 2009-07-14 04:20 - 00000000 ___SD C:\ProgramData\Microsoft
2016-12-29 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\migration
2016-12-29 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\migration
2016-12-29 09:44 - 2013-12-08 01:44 - 00002117 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2016-12-29 09:44 - 2013-12-08 01:44 - 00001945 _____ C:\Windows\epplauncher.mif
2016-12-29 09:44 - 2013-12-08 01:44 - 00000000 ____D C:\Program Files\Microsoft Security Client
2016-12-29 09:44 - 2013-12-08 01:44 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2016-12-26 23:05 - 2016-08-12 14:31 - 00000000 ____D C:\Users\Guest\AppData\Local
2016-12-25 12:50 - 2013-12-08 02:10 - 00000000 ____D C:\Windows\Prefetch

==================== Files in the root of some directories =======

2015-05-01 20:23 - 2015-05-01 20:23 - 1065984 _____ () C:\Users\user\AppData\Local\file__0.localstorage
2014-01-27 16:16 - 2014-01-27 16:16 - 0000337 _____ () C:\Users\user\AppData\Local\Perfmon.PerfmonCfg

Some files in TEMP:
====================
C:\Users\user\AppData\Local\Temp\BingSvc.exe
C:\Users\user\AppData\Local\Temp\BSvcProcessor.exe
C:\Users\user\AppData\Local\Temp\BSvcUpdater.exe
C:\Users\user\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpw06rfy.dll
C:\Users\user\AppData\Local\Temp\jre-8u71-windows-au.exe
C:\Users\user\AppData\Local\Temp\jre-8u73-windows-au.exe
C:\Users\user\AppData\Local\Temp\jre-8u77-windows-au.exe
C:\Users\user\AppData\Local\Temp\jre-8u91-windows-au.exe
C:\Users\user\AppData\Local\Temp\paint.net.4.0.12.install.exe
C:\Users\user\AppData\Local\Temp\Quarantine.exe
C:\Users\user\AppData\Local\Temp\SkypeSetup.exe
C:\Users\user\AppData\Local\Temp\sqlite3.dll
C:\Users\user\AppData\Local\Temp\{4E3E1B2F-8D98-4B99-9943-E2CB10FCF609}-GoogleEarth-Win-Bundle-7.1.5.1557.exe
C:\Users\user\AppData\Local\Temp\{B632A662-D740-4473-9477-5A7CE5F27ED7}-DropboxClient_8.4.19.exe


==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-01-20 17:36

==================== End of FRST.txt ============================
--- --- ---

[CODE]Additional
FRST Logfile:
Code:
scan result of Farbar Recovery Scan Tool (x64) Version: 18-01-2017
Ran by user (20-01-2017 17:52:03)
Running from C:\Users\user\Desktop
Windows 7 Professional Service Pack 1 (X64) (2013-12-08 00:14:01)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3705937506-1407253618-1579061599-500 - Administrator - Disabled)
Guest (S-1-5-21-3705937506-1407253618-1579061599-501 - Limited - Enabled) => C:\Users\Guest
HomeGroupUser$ (S-1-5-21-3705937506-1407253618-1579061599-1002 - Limited - Enabled)
user (S-1-5-21-3705937506-1407253618-1579061599-1000 - Administrator - Enabled) => C:\Users\user

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {71A27EC9-3DA6-45FC-60A7-004F623C6189}
AS: Microsoft Security Essentials (Enabled - Up to date) {CAC39F2D-1B9C-4A72-5A17-3B3D19BB2B34}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

1&1 Surf-Stick (HKLM-x32\...\{7438DA7D-782C-450F-BCDC-5FC54E6831B8}) (Version: 1.0.0.2 - ZTE Corporation)
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
Adobe Acrobat DC (HKLM-x32\...\{AC76BA86-1033-FFFF-7760-0C0F074E4100}) (Version: 15.023.20053 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 21 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 21.0.0.242 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 5.4 64-bit (HKLM\...\{558B5965-CC1B-4AF1-BA07-5D6832404050}) (Version: 5.4.0 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
CDisplayEx 1.10.18 (HKLM-x32\...\CDisplayEx_is1) (Version:  - cdisplayex.com)
Cisco Systems VPN Client 5.0.07.0440 (HKLM\...\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}) (Version: 5.0.7 - Cisco Systems, Inc.)
Cliqz (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.22 - Cliqz.com)
Clonk Planet (HKLM-x32\...\Clonk Planet) (Version: 4.65 - RedWolf Design)
Cold Turkey version 0.9 (HKLM\...\{6498E673-B9C2-4544-A722-1E854B5B573E}_is1) (Version: 0.9 - Felix Belzile)
Command & Conquer Tiberian Sun (HKLM-x32\...\{52F25D7D-DEE1-42E7-AB48-D0F014E1F795}_is1) (Version:  - Command & Conquer Communications Center)
Conexant 20585 SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.95.49.53 - Conexant)
Dia (nur entfernen) (HKLM-x32\...\Dia) (Version:  - )
Dota 2 (HKLM-x32\...\Steam App 570) (Version:  - Valve)
Dropbox (HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Dropbox) (Version: 17.4.33 - Dropbox, Inc.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Exact Audio Copy 1.0beta3 (HKLM-x32\...\Exact Audio Copy) (Version: 1.0beta3 - Andre Wiethoff)
Free YouTube to MP3 Converter version 3.12.42.716 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.42.716 - DVDVideoSoft Ltd.)
Futuremark SystemInfo (HKLM-x32\...\{BEE64C14-BEF1-4610-8A68-A16EAA47B882}) (Version: 4.15.0 - Futuremark Corporation)
Google Earth (HKLM-x32\...\{A0C18B96-AB79-46BD-8321-6FA83E6D25B9}) (Version: 7.1.7.2606 - Google)
Google Earth Pro (HKLM-x32\...\{44FC61F0-2F8A-11E3-8CAE-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
GPL Ghostscript 8.71 (HKLM\...\GPL Ghostscript 8.71) (Version:  - )
GSview 5.0 (HKLM\...\GSview 5.0) (Version: 5.0 - Ghostgum Software Pty Ltd)
Half-Life 2: Demo (HKLM-x32\...\Steam App 219) (Version:  - Valve)
Image Composite Editor (HKLM\...\{92AB5708-1AAA-4B1B-A8D5-45CF3AD77519}) (Version: 2.0.3 - Microsoft Corporation)
InfraRecorder 0.53 (x64 edition) (HKLM\...\{2C22EA92-CB30-4932-0053-000001000000}) (Version: 0.53.00.00 - Christian Kindahl)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 18.7 - Intel)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version:  - )
Lenovo Battery Utility 2014 1.2 (HKLM-x32\...\{62D5A67D-E5CC-4D79-8998-DDFDB7750346}_is1) (Version: 1.2 - Lenovo Corp)
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.03.13 - )
Malwarebytes Anti-Malware version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Medieval II Total War (HKLM-x32\...\{C0698BDA-0D29-40EE-8570-A31106DF9AB1}) (Version: 1.00.0000 - SEGA)
Meltdown (HKLM-x32\...\{673B2230-6035-11DE-6784-5813CA2118BE}) (Version: 3 - Poda)
Metro 2033 Demo (HKLM-x32\...\{74027A70-698F-49B4-969D-AA64BE2A8D8B}_is1) (Version:  - THQ)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 365 Business - de-de (HKLM\...\O365BusinessRetail - de-de) (Version: 16.0.7571.2109 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\OneDriveSetup.exe) (Version: 17.3.4604.0120 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.10.209.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MiKTeX 2.9 (HKLM\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
Mobile Partner (HKLM-x32\...\Mobile Partner) (Version: 23.015.11.00.382 - Huawei Technologies Co.,Ltd)
Mozilla Firefox 38.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.5 (x86 de)) (Version: 38.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 45.1.1.5990 - Mozilla)
Mozilla Thunderbird 24.2.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.2.0 (x86 de)) (Version: 24.2.0 - Mozilla)
Mozilla Thunderbird 45.1.1 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 45.1.1 (x86 de)) (Version: 45.1.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MuseScore 2 (HKLM-x32\...\{D0969A82-E79E-45D9-95D2-B2824880F780}) (Version: 2.0.2 - Werner Schweer and Others)
No More Room in Hell (HKLM-x32\...\Steam App 224260) (Version:  - No More Room in Hell Team)
NVIDIA Graphics Driver 327.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.23 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{54194F60-988C-4D03-B922-C2B00EFDA39A}) (Version: 9.10.0222 - NVIDIA Corporation)
Office 16 Click-to-Run Extensibility Component (x32 Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (x32 Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
online-foto Bestellsoftware (HKLM-x32\...\online-foto Bestellsoftware) (Version: 5.1.7 - CEWE Stiftung u Co. KGaA)
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
OpenOffice 4.0.1 (HKLM-x32\...\{47F460DA-D1BE-4D85-8DF2-AA1F31D3445F}) (Version: 4.01.9714 - Apache Software Foundation)
OpenProj (HKLM-x32\...\{13702021-43FB-480C-912F-D9B74A538288}) (Version: 1.4.0 - Serena Software Inc.)
Opera Stable 42.0.2393.137 (HKLM-x32\...\Opera 42.0.2393.137) (Version: 42.0.2393.137 - Opera Software)
Painkiller Demo (HKLM-x32\...\Steam App 3210) (Version:  - People Can Fly)
Painkiller Hell & Damnation Demo (HKLM-x32\...\Steam App 223370) (Version:  - The Farm 51)
paint.net (HKLM\...\{19BD2C33-16A8-4ED1-B9EA-D9E35B21EC42}) (Version: 4.0.5 - dotPDN LLC)
QGIS Dufour 2.0.1 Dufour (HKLM\...\QGIS Dufour) (Version:  - QGIS Development Team)
Quake Live (HKLM-x32\...\Steam App 282440) (Version:  - id Software)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
SereneScreen Marine Aquarium 2 (HKLM-x32\...\SereneScreen Marine Aquarium 2_is1) (Version: 2.0 - Prolific Publishing, Inc.)
SketchUp 2015 (HKLM\...\{A83795B9-570F-40FF-ACB4-710B568EBA22}) (Version: 15.3.331 - Trimble Navigation Limited)
Skype™ 7.18 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.18.111 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Spotify) (Version: 1.0.45.186.g3b5036d6 - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
StreamTransport version: 1.1.6.1 (HKLM-x32\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version:  - )
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
TeamViewer 11 (HKLM-x32\...\TeamViewer) (Version: 11.0.66695 - TeamViewer)
TeXnicCenter Version 2.02 Stable (HKLM\...\TeXnicCenter_is1) (Version: 2.02 Stable - The TeXnicCenter Team)
Tinypic 3.18 (HKLM-x32\...\{E3723A04-A894-4036-A78E-282E18F43C0A}_is1) (Version: Tinypic 3.18 - E. Fiedler)
Unigine Valley Benchmark version 1.0 (HKLM-x32\...\Unigine Valley Benchmark_is1) (Version: 1.0 - Unigine Corp.) <==== ATTENTION
VLC media player 2.1.1 (HKLM-x32\...\VLC media player) (Version: 2.1.1 - VideoLAN)
War2Combat 3.05 (HKLM-x32\...\War2Combat_is1) (Version: 3.05 - il)
WAV To MP3 V2 (HKLM-x32\...\WAV To MP3_is1) (Version:  - hxxp://www.WAVMP3.net)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WinRAR 5.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
XSManager (HKLM-x32\...\XSManager) (Version: 3.2 - XSManager)
YANG (Yet Another Netplay Guider) (HKLM-x32\...\YANG) (Version:  - )
yEd Graph Editor 3.11.1 (HKLM-x32\...\3309-7404-0599-8908) (Version: 3.11.1 - yWorks GmbH)
ZDaemon (remove only) (HKLM-x32\...\ZDaemon) (Version:  - )
ZDServer (HKLM-x32\...\{C8197F5F-E0DC-44f1-8AF2-1AA5A84F695D}) (Version: 1.0.1.2 - ZTE Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {05F64073-CD20-4C58-9269-A4DCE9F29752} - System32\Tasks\{8661ED1F-3571-4265-A579-5F7FBB9315C0} => Firefox.exe hxxp://ui.skype.com/ui/0/7.27.64.101/de/abandoninstall?page=tsMain
Task: {343FA0EC-472E-4898-A351-72A150107C9E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {46D42B05-F72C-44CE-8C7C-FD7BF8511A2A} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\\MpCmdRun.exe [2016-11-14] (Microsoft Corporation)
Task: {5BE089BD-0064-4D1C-88C5-0D97F35960D9} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-12-19] (Adobe Systems Incorporated)
Task: {64A798E8-C7F2-4A31-8F01-EB9DA0C0507D} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-12-28] (Microsoft Corporation)
Task: {A25576EC-6A2A-4DB2-A7EB-5E784629C973} - System32\Tasks\{7728094E-8498-4266-BA28-E921C2676EDE} => pcalua.exe -a "C:\Dominik\Programme\Virenschutz\RevoUninstaller\Revo Uninstaller\Revouninstaller.exe" -d "C:\Dominik\Programme\Virenschutz\RevoUninstaller\Revo Uninstaller"
Task: {B162D77B-0A94-4408-B4D7-634FC86C033F} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-3705937506-1407253618-1579061599-1000Core => C:\Users\user\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-11-05] (Dropbox, Inc.)
Task: {B3B3FAA1-D1C3-451E-B168-0A6809385D78} - System32\Tasks\Opera scheduled Autoupdate 1464282961 => C:\Program Files (x86)\Opera\launcher.exe [2017-01-16] (Opera Software)
Task: {C630EE30-91AF-4826-84E7-E9CD8A4E0098} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-3705937506-1407253618-1579061599-1000UA => C:\Users\user\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-11-05] (Dropbox, Inc.)
Task: {D17C79C6-2BC0-453A-806B-A2CBABEBC727} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-12-28] (Microsoft Corporation)
Task: {E1271D86-7755-4B6D-92EE-686C911254D9} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2016-12-29] (Microsoft Corporation)
Task: {E2EB2F22-B9FF-4D3D-996D-5D06AD57806A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3705937506-1407253618-1579061599-1000Core.job => C:\Users\user\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3705937506-1407253618-1579061599-1000UA.job => C:\Users\user\AppData\Local\Dropbox\Update\DropboxUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2013-12-28 22:48 - 2013-09-12 08:25 - 00097568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-01-30 22:58 - 2013-12-08 01:04 - 00062976 _____ () C:\Program Files\Cold Turkey\CTService.exe
2014-01-30 22:58 - 2012-12-21 16:54 - 00006656 _____ () C:\Program Files\Cold Turkey\NetworkTime.dll
2014-01-30 22:58 - 2013-10-27 10:04 - 00557056 _____ () C:\Program Files\Cold Turkey\CTConfigServer.exe
2014-01-15 04:42 - 2014-01-15 04:42 - 00351824 _____ () C:\ProgramData\DatacardService\HWDeviceService64.exe
2016-09-22 09:45 - 2014-12-02 10:28 - 00651856 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
2015-03-12 09:13 - 2013-05-06 14:45 - 00329848 ____N () C:\Program Files (x86)\XSManager\WTGService.exe
2015-03-11 21:04 - 2014-07-07 17:34 - 00427264 _____ () C:\ProgramData\ZDSupport\ZDServ\ZDServ.exe
2015-03-11 21:04 - 2014-07-07 17:34 - 00426752 _____ () C:\ProgramData\ZDSupport\ZDServ\CancelAutoPlay_Server.exe
2016-10-06 19:06 - 2014-12-02 10:28 - 01531472 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\LiveUpd.exe
2015-09-18 21:50 - 2016-12-25 13:36 - 51777648 _____ () C:\Users\user\AppData\Roaming\Spotify\libcef.dll
2016-12-24 11:38 - 2016-12-08 02:00 - 00035792 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\_multiprocessing.pyd
2017-01-13 10:28 - 2016-12-08 02:00 - 00145864 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\pyexpat.pyd
2017-01-13 10:28 - 2016-12-08 02:01 - 00019408 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\faulthandler.pyd
2017-01-13 10:28 - 2016-12-08 02:00 - 00116688 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\pywintypes27.dll
2016-12-24 11:38 - 2016-12-08 02:04 - 00024528 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32event.pyd
2016-12-24 11:38 - 2016-12-08 02:00 - 00100296 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\_ctypes.pyd
2016-12-24 11:38 - 2016-12-08 02:04 - 00105928 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32api.pyd
2016-12-24 11:38 - 2016-12-08 02:00 - 00018888 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\select.pyd
2016-12-24 11:38 - 2017-01-06 01:04 - 00019776 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\tornado.speedups.pyd
2016-12-24 11:38 - 2016-12-08 02:00 - 00694224 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\unicodedata.pyd
2017-01-13 10:28 - 2017-01-06 01:03 - 00020824 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._constant_time.pyd
2016-12-24 11:38 - 2016-12-08 02:01 - 00123856 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\_cffi_backend.pyd
2017-01-13 10:28 - 2017-01-06 01:03 - 01682768 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._openssl.pyd
2017-01-13 10:28 - 2017-01-06 01:03 - 00020816 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._padding.pyd
2016-12-24 11:38 - 2017-01-06 01:04 - 00021328 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\winffi.crt.compiled._winffi_crt.pyd
2017-01-13 10:28 - 2017-01-06 01:04 - 00052032 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\psutil._psutil_windows.pyd
2017-01-13 10:28 - 2017-01-06 01:04 - 00038712 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\fastpath.pyd
2017-01-13 10:28 - 2016-12-08 02:00 - 00392144 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\pythoncom27.dll
2017-01-13 10:28 - 2016-12-08 02:04 - 00020936 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\mmapfile.pyd
2016-12-24 11:38 - 2016-12-08 02:04 - 00116176 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32security.pyd
2016-12-24 11:38 - 2017-01-06 01:04 - 00381760 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32com.shell.shell.pyd
2016-12-24 11:38 - 2016-12-08 02:04 - 00124880 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32file.pyd
2016-12-24 11:38 - 2017-01-06 01:04 - 00025432 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\winffi.kernel32.compiled._winffi_kernel32.pyd
2016-12-24 11:38 - 2016-12-08 02:04 - 00024016 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32clipboard.pyd
2016-12-24 11:38 - 2016-12-08 02:04 - 00175560 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32gui.pyd
2016-12-24 11:38 - 2016-12-08 02:04 - 00030160 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32pipe.pyd
2016-12-24 11:38 - 2016-12-08 02:04 - 00043472 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32process.pyd
2016-12-24 11:38 - 2016-12-08 02:04 - 00048592 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32service.pyd
2016-12-24 11:38 - 2016-12-08 02:04 - 00057808 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32evtlog.pyd
2016-12-24 11:38 - 2016-12-08 02:04 - 00024016 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32profile.pyd
2017-01-13 10:28 - 2017-01-06 01:03 - 00246608 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\breakpad.client.windows.handler.pyd
2017-01-13 10:28 - 2017-01-06 01:03 - 00026464 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\dropbox.infinite.win.compiled._driverinstallation.pyd
2016-12-24 11:38 - 2016-12-08 02:02 - 00241104 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\_jpegtran.pyd
2017-01-13 10:28 - 2017-01-06 01:03 - 00020288 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\cpuid.compiled._cpuid.pyd
2016-12-24 11:38 - 2016-12-08 02:04 - 00028616 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32ts.pyd
2016-12-24 11:38 - 2017-01-06 01:04 - 00023384 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\winscreenshot.compiled._CaptureScreenshot.pyd
2016-12-24 11:38 - 2017-01-06 01:04 - 00020816 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\winffi.iphlpapi._winffi_iphlpapi.pyd
2016-12-24 11:38 - 2017-01-06 01:04 - 00019792 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\winffi.winerror._winffi_winerror.pyd
2016-12-24 11:38 - 2017-01-06 01:04 - 00020808 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\winffi.wininet._winffi_wininet.pyd
2016-12-24 11:38 - 2016-12-08 02:04 - 00350152 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\winxpgui.pyd
2016-12-24 11:38 - 2017-01-06 01:04 - 00022360 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\winverifysignature.compiled._VerifySignature.pyd
2017-01-13 10:28 - 2017-01-06 01:04 - 00024400 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\librsyncffi.compiled._librsyncffi.pyd
2017-01-13 10:28 - 2016-12-08 01:57 - 00036296 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\librsync.dll
2017-01-13 10:28 - 2017-01-06 01:03 - 00084288 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\dropbox_sqlite_ext.DLL
2017-01-13 10:28 - 2017-01-06 01:04 - 01826104 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\PyQt5.QtCore.pyd
2016-12-24 11:38 - 2016-12-08 02:01 - 00083912 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\sip.pyd
2017-01-13 10:28 - 2017-01-06 01:04 - 00531264 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\PyQt5.QtNetwork.pyd
2017-01-13 10:28 - 2017-01-06 01:04 - 03928896 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\PyQt5.QtWidgets.pyd
2017-01-13 10:28 - 2017-01-06 01:04 - 01972536 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\PyQt5.QtGui.pyd
2017-01-13 10:28 - 2017-01-06 01:04 - 00133432 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKit.pyd
2017-01-13 10:28 - 2017-01-06 01:04 - 00224064 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKitWidgets.pyd
2017-01-13 10:28 - 2017-01-06 01:04 - 00207680 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\PyQt5.QtPrintSupport.pyd
2016-12-24 11:38 - 2017-01-06 01:04 - 00020296 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\winffi.user32._winffi_user32.pyd
2017-01-13 10:28 - 2016-12-08 02:08 - 00017864 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\libEGL.dll
2017-01-13 10:28 - 2016-12-08 02:08 - 01631184 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2017-01-13 10:28 - 2017-01-06 01:04 - 00042816 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\PyQt5.QtWebChannel.pyd
2017-01-13 10:28 - 2017-01-06 01:04 - 00171336 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\PyQt5.QtWebEngineWidgets.pyd
2017-01-13 10:28 - 2017-01-06 01:04 - 00357688 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\PyQt5.QtQml.pyd
2016-12-24 11:38 - 2016-12-08 02:04 - 00060880 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32print.pyd
2016-12-24 11:38 - 2017-01-06 01:04 - 00024920 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\winffi.winhttp.compiled._winffi_winhttp.pyd
2017-01-13 10:28 - 2017-01-06 01:04 - 00546104 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\PyQt5.QtQuick.pyd
2016-12-24 11:38 - 2016-12-08 02:11 - 00697304 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-03-17 01:34 - 2015-03-17 01:34 - 00010240 _____ () C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\locale\de_de\acrotray.deu
2011-03-04 12:49 - 2011-03-04 12:49 - 00202752 _____ () C:\Dominik\Programme\ciscoclient\vpnapi.dll
2015-09-18 21:50 - 2016-12-25 13:36 - 01803888 _____ () C:\Users\user\AppData\Roaming\Spotify\libglesv2.dll
2015-09-18 21:50 - 2016-12-25 13:36 - 00086128 _____ () C:\Users\user\AppData\Roaming\Spotify\libegl.dll
2016-09-22 09:45 - 2013-08-31 06:44 - 02417152 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtCore4.dll
2016-09-22 09:45 - 2009-01-10 19:32 - 00011362 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\mingwm10.dll
2016-09-22 09:45 - 2009-06-23 03:42 - 00043008 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\libgcc_s_dw2-1.dll
2016-09-22 09:45 - 2013-08-31 06:46 - 01148416 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtNetwork4.dll
2016-09-22 09:45 - 2013-08-31 06:59 - 09559040 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtGui4.dll
2016-10-06 19:06 - 2014-12-02 10:28 - 00082944 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\plugins\imageformats\qgif4.dll
2016-10-06 19:06 - 2014-12-02 10:28 - 00081920 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\plugins\imageformats\qico4.dll
2015-02-19 11:29 - 2015-02-19 11:29 - 16852144 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll
2017-01-07 11:43 - 2017-01-07 11:43 - 00390656 _____ () C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\extensions\artur.dubovoy@gmail.com\data\lib\ffmpeg\ffmpeg.exe

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`26hfm [0]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2016-08-15 13:29 - 00000278 ____R C:\Windows\system32\Drivers\etc\hosts

127.0.0.1      localhost



































































































==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is disabled.

==================== MSCONFIG/TASK MANAGER disabled items ==


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => %SystemRoot%\system32\sppsvc.exe
FirewallRules: [TCP Query User{9521B3B1-64C2-484C-9E5E-477B3E068843}C:\program files (x86)\gsc world publishing\s.t.a.l.k.e.r. ìóëüòèïëååð\bin\xr_3da.exe] => C:\program files (x86)\gsc world publishing\s.t.a.l.k.e.r. ìóëüòèïëååð\bin\xr_3da.exe
FirewallRules: [UDP Query User{0186AE12-FED2-4ED2-81DA-D482E8E0D00F}C:\program files (x86)\gsc world publishing\s.t.a.l.k.e.r. ìóëüòèïëååð\bin\xr_3da.exe] => C:\program files (x86)\gsc world publishing\s.t.a.l.k.e.r. ìóëüòèïëååð\bin\xr_3da.exe
FirewallRules: [TCP Query User{462A49B6-9A3B-40B1-98A5-472C77761E66}C:\programme\yed\yed.exe] => C:\programme\yed\yed.exe
FirewallRules: [UDP Query User{00F14B30-F1C7-409F-A696-96549D995D2C}C:\programme\yed\yed.exe] => C:\programme\yed\yed.exe
FirewallRules: [{B49643CE-673C-441F-8CB1-037D0FACB36D}] => C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{F3AF97AD-A720-4061-948E-9176F6DD282D}] => C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{9C16A566-EEEA-482A-869A-160142998928}C:\users\user\appdata\roaming\dropbox\bin\dropbox.exe] => C:\users\user\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{B3116B0B-9865-4CEF-AB6B-9593D7EF7F0B}C:\users\user\appdata\roaming\dropbox\bin\dropbox.exe] => C:\users\user\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [TCP Query User{98720FB8-E084-429A-853C-049B411263BD}C:\dominik\sonstiges\spiele\commandandconquer\game.exe] => C:\dominik\sonstiges\spiele\commandandconquer\game.exe
FirewallRules: [UDP Query User{E8C44E1B-599C-41B8-A4CC-DC80A19532CA}C:\dominik\sonstiges\spiele\commandandconquer\game.exe] => C:\dominik\sonstiges\spiele\commandandconquer\game.exe
FirewallRules: [TCP Query User{B5FC9B5B-67D2-40A8-8FF3-8E6B754F727F}C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe] => C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe
FirewallRules: [UDP Query User{AD592A74-B612-43BB-9B1B-818AEF8034F3}C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe] => C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe
FirewallRules: [TCP Query User{254C91A3-9EE1-4BBE-A86E-85263691D0DC}C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\duke matcher 1.0\duke matcher\dukematcher.exe] => C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\duke matcher 1.0\duke matcher\dukematcher.exe
FirewallRules: [UDP Query User{40E81D0A-B19A-47CA-AF53-5295099F9506}C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\duke matcher 1.0\duke matcher\dukematcher.exe] => C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\duke matcher 1.0\duke matcher\dukematcher.exe
FirewallRules: [TCP Query User{D1121D48-5DA4-47F3-89FD-F26CBF52FFA0}C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\yang\yang.exe] => C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\yang\yang.exe
FirewallRules: [UDP Query User{210E18D4-D37A-4F69-AA08-CAAE9E92634F}C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\yang\yang.exe] => C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\yang\yang.exe
FirewallRules: [TCP Query User{8C6478E0-8A42-459A-876C-900383A1315D}C:\dominik\sonstiges\spiele\war2combat\warcraft ii bne.exe] => C:\dominik\sonstiges\spiele\war2combat\warcraft ii bne.exe
FirewallRules: [UDP Query User{75E7DD15-3E99-4B2C-8352-EC4212AEC9D9}C:\dominik\sonstiges\spiele\war2combat\warcraft ii bne.exe] => C:\dominik\sonstiges\spiele\war2combat\warcraft ii bne.exe
FirewallRules: [TCP Query User{C29D7DAE-6848-4B7A-87AB-81D0513F5793}C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe] => C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe
FirewallRules: [UDP Query User{157FD495-46FE-468F-A1C0-8F24A69740C7}C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe] => C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe
FirewallRules: [{F1524149-1CCF-40A9-9845-C4C23F26104A}] => C:\Dominik\sonstiges\spiele\steam\Steam.exe
FirewallRules: [{DA1297BC-F638-4726-B4E8-D4449DE4ED91}] => C:\Dominik\sonstiges\spiele\steam\Steam.exe
FirewallRules: [{CB6F7F79-40DA-483C-85F7-67FB9FD7E5FF}] => C:\Dominik\sonstiges\spiele\steam\bin\steamwebhelper.exe
FirewallRules: [{B3C18334-6D0B-4674-B3D2-BB63370F0CD0}] => C:\Dominik\sonstiges\spiele\steam\bin\steamwebhelper.exe
FirewallRules: [{F2266684-5CBF-4D69-8EC6-34957747C67E}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Half-Life 2\hl2.exe
FirewallRules: [{378C492B-7394-46AF-A582-BB659D6D0B65}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Half-Life 2\hl2.exe
FirewallRules: [{9ADBDC08-51C6-4E6F-8B0E-1E2E917EE54D}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\nmrih\sdk\hl2.exe
FirewallRules: [{04231C4A-E445-4D5D-8C7B-4FE4D25D7703}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\nmrih\sdk\hl2.exe
FirewallRules: [{62B22E62-4C1B-451E-A4E3-EEDEA3DEED74}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Painkiller Hell & Damnation Demo\Binaries\Win32\PKHDGame-Win32-Shipping.exe
FirewallRules: [{3E2C22D8-AAC5-4ED1-93DE-C2750F577CE5}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Painkiller Hell & Damnation Demo\Binaries\Win32\PKHDGame-Win32-Shipping.exe
FirewallRules: [{0E4D3E4D-AAFD-40AA-9538-48886017B085}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Quake Live\quakelive_steam.exe
FirewallRules: [{6D53EF41-9530-4E1E-B9C6-163F1C47C677}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Quake Live\quakelive_steam.exe
FirewallRules: [{FC32617B-A2B1-4FFA-AD55-834297D9EA7F}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Painkiller Demo\Bin\PainGame.exe
FirewallRules: [{833E9490-E8F4-4353-A889-D61125DAC61C}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Painkiller Demo\Bin\PainGame.exe
FirewallRules: [{A7C85A09-6500-4071-A861-0E467B36FDA8}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{63D0D9E9-D6D6-4498-8287-5BF133F2CB49}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4F92E3F2-D8B0-40EB-BFAB-ED124C808E3D}] => C:\Dominik\sonstiges\spiele\Meltdown.exe
FirewallRules: [{70686225-14CA-4B71-BC37-291DC3463A53}] => C:\Dominik\sonstiges\spiele\Meltdown.exe
FirewallRules: [{7CA644FD-0789-483C-9693-2907B841ABD3}] => C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{C9AE6A10-FED1-4130-91FF-65AAA1A77490}] => C:\Users\user\AppData\Local\Microsoft\OneDrive\OneDrive.exe
FirewallRules: [{34335651-6E5E-4ABC-A7EC-960A60A4F0F6}] => C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{8512BBE7-88DD-40A1-8C0C-A850D7092A9B}] => C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{E5F2C46D-366C-4FA7-A350-1FD52A9BF749}] => C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{7148B556-CB31-4867-86F5-38859D93B4DD}] => C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{90BEB6D8-E1B5-42E2-988A-AD43626888B4}] => C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{12B90CEF-EA1B-4B66-A14F-ED8AC56EC44C}] => C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{A63E9E6D-0616-4525-BD4B-0C18CE2CA27A}] => C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{9C832647-D59C-44FA-9314-26D52F9ECAD2}] => C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{F3195A86-A3C6-4686-B36F-B98DBB62F511}] => C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{0494DE03-CAF2-4A2D-A77E-EDD96427B0D8}] => C:\Program Files (x86)\Opera\42.0.2393.137\opera.exe

==================== Restore Points =========================

29-12-2016 09:41:10 Windows Update
08-01-2017 03:00:15 Windows Update
13-01-2017 10:38:28 Windows Update
14-01-2017 12:04:22 Windows Update
18-01-2017 09:19:38 Windows Update

==================== Faulty Device Manager Devices =============

Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/19/2017 04:15:58 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Users\user\Downloads\esetsmartinstaller_deu.exe".Error in manifest or policy file "" on line .
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.

Error: (01/19/2017 12:16:21 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program Acrobat.exe version 15.23.20053.15062 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: e84

Start Time: 01d27244288a9cde

Termination Time: 60

Application Path: C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Report Id: a97fde58-de38-11e6-8959-ec55f9de5f26

Error: (01/19/2017 11:58:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (01/19/2017 08:35:50 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: vlc.exe, version: 2.1.1.0, time stamp: 0x52812684
Faulting module name: vlc.exe, version: 2.1.1.0, time stamp: 0x52812684
Exception code: 0xc0000005
Fault offset: 0x00001a5b
Faulting process id: 0x1418
Faulting application start time: 0x01d272269fa37ae5
Faulting application path: C:\Program Files (x86)\VideoLAN\VLC\vlc.exe
Faulting module path: C:\Program Files (x86)\VideoLAN\VLC\vlc.exe
Report Id: e60f2953-de19-11e6-b986-ec55f9de5f26

Error: (01/18/2017 10:47:06 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (01/17/2017 04:26:32 PM) (Source: Microsoft Office 16) (EventID: 2011) (User: )
Description: Office Subscription licensing exception: Error Code: 0x803D0010; CorrelationId: {AB37C322-1D42-4F32-A9F3-FC957572B6F3}

Error: (01/17/2017 04:26:32 PM) (Source: Microsoft Office 16) (EventID: 2011) (User: )
Description: Office Subscription licensing exception: Error Code: 0x803D0010; CorrelationId: {AB37C322-1D42-4F32-A9F3-FC957572B6F3}

Error: (01/14/2017 08:45:12 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (01/14/2017 08:15:48 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (01/08/2017 11:39:59 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.


System errors:
=============
Error: (01/19/2017 12:12:15 PM) (Source: bowser) (EventID: 8003) (User: )
Description: The master browser has received a server announcement from the computer NOTEBOOK
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{F803A312-9FB2-4B80-830E-D0882C84BC70}.
The master browser is stopping or an election is being forced.

Error: (01/19/2017 12:00:13 PM) (Source: bowser) (EventID: 8003) (User: )
Description: The master browser has received a server announcement from the computer NOTEBOOK
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{F803A312-9FB2-4B80-830E-D0882C84BC70}.
The master browser is stopping or an election is being forced.

Error: (01/19/2017 11:57:37 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Mobile Partner. OUC service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Error: (01/19/2017 11:57:37 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Mobile Partner. OUC service to connect.

Error: (01/19/2017 09:35:30 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Microsoft Antimalware has encountered an error trying to update signatures.

        New Signature Version:

        Previous Signature Version: 116.72.0.0

        Update Source: Microsoft Malware Protection Center

        Update Stage: Search

        Source Path: hxxp://go.microsoft.com/fwlink/?LinkID=260974&clcid=0x409&NRI=true&arch=x64&eng=2.1.12706.0&sig=116.72.0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

        Signature Type: Network Inspection System

        Update Type: Full

        User: NT AUTHORITY\NETWORK SERVICE

        Current Engine Version:

        Previous Engine Version: 2.1.12706.0

        Error code: 0x80072ee7

        Error description: The server name or address could not be resolved

Error: (01/19/2017 09:35:30 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Microsoft Antimalware has encountered an error trying to update signatures.

        New Signature Version:

        Previous Signature Version: 1.235.688.0

        Update Source: Microsoft Malware Protection Center

        Update Stage: Search

        Source Path: hxxp://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x64&eng=1.1.13407.0&avdelta=1.235.688.0&asdelta=1.235.688.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

        Signature Type: AntiSpyware

        Update Type: Full

        User: NT AUTHORITY\NETWORK SERVICE

        Current Engine Version:

        Previous Engine Version: 1.1.13407.0

        Error code: 0x80072ee7

        Error description: The server name or address could not be resolved

Error: (01/19/2017 09:35:30 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Microsoft Antimalware has encountered an error trying to update signatures.

        New Signature Version:

        Previous Signature Version: 1.235.688.0

        Update Source: Microsoft Malware Protection Center

        Update Stage: Search

        Source Path: hxxp://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x64&eng=1.1.13407.0&avdelta=1.235.688.0&asdelta=1.235.688.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

        Signature Type: AntiVirus

        Update Type: Full

        User: NT AUTHORITY\NETWORK SERVICE

        Current Engine Version:

        Previous Engine Version: 1.1.13407.0

        Error code: 0x80072ee7

        Error description: The server name or address could not be resolved

Error: (01/19/2017 09:35:30 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Microsoft Antimalware has encountered an error trying to update signatures.

        New Signature Version:

        Previous Signature Version: 1.235.688.0

        Update Source: Microsoft Update Server

        Update Stage: Search

        Source Path: hxxp://www.microsoft.com

        Signature Type: AntiVirus

        Update Type: Full

        User: NT AUTHORITY\SYSTEM

        Current Engine Version:

        Previous Engine Version: 1.1.13407.0

        Error code: 0x8024402c

        Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.

Error: (01/19/2017 07:19:22 AM) (Source: bowser) (EventID: 8003) (User: )
Description: The master browser has received a server announcement from the computer KOALA
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{F803A312-9FB2-4B80-830E-D0882C84BC70}.
The master browser is stopping or an election is being forced.

Error: (01/19/2017 07:07:22 AM) (Source: bowser) (EventID: 8003) (User: )
Description: The master browser has received a server announcement from the computer KOALA
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{F803A312-9FB2-4B80-830E-D0882C84BC70}.
The master browser is stopping or an election is being forced.


CodeIntegrity:
===================================
  Date: 2017-01-19 19:32:01.725
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-19 19:31:12.955
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-19 19:26:19.165
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-19 19:26:05.241
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-19 19:26:05.091
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-19 16:11:48.692
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-19 16:11:40.462
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-19 15:36:07.357
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-19 14:40:45.515
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-19 13:06:02.624
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7 CPU M 620 @ 2.67GHz
Percentage of memory in use: 42%
Total physical RAM: 8051.67 MB
Available physical RAM: 4647.75 MB
Total Virtual: 16101.53 MB
Available Virtual: 11899.79 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:381.42 GB) (Free:48.94 GB) NTFS
Drive g: (CANON_DC) (Removable) (Total:15.01 GB) (Free:14.34 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: DE2F4001)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=381.4 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=84.2 GB) - (Type=05)

========================================================
Disk: 1 (Size: 15 GB) (Disk ID: 00000000)

Partition: GPT.

==================== End of Addition.txt ============================
--- --- ---

Dominik H. 20.01.2017 18:37
Code:

       
Code:

       
18:31:54.0151 0x1510  TDSS rootkit removing tool 3.1.0.12 Nov  7 2016 07:10:01
18:31:57.0713 0x1510  ============================================================
18:31:57.0713 0x1510  Current date / time: 2017/01/20 18:31:57.0713
18:31:57.0713 0x1510  SystemInfo:
18:31:57.0713 0x1510 
18:31:57.0713 0x1510  OS Version: 6.1.7601 ServicePack: 1.0
18:31:57.0713 0x1510  Product type: Workstation
18:31:57.0713 0x1510  ComputerName: USER-PC
18:31:57.0713 0x1510  UserName: user
18:31:57.0713 0x1510  Windows directory: C:\Windows
18:31:57.0713 0x1510  System windows directory: C:\Windows
18:31:57.0713 0x1510  Running under WOW64
18:31:57.0713 0x1510  Processor architecture: Intel x64
18:31:57.0713 0x1510  Number of processors: 4
18:31:57.0713 0x1510  Page size: 0x1000
18:31:57.0714 0x1510  Boot type: Normal boot
18:31:57.0714 0x1510  CodeIntegrityOptions = 0x00000001
18:31:57.0714 0x1510  ============================================================
18:32:00.0476 0x1510  KLMD registered as C:\Windows\system32\drivers\79096366.sys
18:32:00.0476 0x1510  KLMD ARK init status: drvProperties = 0xFFF00, osBuild = 7601.23572, osProperties = 0x1
18:32:01.0608 0x1510  System UUID: {92B0B9A3-45CF-BB2F-A635-9DD69699E474}
18:32:02.0265 0x1510  Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 ( 465.76 Gb ), SectorSize: 0x200, Cylinders: 0xFC59, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000040
18:32:02.0268 0x1510  Drive \Device\Harddisk1\DR1 - Size: 0x3C1300000 ( 15.02 Gb ), SectorSize: 0x200, Cylinders: 0x7A8, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
18:32:02.0270 0x1510  ============================================================
18:32:02.0270 0x1510  \Device\Harddisk0\DR0:
18:32:02.0271 0x1510  MBR partitions:
18:32:02.0271 0x1510  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
18:32:02.0271 0x1510  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x2FAD5CF0
18:32:02.0271 0x1510  \Device\Harddisk1\DR1:
18:32:02.0272 0x1510  MBR partitions:
18:32:02.0272 0x1510  \Device\Harddisk1\DR1\Partition1: MBR, Type 0xC, StartLBA 0x2000, BlocksNum 0x1E09800
18:32:02.0272 0x1510  ============================================================
18:32:02.0283 0x1510  C: <-> \Device\Harddisk0\DR0\Partition2
18:32:02.0283 0x1510  ============================================================
18:32:02.0283 0x1510  Initialize success
18:32:02.0283 0x1510  ============================================================
18:32:25.0714 0x1f0c  ============================================================
18:32:25.0714 0x1f0c  Scan started
18:32:25.0714 0x1f0c  Mode: Manual; SigCheck; TDLFS;
18:32:25.0714 0x1f0c  ============================================================
18:32:25.0714 0x1f0c  KSN ping started
18:32:25.0850 0x1f0c  KSN ping finished: true
18:32:28.0355 0x1f0c  ================ Scan system memory ========================
18:32:28.0355 0x1f0c  System memory - ok
18:32:28.0356 0x1f0c  ================ Scan services =============================
18:32:29.0401 0x1f0c  [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci        C:\Windows\system32\DRIVERS\1394ohci.sys
18:32:29.0478 0x1f0c  1394ohci - ok
18:32:29.0498 0x1f0c  [ 0839005949EA2DA7E9420A66614C6649, 2095EC5A6B545BCA20077B53AA7AEB4A00865DC035E22070400F91B068493D74 ] 5U877           C:\Windows\system32\DRIVERS\5U877.sys
18:32:29.0511 0x1f0c  5U877 - ok
18:32:29.0531 0x1f0c  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
18:32:29.0546 0x1f0c  ACPI - ok
18:32:29.0550 0x1f0c  [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys
18:32:29.0564 0x1f0c  AcpiPmi - ok
18:32:29.0634 0x1f0c  [ B932E0EE190778D840F1442DFC0F9612, 8780963F14D57279FDD585BE945ED40F24590D32676C7A9EF94002D38B8BA643 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
18:32:29.0653 0x1f0c  AdobeARMservice - ok
18:32:29.0683 0x1f0c  [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx         C:\Windows\system32\drivers\adp94xx.sys
18:32:29.0710 0x1f0c  adp94xx - ok
18:32:29.0721 0x1f0c  [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci         C:\Windows\system32\drivers\adpahci.sys
18:32:29.0737 0x1f0c  adpahci - ok
18:32:29.0746 0x1f0c  [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320         C:\Windows\system32\drivers\adpu320.sys
18:32:29.0760 0x1f0c  adpu320 - ok
18:32:29.0774 0x1f0c  [ 4B78B431F225FD8624C5655CB1DE7B61, 198A5AF2125C7C41F531A652D200C083A55A97DC541E3C0B5B253C7329949156 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
18:32:29.0811 0x1f0c  AeLookupSvc - ok
18:32:29.0836 0x1f0c  [ 9A4A1EEE802BF2F878EE8EAB407B21B7, 177EB7DF4B35FE4C0E45E775A0FD5D48D39B410052E3EE18BDEEC809E152D9D8 ] AFD             C:\Windows\system32\drivers\afd.sys
18:32:29.0856 0x1f0c  AFD - ok
18:32:29.0869 0x1f0c  [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440          C:\Windows\system32\drivers\agp440.sys
18:32:29.0879 0x1f0c  agp440 - ok
18:32:29.0962 0x1f0c  [ 021D06851E7AFF5C314039DF813608F3, 081B14840F4AD428B4407AA2E639369A45D174D9507BD107F33FE3A94FB8F8EC ] AGSService      C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
18:32:30.0014 0x1f0c  AGSService - ok
18:32:30.0029 0x1f0c  [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG             C:\Windows\System32\alg.exe
18:32:30.0041 0x1f0c  ALG - ok
18:32:30.0056 0x1f0c  [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide          C:\Windows\system32\drivers\aliide.sys
18:32:30.0065 0x1f0c  aliide - ok
18:32:30.0069 0x1f0c  [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide          C:\Windows\system32\drivers\amdide.sys
18:32:30.0077 0x1f0c  amdide - ok
18:32:30.0091 0x1f0c  [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8           C:\Windows\system32\drivers\amdk8.sys
18:32:30.0102 0x1f0c  AmdK8 - ok
18:32:30.0106 0x1f0c  [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM          C:\Windows\system32\drivers\amdppm.sys
18:32:30.0118 0x1f0c  AmdPPM - ok
18:32:30.0125 0x1f0c  [ 6EC6D772EAE38DC17C14AED9B178D24B, B4FB936B31B1265B8CC6B426C64965C34D0CCF1638E645ACD65E88F4AFFC57A6 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
18:32:30.0136 0x1f0c  amdsata - ok
18:32:30.0143 0x1f0c  [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys
18:32:30.0156 0x1f0c  amdsbs - ok
18:32:30.0168 0x1f0c  [ 1142A21DB581A84EA5597B03A26EBAA0, F94EB140D0CD068760D7EB081FF75154C75DAC75E5E24B6DE4E4F9CE65A70343 ] amdxata         C:\Windows\system32\drivers\amdxata.sys
18:32:30.0177 0x1f0c  amdxata - ok
18:32:30.0187 0x1f0c  [ FCE5C79717A487BDC71F3DEC78A684CA, F5520F112A4EBDD10444AA5E9FDB9125219FCF768FEB95AB608BC84D60136816 ] AppID           C:\Windows\system32\drivers\appid.sys
18:32:30.0198 0x1f0c  AppID - ok
18:32:30.0203 0x1f0c  [ 8921E1D8AE5171691F186A7C5B98B630, 4A37313BB94D4B49D0294C9439AD0793DE328F9F4DA1C47E34E6ACEA46AF6E14 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
18:32:30.0213 0x1f0c  AppIDSvc - ok
18:32:30.0219 0x1f0c  [ DE23E052E557580674785CDF45B613F3, A955ADC6CC7D816BA7CE1065F911E7A3295A1908C22BE0A3C506C38CFEE8DE0D ] Appinfo         C:\Windows\System32\appinfo.dll
18:32:30.0230 0x1f0c  Appinfo - ok
18:32:30.0242 0x1f0c  [ 9B950F341D72D1BF72C9D13BEF0C19C1, 149A3AE4124D77DEE66045EBB355A963FD2ED5C46318BCF6D94E5768581B7F4E ] AppleHFS        C:\Windows\system32\drivers\AppleHFS.sys
18:32:30.0254 0x1f0c  AppleHFS - ok
18:32:30.0268 0x1f0c  [ 8A3CBBAF1974B3E73A12350F4F2EA699, 757B45C585AE10EA617576DADA2E305C93B879873DEDCB1BACE2F06E2923ED03 ] AppleMNT        C:\Windows\system32\drivers\AppleMNT.sys
18:32:30.0276 0x1f0c  AppleMNT - ok
18:32:30.0296 0x1f0c  [ 4ABA3E75A76195A3E38ED2766C962899, E2001ACD44DA270B8289DA362D26416676301773AB22616C211F31CF2E7869AA ] AppMgmt         C:\Windows\System32\appmgmts.dll
18:32:30.0309 0x1f0c  AppMgmt - ok
18:32:30.0324 0x1f0c  [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc             C:\Windows\system32\drivers\arc.sys
18:32:30.0334 0x1f0c  arc - ok
18:32:30.0339 0x1f0c  [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas          C:\Windows\system32\drivers\arcsas.sys
18:32:30.0350 0x1f0c  arcsas - ok
18:32:30.0452 0x1f0c  [ 08FC11F6416923BBC614C28B4180E9A7, C829380F10E3EE92A38F2D59ED0D5B1D27B577021307E0C2C23EC901D0479006 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
18:32:30.0480 0x1f0c  aspnet_state - ok
18:32:30.0501 0x1f0c  [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
18:32:30.0536 0x1f0c  AsyncMac - ok
18:32:30.0541 0x1f0c  [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi           C:\Windows\system32\drivers\atapi.sys
18:32:30.0553 0x1f0c  atapi - ok
18:32:30.0592 0x1f0c  [ 8AC83497A2F09317BBECEAF29D3477BD, D5DE3DD7C793DCE9A4DAF53D3CCB65889B73735EA1ADBCD70161DCF540233E5C ] atmeltpm        C:\Windows\system32\DRIVERS\atmeltpm64.sys
18:32:30.0601 0x1f0c  atmeltpm - ok
18:32:30.0620 0x1f0c  [ 67C717EC24FCAAE7B518D9E06AD036AB, F08550E4FCEC2899FACEF2A18CEE3D068D5911FFD2FF5534E4921E56FB0AEF59 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
18:32:30.0645 0x1f0c  AudioEndpointBuilder - ok
18:32:30.0662 0x1f0c  [ 67C717EC24FCAAE7B518D9E06AD036AB, F08550E4FCEC2899FACEF2A18CEE3D068D5911FFD2FF5534E4921E56FB0AEF59 ] AudioSrv        C:\Windows\System32\Audiosrv.dll
18:32:30.0686 0x1f0c  AudioSrv - ok
18:32:30.0720 0x1f0c  [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV        C:\Windows\System32\AxInstSV.dll
18:32:30.0738 0x1f0c  AxInstSV - ok
18:32:30.0755 0x1f0c  [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv         C:\Windows\system32\drivers\bxvbda.sys
18:32:30.0775 0x1f0c  b06bdrv - ok
18:32:30.0794 0x1f0c  [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
18:32:30.0811 0x1f0c  b57nd60a - ok
18:32:30.0830 0x1f0c  [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC          C:\Windows\System32\bdesvc.dll
18:32:30.0842 0x1f0c  BDESVC - ok
18:32:30.0855 0x1f0c  [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep            C:\Windows\system32\drivers\Beep.sys
18:32:30.0886 0x1f0c  Beep - ok
18:32:30.0909 0x1f0c  [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE             C:\Windows\System32\bfe.dll
18:32:30.0937 0x1f0c  BFE - ok
18:32:30.0962 0x1f0c  [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS            C:\Windows\system32\qmgr.dll
18:32:31.0013 0x1f0c  BITS - ok
18:32:31.0018 0x1f0c  [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
18:32:31.0029 0x1f0c  blbdrive - ok
18:32:31.0047 0x1f0c  [ ABA3984C822E4D3F889699912D85D6C5, 2251FA135CC290DA13DAE4743F393C7CC9E6A737C054707CB8D72C369D1FFACB ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
18:32:31.0060 0x1f0c  bowser - ok
18:32:31.0078 0x1f0c  [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo        C:\Windows\system32\drivers\BrFiltLo.sys
18:32:31.0091 0x1f0c  BrFiltLo - ok
18:32:31.0099 0x1f0c  [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp        C:\Windows\system32\drivers\BrFiltUp.sys
18:32:31.0112 0x1f0c  BrFiltUp - ok
18:32:31.0119 0x1f0c  [ 5C2F352A4E961D72518261257AAE204B, 9EE1001E1D46A414A7A86FE1DBBE232203E26F54D9EF43ED31ED8EACD4D09853 ] BridgeMP        C:\Windows\system32\DRIVERS\bridge.sys
18:32:31.0152 0x1f0c  BridgeMP - ok
18:32:31.0164 0x1f0c  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser         C:\Windows\System32\browser.dll
18:32:31.0177 0x1f0c  Browser - ok
18:32:31.0194 0x1f0c  [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
18:32:31.0211 0x1f0c  Brserid - ok
18:32:31.0228 0x1f0c  [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
18:32:31.0243 0x1f0c  BrSerWdm - ok
18:32:31.0255 0x1f0c  [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
18:32:31.0268 0x1f0c  BrUsbMdm - ok
18:32:31.0272 0x1f0c  [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
18:32:31.0283 0x1f0c  BrUsbSer - ok
18:32:31.0299 0x1f0c  [ CF98190A94F62E405C8CB255018B2315, E1B2540023C4FE9FD588E4B6AE6347DFA565EB3898F21E5360882BF3E8B5E781 ] BthEnum         C:\Windows\system32\DRIVERS\BthEnum.sys
18:32:31.0312 0x1f0c  BthEnum - ok
18:32:31.0317 0x1f0c  [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
18:32:31.0333 0x1f0c  BTHMODEM - ok
18:32:31.0347 0x1f0c  [ 02DD601B708DD0667E1331FA8518E9FF, 7DE6CC4DBB621CD03B01D9CE6CF66EAFE31D39030A391562CD0E278E1D70ADE1 ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys
18:32:31.0363 0x1f0c  BthPan - ok
18:32:31.0391 0x1f0c  [ 64C198198501F7560EE41D8D1EFA7952, 53CE5FDD1866FC8A0B91C7A620F7555D197488C4C8F3DEFD4398D8E3ED2AEBD0 ] BTHPORT         C:\Windows\system32\Drivers\BTHport.sys
18:32:31.0491 0x1f0c  BTHPORT - ok
18:32:31.0538 0x1f0c  [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv         C:\Windows\system32\bthserv.dll
18:32:31.0596 0x1f0c  bthserv - ok
18:32:31.0617 0x1f0c  [ F188B7394D81010767B6DF3178519A37, 576304E92FD94908F093A6AB5F4D328F25829BE32EC3CA0D29EBFDF5DE83539B ] BTHUSB          C:\Windows\system32\Drivers\BTHUSB.sys
18:32:31.0634 0x1f0c  BTHUSB - ok
18:32:31.0644 0x1f0c  catchme - ok
18:32:31.0656 0x1f0c  [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
18:32:31.0690 0x1f0c  cdfs - ok
18:32:31.0696 0x1f0c  [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys
18:32:31.0711 0x1f0c  cdrom - ok
18:32:31.0728 0x1f0c  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc     C:\Windows\System32\certprop.dll
18:32:31.0762 0x1f0c  CertPropSvc - ok
18:32:31.0777 0x1f0c  [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass        C:\Windows\system32\drivers\circlass.sys
18:32:31.0791 0x1f0c  circlass - ok
18:32:31.0804 0x1f0c  [ 3D67C27DD17B254D7915FA16A5AE3573, 5B3A6C6A7F940C06362775DAF13CEADA37C7AA84A509458A57C23B4369970A90 ] CLFS            C:\Windows\system32\CLFS.sys
18:32:31.0822 0x1f0c  CLFS - ok
18:32:32.0030 0x1f0c  [ ACFB2A62301C6A903FA6A97DB84E9C31, 7A3089812330B605D2F545374A1A916B6DBA188186EC88DA3348814A95C791F0 ] ClickToRunSvc   C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
18:32:32.0125 0x1f0c  ClickToRunSvc - ok
18:32:32.0176 0x1f0c  [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
18:32:32.0200 0x1f0c  clr_optimization_v2.0.50727_32 - ok
18:32:32.0258 0x1f0c  [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
18:32:32.0284 0x1f0c  clr_optimization_v2.0.50727_64 - ok
18:32:32.0330 0x1f0c  [ 40554ADA608F31A73BC002041BFBCED4, 8A4FB3B824EC49392A206BF14381AAE389C0E683B4ED0E89F5362746222E1FBA ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
18:32:32.0343 0x1f0c  clr_optimization_v4.0.30319_32 - ok
18:32:32.0353 0x1f0c  [ 7CD17E6A27D64F672DEA52E9D144B08E, 566CB07531BEBFB704E2BE2D33F49B5D9F962D7931B2BABC1BA2F4015C651CBE ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
18:32:32.0366 0x1f0c  clr_optimization_v4.0.30319_64 - ok
18:32:32.0370 0x1f0c  [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
18:32:32.0382 0x1f0c  CmBatt - ok
18:32:32.0398 0x1f0c  [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide          C:\Windows\system32\drivers\cmdide.sys
18:32:32.0408 0x1f0c  cmdide - ok
18:32:32.0424 0x1f0c  [ F34031DC6D1745154F54B04AFF54F5D1, CDC5CCCB7F9A19C6F9459754895F60B149C2BDBADEF2620F75FAA9B870757758 ] cmnsusbser      C:\Windows\system32\DRIVERS\cmnsusbser.sys
18:32:32.0437 0x1f0c  cmnsusbser - ok
18:32:32.0452 0x1f0c  [ A98CED39AD91B445E2E442A9BD67E8B4, B4189DEEF1C0EE22AE983119047B1A40FFDD8F3E163DFFABD7C2706231B0B1B0 ] CNG             C:\Windows\system32\Drivers\cng.sys
18:32:32.0476 0x1f0c  CNG - ok
18:32:32.0496 0x1f0c  [ FF2F82E10ABCB13D89C9CE3D8FCDE5D5, 43F808DBD04B745C167F96510C26807ABB09112883A9F4DA551B12797DDADE1C ] CnxtHdAudService C:\Windows\system32\drivers\CHDRT64.sys
18:32:32.0521 0x1f0c  CnxtHdAudService - ok
18:32:32.0542 0x1f0c  [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
18:32:32.0552 0x1f0c  Compbatt - ok
18:32:32.0556 0x1f0c  [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus    C:\Windows\system32\DRIVERS\CompositeBus.sys
18:32:32.0570 0x1f0c  CompositeBus - ok
18:32:32.0573 0x1f0c  COMSysApp - ok
18:32:35.0022 0x1f0c  cpuz136 - ok
18:32:35.0039 0x1f0c  [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk         C:\Windows\system32\drivers\crcdisk.sys
18:32:35.0050 0x1f0c  crcdisk - ok
18:32:35.0080 0x1f0c  [ 2C6632CECFDBBE793FDA8AF9CA55A9CC, 335188515F798483660E529204A13012E4D21B0ECA489224A11C26F91A5B3CCE ] CryptSvc        C:\Windows\system32\cryptsvc.dll
18:32:35.0096 0x1f0c  CryptSvc - ok
18:32:35.0135 0x1f0c  [ 54DA3DFD29ED9F1619B6F53F3CE55E49, 9177C6907A983296BF188892A894B668A09FFA058FD56B50FE12940D54B0FA5E ] CSC             C:\Windows\system32\drivers\csc.sys
18:32:35.0160 0x1f0c  CSC - ok
18:32:35.0184 0x1f0c  [ 3AB183AB4D2C79DCF459CD2C1266B043, 72B0187EBA9DC74E61EC5CB3DC24058DDB768843E865801894AAEAA211610C56 ] CscService      C:\Windows\System32\cscsvc.dll
18:32:35.0211 0x1f0c  CscService - ok
18:32:35.0223 0x1f0c  [ 7AC269A7B20ABDD6B17505C68C594BFD, 000499E9A4620E7AD0AAC9459A8E5781B5FF968D5E4D61C18B37477C3E2ECDD2 ] CTService       C:\Program Files\Cold Turkey\CTService.exe
18:32:35.0229 0x1f0c  CTService - detected UnsignedFile.Multi.Generic ( 1 )
18:32:35.0336 0x1f0c  Detect skipped due to KSN trusted
18:32:35.0336 0x1f0c  CTService - ok
18:32:35.0342 0x1f0c  [ 44BDDEB03C84A1C993C992FFB5700357, 29080E9A434BB2A932783B0B5104BC9E3C514A0FFB387123B75F4F4045E353BC ] CVirtA          C:\Windows\system32\DRIVERS\CVirtA64.sys
18:32:35.0360 0x1f0c  CVirtA - ok
18:32:35.0438 0x1f0c  [ 98C413E1A2FB6E5A4C101C25B3D0B275, 86C02211285F1807A6B276F07C56DE1A54BD5947E513884D8D971A22F4362849 ] CVPND           C:\Dominik\Programme\ciscoclient\cvpnd.exe
18:32:35.0482 0x1f0c  CVPND - ok
18:32:35.0494 0x1f0c  [ 79AF0E203D089AF442A3F70ED00A37FB, BF28BF9AEE23A3052D5ADA6C1B4C255C5F09DED69BB88D2CA3C011D2C3CFA8C1 ] CVPNDRVA        C:\Windows\system32\Drivers\CVPNDRVA.sys
18:32:35.0511 0x1f0c  CVPNDRVA - ok
18:32:35.0549 0x1f0c  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch      C:\Windows\system32\rpcss.dll
18:32:35.0589 0x1f0c  DcomLaunch - ok
18:32:35.0600 0x1f0c  [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc       C:\Windows\System32\defragsvc.dll
18:32:35.0637 0x1f0c  defragsvc - ok
18:32:35.0643 0x1f0c  [ 9B38580063D281A99E68EF5813022A5F, D91676B0E0A8E2A090E3E5DD340ABCFC20AE0F55B4C82869D6CFB34239BD27DA ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
18:32:35.0655 0x1f0c  DfsC - ok
18:32:35.0676 0x1f0c  [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp            C:\Windows\system32\dhcpcore.dll
18:32:35.0713 0x1f0c  Dhcp - ok
18:32:35.0783 0x1f0c  [ EE9954237F15BE4DD9304D12E4D305ED, F295C9BAF20F0E669B673AFCC16B4969EE31B6A3808980DAB93D9B0F167DA3C0 ] DiagTrack       C:\Windows\system32\diagtrack.dll
18:32:35.0819 0x1f0c  DiagTrack - ok
18:32:35.0854 0x1f0c  [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache        C:\Windows\system32\drivers\discache.sys
18:32:35.0889 0x1f0c  discache - ok
18:32:35.0905 0x1f0c  [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk            C:\Windows\system32\drivers\disk.sys
18:32:35.0917 0x1f0c  Disk - ok
18:32:35.0934 0x1f0c  [ 5DB085A8A6600BE6401F2B24EECB5415, 5FC5C7C1B4DB7BF6EFD0992E91DB41FD047E90D1ABA0B8F868CB72557F88FB13 ] dmvsc           C:\Windows\system32\drivers\dmvsc.sys
18:32:35.0946 0x1f0c  dmvsc - ok
18:32:35.0954 0x1f0c  [ 05CB5910B3CA6019FC3CCA815EE06FFB, 8FA532ED500BB1F08E8034A6125BDD53B74D5E6AB0A83A6185B07AAFCD90AA82 ] DNE             C:\Windows\system32\DRIVERS\dne64x.sys
18:32:35.0965 0x1f0c  DNE - ok
18:32:35.0983 0x1f0c  [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
18:32:35.0997 0x1f0c  Dnscache - ok
18:32:36.0019 0x1f0c  [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc         C:\Windows\System32\dot3svc.dll
18:32:36.0055 0x1f0c  dot3svc - ok
18:32:36.0072 0x1f0c  [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS             C:\Windows\system32\dps.dll
18:32:36.0106 0x1f0c  DPS - ok
18:32:36.0115 0x1f0c  [ 26FE888505E5A945B0536AF9A2A27A6F, A6B16ED498BAFE300E1F0E0A241E3D62F7A1C5973EE775904ED14F33A2BC08A6 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
18:32:36.0125 0x1f0c  drmkaud - ok
18:32:36.0156 0x1f0c  [ 3A9D7D464BDB3B70D7ECF689ADABBD4D, B4F5B23705EA1BA453FE30791CA245E1A5F7FBEABAD026E4A8A15A9FC44E8C9C ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
18:32:36.0188 0x1f0c  DXGKrnl - ok
18:32:36.0216 0x1f0c  [ 477E33019A855D9B8E7B3263CB9A1AE5, F28840936D992C99238AFECBBF03B75047DEDF0EC682C1444036931E4036AFBB ] e1kexpress      C:\Windows\system32\DRIVERS\e1k62x64.sys
18:32:36.0237 0x1f0c  e1kexpress - ok
18:32:36.0249 0x1f0c  [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost         C:\Windows\System32\eapsvc.dll
18:32:36.0281 0x1f0c  EapHost - ok
18:32:36.0425 0x1f0c  [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv           C:\Windows\system32\drivers\evbda.sys
18:32:36.0548 0x1f0c  ebdrv - ok
18:32:36.0559 0x1f0c  [ 1F9335A2C68B65E7D95985FA50968EA0, A0918C943F9CF5C6DB9440222B8E3B0DD645068B44E18253F275509550C0DF4D ] EFS             C:\Windows\System32\lsass.exe
18:32:36.0572 0x1f0c  EFS - ok
18:32:36.0694 0x1f0c  [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
18:32:36.0734 0x1f0c  ehRecvr - ok
18:32:36.0751 0x1f0c  [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched         C:\Windows\ehome\ehsched.exe
18:32:36.0765 0x1f0c  ehSched - ok
18:32:36.0793 0x1f0c  [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor         C:\Windows\system32\drivers\elxstor.sys
18:32:36.0815 0x1f0c  elxstor - ok
18:32:36.0820 0x1f0c  [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
18:32:36.0831 0x1f0c  ErrDev - ok
18:32:36.0838 0x1f0c  esgiguard - ok
18:32:36.0852 0x1f0c  [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem     C:\Windows\system32\es.dll
18:32:36.0893 0x1f0c  EventSystem - ok
18:32:36.0924 0x1f0c  [ 7230F4CF9F20DCD1DBF4BB3296EEED68, 0B9EAA411271AAB9C84680AAF8910854124D8A318A7388E0E356869126BE533D ] ew_hwusbdev     C:\Windows\system32\DRIVERS\ew_hwusbdev.sys
18:32:36.0938 0x1f0c  ew_hwusbdev - ok
18:32:36.0959 0x1f0c  [ 5222D99C7E3245882E864D2EA7011387, 184E36074C765243783F69B7073FB2FAFC53BB18209ECD5030514CC513A47C8B ] ew_usbenumfilter C:\Windows\system32\DRIVERS\ew_usbenumfilter.sys
18:32:36.0977 0x1f0c  ew_usbenumfilter - ok
18:32:36.0985 0x1f0c  [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat           C:\Windows\system32\drivers\exfat.sys
18:32:37.0018 0x1f0c  exfat - ok
18:32:37.0027 0x1f0c  [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat         C:\Windows\system32\drivers\fastfat.sys
18:32:37.0060 0x1f0c  fastfat - ok
18:32:37.0084 0x1f0c  [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax             C:\Windows\system32\fxssvc.exe
18:32:37.0109 0x1f0c  Fax - ok
18:32:37.0134 0x1f0c  [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc             C:\Windows\system32\drivers\fdc.sys
18:32:37.0145 0x1f0c  fdc - ok
18:32:37.0158 0x1f0c  [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost         C:\Windows\system32\fdPHost.dll
18:32:37.0189 0x1f0c  fdPHost - ok
18:32:37.0203 0x1f0c  [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub        C:\Windows\system32\fdrespub.dll
18:32:37.0237 0x1f0c  FDResPub - ok
18:32:37.0241 0x1f0c  [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
18:32:37.0252 0x1f0c  FileInfo - ok
18:32:37.0259 0x1f0c  [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
18:32:37.0292 0x1f0c  Filetrace - ok
18:32:37.0295 0x1f0c  [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk        C:\Windows\system32\drivers\flpydisk.sys
18:32:37.0307 0x1f0c  flpydisk - ok
18:32:37.0317 0x1f0c  [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
18:32:37.0333 0x1f0c  FltMgr - ok
18:32:37.0363 0x1f0c  [ 700A5373FA66F1DAAECBD2CFB88C73ED, D6C1C4C846BC24EB6539ECC701A456FA53BB6679C79391F5B70580D47B6CE395 ] FontCache       C:\Windows\system32\FntCache.dll
18:32:37.0403 0x1f0c  FontCache - ok
18:32:37.0456 0x1f0c  [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
18:32:37.0475 0x1f0c  FontCache3.0.0.0 - ok
18:32:37.0481 0x1f0c  [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
18:32:37.0496 0x1f0c  FsDepends - ok
18:32:37.0513 0x1f0c  [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
18:32:37.0524 0x1f0c  Fs_Rec - ok
18:32:37.0572 0x1f0c  [ 290EBA98AD0CE0D1B880B5D71194B069, 60CF4DBCFBF5EABE127663322E0CA2B324DB8A92039E7B7C044ACD64DBD324AB ] Futuremark SystemInfo Service C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe
18:32:37.0600 0x1f0c  Futuremark SystemInfo Service - ok
18:32:37.0635 0x1f0c  [ 1F7B25B858FA27015169FE95E54108ED, 72DD12E924AA7273B3E4BDD2A2C581DECE304C8EF3D44EA79ABB032F3F95DCE5 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
18:32:37.0658 0x1f0c  fvevol - ok
18:32:37.0670 0x1f0c  [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
18:32:37.0681 0x1f0c  gagp30kx - ok
18:32:37.0705 0x1f0c  [ E4AE497857409127ED57562AF913A903, 262ADD713B1FBF6200550967D1F8635B55D01BBD8FA2E753536E71A4EC87867B ] gpsvc           C:\Windows\System32\gpsvc.dll
18:32:37.0736 0x1f0c  gpsvc - ok
18:32:37.0794 0x1f0c  [ DD7423ABBE2913E70D50E9318AD57EE4, 74BC123808F3FA60ADDC51C1383F8250608D3DBA3A8DC175B3418A1CF0BC53E9 ] gupdate         C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
18:32:37.0816 0x1f0c  gupdate - ok
18:32:37.0826 0x1f0c  [ DD7423ABBE2913E70D50E9318AD57EE4, 74BC123808F3FA60ADDC51C1383F8250608D3DBA3A8DC175B3418A1CF0BC53E9 ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
18:32:37.0841 0x1f0c  gupdatem - ok
18:32:37.0858 0x1f0c  [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
18:32:37.0870 0x1f0c  hcw85cir - ok
18:32:37.0884 0x1f0c  [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
18:32:37.0906 0x1f0c  HdAudAddService - ok
18:32:37.0915 0x1f0c  [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
18:32:37.0932 0x1f0c  HDAudBus - ok
18:32:37.0947 0x1f0c  [ 7F40163C7A7369A147761C9B57A1223E, 1BF89A4E405F24FB339151CCC2957D22683548B8064F08DC9CECB7580D0A173B ] HECIx64         C:\Windows\system32\DRIVERS\HECIx64.sys
18:32:37.0959 0x1f0c  HECIx64 - ok
18:32:37.0963 0x1f0c  [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt         C:\Windows\system32\drivers\HidBatt.sys
18:32:37.0975 0x1f0c  HidBatt - ok
18:32:37.0993 0x1f0c  [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth          C:\Windows\system32\drivers\hidbth.sys
18:32:38.0008 0x1f0c  HidBth - ok
18:32:38.0013 0x1f0c  [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr           C:\Windows\system32\drivers\hidir.sys
18:32:38.0029 0x1f0c  HidIr - ok
18:32:38.0037 0x1f0c  [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv         C:\Windows\System32\hidserv.dll
18:32:38.0070 0x1f0c  hidserv - ok
18:32:38.0086 0x1f0c  [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
18:32:38.0098 0x1f0c  HidUsb - ok
18:32:38.0107 0x1f0c  [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc          C:\Windows\system32\kmsvc.dll
18:32:38.0140 0x1f0c  hkmsvc - ok
18:32:38.0155 0x1f0c  [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
18:32:38.0170 0x1f0c  HomeGroupListener - ok
18:32:38.0181 0x1f0c  [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
18:32:38.0196 0x1f0c  HomeGroupProvider - ok
18:32:38.0214 0x1f0c  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
18:32:38.0224 0x1f0c  HpSAMD - ok
18:32:38.0259 0x1f0c  [ F61634BEC53F73702A10DE69F6DCAF57, BBA7344CF3AB96A46D1A6F1D50F2758EA8D097FE558C38B4EF45C8C334AF96E1 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
18:32:38.0286 0x1f0c  HTTP - ok
18:32:38.0302 0x1f0c  [ D49D4E7B70AD6B1D04771AC1F7DB79C7, 093D8343CF769FC805308ED357EEF30E3D78569B817A20FE9884863A1FDBC028 ] huawei_enumerator C:\Windows\system32\DRIVERS\ew_jubusenum.sys
18:32:38.0315 0x1f0c  huawei_enumerator - ok
18:32:38.0353 0x1f0c  [ C08814014290BF3AD581C0E9C5919269, 9C16822AC6B8977AAEFDB54C2B4295546461DD888060B62223EF20151790C934 ] HWDeviceService64.exe C:\ProgramData\DatacardService\HWDeviceService64.exe
18:32:38.0368 0x1f0c  HWDeviceService64.exe - ok
18:32:38.0379 0x1f0c  [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
18:32:38.0389 0x1f0c  hwpolicy - ok
18:32:38.0403 0x1f0c  [ 26DA38304822C347DC65A9218C84A376, C765543D6EDDFFBAA7B262C484BAFD75993EDCF42C4FC9A0D945A63AF8708CCC ] hwusb_cdcacm    C:\Windows\system32\DRIVERS\ew_cdcacm.sys
18:32:38.0417 0x1f0c  hwusb_cdcacm - ok
18:32:38.0430 0x1f0c  [ 3DDBB627CE3D2815D74446C81811FD52, 0EB41BF84B52DFD41916D2A7478391C148458A4AB96791D978CB86F0905C6AFE ] hwusb_wwanecm   C:\Windows\system32\DRIVERS\ew_wwanecm.sys
18:32:38.0449 0x1f0c  hwusb_wwanecm - ok
18:32:38.0464 0x1f0c  [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
18:32:38.0477 0x1f0c  i8042prt - ok
18:32:38.0506 0x1f0c  [ 71341219FBB4BAB7F2462C4267DAB594, 0C6B684781D27F423D20186A40D7513DD6ABC38AD286D013791B37CBF5477A55 ] iaStorA         C:\Windows\system32\DRIVERS\iaStorA.sys
18:32:38.0528 0x1f0c  iaStorA - ok
18:32:38.0533 0x1f0c  [ B9D5AE799CB622C144AE5399C55EF29B, 5C2858590436EEDDE029C5448AEC3ACBB1C0FCED23F305302BAF831C6EC1654A ] iaStorF         C:\Windows\system32\DRIVERS\iaStorF.sys
18:32:38.0542 0x1f0c  iaStorF - ok
18:32:38.0554 0x1f0c  [ 3DF4395A7CF8B7A72A5F4606366B8C2D, 483588B8FC6E05488ED631C4E1CFC398553FEBFA2CD2BB527B4DF12D19774F80 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
18:32:38.0573 0x1f0c  iaStorV - ok
18:32:38.0582 0x1f0c  [ A410235155EAC4D43262532B53F229E3, A4C40F513CB56BC11DCD40F8B5EDC0D575FD7503A04A72803AD324ECDB2282DD ] IBMPMDRV        C:\Windows\system32\DRIVERS\ibmpmdrv.sys
18:32:38.0593 0x1f0c  IBMPMDRV - ok
18:32:38.0604 0x1f0c  [ A0680FF223F055DE508E72B185A41484, 7FFB4F9B7F4395CFDF059D5744BDEACF91C70C08B6C399A17BDDA5610D879B15 ] IBMPMSVC        C:\Windows\system32\ibmpmsvc.exe
18:32:38.0612 0x1f0c  IBMPMSVC - ok
18:32:38.0653 0x1f0c  [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
18:32:38.0681 0x1f0c  idsvc - ok
18:32:38.0685 0x1f0c  IEEtwCollectorService - ok
18:32:38.0701 0x1f0c  [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp           C:\Windows\system32\drivers\iirsp.sys
18:32:38.0711 0x1f0c  iirsp - ok
18:32:38.0743 0x1f0c  [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT          C:\Windows\System32\ikeext.dll
18:32:38.0773 0x1f0c  IKEEXT - ok
18:32:38.0793 0x1f0c  [ DD587A55390ED2295BCE6D36AD567DA9, AEB7DCB8EF89BEE8D9649A05FC482B1E4E3F44243D57A2577C862EB69166C48E ] Impcd           C:\Windows\system32\DRIVERS\Impcd.sys
18:32:38.0805 0x1f0c  Impcd - ok
18:32:38.0809 0x1f0c  [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide        C:\Windows\system32\drivers\intelide.sys
18:32:38.0819 0x1f0c  intelide - ok
18:32:38.0835 0x1f0c  [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
18:32:38.0846 0x1f0c  intelppm - ok
18:32:38.0860 0x1f0c  [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
18:32:38.0894 0x1f0c  IPBusEnum - ok
18:32:38.0909 0x1f0c  [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
18:32:38.0941 0x1f0c  IpFilterDriver - ok
18:32:38.0971 0x1f0c  [ A34A587FFFD45FA649FBA6D03784D257, C9A2BCD4E2A5EB6E320092A3AFD5737ECDCDA0B83EE42314A23C4978F2974767 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
18:32:39.0016 0x1f0c  iphlpsvc - ok
18:32:39.0022 0x1f0c  [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys
18:32:39.0035 0x1f0c  IPMIDRV - ok
18:32:39.0047 0x1f0c  [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
18:32:39.0081 0x1f0c  IPNAT - ok
18:32:39.0085 0x1f0c  [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM          C:\Windows\system32\drivers\irenum.sys
18:32:39.0101 0x1f0c  IRENUM - ok
18:32:39.0111 0x1f0c  [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
18:32:39.0123 0x1f0c  isapnp - ok
18:32:39.0139 0x1f0c  [ D931D7309DEB2317035B07C9F9E6B0BD, 13AD84172ED8C6153F8A98499C01733B74E48464CE07D099508E38D409913ED3 ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
18:32:39.0155 0x1f0c  iScsiPrt - ok
18:32:39.0170 0x1f0c  [ 68CF5515B176527523ED379915350AE3, C69C7B69ECAE290A27F0D3DF6C989CDA667A0C4807216D3C0390EECFC4108D16 ] iusb3hcs        C:\Windows\system32\DRIVERS\iusb3hcs.sys
18:32:39.0179 0x1f0c  iusb3hcs - ok
18:32:39.0185 0x1f0c  [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
18:32:39.0195 0x1f0c  kbdclass - ok
18:32:39.0211 0x1f0c  [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
18:32:39.0224 0x1f0c  kbdhid - ok
18:32:39.0227 0x1f0c  [ 1F9335A2C68B65E7D95985FA50968EA0, A0918C943F9CF5C6DB9440222B8E3B0DD645068B44E18253F275509550C0DF4D ] KeyIso          C:\Windows\system32\lsass.exe
18:32:39.0239 0x1f0c  KeyIso - ok
18:32:39.0244 0x1f0c  [ 6F5F0C6160EF237F0243C1E416EEBA98, 8BA8AA0D71350A74E294A731226B1638C6059013D645ABDE7188F7733E320FBD ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
18:32:39.0256 0x1f0c  KSecDD - ok
18:32:39.0262 0x1f0c  [ 05529E53B286FD60E7EF04EF138CABFD, 6C045750DCD3EE76F748582513AD4FA99C0E8E56B616725CD48DCA1068FF8923 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
18:32:39.0275 0x1f0c  KSecPkg - ok
18:32:39.0289 0x1f0c  [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys
18:32:39.0321 0x1f0c  ksthunk - ok
18:32:39.0335 0x1f0c  [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm           C:\Windows\system32\msdtckrm.dll
18:32:39.0377 0x1f0c  KtmRm - ok
18:32:39.0395 0x1f0c  [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer    C:\Windows\System32\srvsvc.dll
18:32:39.0431 0x1f0c  LanmanServer - ok
18:32:39.0441 0x1f0c  [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
18:32:39.0475 0x1f0c  LanmanWorkstation - ok
18:32:39.0481 0x1f0c  [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
18:32:39.0513 0x1f0c  lltdio - ok
18:32:39.0545 0x1f0c  [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc         C:\Windows\System32\lltdsvc.dll
18:32:39.0584 0x1f0c  lltdsvc - ok
18:32:39.0589 0x1f0c  [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts         C:\Windows\System32\lmhsvc.dll
18:32:39.0620 0x1f0c  lmhosts - ok
18:32:39.0639 0x1f0c  [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
18:32:39.0650 0x1f0c  LSI_FC - ok
18:32:39.0668 0x1f0c  [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS         C:\Windows\system32\drivers\lsi_sas.sys
18:32:39.0679 0x1f0c  LSI_SAS - ok
18:32:39.0683 0x1f0c  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys
18:32:39.0694 0x1f0c  LSI_SAS2 - ok
18:32:39.0701 0x1f0c  [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
18:32:39.0712 0x1f0c  LSI_SCSI - ok
18:32:39.0718 0x1f0c  [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv           C:\Windows\system32\drivers\luafv.sys
18:32:39.0752 0x1f0c  luafv - ok
18:32:39.0768 0x1f0c  [ C06234DCDB1BFC0CF7E25CFAC5B7F5FE, 149A3880E1D58CC0768A174DF4E884F3A4432F935D134B5AE536B7020788F5D5 ] ManyCam         C:\Windows\system32\DRIVERS\mcvidrv.sys
18:32:39.0777 0x1f0c  ManyCam - ok
18:32:39.0786 0x1f0c  [ 8F22037D3F5A6BB676525D825A1388B9, 2AAC748D46136DFA1BE45150BF0AB7707D45391CAC1F63B964D341D11B135C91 ] MBAMSwissArmy   C:\Windows\system32\drivers\MBAMSwissArmy.sys
18:32:39.0796 0x1f0c  MBAMSwissArmy - ok
18:32:39.0820 0x1f0c  [ 88B3BADFB02BE4471655EAF88DDC7EBD, F38D69B80A7670F85A9692A01D2D71A54BB413346C3523726E59D1282D349B83 ] mcaudrv_simple  C:\Windows\system32\drivers\mcaudrv_x64.sys
18:32:39.0830 0x1f0c  mcaudrv_simple - ok
18:32:39.0857 0x1f0c  [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
18:32:39.0871 0x1f0c  Mcx2Svc - ok
18:32:39.0889 0x1f0c  [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas         C:\Windows\system32\drivers\megasas.sys
18:32:39.0899 0x1f0c  megasas - ok
18:32:39.0917 0x1f0c  [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR          C:\Windows\system32\drivers\MegaSR.sys
18:32:39.0934 0x1f0c  MegaSR - ok
18:32:39.0950 0x1f0c  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS           C:\Windows\system32\mmcss.dll
18:32:39.0984 0x1f0c  MMCSS - ok
18:32:40.0040 0x1f0c  [ 53B8D9B905223CBB6317B0FFF61D155A, 3C3516CBFE08EB057EDFFF8D37A1691CF40252D0CBE5CAF01A7AA23C43CDE361 ] Mobile Partner. RunOuc C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe
18:32:40.0062 0x1f0c  Mobile Partner. RunOuc - ok
18:32:40.0068 0x1f0c  [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem           C:\Windows\system32\drivers\modem.sys
18:32:40.0098 0x1f0c  Modem - ok
18:32:40.0171 0x1f0c  [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
18:32:40.0202 0x1f0c  monitor - ok
18:32:40.0209 0x1f0c  [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
18:32:40.0221 0x1f0c  mouclass - ok
18:32:40.0249 0x1f0c  [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
18:32:40.0264 0x1f0c  mouhid - ok
18:32:40.0270 0x1f0c  [ 8ADB5445B29941CB41AF2846FD5C93C7, 689582430FE29EC0845B1DB841D3CC49D5D09DE264586E3999EEFE616986D12B ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
18:32:40.0284 0x1f0c  mountmgr - ok
18:32:40.0307 0x1f0c  [ C410158EAB38FC64D026830B2E509ED0, 7BBF004CC78CDD763413268A1A2E151B6F1E8010827097B5C454CE8FFBD21974 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
18:32:40.0320 0x1f0c  MozillaMaintenance - ok
18:32:40.0339 0x1f0c  [ 3665AB2F67F4024F5F3F80335ED5322A, BE3DC246F176E00D7611A7E16FBC22615199F49EBCB4C90B0C107294E592BF8D ] MpFilter        C:\Windows\system32\DRIVERS\MpFilter.sys
18:32:40.0359 0x1f0c  MpFilter - ok
18:32:40.0379 0x1f0c  [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio            C:\Windows\system32\drivers\mpio.sys
18:32:40.0393 0x1f0c  mpio - ok
18:32:40.0397 0x1f0c  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
18:32:40.0429 0x1f0c  mpsdrv - ok
18:32:40.0532 0x1f0c  [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc          C:\Windows\system32\mpssvc.dll
18:32:40.0588 0x1f0c  MpsSvc - ok
18:32:40.0608 0x1f0c  [ 98DB1790F0A584E0A2528B92B052417F, 9AA04CA73AFE599810CD233B9CEC212E16D44DCEDF5C7D0181C7257F498068B5 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
18:32:40.0622 0x1f0c  MRxDAV - ok
18:32:40.0631 0x1f0c  [ 632E8A00090E4F85F304E152C92C7F2C, A3098941251A8327C95E6B1122384D54FB0ED705A9215577D968EA5B5FD88C87 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
18:32:40.0646 0x1f0c  mrxsmb - ok
18:32:40.0660 0x1f0c  [ 0D9C05484F2F4BD9D33A615D5DBE67EA, 1E164B631B1CD85DD5B205284CB547B189609946490AAABD22741743BFB413DF ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
18:32:40.0679 0x1f0c  mrxsmb10 - ok
18:32:40.0686 0x1f0c  [ 6123E6FECC1C164022868FB1982271BE, 417E6C7AFF8B014B31AFCC202B0DCEECBDBB73205DF8C3EFC7E313664E284178 ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
18:32:40.0701 0x1f0c  mrxsmb20 - ok
18:32:40.0709 0x1f0c  [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci          C:\Windows\system32\drivers\msahci.sys
18:32:40.0719 0x1f0c  msahci - ok
18:32:40.0725 0x1f0c  [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
18:32:40.0737 0x1f0c  msdsm - ok
18:32:40.0744 0x1f0c  [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC           C:\Windows\System32\msdtc.exe
18:32:40.0758 0x1f0c  MSDTC - ok
18:32:40.0776 0x1f0c  [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
18:32:40.0807 0x1f0c  Msfs - ok
18:32:40.0811 0x1f0c  [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
18:32:40.0843 0x1f0c  mshidkmdf - ok
18:32:40.0846 0x1f0c  [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
18:32:40.0855 0x1f0c  msisadrv - ok
18:32:40.0870 0x1f0c  [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
18:32:40.0905 0x1f0c  MSiSCSI - ok
18:32:40.0908 0x1f0c  msiserver - ok
18:32:40.0953 0x1f0c  [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
18:32:41.0009 0x1f0c  MSKSSRV - ok
18:32:41.0052 0x1f0c  [ 5ADED2C1239D7BD798E2C4EF9EAA1FA3, 6A462DAC110015F3E59610202714120C557674019A0196680B72031C50D7C474 ] MsMpSvc         c:\Program Files\Microsoft Security Client\MsMpEng.exe
18:32:41.0080 0x1f0c  MsMpSvc - ok
18:32:41.0084 0x1f0c  [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
18:32:41.0124 0x1f0c  MSPCLOCK - ok
18:32:41.0131 0x1f0c  [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
18:32:41.0162 0x1f0c  MSPQM - ok
18:32:41.0186 0x1f0c  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
18:32:41.0204 0x1f0c  MsRPC - ok
18:32:41.0228 0x1f0c  [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
18:32:41.0238 0x1f0c  mssmbios - ok
18:32:41.0242 0x1f0c  [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
18:32:41.0273 0x1f0c  MSTEE - ok
18:32:41.0286 0x1f0c  [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig        C:\Windows\system32\drivers\MTConfig.sys
18:32:41.0297 0x1f0c  MTConfig - ok
18:32:41.0302 0x1f0c  [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup             C:\Windows\system32\Drivers\mup.sys
18:32:41.0312 0x1f0c  Mup - ok
18:32:41.0327 0x1f0c  [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent        C:\Windows\system32\qagentRT.dll
18:32:41.0371 0x1f0c  napagent - ok
18:32:41.0392 0x1f0c  [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
18:32:41.0414 0x1f0c  NativeWifiP - ok
18:32:41.0444 0x1f0c  [ F7309F42555F8AAB7144A51A1F2585B0, 065277A8AFAEE3888C997A76D2F751070F92DF4C3354D16B194860B4BDAFF937 ] NDIS            C:\Windows\system32\drivers\ndis.sys
18:32:41.0478 0x1f0c  NDIS - ok
18:32:41.0497 0x1f0c  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
18:32:41.0532 0x1f0c  NdisCap - ok
18:32:41.0541 0x1f0c  [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
18:32:41.0574 0x1f0c  NdisTapi - ok
18:32:41.0578 0x1f0c  [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
18:32:41.0614 0x1f0c  Ndisuio - ok
18:32:41.0621 0x1f0c  [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
18:32:41.0659 0x1f0c  NdisWan - ok
18:32:41.0694 0x1f0c  [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
18:32:41.0729 0x1f0c  NDProxy - ok
18:32:41.0734 0x1f0c  [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
18:32:41.0769 0x1f0c  NetBIOS - ok
18:32:41.0800 0x1f0c  [ E47D571FEC2C76E867935109AB2A770C, F349D25890B6F476B106FD75BFB081DB737CA9B224D95E44927942FFF2DF82CD ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
18:32:41.0816 0x1f0c  NetBT - ok
18:32:41.0820 0x1f0c  [ 1F9335A2C68B65E7D95985FA50968EA0, A0918C943F9CF5C6DB9440222B8E3B0DD645068B44E18253F275509550C0DF4D ] Netlogon        C:\Windows\system32\lsass.exe
18:32:41.0831 0x1f0c  Netlogon - ok
18:32:41.0854 0x1f0c  [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman          C:\Windows\System32\netman.dll
18:32:41.0894 0x1f0c  Netman - ok
18:32:42.0031 0x1f0c  [ 58EB8F52D1F17AF2F6EF9CCE7838D0F8, 6AAEA7AC36F56C7CED5DE8BA8B46716C3E8D0A418D862F4D3C84AD022659456A ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
18:32:42.0060 0x1f0c  NetMsmqActivator - ok
18:32:42.0068 0x1f0c  [ 58EB8F52D1F17AF2F6EF9CCE7838D0F8, 6AAEA7AC36F56C7CED5DE8BA8B46716C3E8D0A418D862F4D3C84AD022659456A ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
18:32:42.0086 0x1f0c  NetPipeActivator - ok
18:32:42.0123 0x1f0c  [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm        C:\Windows\System32\netprofm.dll
18:32:42.0166 0x1f0c  netprofm - ok
18:32:42.0172 0x1f0c  [ 58EB8F52D1F17AF2F6EF9CCE7838D0F8, 6AAEA7AC36F56C7CED5DE8BA8B46716C3E8D0A418D862F4D3C84AD022659456A ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
18:32:42.0185 0x1f0c  NetTcpActivator - ok
18:32:42.0191 0x1f0c  [ 58EB8F52D1F17AF2F6EF9CCE7838D0F8, 6AAEA7AC36F56C7CED5DE8BA8B46716C3E8D0A418D862F4D3C84AD022659456A ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
18:32:42.0205 0x1f0c  NetTcpPortSharing - ok
18:32:42.0935 0x1f0c  [ 7D3646F4E3F2C27A1415F1685391F024, E5426EC1347DBA302C786B72B510C61BA694D7A1FE0023CA61A587672F8F3548 ] NETwNs64        C:\Windows\system32\DRIVERS\Netwsw00.sys
18:32:43.0326 0x1f0c  NETwNs64 - ok
18:32:43.0369 0x1f0c  [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960         C:\Windows\system32\drivers\nfrd960.sys
18:32:43.0381 0x1f0c  nfrd960 - ok
18:32:43.0396 0x1f0c  [ CE5F6E635FE4506AE6F2D6EB87425128, 3DB5ECF7CD2F2C3C010AA40CE57F1B3856E284BBA359FBC41A1B340E3180FD5F ] NisDrv          C:\Windows\system32\DRIVERS\NisDrvWFP.sys
18:32:43.0412 0x1f0c  NisDrv - ok
18:32:43.0422 0x1f0c  [ D630B510E1E3FF6BA12B705F47F115D9, 05D76065D5D9A82E53EA18CD2D0184338681A7BBD3CD5D6C44D1FA5CB1C63640 ] NisSrv          c:\Program Files\Microsoft Security Client\NisSrv.exe
18:32:43.0441 0x1f0c  NisSrv - ok
18:32:43.0458 0x1f0c  [ 8B301D474B478E9A92823BAB50A7BC49, 8181816035F41B1DABEC05E65E4F67BCD785F56760A61F1049E91BA39D42F01D ] NlaSvc          C:\Windows\System32\nlasvc.dll
18:32:43.0476 0x1f0c  NlaSvc - ok
18:32:43.0480 0x1f0c  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs            C:\Windows\system32\drivers\Npfs.sys
18:32:43.0513 0x1f0c  Npfs - ok
18:32:43.0524 0x1f0c  [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi             C:\Windows\system32\nsisvc.dll
18:32:43.0554 0x1f0c  nsi - ok
18:32:43.0571 0x1f0c  [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
18:32:43.0601 0x1f0c  nsiproxy - ok
18:32:43.0818 0x1f0c  [ B98F8C6E31CD07B2E6F71F7F648E38C0, 2FEA100B80680FBBF644CB6763738804155DF1E94A6542CAE2B2786D770D554E ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
18:32:43.0884 0x1f0c  Ntfs - ok
18:32:43.0904 0x1f0c  [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null            C:\Windows\system32\drivers\Null.sys
18:32:43.0936 0x1f0c  Null - ok
18:32:43.0956 0x1f0c  [ 554964B900AE2954B8B589B6287034AC, C6C9EA3ADAFEBBF2AF944E4A0656BD795AD37706008CC0CA3F2150BD709476E7 ] NVHDA           C:\Windows\system32\drivers\nvhda64v.sys
18:32:43.0969 0x1f0c  NVHDA - ok
18:32:44.0833 0x1f0c  [ CE1B54F1ED2080B15DAF9044EC92075A, DD8557B0E159C09DF3195EC01545CCE2BD580DC2557CCC4F90D3B7C02D07FC36 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
18:32:45.0199 0x1f0c  nvlddmkm - ok
18:32:45.0229 0x1f0c  [ 5D9FD91F3D38DC9DA01E3CB5FA89CD48, 7738785DE8B50D69993F4408498B812D0283FEE5C04FF5B89C20F149B44E9737 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
18:32:45.0242 0x1f0c  nvraid - ok
18:32:45.0272 0x1f0c  [ F7CD50FE7139F07E77DA8AC8033D1832, DA96F4B15C8165E6AE1D00E03A062C66CA3A3089E4FF0E9E11CE00B154DD12EC ] nvstor          C:\Windows\system32\drivers\nvstor.sys
18:32:45.0285 0x1f0c  nvstor - ok
18:32:45.0322 0x1f0c  [ 67E9F641C1B5387F298F3063FAFA022B, F9C9974828632349E426C5375D2FD63744350D3D6FD693071231370D52E76DE7 ] nvsvc           C:\Windows\system32\nvvsvc.exe
18:32:45.0353 0x1f0c  nvsvc - ok
18:32:45.0362 0x1f0c  [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
18:32:45.0375 0x1f0c  nv_agp - ok
18:32:45.0380 0x1f0c  [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
18:32:45.0394 0x1f0c  ohci1394 - ok
18:32:45.0464 0x1f0c  [ AC0F1B7B71D9D435EC33456F7EDF6FF1, 8FEFF5F99F1AFF21CF9415D4BF26936EF3A7347DA06F30ADD1DD1B14916F2585 ] ose             C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
18:32:45.0479 0x1f0c  ose - ok
18:32:45.0754 0x1f0c  [ FE9C0029E1AF26350D9985D00520E5C8, 967079CCF7B2CBD4B48C9F076675C26AF93A1CEC26C96811F279414E34004EE6 ] osppsvc         C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
18:32:45.0953 0x1f0c  osppsvc - ok
18:32:46.0026 0x1f0c  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
18:32:46.0060 0x1f0c  p2pimsvc - ok
18:32:46.0130 0x1f0c  [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc          C:\Windows\system32\p2psvc.dll
18:32:46.0156 0x1f0c  p2psvc - ok
18:32:46.0181 0x1f0c  [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport         C:\Windows\system32\drivers\parport.sys
18:32:46.0194 0x1f0c  Parport - ok
18:32:46.0211 0x1f0c  [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
18:32:46.0222 0x1f0c  partmgr - ok
18:32:46.0229 0x1f0c  [ 3CD83692C43D87088E85E3C916146FFB, 9E812535E8FBA045FDA30F68E9EB2031132C37721D542A2DC9D4C33E2B137FCF ] PcaSvc          C:\Windows\System32\pcasvc.dll
18:32:46.0245 0x1f0c  PcaSvc - ok
18:32:46.0260 0x1f0c  [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci             C:\Windows\system32\drivers\pci.sys
18:32:46.0273 0x1f0c  pci - ok
18:32:46.0279 0x1f0c  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide          C:\Windows\system32\drivers\pciide.sys
18:32:46.0289 0x1f0c  pciide - ok
18:32:46.0305 0x1f0c  [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
18:32:46.0319 0x1f0c  pcmcia - ok
18:32:46.0323 0x1f0c  [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw             C:\Windows\system32\drivers\pcw.sys
18:32:46.0333 0x1f0c  pcw - ok
18:32:46.0352 0x1f0c  [ EA4D67448BE493D543F1730D6CD04694, 24717C5E41B7CA522F3330EF2228B6685E710A5259396E9887A1C1E7A413F8CA ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
18:32:46.0376 0x1f0c  PEAUTH - ok
18:32:46.0428 0x1f0c  [ B9B0A4299DD2D76A4243F75FD54DC680, BBF62E9628131FA396EB08D63B76D2D5FBDD61339E92B759125A066470D1C039 ] PeerDistSvc     C:\Windows\system32\peerdistsvc.dll
18:32:46.0471 0x1f0c  PeerDistSvc - ok
18:32:47.0693 0x1f0c  [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost        C:\Windows\SysWow64\perfhost.exe
18:32:47.0716 0x1f0c  PerfHost - ok
18:32:47.0776 0x1f0c  [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla             C:\Windows\system32\pla.dll
18:32:47.0844 0x1f0c  pla - ok
18:32:47.0872 0x1f0c  [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
18:32:47.0894 0x1f0c  PlugPlay - ok
18:32:47.0907 0x1f0c  [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
18:32:47.0918 0x1f0c  PNRPAutoReg - ok
18:32:47.0928 0x1f0c  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
18:32:47.0945 0x1f0c  PNRPsvc - ok
18:32:47.0980 0x1f0c  [ 80D6B0563ED2BF10656B1D4748331082, B7E6B5E1148B7EE537E8D5C3A65450876B61CD45A395267D08699746E98AD574 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
18:32:48.0003 0x1f0c  PolicyAgent - ok
18:32:48.0026 0x1f0c  [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power           C:\Windows\system32\umpo.dll
18:32:48.0062 0x1f0c  Power - ok
18:32:48.0078 0x1f0c  [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
18:32:48.0111 0x1f0c  PptpMiniport - ok
18:32:48.0121 0x1f0c  [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor       C:\Windows\system32\drivers\processr.sys
18:32:48.0134 0x1f0c  Processor - ok
18:32:48.0148 0x1f0c  [ B6A58491307B4CADA572583D863DC602, 5C44936605E52C9533E4CE22F18FAB8211475877F71EFD88DA4D02FD608C90A3 ] ProfSvc         C:\Windows\system32\profsvc.dll
18:32:48.0165 0x1f0c  ProfSvc - ok
18:32:48.0169 0x1f0c  [ 1F9335A2C68B65E7D95985FA50968EA0, A0918C943F9CF5C6DB9440222B8E3B0DD645068B44E18253F275509550C0DF4D ] ProtectedStorage C:\Windows\system32\lsass.exe
18:32:48.0180 0x1f0c  ProtectedStorage - ok
18:32:48.0187 0x1f0c  [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
18:32:48.0221 0x1f0c  Psched - ok
18:32:48.0273 0x1f0c  [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300          C:\Windows\system32\drivers\ql2300.sys
18:32:48.0318 0x1f0c  ql2300 - ok
18:32:48.0334 0x1f0c  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
18:32:48.0346 0x1f0c  ql40xx - ok
18:32:48.0367 0x1f0c  [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE           C:\Windows\system32\qwave.dll
18:32:48.0387 0x1f0c  QWAVE - ok
18:32:48.0392 0x1f0c  [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
18:32:48.0407 0x1f0c  QWAVEdrv - ok
18:32:48.0420 0x1f0c  [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
18:32:48.0451 0x1f0c  RasAcd - ok
18:32:48.0463 0x1f0c  [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
18:32:48.0494 0x1f0c  RasAgileVpn - ok
18:32:48.0508 0x1f0c  [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto         C:\Windows\System32\rasauto.dll
18:32:48.0540 0x1f0c  RasAuto - ok
18:32:48.0549 0x1f0c  [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
18:32:48.0583 0x1f0c  Rasl2tp - ok
18:32:48.0602 0x1f0c  [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan          C:\Windows\System32\rasmans.dll
18:32:48.0639 0x1f0c  RasMan - ok
18:32:48.0644 0x1f0c  [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
18:32:48.0677 0x1f0c  RasPppoe - ok
18:32:48.0681 0x1f0c  [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
18:32:48.0715 0x1f0c  RasSstp - ok
18:32:48.0773 0x1f0c  [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
18:32:48.0817 0x1f0c  rdbss - ok
18:32:48.0848 0x1f0c  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
18:32:48.0863 0x1f0c  rdpbus - ok
18:32:49.0034 0x1f0c  [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
18:32:49.0093 0x1f0c  RDPCDD - ok
18:32:49.0176 0x1f0c  [ 1B6163C503398B23FF8B939C67747683, 339A5AA7970FF34FAAB213B655860C5B0DEC5F983A4A11A088017D849F320ACE ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys
18:32:49.0204 0x1f0c  RDPDR - ok
18:32:49.0231 0x1f0c  [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
18:32:49.0272 0x1f0c  RDPENCDD - ok
18:32:49.0282 0x1f0c  [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
18:32:49.0314 0x1f0c  RDPREFMP - ok
18:32:49.0343 0x1f0c  [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
18:32:49.0360 0x1f0c  RDPWD - ok
18:32:49.0378 0x1f0c  [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
18:32:49.0393 0x1f0c  rdyboost - ok
18:32:49.0402 0x1f0c  [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess    C:\Windows\System32\mprdim.dll
18:32:49.0436 0x1f0c  RemoteAccess - ok
18:32:49.0468 0x1f0c  [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
18:32:49.0505 0x1f0c  RemoteRegistry - ok
18:32:49.0531 0x1f0c  [ 3DD798846E2C28102B922C56E71B7932, 30B111615D74CB2213997A5C08DD9C8613ADE441D9423CC1C49A753D13CE524D ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys
18:32:49.0549 0x1f0c  RFCOMM - ok
18:32:49.0554 0x1f0c  [ B1C40561513067C3C999B92ACB350E08, B74B583E077A4553054D318E8B87CF3BD9EB2629B3F7729071708848E17796E5 ] rimspci         C:\Windows\system32\DRIVERS\rimspe64.sys
18:32:49.0566 0x1f0c  rimspci - ok
18:32:49.0580 0x1f0c  [ 8F8539A7F5C117D4407B2985995671F2, D598C2F1F7B20E88386EADAFCA2616C3E4277521DDADF05C54933CCD9F5CA39B ] risdsnpe        C:\Windows\system32\DRIVERS\risdsne64.sys
18:32:49.0592 0x1f0c  risdsnpe - ok
18:32:49.0607 0x1f0c  [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
18:32:49.0641 0x1f0c  RpcEptMapper - ok
18:32:49.0655 0x1f0c  [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator      C:\Windows\system32\locator.exe
18:32:49.0668 0x1f0c  RpcLocator - ok
18:32:49.0694 0x1f0c  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs           C:\Windows\system32\rpcss.dll
18:32:49.0735 0x1f0c  RpcSs - ok
18:32:49.0753 0x1f0c  [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
18:32:49.0787 0x1f0c  rspndr - ok
18:32:49.0811 0x1f0c  [ E60C0A09F997826C7627B244195AB581, E8630ED74B38B98BF584E353D992C1311BC36AB7F20A1BB66C9CD65CE1E46F8D ] s3cap           C:\Windows\system32\drivers\vms3cap.sys
18:32:49.0824 0x1f0c  s3cap - ok
18:32:49.0827 0x1f0c  [ 1F9335A2C68B65E7D95985FA50968EA0, A0918C943F9CF5C6DB9440222B8E3B0DD645068B44E18253F275509550C0DF4D ] SamSs           C:\Windows\system32\lsass.exe
18:32:49.0840 0x1f0c  SamSs - ok
18:32:49.0853 0x1f0c  [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
18:32:49.0865 0x1f0c  sbp2port - ok
18:32:49.0900 0x1f0c  [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
18:32:49.0938 0x1f0c  SCardSvr - ok
18:32:49.0942 0x1f0c  [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
18:32:49.0974 0x1f0c  scfilter - ok
18:32:50.0063 0x1f0c  [ 40686B59C127F0C93B4234E4A1E3472A, B2DD61CB796C6AA8AFD285D43472B94646CA6D331D282818E0FDC9DE28DDE9CF ] Schedule        C:\Windows\system32\schedsvc.dll
18:32:50.0110 0x1f0c  Schedule - ok
18:32:50.0134 0x1f0c  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc     C:\Windows\System32\certprop.dll
18:32:50.0166 0x1f0c  SCPolicySvc - ok
18:32:50.0184 0x1f0c  [ 111E0EBC0AD79CB0FA014B907B231CF0, B7D43D156C2524938503CF8E99C4D1F7A5C55E16C0368F57F4CD23C6D833B38F ] sdbus           C:\Windows\system32\DRIVERS\sdbus.sys
18:32:50.0201 0x1f0c  sdbus - ok
18:32:50.0232 0x1f0c  [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
18:32:50.0247 0x1f0c  SDRSVC - ok
18:32:50.0262 0x1f0c  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\Windows\system32\drivers\secdrv.sys
18:32:50.0274 0x1f0c  secdrv - ok
18:32:50.0278 0x1f0c  [ A19623BDD61E66A12AB53992002B4F3A, E351CEEC086084A417BA3BD0EEF46114D3147EC38E3EF8BE49B724F9D028CC56 ] seclogon        C:\Windows\system32\seclogon.dll
18:32:50.0291 0x1f0c  seclogon - ok
18:32:50.0306 0x1f0c  [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS            C:\Windows\system32\sens.dll
18:32:50.0340 0x1f0c  SENS - ok
18:32:50.0350 0x1f0c  [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc        C:\Windows\system32\sensrsvc.dll
18:32:50.0362 0x1f0c  SensrSvc - ok
18:32:50.0373 0x1f0c  [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
18:32:50.0384 0x1f0c  Serenum - ok
18:32:50.0389 0x1f0c  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial          C:\Windows\system32\DRIVERS\serial.sys
18:32:50.0402 0x1f0c  Serial - ok
18:32:50.0417 0x1f0c  [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse        C:\Windows\system32\drivers\sermouse.sys
18:32:50.0428 0x1f0c  sermouse - ok
18:32:50.0440 0x1f0c  [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv      C:\Windows\system32\sessenv.dll
18:32:50.0476 0x1f0c  SessionEnv - ok
18:32:50.0489 0x1f0c  [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
18:32:50.0503 0x1f0c  sffdisk - ok
18:32:50.0528 0x1f0c  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
18:32:50.0544 0x1f0c  sffp_mmc - ok
18:32:50.0550 0x1f0c  [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
18:32:50.0564 0x1f0c  sffp_sd - ok
18:32:50.0585 0x1f0c  [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy         C:\Windows\system32\drivers\sfloppy.sys
18:32:50.0597 0x1f0c  sfloppy - ok
18:32:50.0625 0x1f0c  [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
18:32:50.0668 0x1f0c  SharedAccess - ok
18:32:50.0690 0x1f0c  [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
18:32:50.0728 0x1f0c  ShellHWDetection - ok
18:32:50.0758 0x1f0c  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys
18:32:50.0769 0x1f0c  SiSRaid2 - ok
18:32:50.0785 0x1f0c  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
18:32:50.0796 0x1f0c  SiSRaid4 - ok
18:32:50.0814 0x1f0c  [ 52F7E8603E888E3DB0A8B3D1804098E9, 4E23DC9442C0C14AAE7146DACBB0B39743F1FFAA463EE7069CCDF866AD27BD77 ] SkypeUpdate     C:\Program Files (x86)\Skype\Updater\Updater.exe
18:32:50.0837 0x1f0c  SkypeUpdate - ok
18:32:50.0855 0x1f0c  [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
18:32:50.0909 0x1f0c  Smb - ok
18:32:50.0940 0x1f0c  [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
18:32:50.0970 0x1f0c  SNMPTRAP - ok
18:32:50.0983 0x1f0c  [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr           C:\Windows\system32\drivers\spldr.sys
18:32:50.0992 0x1f0c  spldr - ok
18:32:51.0082 0x1f0c  [ B96C17B5DC1424D56EEA3A99E97428CD, AF0A85066A7983878DC1C663811CE61C6CA1912DC956184F878B7B82DB93C651 ] Spooler         C:\Windows\System32\spoolsv.exe
18:32:51.0143 0x1f0c  Spooler - ok
18:32:51.0434 0x1f0c  [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc          C:\Windows\system32\sppsvc.exe
18:32:51.0562 0x1f0c  sppsvc - ok
18:32:51.0578 0x1f0c  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify     C:\Windows\system32\sppuinotify.dll
18:32:51.0611 0x1f0c  sppuinotify - ok
18:32:51.0641 0x1f0c  [ EC666682FE8344CF7E6ED69E74FA9F4F, DCD2A1C046425630689E2C9A6A6E356FE5A2A6664D12C20CFE236FCB32240DF9 ] srv             C:\Windows\system32\DRIVERS\srv.sys
18:32:51.0661 0x1f0c  srv - ok
18:32:51.0683 0x1f0c  [ E450C0318DCE8ED28ED272C8806B8495, D2FD459F8C5E42103EF2F71421FA175A4F0821F8C2A3763093122D433D1C50FB ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
18:32:51.0702 0x1f0c  srv2 - ok
18:32:51.0717 0x1f0c  [ 0C4540311E11664B245A263E1154CEF8, 63376322BFFAFF2F166AF3FDD3F1A346C21FAE21F406F659F8630779D1D6525D ] SrvHsfHDA       C:\Windows\system32\DRIVERS\VSTAZL6.SYS
18:32:51.0734 0x1f0c  SrvHsfHDA - ok
18:32:51.0777 0x1f0c  [ 02071D207A9858FBE3A48CBFD59C4A04, FEA4DEBAEC3465E0C7C1E8B721805922F6BBCB96A60A193B11688F4252F4B89E ] SrvHsfV92       C:\Windows\system32\DRIVERS\VSTDPV6.SYS
18:32:51.0824 0x1f0c  SrvHsfV92 - ok
18:32:51.0845 0x1f0c  [ 18E40C245DBFAF36FD0134A7EF2DF396, 0138A68958112101A5D3BD94114F320CE80B0C9A93E009AC78DE7415FCCC7DE7 ] SrvHsfWinac     C:\Windows\system32\DRIVERS\VSTCNXT6.SYS
18:32:51.0872 0x1f0c  SrvHsfWinac - ok
18:32:51.0880 0x1f0c  [ 9C12C78AD36C23D925711A4640228225, FF72C23F2A08EDF0C41BAF1EB0245AB44FF91365C5466F09C47A8F0928D20994 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
18:32:51.0892 0x1f0c  srvnet - ok
18:32:51.0909 0x1f0c  [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
18:32:51.0945 0x1f0c  SSDPSRV - ok
18:32:51.0961 0x1f0c  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc         C:\Windows\system32\sstpsvc.dll
18:32:51.0995 0x1f0c  SstpSvc - ok
18:32:52.0057 0x1f0c  [ AFE32AFD30464FC59CB8E88DC72F66FA, 24644F8AA47E61B98EF867BE18A9BE383822D64F3AADF2ED35E42FBFBA7B340F ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe
18:32:52.0089 0x1f0c  Steam Client Service - ok
18:32:52.0104 0x1f0c  [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor        C:\Windows\system32\drivers\stexstor.sys
18:32:52.0115 0x1f0c  stexstor - ok
18:32:52.0143 0x1f0c  [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc          C:\Windows\System32\wiaservc.dll
18:32:52.0186 0x1f0c  stisvc - ok
18:32:52.0202 0x1f0c  [ 7785DC213270D2FC066538DAF94087E7, F09CB2895241719CA5147B2EE9F7ECBD0303AFFB5CD896F06D4D29BAAAFC207B ] storflt         C:\Windows\system32\drivers\vmstorfl.sys
18:32:52.0212 0x1f0c  storflt - ok
18:32:52.0242 0x1f0c  [ C40841817EF57D491F22EB103DA587CC, 5FAA2DE43BADC16A898C0C290C44C41E4411D919A95FE8C6FF45EA7A34495079 ] StorSvc         C:\Windows\system32\storsvc.dll
18:32:52.0252 0x1f0c  StorSvc - ok
18:32:52.0272 0x1f0c  [ D34E4943D5AC096C8EDEEBFD80D76E23, 1DD7F6F97060B5F763A04ACA1F75E59DAB09EF824FD09B83FC3C192837D006DE ] storvsc         C:\Windows\system32\drivers\storvsc.sys
18:32:52.0282 0x1f0c  storvsc - ok
18:32:52.0302 0x1f0c  [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
18:32:52.0312 0x1f0c  swenum - ok
18:32:52.0332 0x1f0c  [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv           C:\Windows\System32\swprv.dll
18:32:52.0382 0x1f0c  swprv - ok
18:32:52.0462 0x1f0c  [ 2E730941CC5BF6200A4F56D1E9C24AAD, 758836D55DC84F3EBE9917DC6FAB8E6170A5B238FEDBCFDB6D7C5C6EA98E08B2 ] SysMain         C:\Windows\system32\sysmain.dll
18:32:52.0512 0x1f0c  SysMain - ok
18:32:52.0532 0x1f0c  [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
18:32:52.0552 0x1f0c  TabletInputService - ok
18:32:52.0572 0x1f0c  [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv         C:\Windows\System32\tapisrv.dll
18:32:52.0612 0x1f0c  TapiSrv - ok
18:32:52.0622 0x1f0c  [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS             C:\Windows\System32\tbssvc.dll
18:32:52.0652 0x1f0c  TBS - ok
18:32:52.0712 0x1f0c  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
18:32:52.0762 0x1f0c  Tcpip - ok
18:32:52.0812 0x1f0c  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
18:32:52.0862 0x1f0c  TCPIP6 - ok
18:32:52.0902 0x1f0c  [ DF687E3D8836BFB04FCC0615BF15A519, 7C5B1E72673B4299DFC21E869F0FBB28198CA54DF4F4AF7080005F2D82467784 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
18:32:52.0932 0x1f0c  tcpipreg - ok
18:32:52.0942 0x1f0c  [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
18:32:52.0952 0x1f0c  TDPIPE - ok
18:32:52.0972 0x1f0c  [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
18:32:52.0982 0x1f0c  TDTCP - ok
18:32:52.0992 0x1f0c  [ AA77EB517D2F07A947294F260E3ACA83, B7A5DF3066830C0C2302B059778A67419792058A0D300C471DE40AB245EA7E58 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
18:32:53.0022 0x1f0c  tdx - ok
18:32:53.0572 0x1f0c  [ F2F02E436BA56A96A06E4427C5787B6E, 1562FF264011A15AC69808CB74F387917C4E8ED3B91546B12933BE10B6E20B3A ] TeamViewer      C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
18:32:53.0862 0x1f0c  TeamViewer - ok
18:32:53.0902 0x1f0c  [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
18:32:53.0912 0x1f0c  TermDD - ok
18:32:53.0932 0x1f0c  [ 008CD4EBFABCF78D0F19B3778492648C, 9050490EEE0AD86E73F0A82D83E4FC29DF84F6B6FDB389AE135FD712B5F425BE ] TermService     C:\Windows\System32\termsrv.dll
18:32:53.0952 0x1f0c  TermService - ok
18:32:53.0962 0x1f0c  [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes          C:\Windows\system32\themeservice.dll
18:32:53.0982 0x1f0c  Themes - ok
18:32:53.0992 0x1f0c  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER     C:\Windows\system32\mmcss.dll
18:32:54.0022 0x1f0c  THREADORDER - ok
18:32:54.0032 0x1f0c  [ DBCC20C02E8A3E43B03C304A4E40A84F, BF5F3ACCB0342304A6870E94D2576644B08DBF307C853C7DBA4B82B0C7309DA4 ] TPM             C:\Windows\system32\drivers\tpm.sys
18:32:54.0042 0x1f0c  TPM - ok
18:32:54.0082 0x1f0c  [ A9EF6C7E62DC3B01C51CFB92C1596C62, 432335FDA5DF9FF8C9B86767980A07C720E7158D5362E40D3A745817D4275A07 ] TPPWRIF         C:\Dominik\Programme\Lenovo Battery Utility 2014\TPPWR64V.sys
18:32:54.0092 0x1f0c  TPPWRIF - ok
18:32:54.0112 0x1f0c  [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks          C:\Windows\System32\trkwks.dll
18:32:54.0142 0x1f0c  TrkWks - ok
18:32:54.0202 0x1f0c  [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
18:32:54.0262 0x1f0c  TrustedInstaller - ok
18:32:54.0282 0x1f0c  [ E232A3B43A894BB327FC161529BD9ED1, F2673DA8C920F21ACCECC25F7C59A05822E5E577D47F126EDF9C94FEB4B30C5F ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
18:32:54.0292 0x1f0c  tssecsrv - ok
18:32:54.0302 0x1f0c  [ D11C783E3EF9A3C52C0EBE83CC5000E9, A136C355D4C8945729163D15801364A614E23217B15F9313C85BA45BB71A74EB ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
18:32:54.0312 0x1f0c  TsUsbFlt - ok
18:32:54.0332 0x1f0c  [ 9CC2CCAE8A84820EAECB886D477CBCB8, 50D8AA2D7477A6618A0C31BB4D1C4887B457865FB1105E2E7B984EEFA337B804 ] TsUsbGD         C:\Windows\system32\drivers\TsUsbGD.sys
18:32:54.0342 0x1f0c  TsUsbGD - ok
18:32:54.0352 0x1f0c  [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
18:32:54.0382 0x1f0c  tunnel - ok
18:32:54.0392 0x1f0c  [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
18:32:54.0402 0x1f0c  uagp35 - ok
18:32:54.0422 0x1f0c  [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
18:32:54.0462 0x1f0c  udfs - ok
18:32:54.0512 0x1f0c  [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect       C:\Windows\system32\UI0Detect.exe
18:32:54.0522 0x1f0c  UI0Detect - ok
18:32:54.0532 0x1f0c  [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
18:32:54.0542 0x1f0c  uliagpkx - ok
18:32:54.0542 0x1f0c  [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus           C:\Windows\system32\DRIVERS\umbus.sys
18:32:54.0562 0x1f0c  umbus - ok
18:32:54.0572 0x1f0c  [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass          C:\Windows\system32\drivers\umpass.sys
18:32:54.0582 0x1f0c  UmPass - ok
18:32:54.0602 0x1f0c  [ A293DCD756D04D8492A750D03B9A297C, 203600ED0B7F8BA4C6D6F4ED810F4DF5AB70928B06EC4131C5D8ADF628444ED1 ] UmRdpService    C:\Windows\System32\umrdp.dll
18:32:54.0622 0x1f0c  UmRdpService - ok
18:32:54.0642 0x1f0c  [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost        C:\Windows\System32\upnphost.dll
18:32:54.0772 0x1f0c  upnphost - ok
18:32:54.0812 0x1f0c  [ B0435098C81D04CAFFF80DDB746CD3A2, A17B207740382E38729571F0B0BC98FF874E856A7C7CE9EB930328A2AD88F52A ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys
18:32:54.0822 0x1f0c  usbaudio - ok
18:32:54.0842 0x1f0c  [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys
18:32:54.0852 0x1f0c  usbccgp - ok
18:32:54.0872 0x1f0c  [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir          C:\Windows\system32\drivers\usbcir.sys
18:32:54.0882 0x1f0c  usbcir - ok
18:32:54.0902 0x1f0c  [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci         C:\Windows\system32\drivers\usbehci.sys
18:32:54.0912 0x1f0c  usbehci - ok
18:32:54.0922 0x1f0c  [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
18:32:54.0942 0x1f0c  usbhub - ok
18:32:54.0952 0x1f0c  [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci         C:\Windows\system32\drivers\usbohci.sys
18:32:54.0962 0x1f0c  usbohci - ok
18:32:54.0972 0x1f0c  [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
18:32:54.0982 0x1f0c  usbprint - ok
18:32:55.0002 0x1f0c  [ D029DD09E22EB24318A8FC3D8138BA43, C95805E8BF75ECB939520AE86420B16467B0771C161C51C9F1A37649ADFADCD0 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
18:32:55.0022 0x1f0c  USBSTOR - ok
18:32:55.0032 0x1f0c  [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys
18:32:55.0042 0x1f0c  usbuhci - ok
18:32:55.0062 0x1f0c  [ 1F775DA4CF1A3A1834207E975A72E9D7, 6D3DE5BD3EF3A76E997E5BAF900C51D25308F5A9682D1F62017F577A24095B90 ] usbvideo        C:\Windows\System32\Drivers\usbvideo.sys
18:32:55.0072 0x1f0c  usbvideo - ok
18:32:55.0092 0x1f0c  [ 7B28E2FBE75115660FAB31079C0A9F29, 81BB5A3E64B652A672A0782A88ABF6DDD729D38712D0706CE0FB9DE6D1EE1515 ] usb_rndisx      C:\Windows\system32\DRIVERS\usb8023x.sys
18:32:55.0102 0x1f0c  usb_rndisx - ok
18:32:55.0122 0x1f0c  [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms           C:\Windows\System32\uxsms.dll
18:32:55.0152 0x1f0c  UxSms - ok
18:32:55.0152 0x1f0c  [ 1F9335A2C68B65E7D95985FA50968EA0, A0918C943F9CF5C6DB9440222B8E3B0DD645068B44E18253F275509550C0DF4D ] VaultSvc        C:\Windows\system32\lsass.exe
18:32:55.0162 0x1f0c  VaultSvc - ok
18:32:55.0192 0x1f0c  [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
18:32:55.0202 0x1f0c  vdrvroot - ok
18:32:55.0232 0x1f0c  [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds             C:\Windows\System32\vds.exe
18:32:55.0292 0x1f0c  vds - ok
18:32:55.0302 0x1f0c  [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
18:32:55.0322 0x1f0c  vga - ok
18:32:55.0322 0x1f0c  [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave         C:\Windows\System32\drivers\vga.sys
18:32:55.0362 0x1f0c  VgaSave - ok
18:32:55.0442 0x1f0c  [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys
18:32:55.0452 0x1f0c  vhdmp - ok
18:32:55.0462 0x1f0c  [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide          C:\Windows\system32\drivers\viaide.sys
18:32:55.0472 0x1f0c  viaide - ok
18:32:55.0492 0x1f0c  [ 86EA3E79AE350FEA5331A1303054005F, 7E7D6027EB41E591633C7383A5D29A3BA8ECFC08C177D2BCF741EE27686B1691 ] vmbus           C:\Windows\system32\drivers\vmbus.sys
18:32:55.0502 0x1f0c  vmbus - ok
18:32:55.0512 0x1f0c  [ 7DE90B48F210D29649380545DB45A187, 09522F84285D62B961868DA98C40B82E746CA4D24A9780905673A2349D6B07F4 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
18:32:55.0522 0x1f0c  VMBusHID - ok
18:32:55.0532 0x1f0c  [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
18:32:55.0542 0x1f0c  volmgr - ok
18:32:55.0562 0x1f0c  [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
18:32:55.0582 0x1f0c  volmgrx - ok
18:32:55.0592 0x1f0c  [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap         C:\Windows\system32\drivers\volsnap.sys
18:32:55.0602 0x1f0c  volsnap - ok
18:32:55.0622 0x1f0c  [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid         C:\Windows\system32\drivers\vsmraid.sys
18:32:55.0632 0x1f0c  vsmraid - ok
18:32:55.0672 0x1f0c  [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS             C:\Windows\system32\vssvc.exe
18:32:55.0742 0x1f0c  VSS - ok
18:32:55.0752 0x1f0c  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys
18:32:55.0762 0x1f0c  vwifibus - ok
18:32:55.0772 0x1f0c  [ 6A3D66263414FF0D6FA754C646612F3F, 30F6BA594B0D3B94113064015A16D97811CD989DF1715CCE21CEAB9894C1B4FB ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
18:32:55.0782 0x1f0c  vwififlt - ok
18:32:55.0792 0x1f0c  [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time         C:\Windows\system32\w32time.dll
18:32:55.0832 0x1f0c  W32Time - ok
18:32:55.0862 0x1f0c  [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
18:32:55.0872 0x1f0c  WacomPen - ok
18:32:55.0892 0x1f0c  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
18:32:55.0932 0x1f0c  WANARP - ok
18:32:55.0942 0x1f0c  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
18:32:55.0982 0x1f0c  Wanarpv6 - ok
18:32:56.0022 0x1f0c  [ 3CEC96DE223E49EAAE3651FCF8FAEA6C, 4150DAB33E8D61076F1D4767BCAFC9B4ECCCCBD58FD4FB3CFE5B8D27DCDCAB61 ] WatAdminSvc     C:\Windows\system32\Wat\WatAdminSvc.exe
18:32:56.0062 0x1f0c  WatAdminSvc - ok
18:32:56.0182 0x1f0c  [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine        C:\Windows\system32\wbengine.exe
18:32:56.0222 0x1f0c  wbengine - ok
18:32:56.0252 0x1f0c  [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
18:32:56.0272 0x1f0c  WbioSrvc - ok
18:32:56.0292 0x1f0c  [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc         C:\Windows\System32\wcncsvc.dll
18:32:56.0312 0x1f0c  wcncsvc - ok
18:32:56.0332 0x1f0c  [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
18:32:56.0342 0x1f0c  WcsPlugInService - ok
18:32:56.0362 0x1f0c  [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd              C:\Windows\system32\drivers\wd.sys
18:32:56.0372 0x1f0c  Wd - ok
18:32:56.0412 0x1f0c  [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
18:32:56.0442 0x1f0c  Wdf01000 - ok
18:32:56.0442 0x1f0c  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiServiceHost  C:\Windows\system32\wdi.dll
18:32:56.0462 0x1f0c  WdiServiceHost - ok
18:32:56.0472 0x1f0c  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiSystemHost   C:\Windows\system32\wdi.dll
18:32:56.0492 0x1f0c  WdiSystemHost - ok
18:32:56.0502 0x1f0c  [ EE841B6D1F2B9508D3ABAE52AC05A94F, F1AE981FCDBFC4672A4EABABD41382E93762EFC2EDAD96E75530E7ACA5AF1FD8 ] WebClient       C:\Windows\System32\webclnt.dll
18:32:56.0522 0x1f0c  WebClient - ok
18:32:56.0542 0x1f0c  [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc          C:\Windows\system32\wecsvc.dll
18:32:56.0592 0x1f0c  Wecsvc - ok
18:32:56.0592 0x1f0c  [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
18:32:56.0632 0x1f0c  wercplsupport - ok
18:32:56.0662 0x1f0c  [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc          C:\Windows\System32\WerSvc.dll
18:32:56.0692 0x1f0c  WerSvc - ok
18:32:56.0702 0x1f0c  [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
18:32:56.0732 0x1f0c  WfpLwf - ok
18:32:56.0752 0x1f0c  [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
18:32:56.0762 0x1f0c  WIMMount - ok
18:32:56.0772 0x1f0c  WinDefend - ok
18:32:56.0772 0x1f0c  WinHttpAutoProxySvc - ok
18:32:56.0962 0x1f0c  [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
18:32:57.0002 0x1f0c  Winmgmt - ok
18:32:57.0052 0x1f0c  [ EBDA1B0F15CB9B2CBCC6C94824E4E054, C51314F7D611E4903DA00EFA8EB99365414436324D256083CE0B5A8E055E8E06 ] WinRM           C:\Windows\system32\WsmSvc.dll
18:32:57.0112 0x1f0c  WinRM - ok
18:32:57.0122 0x1f0c  [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
18:32:57.0142 0x1f0c  WinUsb - ok
18:32:57.0182 0x1f0c  [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc         C:\Windows\System32\wlansvc.dll
18:32:57.0212 0x1f0c  Wlansvc - ok
18:32:57.0232 0x1f0c  [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi         C:\Windows\system32\DRIVERS\wmiacpi.sys
18:32:57.0242 0x1f0c  WmiAcpi - ok
18:32:57.0282 0x1f0c  [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
18:32:57.0302 0x1f0c  wmiApSrv - ok
18:32:57.0312 0x1f0c  WMPNetworkSvc - ok
18:32:57.0332 0x1f0c  [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc          C:\Windows\System32\wpcsvc.dll
18:32:57.0342 0x1f0c  WPCSvc - ok
18:32:57.0352 0x1f0c  [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
18:32:57.0372 0x1f0c  WPDBusEnum - ok
18:32:57.0432 0x1f0c  [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
18:32:57.0492 0x1f0c  ws2ifsl - ok
18:32:57.0532 0x1f0c  [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc          C:\Windows\system32\wscsvc.dll
18:32:57.0552 0x1f0c  wscsvc - ok
18:32:57.0552 0x1f0c  WSearch - ok
18:32:57.0602 0x1f0c  [ 88D5841677EF05E1E0CF6217A1F9FD18, 9E5B60161316979B8A2DC301D0C1A7072ED1C9654D75EF7D689798678C9ECA53 ] WTGService      C:\Program Files (x86)\XSManager\WTGService.exe
18:32:57.0612 0x1f0c  WTGService - ok
18:32:57.0692 0x1f0c  [ 86F11B85102AFA6A1A6101DCE2F09386, 68A0F0E628C8F33FDAC114876DA8ED14776DD74E80AC5A6A52257E19DE011091 ] wuauserv        C:\Windows\system32\wuaueng.dll
18:32:57.0802 0x1f0c  wuauserv - ok
18:32:57.0812 0x1f0c  [ D3381DC54C34D79B22CEE0D65BA91B7C, 70DC4ADCA4C0C28BB133287511E329D1B6B9B97F96CDE5B1D2F1F59FE1A965D9 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
18:32:57.0842 0x1f0c  WudfPf - ok
18:32:57.0882 0x1f0c  [ CF8D590BE3373029D57AF80914190682, FB9641777E90A58C063FBE95F081DC6D2F4770827DE19108A9DC3E3D6B17B4BF ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
18:32:57.0922 0x1f0c  WUDFRd - ok
18:32:57.0932 0x1f0c  [ 7A95C95B6C4CF292D689106BCAE49543, 9029F489E1E817CE12839B8C6656E46190497D445DC3F43C20CF96E5E6BD0691 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
18:32:57.0962 0x1f0c  wudfsvc - ok
18:32:57.0982 0x1f0c  [ 9A3452B3C2A46C073166C5CF49FAD1AE, D6F95F51D8E37BA4CF403965EC08CCFEEA9EEFDBFC7752432EAEC19925BDA115 ] WwanSvc         C:\Windows\System32\wwansvc.dll
18:32:58.0002 0x1f0c  WwanSvc - ok
18:32:58.0042 0x1f0c  [ A2611162665259600AE179521D3E9E2D, 145DBFE0FF0FD0DF81403EEE4F3366929FFD1EA7553679B6F09672D3A4BB43FE ] ZDServ          C:\ProgramData\ZDSupport\ZDServ\ZDServ.exe
18:32:58.0062 0x1f0c  ZDServ - ok
18:32:58.0082 0x1f0c  ================ Scan global ===============================
18:32:58.0102 0x1f0c  [ 168EA9CD9BD6056BB6F60B57D5304BBE, 5A2F98754F042A7D80E7483842967EB362F01D57CE9720B24C7EDAA047F24C6F ] C:\Windows\system32\basesrv.dll
18:32:58.0112 0x1f0c  [ 93E5D2B763374F484918A0909724B3EB, 900F1CCAEFCF77AB678C74D542ABDDA7134CD33D7811537E2829FC69E99F2B3E ] C:\Windows\system32\winsrv.dll
18:32:58.0122 0x1f0c  [ 93E5D2B763374F484918A0909724B3EB, 900F1CCAEFCF77AB678C74D542ABDDA7134CD33D7811537E2829FC69E99F2B3E ] C:\Windows\system32\winsrv.dll
18:32:58.0132 0x1f0c  [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
18:32:58.0152 0x1f0c  [ 71C85477DF9347FE8E7BC55768473FCA, A86D6A6D1F5A0EFCD649792A06F3AE9B37158D48493D2ECA7F52DCC1CB9B6536 ] C:\Windows\system32\services.exe
18:32:58.0162 0x1f0c  [ Global ] - ok
18:32:58.0162 0x1f0c  ================ Scan MBR ==================================
18:32:58.0162 0x1f0c  [ 8E734BD7AA1D4F7E9AF58DF495F6CF9E ] \Device\Harddisk0\DR0
18:32:58.0232 0x1f0c  \Device\Harddisk0\DR0 - ok
18:32:58.0242 0x1f0c  [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk1\DR1
18:32:58.0352 0x1f0c  \Device\Harddisk1\DR1 - ok
18:32:58.0352 0x1f0c  ================ Scan VBR ==================================
18:32:58.0362 0x1f0c  [ 4F78D0B8415BA2308284B163147F339E ] \Device\Harddisk0\DR0\Partition1
18:32:58.0372 0x1f0c  \Device\Harddisk0\DR0\Partition1 - ok
18:32:58.0402 0x1f0c  [ 4111962119778EDE3CBA2F22A68F27A2 ] \Device\Harddisk0\DR0\Partition2
18:32:58.0422 0x1f0c  \Device\Harddisk0\DR0\Partition2 - ok
18:32:58.0432 0x1f0c  [ 00C06D6B469AEC6B4595F8B9FD8C1D3A ] \Device\Harddisk1\DR1\Partition1
18:32:58.0432 0x1f0c  \Device\Harddisk1\DR1\Partition1 - ok
18:32:58.0432 0x1f0c  ================ Scan generic autorun ======================
18:32:58.0562 0x1f0c  [ 7A727248EBC065BD2BB94A9B2892D190, B1E12ED3D07963EF0FA09B3ECD8AC3FBD316733D968A99C958DF7026B1BDFD99 ] c:\Program Files\Microsoft Security Client\msseces.exe
18:32:58.0612 0x1f0c  MSC - ok
18:32:58.0702 0x1f0c  [ 48515EEA1608ECD83FE26C7490460F59, C7C552D13ED12B4165FDE45F69E170D4F18B746D84B3B08E7254AAF8D9671D0C ] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe
18:32:58.0712 0x1f0c  AdobeAAMUpdater-1.0 - ok
18:32:58.0782 0x1f0c  [ 5B6E8E09BE6401A7E022F52FDFCB2FF8, 471C556CF9405BBB380A8CEFE945C126B954B7C94F79CC72441B51F80141FC5E ] C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
18:32:58.0802 0x1f0c  SunJavaUpdateSched - ok
18:32:59.0012 0x1f0c  [ E2CB8918F91D39E24C4A488ED9F22325, F674C9AEECC6D2553E952B4D51BECEA3B18FA5AB191276FCA8D0434015971F67 ] C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Acrotray.exe
18:32:59.0102 0x1f0c  Acrobat Assistant 8.0 - ok
18:32:59.0402 0x1f0c  [ A1F58FFF448E4099297D6EE0641D4D0E, 47839789332AAF8861F7731BF2D3FBB5E0991EA0D0B457BB4C8C1784F76C73DC ] C:\Users\user\AppData\Local\Dropbox\Update\DropboxUpdate.exe
18:32:59.0472 0x1f0c  Dropbox Update - ok
18:32:59.0622 0x1f0c  [ CC436BB2A26391F3DEBE316F6FB0474F, 2DA63827AD1449CA5F2888ADFA9645F1EAF8B39D26EC214441EE80F3A56E6E72 ] C:\Users\user\AppData\Local\Microsoft\BingSvc\BingSvc.exe
18:32:59.0652 0x1f0c  BingSvc - ok
18:33:00.0042 0x1f0c  [ 0C2D8CBA28E12D170FC5343F03E6D20C, 73A66AEF5D89E69E6B19172328AC043542FD7628DD44A569B23625261A0B56FB ] C:\Users\user\AppData\Roaming\Spotify\SpotifyWebHelper.exe
18:33:00.0082 0x1f0c  Spotify Web Helper - ok
18:33:00.0092 0x1f0c  Skype - ok
18:33:00.0142 0x1f0c  [ 1F963FAD87E58A1760B4902CB8F89079, F2FEE975FDBCD3CF910306EFAA115700C531825381CF969E14D1CD244CE1BAAF ] C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe
18:33:00.0182 0x1f0c  Adobe Acrobat Synchronizer - ok
18:33:00.0712 0x1f0c  [ C654101E928F9C1EC19A3C3AA78D4482, 925C51A2B1DD082EA5F7035CDAD481F6017DD943B005042703CCE1D5F9572AF2 ] C:\Users\user\AppData\Roaming\Spotify\Spotify.exe
18:33:00.0872 0x1f0c  Spotify - ok
18:33:00.0902 0x1f0c  Lync - ok
18:33:00.0952 0x1f0c  [ 7A727248EBC065BD2BB94A9B2892D190, B1E12ED3D07963EF0FA09B3ECD8AC3FBD316733D968A99C958DF7026B1BDFD99 ] C:\Program Files\Microsoft Security Client\msseces.exe
18:33:01.0012 0x1f0c  Application Restart #0 - ok
18:33:01.0022 0x1f0c  Application Restart #1 - ok
18:33:01.0022 0x1f0c  Waiting for KSN requests completion. In queue: 122
18:33:02.0034 0x1f0c  AV detected via SS2: Microsoft Security Essentials, C:\Program Files\Microsoft Security Client\msseces.exe ( 4.10.209.0 ), 0x61000 ( enabled : updated )
18:33:02.0034 0x1f0c  Win FW state via NFP2: disabled ( trusted )
18:33:02.0184 0x1f0c  ============================================================
18:33:02.0184 0x1f0c  Scan finished
18:33:02.0184 0x1f0c  ============================================================
18:33:02.0194 0x1a4c  Detected object count: 0
18:33:02.0194 0x1a4c  Actual detected object count: 0

Danke und viele Grüße
Dominik

M-K-D-B 20.01.2017 21:00
Servus,






Schritt 1
Downloade Dir bitte AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Werkzeuge > Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel
    • "Prefetch" Dateien
    • Proxy
    • Winsock
    • Internet Explorer Richtlinien
    • Chrome Richtlinien
    • Chrome Einstellungen
  • Bestätige die Auswahl mit Ok.
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen (auch dann wenn AdwCleaner sagt, dass nichts gefunden wurde) und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).





Schritt 2
  • Deinstalliere Malwarebytes' Anti-Malware 2 über die Systemsteuerung. (Bebilderte Anleitung)
  • Starte den Rechner im Anschluss neu auf.
  • Downloade dir den MBAM Uninstaller auf deinen Desktop.
  • Schließe alle offenen Programme und führe den Uninstaller aus. Der Rechner muss zum Abschluss neu gestartet werden.





Schritt 3
Downloade Dir bitte Malwarebytes Anti-Malware 3
  • Installiere das Programm in den vorgegebenen Pfad.
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scan, wähle den Bedrohungs-Scan aus und klicke auf Scan starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Ausgewählte Elemente in die Quarantäne verschieben.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM nach dem Neustart, klicke auf Berichte.
  • Wähle den neuesten Scan-Bericht aus, klicke auf Bericht anzeigen und dann auf Export.
  • Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.





Schritt 4

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.







Schritt 5
  • Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Scan.
  • FRST erstellt nun zwei Logdateien (FRST.txt und Addition.txt).
  • Poste mir beide Logdateien mit deiner nächsten Antwort.






Bitte poste mit deiner nächsten Antwort
  • die Logdatei von AdwCleaner,
  • die neue Logdatei von MBAM,
  • die Logdatei von JRT,
  • die beiden neuen Logdateien von FRST.

Dominik H. 22.01.2017 13:38
Danke.
Ich erstelle im Folgenden aufgrund der Codelänge mehrere Posts.

Rein aus Interesse am Rande:
Konnte man bereis durch die ersten FRSTLogs sehen, dass irgendetwas falsch ist.
Für mich sind die Codezeilen nur böhmische Dörfer.

Danke und Grüße
Dominik


Code:
# AdwCleaner v6.042 - Logfile created 22/01/2017 at 12:15:31
# Updated on 06/01/2017 by Malwarebytes
# Database : 2017-01-21.2 [Server]
# Operating System : Windows 7 Professional Service Pack 1 (X64)
# Username : user - USER-PC
# Running from : C:\Users\user\Desktop\AdwCleaner_6.042.exe
# Mode: Clean
# Support : https://www.malwarebytes.com/support



***** [ Services ] *****

[-] Service deleted: esgiguard


***** [ Folders ] *****

[-] Folder deleted: C:\Program Files\Enigma Software Group


***** [ Files ] *****



***** [ DLL ] *****



***** [ WMI ] *****



***** [ Shortcuts ] *****



***** [ Scheduled Tasks ] *****



***** [ Registry ] *****

[-] Key deleted: HKU\.DEFAULT\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
[-] Key deleted: HKU\S-1-5-19\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
[-] Key deleted: HKU\S-1-5-20\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
[#] Key deleted on reboot: HKU\S-1-5-18\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
[-] Key deleted: [x64] HKLM\SOFTWARE\EnigmaSoftwareGroup
[-] Value deleted: HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]
[#] Value deleted on reboot: [x64] HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]
[#] Value deleted on reboot: HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]
[#] Value deleted on reboot: [x64] HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]
[#] Value deleted on reboot: HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]
[#] Value deleted on reboot: [x64] HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]
[#] Value deleted on reboot: HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]
[#] Value deleted on reboot: [x64] HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]
[#] Value deleted on reboot: HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]
[#] Value deleted on reboot: [x64] HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]
[#] Value deleted on reboot: HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]
[#] Value deleted on reboot: [x64] HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]


***** [ Web browsers ] *****

[-] Chrome preferences cleaned: "browser.search.selectedEngine" -  "Yahoo Search!"
[-] Chrome preferences cleaned: "browser.search.selectedEngine" -  "Yahoo Search!"
[-] Chrome preferences cleaned: "browser.search.selectedEngine" -  "Yahoo Search!"
[-] Chrome preferences cleaned: "browser.search.selectedEngine" -  "Yahoo Search!"
[-] Chrome preferences cleaned: "browser.search.defaultenginename" -  "Yahoo Search!"


*************************

:: "Tracing" keys deleted
:: Winsock settings cleared
:: "Prefetch" files deleted
:: Proxy settings cleared
:: IE policies deleted
:: Chrome policies deleted
:: Chrome preferences reset: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [3251 Bytes] - [22/01/2017 12:15:31]
C:\AdwCleaner\AdwCleaner[R0].txt - [3461 Bytes] - [13/08/2015 17:49:23]
C:\AdwCleaner\AdwCleaner[S0].txt - [3339 Bytes] - [13/08/2015 17:50:05]
C:\AdwCleaner\AdwCleaner[S1].txt - [3698 Bytes] - [22/01/2017 12:12:45]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [3543 Bytes] ##########
Code:
Malwarebytes
www.malwarebytes.com

-Protokolldetails-
Scan-Datum: 22.01.17
Scan-Zeit: 12:44
Protokolldatei: mbam.txt
Administrator: Ja

-Softwaredaten-
Version: 3.0.5.1299
Komponentenversion: 1.0.43
Version des Aktualisierungspakets: 1.0.1073
Lizenz: Testversion

-Systemdaten-
Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: user-PC\user

-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Ergebnis: Abgeschlossen
Gescannte Objekte: 414236
Abgelaufene Zeit: 12 Min., 10 Sek.

-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

-Scan-Details-
Prozess: 0
(keine bösartigen Elemente erkannt)

Modul: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 7
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{D7720535-EFDF-47DC-A3BF-31AABE0F3223}, In Quarantäne, [71], [169169],1.0.1073
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\{D7720535-EFDF-47DC-A3BF-31AABE0F3223}, In Quarantäne, [71], [169169],1.0.1073
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\APPID\{d7720535-efdf-47dc-a3bf-31aabe0f3223}, In Quarantäne, [71], [169169],1.0.1073
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\APPID\{ABE3B32B-B9F8-4D33-A7C4-4D73E3BF60EC}, In Quarantäne, [71], [169168],1.0.1073
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\{ABE3B32B-B9F8-4D33-A7C4-4D73E3BF60EC}, In Quarantäne, [71], [169168],1.0.1073
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{abe3b32b-b9f8-4d33-a7c4-4d73e3bf60ec}, In Quarantäne, [71], [169168],1.0.1073
PUP.Optional.Hicosmea, HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\SOFTWARE\toralsup, In Quarantäne, [1283], [245427],1.0.1073

Registrierungswert: 0
(keine bösartigen Elemente erkannt)

Daten-Stream: 0
(keine bösartigen Elemente erkannt)

Ordner: 46
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\es_419, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\en_GB, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\zh_CN, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\pt_PT, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\pt_BR, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\zh_TW, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\fil, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\ca, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\cs, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\da, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\de, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\el, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\en, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\es, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\et, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\fi, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\fr, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\hi, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\hr, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\hu, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\id, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\it, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\ja, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\ko, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\lt, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\lv, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\nb, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\nl, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\pl, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\ro, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\ru, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\sk, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\sl, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\sr, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\sv, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\th, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\tr, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\uk, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\vi, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\bg, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\images, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\html, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\css, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\USERS\USER\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\NMMHKKEGCCAGDLDGIIMEDPICCMGMIEDA, In Quarantäne, [19646], [302160],1.0.1073

Datei: 54
PUP.Optional.HijackModifiedExtension, C:\USERS\USER\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\NMMHKKEGCCAGDLDGIIMEDPICCMGMIEDA\0.0.6.0_0\MANIFEST.JSON, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\css\craw_window.css, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\css\craw_window.css~, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\html\craw_window.html, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\images\flapper.gif, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\images\icon_128.png, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\images\icon_16.png, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\images\topbar_floating_button.png, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\images\topbar_floating_button_close.png, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\images\topbar_floating_button_hover.png, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\images\topbar_floating_button_maximize.png, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\images\topbar_floating_button_pressed.png, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\bg\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\ca\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\cs\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\da\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\de\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\el\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\en\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\en_GB\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\es\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\es_419\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\et\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\fi\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\fil\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\fr\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\hi\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\hr\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\hu\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\id\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\it\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\ja\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\ko\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\lt\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\lv\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\nb\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\nl\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\pl\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\pt_BR\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\pt_PT\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\ro\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\ru\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\sk\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\sl\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\sr\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\sv\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\th\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\tr\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\uk\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\vi\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\zh_CN\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\_locales\zh_TW\messages.json, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\craw_background.js, In Quarantäne, [19646], [302160],1.0.1073
PUP.Optional.HijackModifiedExtension, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\craw_window.js, In Quarantäne, [19646], [302160],1.0.1073

Physischer Sektor: 0
(keine bösartigen Elemente erkannt)


(end)
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.0 (12.05.2016)
Operating System: Windows 7 Professional x64
Ran by user (Administrator) on 22.01.2017 at 13:14:50,02
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 59

Failed to delete: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\extensions\groovesharkUnlocker@overlord1337.xpi (File)
Failed to delete: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\user.js (File)
Failed to delete: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\INNTKSI9 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\extensions\bingsearch.full@microsoft.com\search.xml (File)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\24O9Z36K (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5QPAPRXB (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\63WSBFYN (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\939GYH0Y (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A3A12FRA (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AFO00TKG (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BF73K68Z (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DPW7JJV7 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E216LPWA (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F3KU1NFO (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FDW0453G (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FW0VAWCU (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IPUDJNDT (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J087GJLU (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KCDUW97H (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KSK95R88 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KUQBWVZP (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L97N3ZX3 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LIXMVQOA (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PHLY4537 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RXFVJ4JN (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TQVC4TSP (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U40LOVSC (Temporary Internet Files Folder)
Successfully deleted: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZLU18FBS (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\24O9Z36K (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5QPAPRXB (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\63WSBFYN (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\939GYH0Y (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A3A12FRA (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AFO00TKG (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BF73K68Z (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DPW7JJV7 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E216LPWA (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F3KU1NFO (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FDW0453G (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FW0VAWCU (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\INNTKSI9 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IPUDJNDT (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J087GJLU (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KCDUW97H (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KSK95R88 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KUQBWVZP (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L97N3ZX3 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LIXMVQOA (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PHLY4537 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RXFVJ4JN (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TQVC4TSP (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U40LOVSC (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZLU18FBS (Temporary Internet Files Folder)



Registry: 0





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 22.01.2017 at 13:20:13,83
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 22-01-2017
Ran by user (administrator) on USER-PC (22-01-2017 13:29:51)
Running from C:\Users\user\Desktop
Loaded Profiles: user (Available Profiles: user & Guest)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler64.exe
() C:\Program Files\Cold Turkey\CTService.exe
() C:\Program Files\Cold Turkey\CTConfigServer.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Cisco Systems, Inc.) C:\Dominik\Programme\ciscoclient\cvpnd.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
() C:\Program Files (x86)\XSManager\WTGService.exe
() C:\ProgramData\ZDSupport\ZDServ\ZDServ.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1353680 2016-11-14] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-07-01] (Adobe Systems Incorporated)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2776528 2016-12-14] (Malwarebytes)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Acrotray.exe [1870928 2016-12-23] (Adobe Systems Inc.)
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Run: [Dropbox Update] => C:\Users\user\AppData\Local\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-05] (Dropbox, Inc.)
HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Run: [BingSvc] => C:\Users\user\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-17] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Run: [Spotify Web Helper] => C:\Users\user\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1444976 2016-12-25] (Spotify Ltd)
HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [50605696 2016-02-02] (Skype Technologies S.A.)
HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Run: [Adobe Acrobat Synchronizer] => C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe [886352 2016-12-23] (Adobe Systems Incorporated)
HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Run: [Spotify] => C:\Users\user\AppData\Roaming\Spotify\Spotify.exe [7153264 2016-12-25] (Spotify Ltd)
ShellIconOverlayIdentifiers: [  DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.8.0.dll [2017-01-06] (Dropbox, Inc.)
Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2017-01-13]
ShortcutTarget: Dropbox.lnk -> C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{E1796407-EE12-4BF9-A2CF-56DFA7F556C0}: [DhcpNameServer] 192.168.0.1 192.168.0.1
Tcpip\..\Interfaces\{F803A312-9FB2-4B80-830E-D0882C84BC70}: [DhcpNameServer] 192.168.178.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000 -> OldSearch URL = hxxp://www.bing.com/search?FORM=SK2MDF&PC=SK2M&q={searchTerms}&src=IE-SearchBox
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2016-12-28] (Microsoft Corporation)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\URLREDIR.DLL [2016-12-28] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2016-12-28] (Microsoft Corporation)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2016-12-28] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-01-26] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\URLREDIR.DLL [2016-12-28] (Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2016-12-28] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-01-26] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

FireFox:
========
FF DefaultProfile: 2dz2xpoy.default-1414599074507
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\g2mr5o1m.default-1413196550790 [2015-08-13]
FF Homepage: Mozilla\Firefox\Profiles\g2mr5o1m.default-1413196550790 -> hxxps://www.malwarebytes.org/restorebrowser/-bfr-sm-rhb-30__alt__ddc_dsssyc_bd_com
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507 [2017-01-22]
FF user.js: detected! => C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\user.js [2016-03-04]
FF Extension: (Flash Video Downloader - YouTube HD Download [4K]) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\artur.dubovoy@gmail.com [2017-01-07]
FF Extension: (Bing Search Engine) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\bingsearch.full@microsoft.com [2017-01-22] [not signed]
FF Extension: (Grooveshark Unlocker) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\groovesharkUnlocker@overlord1337.xpi [2016-05-01]
FF Extension: (ProxTube) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\ich@maltegoetz.de.xpi [2016-10-18]
FF Extension: (1-Click YouTube Video Downloader) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\YoutubeDownloader@PeterOlayev.com.xpi [2016-08-25]
FF Extension: (EPUBReader) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F} [2017-01-18]
FF Extension: (hd shield) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\{aa991923-b0b8-4938-b763-2aacc9c6992f}.xpi [2015-12-19] [not signed]
FF Extension: (Adblock Plus) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-24]
FF Extension: (DivX Wizard) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\{e93aa736-6c93-453a-a708-2fd62fbd573e}.xpi [2016-05-25] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension.15@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn
FF Extension: (Adobe Acrobat DC - Create PDF) - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn [2017-01-13]
FF HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\hxod2v34.default-1408804336995\extensions\cliqz@cliqz.com => not found
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-19] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2015-07-29] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-19] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2016-10-06] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-01-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-01-26] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-12-28] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-12-28] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2013-11-11] (VideoLAN)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-12-21] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2015-07-29] (Adobe Systems)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)

Chrome:
=======
CHR DefaultProfile: Default
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2207960 2016-09-26] (Adobe Systems, Incorporated)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [3699904 2016-12-28] (Microsoft Corporation)
R2 CTService; C:\Program Files\Cold Turkey\CTService.exe [62976 2013-12-08] () [File not signed]
R2 CVPND; C:\Dominik\Programme\ciscoclient\cvpnd.exe [1529856 2011-03-04] (Cisco Systems, Inc.)
S2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [351824 2014-01-15] ()
S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4317648 2016-12-14] (Malwarebytes)
S2 Mobile Partner. RunOuc; C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [651856 2014-12-02] ()
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [7500048 2016-09-20] (TeamViewer GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WTGService; C:\Program Files (x86)\XSManager\WTGService.exe [329848 2013-05-06] ()
R2 ZDServ; C:\ProgramData\ZDSupport\ZDServ\ZDServ.exe [427264 2014-07-07] ()

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 atmeltpm; C:\Windows\System32\DRIVERS\atmeltpm64.sys [19456 2011-08-05] (Atmel, Inc.)
S3 cmnsusbser; C:\Windows\System32\DRIVERS\cmnsusbser.sys [126080 2015-03-12] (QUALCOMM Incorporated)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
S3 hwusb_cdcacm; C:\Windows\System32\DRIVERS\ew_cdcacm.sys [125952 2014-07-25] (Huawei Technologies Co., Ltd.)
S3 hwusb_wwanecm; C:\Windows\System32\DRIVERS\ew_wwanecm.sys [380672 2014-09-30] (Huawei Technologies Co., Ltd.)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-31] (Intel Corporation)
S3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv.sys [49304 2014-12-29] (Visicom Media Inc.)
S3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [35992 2014-12-29] (Visicom Media Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation)
S3 TPPWRIF; C:\Dominik\Programme\Lenovo Battery Utility 2014\TPPWR64V.sys [20736 2014-03-05] (Lenovo Group Limited)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-22 13:29 - 2017-01-22 13:29 - 02420736 _____ (Farbar) C:\Users\user\Desktop\FRST64.exe
2017-01-22 13:29 - 2017-01-22 13:29 - 00000000 ____D C:\Users\user\Desktop\FRST-OlderVersion
2017-01-22 13:20 - 2017-01-22 13:20 - 00010157 _____ C:\Users\user\Desktop\JRT.txt
2017-01-22 13:11 - 2017-01-22 13:11 - 01663040 _____ (Malwarebytes) C:\Users\user\Desktop\JRT.exe
2017-01-22 13:10 - 2017-01-22 13:10 - 00023678 _____ C:\Users\user\Desktop\mbam.txt
2017-01-22 12:38 - 2017-01-22 13:06 - 00102856 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2017-01-22 12:38 - 2017-01-22 13:06 - 00081696 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2017-01-22 12:38 - 2017-01-22 13:05 - 00250816 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-01-22 12:38 - 2017-01-22 13:05 - 00043968 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-01-22 12:38 - 2017-01-22 12:38 - 00176064 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys
2017-01-22 12:37 - 2017-01-22 12:37 - 00001867 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-01-22 12:37 - 2017-01-22 12:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-01-22 12:37 - 2017-01-22 12:37 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-01-22 12:37 - 2017-01-22 12:37 - 00000000 ____D C:\Program Files\Malwarebytes
2017-01-22 12:37 - 2016-12-14 12:55 - 00077416 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-01-22 12:36 - 2017-01-22 12:36 - 54199488 _____ (Malwarebytes ) C:\Users\user\Downloads\mb3-setup-consumer-3.0.5.1299.exe
2017-01-22 12:25 - 2017-01-22 12:26 - 00566128 _____ (Malwarebytes) C:\Users\user\Desktop\mbam-clean-2.3.0.1001.exe
2017-01-22 12:19 - 2017-01-22 12:19 - 00003650 _____ C:\Users\user\Desktop\AdwCleaner[C0].txt
2017-01-22 12:08 - 2017-01-22 12:09 - 03988944 _____ C:\Users\user\Desktop\AdwCleaner_6.042.exe
2017-01-20 18:31 - 2017-01-22 12:09 - 00214208 _____ C:\TDSSKiller.3.1.0.12_20.01.2017_18.31.54_log.txt
2017-01-20 17:57 - 2017-01-20 18:30 - 00214206 _____ C:\TDSSKiller.3.1.0.12_20.01.2017_17.57.44_log.txt
2017-01-20 17:57 - 2017-01-20 17:57 - 04747704 _____ (AO Kaspersky Lab) C:\Users\user\Desktop\tdsskiller.exe
2017-01-20 17:52 - 2017-01-20 17:53 - 00052246 _____ C:\Users\user\Desktop\Addition.txt
2017-01-20 17:51 - 2017-01-22 13:30 - 00024174 _____ C:\Users\user\Desktop\FRST.txt
2017-01-17 16:26 - 2017-01-19 07:30 - 56355840 _____ C:\Users\user\Desktop\Lüneburg.ppt
2017-01-15 20:59 - 2017-01-15 20:59 - 00000040 ____H C:\6A4F84AA7F7F
2017-01-13 10:28 - 2017-01-13 10:28 - 00000000 ____D C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2017-01-11 21:34 - 2017-01-05 19:55 - 00154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2017-01-11 21:34 - 2017-01-05 19:55 - 00095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2017-01-11 21:34 - 2017-01-05 19:52 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00730624 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2017-01-11 21:34 - 2017-01-05 18:42 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2017-01-11 21:34 - 2017-01-05 18:32 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2017-01-11 21:34 - 2017-01-05 18:25 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-01-11 21:34 - 2017-01-05 18:24 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-01-11 21:34 - 2017-01-05 18:24 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-01-11 21:34 - 2017-01-05 18:24 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2017-01-11 21:34 - 2017-01-05 18:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2017-01-11 21:34 - 2017-01-05 18:19 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2017-01-08 02:10 - 2016-11-21 19:12 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\hlink.dll
2017-01-08 02:10 - 2016-11-20 17:19 - 00084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hlink.dll
2017-01-08 02:10 - 2016-11-20 15:07 - 00467392 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2017-01-08 02:10 - 2016-11-17 17:41 - 00370920 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2017-01-08 02:10 - 2016-11-15 00:27 - 00394448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-01-08 02:10 - 2016-11-14 23:39 - 00346320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2017-01-08 02:10 - 2016-11-12 20:48 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2017-01-08 02:10 - 2016-11-12 20:48 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2017-01-08 02:10 - 2016-11-12 20:28 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2017-01-08 02:10 - 2016-11-12 20:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2017-01-08 02:10 - 2016-11-12 20:26 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2017-01-08 02:10 - 2016-11-12 20:25 - 00576000 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-01-08 02:10 - 2016-11-12 20:25 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-01-08 02:10 - 2016-11-12 20:21 - 02896384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-01-08 02:10 - 2016-11-12 20:15 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2017-01-08 02:10 - 2016-11-12 20:14 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2017-01-08 02:10 - 2016-11-12 20:09 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2017-01-08 02:10 - 2016-11-12 20:08 - 25759744 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-01-08 02:10 - 2016-11-12 20:08 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2017-01-08 02:10 - 2016-11-12 20:08 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2017-01-08 02:10 - 2016-11-12 20:07 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-01-08 02:10 - 2016-11-12 20:07 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2017-01-08 02:10 - 2016-11-12 19:56 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2017-01-08 02:10 - 2016-11-12 19:53 - 06049280 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-01-08 02:10 - 2016-11-12 19:52 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2017-01-08 02:10 - 2016-11-12 19:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2017-01-08 02:10 - 2016-11-12 19:41 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-01-08 02:10 - 2016-11-12 19:40 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2017-01-08 02:10 - 2016-11-12 19:35 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2017-01-08 02:10 - 2016-11-12 19:34 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-01-08 02:10 - 2016-11-12 19:31 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-01-08 02:10 - 2016-11-12 19:30 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2017-01-08 02:10 - 2016-11-12 19:29 - 00498688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2017-01-08 02:10 - 2016-11-12 19:29 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2017-01-08 02:10 - 2016-11-12 19:29 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2017-01-08 02:10 - 2016-11-12 19:28 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2017-01-08 02:10 - 2016-11-12 19:27 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2017-01-08 02:10 - 2016-11-12 19:20 - 02287616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2017-01-08 02:10 - 2016-11-12 19:20 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2017-01-08 02:10 - 2016-11-12 19:19 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2017-01-08 02:10 - 2016-11-12 19:17 - 20302848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-01-08 02:10 - 2016-11-12 19:15 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2017-01-08 02:10 - 2016-11-12 19:14 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2017-01-08 02:10 - 2016-11-12 19:14 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2017-01-08 02:10 - 2016-11-12 19:14 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-01-08 02:10 - 2016-11-12 19:14 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2017-01-08 02:10 - 2016-11-12 19:11 - 00725504 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-01-08 02:10 - 2016-11-12 19:10 - 00806912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-01-08 02:10 - 2016-11-12 19:08 - 02131456 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-01-08 02:10 - 2016-11-12 19:08 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2017-01-08 02:10 - 2016-11-12 19:03 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2017-01-08 02:10 - 2016-11-12 18:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2017-01-08 02:10 - 2016-11-12 18:56 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2017-01-08 02:10 - 2016-11-12 18:52 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2017-01-08 02:10 - 2016-11-12 18:51 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2017-01-08 02:10 - 2016-11-12 18:49 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2017-01-08 02:10 - 2016-11-12 18:47 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2017-01-08 02:10 - 2016-11-12 18:41 - 15257088 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-01-08 02:10 - 2016-11-12 18:40 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2017-01-08 02:10 - 2016-11-12 18:38 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2017-01-08 02:10 - 2016-11-12 18:37 - 04608000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-01-08 02:10 - 2016-11-12 18:36 - 02055680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2017-01-08 02:10 - 2016-11-12 18:36 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2017-01-08 02:10 - 2016-11-12 18:35 - 02920960 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-01-08 02:10 - 2016-11-12 18:21 - 13653504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-01-08 02:10 - 2016-11-12 18:20 - 01543680 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-01-08 02:10 - 2016-11-12 18:11 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-01-08 02:10 - 2016-11-12 18:05 - 02444800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-01-08 02:10 - 2016-11-12 18:02 - 01312256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-01-08 02:10 - 2016-11-12 18:02 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2017-01-08 02:10 - 2016-11-10 17:32 - 01009152 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2017-01-08 02:10 - 2016-11-10 17:19 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2017-01-08 02:10 - 2016-11-09 17:41 - 00114408 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2017-01-08 02:10 - 2016-11-09 17:33 - 03244032 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2017-01-08 02:10 - 2016-11-09 17:33 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2017-01-08 02:10 - 2016-11-09 17:33 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2017-01-08 02:10 - 2016-11-09 17:33 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2017-01-08 02:10 - 2016-11-09 17:33 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2017-01-08 02:10 - 2016-11-09 17:33 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2017-01-08 02:10 - 2016-11-09 17:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2017-01-08 02:10 - 2016-11-09 17:17 - 01806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2017-01-08 02:10 - 2016-11-09 17:17 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2017-01-08 02:10 - 2016-11-09 17:17 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2017-01-08 02:10 - 2016-11-09 17:17 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2017-01-08 02:10 - 2016-11-09 17:02 - 00128512 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2017-01-08 02:10 - 2016-11-09 16:55 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2017-01-08 02:10 - 2016-11-06 17:33 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2017-01-08 02:10 - 2016-11-06 17:16 - 00312832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2017-01-08 02:10 - 2016-11-06 17:01 - 03219456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-01-08 02:10 - 2016-10-27 16:33 - 00802304 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2017-01-08 02:10 - 2016-10-27 16:20 - 00627712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2017-01-08 02:10 - 2016-10-11 16:40 - 00631176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2017-01-08 02:10 - 2016-10-11 16:37 - 05547752 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-01-08 02:10 - 2016-10-11 16:37 - 00706792 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2017-01-08 02:10 - 2016-10-11 16:34 - 01732864 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\nlsbres.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:24 - 04000488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2017-01-08 02:10 - 2016-10-11 16:24 - 03944680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2017-01-08 02:10 - 2016-10-11 16:21 - 01314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlsbres.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:03 - 00148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2017-01-08 02:10 - 2016-10-11 16:03 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2017-01-08 02:10 - 2016-10-11 16:03 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2017-01-08 02:10 - 2016-10-11 15:59 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2017-01-08 02:10 - 2016-10-11 15:59 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2017-01-08 02:10 - 2016-10-11 15:55 - 00346112 _____ (Microsoft Corporation) C:\Windows\system32\bcdedit.exe
2017-01-08 02:10 - 2016-10-11 15:55 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2017-01-08 02:10 - 2016-10-11 15:51 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2017-01-08 02:10 - 2016-10-11 15:51 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2017-01-08 02:10 - 2016-10-11 15:51 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2017-01-08 02:10 - 2016-10-11 15:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2017-01-08 02:10 - 2016-10-11 15:50 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 15:50 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 15:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 15:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 14:18 - 00419648 _____ C:\Windows\SysWOW64\locale.nls
2017-01-08 02:10 - 2016-10-11 14:17 - 00419648 _____ C:\Windows\system32\locale.nls
2017-01-08 02:10 - 2016-10-08 14:06 - 00633296 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2017-01-08 02:10 - 2016-10-04 16:31 - 01483264 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2017-01-08 02:10 - 2016-10-04 16:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2017-01-08 02:10 - 2016-10-04 16:31 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2017-01-08 02:10 - 2016-10-04 16:31 - 00141824 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2017-01-08 02:10 - 2016-10-04 16:13 - 01176064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2017-01-08 02:10 - 2016-10-04 16:13 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2017-01-08 02:10 - 2016-10-04 16:13 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2017-01-08 02:10 - 2016-10-04 16:13 - 00106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2016-12-31 16:54 - 2016-12-31 16:54 - 00002423 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access 2016.lnk
2016-12-28 15:02 - 2016-11-02 16:36 - 00382696 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2016-12-28 15:02 - 2016-11-02 16:22 - 00308456 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2016-12-28 15:02 - 2016-10-15 16:31 - 00976896 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2016-12-28 15:02 - 2016-10-15 16:13 - 00741888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2016-12-28 15:02 - 2016-10-11 16:31 - 01148416 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10.IME
2016-12-28 15:02 - 2016-10-11 16:31 - 01068544 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2016-12-28 15:02 - 2016-10-11 16:31 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2016-12-28 15:02 - 2016-10-11 16:31 - 00457216 _____ (Microsoft Corporation) C:\Windows\system32\imkr80.ime
2016-12-28 15:02 - 2016-10-11 16:31 - 00246784 _____ (Microsoft Corporation) C:\Windows\system32\input.dll
2016-12-28 15:02 - 2016-10-11 16:31 - 00176128 _____ (Microsoft Corporation) C:\Windows\system32\tintlgnt.ime
2016-12-28 15:02 - 2016-10-11 16:31 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\quick.ime
2016-12-28 15:02 - 2016-10-11 16:31 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\qintlgnt.ime
2016-12-28 15:02 - 2016-10-11 16:31 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\phon.ime
2016-12-28 15:02 - 2016-10-11 16:31 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\cintlgnt.ime
2016-12-28 15:02 - 2016-10-11 16:31 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\chajei.ime
2016-12-28 15:02 - 2016-10-11 16:31 - 00132608 _____ (Microsoft Corporation) C:\Windows\system32\pintlgnt.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 01027584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10.IME
2016-12-28 15:02 - 2016-10-11 16:18 - 00829952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2016-12-28 15:02 - 2016-10-11 16:18 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL
2016-12-28 15:02 - 2016-10-11 16:18 - 00430080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imkr80.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 00202240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\input.dll
2016-12-28 15:02 - 2016-10-11 16:18 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tintlgnt.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quick.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qintlgnt.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\phon.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cintlgnt.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\chajei.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 00090112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pintlgnt.ime
2016-12-28 15:02 - 2016-10-11 14:33 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2016-12-28 15:02 - 2016-10-11 14:06 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2016-12-28 15:02 - 2016-10-07 16:32 - 03649536 _____ (Microsoft Corporation) C:\Windows\system32\MSVidCtl.dll
2016-12-28 15:02 - 2016-10-07 16:32 - 00877056 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2016-12-28 15:02 - 2016-10-07 16:32 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2016-12-28 15:02 - 2016-10-07 16:12 - 02291712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVidCtl.dll
2016-12-28 15:02 - 2016-10-07 16:12 - 00581632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2016-12-28 15:02 - 2016-10-07 16:12 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\asycfilt.dll
2016-12-28 15:02 - 2016-10-05 15:54 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bowser.sys
2016-12-28 15:02 - 2016-09-15 15:56 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2016-12-28 15:02 - 2016-09-09 19:20 - 00756736 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2016-12-28 15:02 - 2016-09-09 19:00 - 00497152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2016-12-28 15:02 - 2016-08-22 17:19 - 01386496 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2016-12-28 15:01 - 2016-11-02 16:32 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2016-12-28 15:01 - 2016-11-02 16:32 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2016-12-28 15:01 - 2016-11-02 16:32 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2016-12-28 15:01 - 2016-11-02 16:32 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2016-12-28 15:01 - 2016-11-02 16:16 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2016-12-28 15:01 - 2016-11-02 16:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2016-12-28 15:01 - 2016-11-02 16:16 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2016-12-28 15:01 - 2016-11-02 15:53 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2016-12-28 15:01 - 2016-10-15 16:31 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll
2016-12-28 15:01 - 2016-10-15 16:13 - 00084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\INETRES.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-22 13:29 - 2014-08-20 11:40 - 00000000 ____D C:\FRST
2017-01-22 13:23 - 2015-06-20 10:07 - 00001220 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3705937506-1407253618-1579061599-1000UA.job
2017-01-22 13:19 - 2016-01-12 20:23 - 00002453 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat DC.lnk
2017-01-22 13:16 - 2016-08-12 20:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-01-22 13:13 - 2016-10-12 19:58 - 00000000 ____D C:\Users\Public\Documents\AdobeGC
2017-01-22 13:12 - 2009-07-14 05:45 - 00022080 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-01-22 13:12 - 2009-07-14 05:45 - 00022080 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-01-22 13:09 - 2009-07-14 06:13 - 00797422 _____ C:\Windows\system32\PerfStringBackup.INI
2017-01-22 13:09 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2017-01-22 13:05 - 2015-09-18 21:50 - 00000000 ____D C:\Users\user\AppData\Local\Spotify
2017-01-22 13:05 - 2015-09-18 21:49 - 00000000 ____D C:\Users\user\AppData\Roaming\Spotify
2017-01-22 13:05 - 2014-04-10 10:59 - 00000000 ___RD C:\Users\user\Dropbox
2017-01-22 13:04 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-01-22 12:33 - 2014-01-15 19:26 - 00000000 ____D C:\Users\user\AppData\Roaming\Skype
2017-01-22 12:15 - 2015-08-13 17:49 - 00000000 ____D C:\AdwCleaner
2017-01-22 11:55 - 2015-06-20 10:07 - 00001168 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3705937506-1407253618-1579061599-1000Core.job
2017-01-20 18:25 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2017-01-19 19:41 - 2014-08-05 22:41 - 00811108 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2017-01-19 12:07 - 2016-05-26 18:16 - 00003844 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1464282961
2017-01-19 12:07 - 2016-05-26 18:15 - 00000000 ____D C:\Program Files (x86)\Opera
2017-01-19 08:35 - 2014-01-18 08:16 - 00000000 ____D C:\Users\user\AppData\Roaming\vlc
2017-01-15 20:59 - 2013-12-08 03:14 - 00000000 ____D C:\Users\user\AppData\Roaming\Adobe
2017-01-14 20:45 - 2016-02-03 21:56 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-01-14 20:41 - 2016-02-03 21:53 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2017-01-14 12:09 - 2013-12-08 02:11 - 00000000 ____D C:\Windows\system32\MRT
2017-01-14 12:05 - 2013-12-08 02:11 - 135657872 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-01-13 13:18 - 2016-01-12 20:23 - 00002037 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller DC.lnk
2017-01-13 10:29 - 2014-04-10 10:55 - 00000000 ____D C:\Users\user\AppData\Roaming\Dropbox
2017-01-13 10:24 - 2014-12-25 13:21 - 00004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2017-01-08 11:39 - 2009-07-14 05:45 - 00455784 _____ C:\Windows\system32\FNTCACHE.DAT
2017-01-08 11:14 - 2016-09-17 11:44 - 02697708 ____H C:\Users\user\AppData\Local\IconCache.db.backup
2016-12-29 10:07 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\catroot
2016-12-29 10:06 - 2009-07-14 04:20 - 00000000 ___SD C:\ProgramData\Microsoft
2016-12-29 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\migration
2016-12-29 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\migration
2016-12-29 09:44 - 2013-12-08 01:44 - 00002117 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2016-12-29 09:44 - 2013-12-08 01:44 - 00001945 _____ C:\Windows\epplauncher.mif
2016-12-29 09:44 - 2013-12-08 01:44 - 00000000 ____D C:\Program Files\Microsoft Security Client
2016-12-29 09:44 - 2013-12-08 01:44 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2016-12-26 23:05 - 2016-08-12 14:31 - 00000000 ____D C:\Users\Guest\AppData\Local

==================== Files in the root of some directories =======

2015-05-01 20:23 - 2015-05-01 20:23 - 1065984 _____ () C:\Users\user\AppData\Local\file__0.localstorage
2014-01-27 16:16 - 2014-01-27 16:16 - 0000337 _____ () C:\Users\user\AppData\Local\Perfmon.PerfmonCfg

Some files in TEMP:
====================
2015-11-17 12:32 - 2015-11-17 12:32 - 0144008 _____ (© 2015 Microsoft Corporation) C:\Users\user\AppData\Local\Temp\BingSvc.exe
2015-11-17 12:32 - 2015-11-17 12:32 - 1118360 _____ (© 2015 Microsoft Corporation) C:\Users\user\AppData\Local\Temp\BSvcProcessor.exe
2015-11-17 12:32 - 2015-11-17 12:32 - 0170128 _____ (© 2015 Microsoft Corporation) C:\Users\user\AppData\Local\Temp\BSvcUpdater.exe
2015-12-11 07:48 - 2015-12-11 07:48 - 0071168 _____ () C:\Users\user\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpw06rfy.dll
2015-12-23 19:48 - 2015-12-23 19:48 - 0644704 _____ (Oracle Corporation) C:\Users\user\AppData\Local\Temp\jre-8u71-windows-au.exe
2016-01-30 09:10 - 2016-01-30 09:10 - 0736352 _____ (Oracle Corporation) C:\Users\user\AppData\Local\Temp\jre-8u73-windows-au.exe
2016-03-21 16:12 - 2016-03-21 16:12 - 0736320 _____ (Oracle Corporation) C:\Users\user\AppData\Local\Temp\jre-8u77-windows-au.exe
2016-06-21 19:15 - 2016-06-21 19:15 - 0739904 _____ (Oracle Corporation) C:\Users\user\AppData\Local\Temp\jre-8u91-windows-au.exe
2016-11-06 18:45 - 2016-11-06 18:45 - 7071976 _____ () C:\Users\user\AppData\Local\Temp\paint.net.4.0.12.install.exe
2014-11-08 09:33 - 2015-06-21 18:56 - 0610816 _____ () C:\Users\user\AppData\Local\Temp\Quarantine.exe
2016-02-12 22:29 - 2017-01-18 20:20 - 43918808 _____ (Skype Technologies S.A.) C:\Users\user\AppData\Local\Temp\SkypeSetup.exe
2014-11-08 09:47 - 2014-10-17 12:39 - 0665682 _____ (SQLite Development Team) C:\Users\user\AppData\Local\Temp\sqlite3.dll
2016-08-20 07:38 - 2016-08-20 07:38 - 0000000 _____ () C:\Users\user\AppData\Local\Temp\{4E3E1B2F-8D98-4B99-9943-E2CB10FCF609}-GoogleEarth-Win-Bundle-7.1.5.1557.exe
2016-08-20 07:38 - 2016-08-20 07:38 - 0000000 _____ () C:\Users\user\AppData\Local\Temp\{B632A662-D740-4473-9477-5A7CE5F27ED7}-DropboxClient_8.4.19.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-01-20 17:36

==================== End of FRST.txt ============================
--- --- ---

--- --- ---

--- --- ---

Dominik H. 22.01.2017 13:39
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-01-2017
Ran by user (22-01-2017 13:31:02)
Running from C:\Users\user\Desktop
Windows 7 Professional Service Pack 1 (X64) (2013-12-08 00:14:01)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3705937506-1407253618-1579061599-500 - Administrator - Disabled)
Guest (S-1-5-21-3705937506-1407253618-1579061599-501 - Limited - Enabled) => C:\Users\Guest
HomeGroupUser$ (S-1-5-21-3705937506-1407253618-1579061599-1002 - Limited - Enabled)
user (S-1-5-21-3705937506-1407253618-1579061599-1000 - Administrator - Enabled) => C:\Users\user

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {71A27EC9-3DA6-45FC-60A7-004F623C6189}
AS: Microsoft Security Essentials (Enabled - Up to date) {CAC39F2D-1B9C-4A72-5A17-3B3D19BB2B34}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

1&1 Surf-Stick (HKLM-x32\...\{7438DA7D-782C-450F-BCDC-5FC54E6831B8}) (Version: 1.0.0.2 - ZTE Corporation)
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
Adobe Acrobat DC (HKLM-x32\...\{AC76BA86-1033-FFFF-7760-0C0F074E4100}) (Version: 15.023.20056 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 21 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 21.0.0.242 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 5.4 64-bit (HKLM\...\{558B5965-CC1B-4AF1-BA07-5D6832404050}) (Version: 5.4.0 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
CDisplayEx 1.10.18 (HKLM-x32\...\CDisplayEx_is1) (Version:  - cdisplayex.com)
Cisco Systems VPN Client 5.0.07.0440 (HKLM\...\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}) (Version: 5.0.7 - Cisco Systems, Inc.)
Cliqz (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.22 - Cliqz.com)
Clonk Planet (HKLM-x32\...\Clonk Planet) (Version: 4.65 - RedWolf Design)
Cold Turkey version 0.9 (HKLM\...\{6498E673-B9C2-4544-A722-1E854B5B573E}_is1) (Version: 0.9 - Felix Belzile)
Command & Conquer Tiberian Sun (HKLM-x32\...\{52F25D7D-DEE1-42E7-AB48-D0F014E1F795}_is1) (Version:  - Command & Conquer Communications Center)
Conexant 20585 SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.95.49.53 - Conexant)
Dia (nur entfernen) (HKLM-x32\...\Dia) (Version:  - )
Dota 2 (HKLM-x32\...\Steam App 570) (Version:  - Valve)
Dropbox (HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Dropbox) (Version: 17.4.33 - Dropbox, Inc.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Exact Audio Copy 1.0beta3 (HKLM-x32\...\Exact Audio Copy) (Version: 1.0beta3 - Andre Wiethoff)
Free YouTube to MP3 Converter version 3.12.42.716 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.42.716 - DVDVideoSoft Ltd.)
Futuremark SystemInfo (HKLM-x32\...\{BEE64C14-BEF1-4610-8A68-A16EAA47B882}) (Version: 4.15.0 - Futuremark Corporation)
Google Earth (HKLM-x32\...\{A0C18B96-AB79-46BD-8321-6FA83E6D25B9}) (Version: 7.1.7.2606 - Google)
Google Earth Pro (HKLM-x32\...\{44FC61F0-2F8A-11E3-8CAE-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
GPL Ghostscript 8.71 (HKLM\...\GPL Ghostscript 8.71) (Version:  - )
GSview 5.0 (HKLM\...\GSview 5.0) (Version: 5.0 - Ghostgum Software Pty Ltd)
Half-Life 2: Demo (HKLM-x32\...\Steam App 219) (Version:  - Valve)
Image Composite Editor (HKLM\...\{92AB5708-1AAA-4B1B-A8D5-45CF3AD77519}) (Version: 2.0.3 - Microsoft Corporation)
InfraRecorder 0.53 (x64 edition) (HKLM\...\{2C22EA92-CB30-4932-0053-000001000000}) (Version: 0.53.00.00 - Christian Kindahl)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 18.7 - Intel)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version:  - )
Lenovo Battery Utility 2014 1.2 (HKLM-x32\...\{62D5A67D-E5CC-4D79-8998-DDFDB7750346}_is1) (Version: 1.2 - Lenovo Corp)
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.03.13 - )
Malwarebytes Version 3.0.5.1299 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.0.5.1299 - Malwarebytes)
Medieval II Total War (HKLM-x32\...\{C0698BDA-0D29-40EE-8570-A31106DF9AB1}) (Version: 1.00.0000 - SEGA)
Meltdown (HKLM-x32\...\{673B2230-6035-11DE-6784-5813CA2118BE}) (Version: 3 - Poda)
Metro 2033 Demo (HKLM-x32\...\{74027A70-698F-49B4-969D-AA64BE2A8D8B}_is1) (Version:  - THQ)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 365 Business - de-de (HKLM\...\O365BusinessRetail - de-de) (Version: 16.0.7571.2109 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\OneDriveSetup.exe) (Version: 17.3.4604.0120 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.10.209.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MiKTeX 2.9 (HKLM\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
Mobile Partner (HKLM-x32\...\Mobile Partner) (Version: 23.015.11.00.382 - Huawei Technologies Co.,Ltd)
Mozilla Firefox 38.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.5 (x86 de)) (Version: 38.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 45.1.1.5990 - Mozilla)
Mozilla Thunderbird 24.2.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.2.0 (x86 de)) (Version: 24.2.0 - Mozilla)
Mozilla Thunderbird 45.1.1 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 45.1.1 (x86 de)) (Version: 45.1.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MuseScore 2 (HKLM-x32\...\{D0969A82-E79E-45D9-95D2-B2824880F780}) (Version: 2.0.2 - Werner Schweer and Others)
No More Room in Hell (HKLM-x32\...\Steam App 224260) (Version:  - No More Room in Hell Team)
NVIDIA Graphics Driver 327.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.23 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{54194F60-988C-4D03-B922-C2B00EFDA39A}) (Version: 9.10.0222 - NVIDIA Corporation)
Office 16 Click-to-Run Extensibility Component (x32 Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (x32 Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
online-foto Bestellsoftware (HKLM-x32\...\online-foto Bestellsoftware) (Version: 5.1.7 - CEWE Stiftung u Co. KGaA)
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
OpenOffice 4.0.1 (HKLM-x32\...\{47F460DA-D1BE-4D85-8DF2-AA1F31D3445F}) (Version: 4.01.9714 - Apache Software Foundation)
OpenProj (HKLM-x32\...\{13702021-43FB-480C-912F-D9B74A538288}) (Version: 1.4.0 - Serena Software Inc.)
Opera Stable 42.0.2393.137 (HKLM-x32\...\Opera 42.0.2393.137) (Version: 42.0.2393.137 - Opera Software)
Painkiller Demo (HKLM-x32\...\Steam App 3210) (Version:  - People Can Fly)
Painkiller Hell & Damnation Demo (HKLM-x32\...\Steam App 223370) (Version:  - The Farm 51)
paint.net (HKLM\...\{19BD2C33-16A8-4ED1-B9EA-D9E35B21EC42}) (Version: 4.0.5 - dotPDN LLC)
QGIS Dufour 2.0.1 Dufour (HKLM\...\QGIS Dufour) (Version:  - QGIS Development Team)
Quake Live (HKLM-x32\...\Steam App 282440) (Version:  - id Software)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
SereneScreen Marine Aquarium 2 (HKLM-x32\...\SereneScreen Marine Aquarium 2_is1) (Version: 2.0 - Prolific Publishing, Inc.)
SketchUp 2015 (HKLM\...\{A83795B9-570F-40FF-ACB4-710B568EBA22}) (Version: 15.3.331 - Trimble Navigation Limited)
Skype™ 7.18 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.18.111 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Spotify) (Version: 1.0.45.186.g3b5036d6 - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
StreamTransport version: 1.1.6.1 (HKLM-x32\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version:  - )
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
TeamViewer 11 (HKLM-x32\...\TeamViewer) (Version: 11.0.66695 - TeamViewer)
TeXnicCenter Version 2.02 Stable (HKLM\...\TeXnicCenter_is1) (Version: 2.02 Stable - The TeXnicCenter Team)
Tinypic 3.18 (HKLM-x32\...\{E3723A04-A894-4036-A78E-282E18F43C0A}_is1) (Version: Tinypic 3.18 - E. Fiedler)
Unigine Valley Benchmark version 1.0 (HKLM-x32\...\Unigine Valley Benchmark_is1) (Version: 1.0 - Unigine Corp.) <==== ATTENTION
VLC media player 2.1.1 (HKLM-x32\...\VLC media player) (Version: 2.1.1 - VideoLAN)
War2Combat 3.05 (HKLM-x32\...\War2Combat_is1) (Version: 3.05 - il)
WAV To MP3 V2 (HKLM-x32\...\WAV To MP3_is1) (Version:  - hxxp://www.WAVMP3.net)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WinRAR 5.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
XSManager (HKLM-x32\...\XSManager) (Version: 3.2 - XSManager)
YANG (Yet Another Netplay Guider) (HKLM-x32\...\YANG) (Version:  - )
yEd Graph Editor 3.11.1 (HKLM-x32\...\3309-7404-0599-8908) (Version: 3.11.1 - yWorks GmbH)
ZDaemon (remove only) (HKLM-x32\...\ZDaemon) (Version:  - )
ZDServer (HKLM-x32\...\{C8197F5F-E0DC-44f1-8AF2-1AA5A84F695D}) (Version: 1.0.1.2 - ZTE Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.8.0.dll (Dropbox, Inc.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {05F64073-CD20-4C58-9269-A4DCE9F29752} - System32\Tasks\{8661ED1F-3571-4265-A579-5F7FBB9315C0} => Firefox.exe hxxp://ui.skype.com/ui/0/7.27.64.101/de/abandoninstall?page=tsMain
Task: {343FA0EC-472E-4898-A351-72A150107C9E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {5BE089BD-0064-4D1C-88C5-0D97F35960D9} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-12-19] (Adobe Systems Incorporated)
Task: {64A798E8-C7F2-4A31-8F01-EB9DA0C0507D} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-12-28] (Microsoft Corporation)
Task: {A25576EC-6A2A-4DB2-A7EB-5E784629C973} - System32\Tasks\{7728094E-8498-4266-BA28-E921C2676EDE} => pcalua.exe -a "C:\Dominik\Programme\Virenschutz\RevoUninstaller\Revo Uninstaller\Revouninstaller.exe" -d "C:\Dominik\Programme\Virenschutz\RevoUninstaller\Revo Uninstaller"
Task: {B162D77B-0A94-4408-B4D7-634FC86C033F} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-3705937506-1407253618-1579061599-1000Core => C:\Users\user\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-11-05] (Dropbox, Inc.)
Task: {B3B3FAA1-D1C3-451E-B168-0A6809385D78} - System32\Tasks\Opera scheduled Autoupdate 1464282961 => C:\Program Files (x86)\Opera\launcher.exe [2017-01-16] (Opera Software)
Task: {BE2889F6-9B01-4983-AB79-990B2F89A5D8} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\\MpCmdRun.exe [2016-11-14] (Microsoft Corporation)
Task: {C630EE30-91AF-4826-84E7-E9CD8A4E0098} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-3705937506-1407253618-1579061599-1000UA => C:\Users\user\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-11-05] (Dropbox, Inc.)
Task: {D17C79C6-2BC0-453A-806B-A2CBABEBC727} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-12-28] (Microsoft Corporation)
Task: {E1271D86-7755-4B6D-92EE-686C911254D9} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2016-12-29] (Microsoft Corporation)
Task: {E2EB2F22-B9FF-4D3D-996D-5D06AD57806A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3705937506-1407253618-1579061599-1000Core.job => C:\Users\user\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3705937506-1407253618-1579061599-1000UA.job => C:\Users\user\AppData\Local\Dropbox\Update\DropboxUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2014-01-30 22:58 - 2013-12-08 01:04 - 00062976 _____ () C:\Program Files\Cold Turkey\CTService.exe
2014-01-30 22:58 - 2012-12-21 16:54 - 00006656 _____ () C:\Program Files\Cold Turkey\NetworkTime.dll
2014-01-30 22:58 - 2013-10-27 10:04 - 00557056 _____ () C:\Program Files\Cold Turkey\CTConfigServer.exe
2016-09-22 09:45 - 2014-12-02 10:28 - 00651856 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
2015-03-12 09:13 - 2013-05-06 14:45 - 00329848 ____N () C:\Program Files (x86)\XSManager\WTGService.exe
2015-03-11 21:04 - 2014-07-07 17:34 - 00427264 _____ () C:\ProgramData\ZDSupport\ZDServ\ZDServ.exe
2011-03-04 12:49 - 2011-03-04 12:49 - 00202752 _____ () C:\Dominik\Programme\ciscoclient\vpnapi.dll
2016-09-22 09:45 - 2013-08-31 06:44 - 02417152 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtCore4.dll
2016-09-22 09:45 - 2009-01-10 19:32 - 00011362 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\mingwm10.dll
2016-09-22 09:45 - 2009-06-23 03:42 - 00043008 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\libgcc_s_dw2-1.dll
2016-09-22 09:45 - 2013-08-31 06:46 - 01148416 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtNetwork4.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`26hfm [0]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2016-08-15 13:29 - 00000278 ____R C:\Windows\system32\Drivers\etc\hosts

127.0.0.1      localhost



































































































==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is disabled.

==================== MSCONFIG/TASK MANAGER disabled items ==


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => %SystemRoot%\system32\sppsvc.exe
FirewallRules: [TCP Query User{9521B3B1-64C2-484C-9E5E-477B3E068843}C:\program files (x86)\gsc world publishing\s.t.a.l.k.e.r. ìóëüòèïëååð\bin\xr_3da.exe] => C:\program files (x86)\gsc world publishing\s.t.a.l.k.e.r. ìóëüòèïëååð\bin\xr_3da.exe
FirewallRules: [UDP Query User{0186AE12-FED2-4ED2-81DA-D482E8E0D00F}C:\program files (x86)\gsc world publishing\s.t.a.l.k.e.r. ìóëüòèïëååð\bin\xr_3da.exe] => C:\program files (x86)\gsc world publishing\s.t.a.l.k.e.r. ìóëüòèïëååð\bin\xr_3da.exe
FirewallRules: [TCP Query User{462A49B6-9A3B-40B1-98A5-472C77761E66}C:\programme\yed\yed.exe] => C:\programme\yed\yed.exe
FirewallRules: [UDP Query User{00F14B30-F1C7-409F-A696-96549D995D2C}C:\programme\yed\yed.exe] => C:\programme\yed\yed.exe
FirewallRules: [{B49643CE-673C-441F-8CB1-037D0FACB36D}] => C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{F3AF97AD-A720-4061-948E-9176F6DD282D}] => C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{9C16A566-EEEA-482A-869A-160142998928}C:\users\user\appdata\roaming\dropbox\bin\dropbox.exe] => C:\users\user\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{B3116B0B-9865-4CEF-AB6B-9593D7EF7F0B}C:\users\user\appdata\roaming\dropbox\bin\dropbox.exe] => C:\users\user\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [TCP Query User{98720FB8-E084-429A-853C-049B411263BD}C:\dominik\sonstiges\spiele\commandandconquer\game.exe] => C:\dominik\sonstiges\spiele\commandandconquer\game.exe
FirewallRules: [UDP Query User{E8C44E1B-599C-41B8-A4CC-DC80A19532CA}C:\dominik\sonstiges\spiele\commandandconquer\game.exe] => C:\dominik\sonstiges\spiele\commandandconquer\game.exe
FirewallRules: [TCP Query User{B5FC9B5B-67D2-40A8-8FF3-8E6B754F727F}C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe] => C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe
FirewallRules: [UDP Query User{AD592A74-B612-43BB-9B1B-818AEF8034F3}C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe] => C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe
FirewallRules: [TCP Query User{254C91A3-9EE1-4BBE-A86E-85263691D0DC}C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\duke matcher 1.0\duke matcher\dukematcher.exe] => C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\duke matcher 1.0\duke matcher\dukematcher.exe
FirewallRules: [UDP Query User{40E81D0A-B19A-47CA-AF53-5295099F9506}C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\duke matcher 1.0\duke matcher\dukematcher.exe] => C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\duke matcher 1.0\duke matcher\dukematcher.exe
FirewallRules: [TCP Query User{D1121D48-5DA4-47F3-89FD-F26CBF52FFA0}C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\yang\yang.exe] => C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\yang\yang.exe
FirewallRules: [UDP Query User{210E18D4-D37A-4F69-AA08-CAAE9E92634F}C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\yang\yang.exe] => C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\yang\yang.exe
FirewallRules: [TCP Query User{8C6478E0-8A42-459A-876C-900383A1315D}C:\dominik\sonstiges\spiele\war2combat\warcraft ii bne.exe] => C:\dominik\sonstiges\spiele\war2combat\warcraft ii bne.exe
FirewallRules: [UDP Query User{75E7DD15-3E99-4B2C-8352-EC4212AEC9D9}C:\dominik\sonstiges\spiele\war2combat\warcraft ii bne.exe] => C:\dominik\sonstiges\spiele\war2combat\warcraft ii bne.exe
FirewallRules: [TCP Query User{C29D7DAE-6848-4B7A-87AB-81D0513F5793}C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe] => C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe
FirewallRules: [UDP Query User{157FD495-46FE-468F-A1C0-8F24A69740C7}C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe] => C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe
FirewallRules: [{F1524149-1CCF-40A9-9845-C4C23F26104A}] => C:\Dominik\sonstiges\spiele\steam\Steam.exe
FirewallRules: [{DA1297BC-F638-4726-B4E8-D4449DE4ED91}] => C:\Dominik\sonstiges\spiele\steam\Steam.exe
FirewallRules: [{CB6F7F79-40DA-483C-85F7-67FB9FD7E5FF}] => C:\Dominik\sonstiges\spiele\steam\bin\steamwebhelper.exe
FirewallRules: [{B3C18334-6D0B-4674-B3D2-BB63370F0CD0}] => C:\Dominik\sonstiges\spiele\steam\bin\steamwebhelper.exe
FirewallRules: [{F2266684-5CBF-4D69-8EC6-34957747C67E}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Half-Life 2\hl2.exe
FirewallRules: [{378C492B-7394-46AF-A582-BB659D6D0B65}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Half-Life 2\hl2.exe
FirewallRules: [{9ADBDC08-51C6-4E6F-8B0E-1E2E917EE54D}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\nmrih\sdk\hl2.exe
FirewallRules: [{04231C4A-E445-4D5D-8C7B-4FE4D25D7703}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\nmrih\sdk\hl2.exe
FirewallRules: [{62B22E62-4C1B-451E-A4E3-EEDEA3DEED74}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Painkiller Hell & Damnation Demo\Binaries\Win32\PKHDGame-Win32-Shipping.exe
FirewallRules: [{3E2C22D8-AAC5-4ED1-93DE-C2750F577CE5}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Painkiller Hell & Damnation Demo\Binaries\Win32\PKHDGame-Win32-Shipping.exe
FirewallRules: [{0E4D3E4D-AAFD-40AA-9538-48886017B085}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Quake Live\quakelive_steam.exe
FirewallRules: [{6D53EF41-9530-4E1E-B9C6-163F1C47C677}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Quake Live\quakelive_steam.exe
FirewallRules: [{FC32617B-A2B1-4FFA-AD55-834297D9EA7F}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Painkiller Demo\Bin\PainGame.exe
FirewallRules: [{833E9490-E8F4-4353-A889-D61125DAC61C}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Painkiller Demo\Bin\PainGame.exe
FirewallRules: [{A7C85A09-6500-4071-A861-0E467B36FDA8}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{63D0D9E9-D6D6-4498-8287-5BF133F2CB49}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4F92E3F2-D8B0-40EB-BFAB-ED124C808E3D}] => C:\Dominik\sonstiges\spiele\Meltdown.exe
FirewallRules: [{70686225-14CA-4B71-BC37-291DC3463A53}] => C:\Dominik\sonstiges\spiele\Meltdown.exe
FirewallRules: [{7CA644FD-0789-483C-9693-2907B841ABD3}] => C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{C9AE6A10-FED1-4130-91FF-65AAA1A77490}] => C:\Users\user\AppData\Local\Microsoft\OneDrive\OneDrive.exe
FirewallRules: [{34335651-6E5E-4ABC-A7EC-960A60A4F0F6}] => C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{8512BBE7-88DD-40A1-8C0C-A850D7092A9B}] => C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{E5F2C46D-366C-4FA7-A350-1FD52A9BF749}] => C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{7148B556-CB31-4867-86F5-38859D93B4DD}] => C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{90BEB6D8-E1B5-42E2-988A-AD43626888B4}] => C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{12B90CEF-EA1B-4B66-A14F-ED8AC56EC44C}] => C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{A63E9E6D-0616-4525-BD4B-0C18CE2CA27A}] => C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{9C832647-D59C-44FA-9314-26D52F9ECAD2}] => C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{F3195A86-A3C6-4686-B36F-B98DBB62F511}] => C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{0494DE03-CAF2-4A2D-A77E-EDD96427B0D8}] => C:\Program Files (x86)\Opera\42.0.2393.137\opera.exe

==================== Restore Points =========================

18-01-2017 09:19:38 Windows Update
22-01-2017 11:52:52 Windows Update
22-01-2017 13:14:56 JRT Pre-Junkware Removal

==================== Faulty Device Manager Devices =============

Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/22/2017 01:09:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 43.0.1.5828, time stamp: 0x56723a12
Faulting module name: mozglue.dll, version: 43.0.1.5828, time stamp: 0x56722c0b
Exception code: 0x80000003
Fault offset: 0x0000ed63
Faulting process id: 0x1168
Faulting application start time: 0x01d274a80a8da309
Faulting application path: C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
Faulting module path: C:\Program Files (x86)\Mozilla Firefox\mozglue.dll
Report Id: 9616446b-e09b-11e6-864a-ec55f9de5f26

Error: (01/22/2017 01:09:13 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program firefox.exe version 43.0.1.5828 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 15c0

Start Time: 01d274a7cc1df2f5

Termination Time: 285

Application Path: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Report Id: 93bedea5-e09b-11e6-864a-ec55f9de5f26

Error: (01/22/2017 01:05:42 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (01/22/2017 01:02:47 PM) (Source: MsiInstaller) (EventID: 1024) (User: user-PC)
Description: Product: Adobe Acrobat DC - Update 'Adobe Acrobat DC
 (15.023.20056)' could not be installed. Error code 1603. Windows Installer can create logs to help troubleshoot issues with installing software packages. Use the following link for instructions on turning on logging support: hxxp://go.microsoft.com/fwlink/?LinkId=23127

Error: (01/22/2017 01:02:42 PM) (Source: MsiInstaller) (EventID: 11722) (User: user-PC)
Description: Produkt: Adobe Acrobat DC -- Fehler 1722. There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor. Action InstallWebResources, location: C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroServicesUpdater.exe, command: 15.023.20056 15.023.20053.0

Error: (01/22/2017 12:34:16 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (01/22/2017 12:24:59 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (01/22/2017 12:18:22 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (01/20/2017 06:19:11 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Activation context generation failed for "c:\program files (x86)\microsoft office\root\Office16\lync.exe.Manifest".Error in manifest or policy file "c:\program files (x86)\microsoft office\root\Office16\UccApi.DLL" on line 1.
Component identity found in manifest does not match the identity of the component requested.
Reference is UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0".
Definition is UccApi,processorArchitecture="x86",type="win32",version="16.0.0.0".
Please use sxstrace.exe for detailed diagnosis.

Error: (01/19/2017 04:15:58 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Users\user\Downloads\esetsmartinstaller_deu.exe".Error in manifest or policy file "" on line .
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.


System errors:
=============
Error: (01/22/2017 01:16:10 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The NVIDIA Display Driver Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (01/22/2017 01:06:24 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The HWDeviceService64.exe service terminated unexpectedly.  It has done this 1 time(s).

Error: (01/22/2017 01:04:42 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Mobile Partner. OUC service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Error: (01/22/2017 01:04:42 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Mobile Partner. OUC service to connect.

Error: (01/22/2017 12:38:44 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The HWDeviceService64.exe service terminated unexpectedly.  It has done this 1 time(s).

Error: (01/22/2017 12:33:17 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Mobile Partner. OUC service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Error: (01/22/2017 12:33:17 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Mobile Partner. OUC service to connect.

Error: (01/22/2017 12:24:17 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Mobile Partner. OUC service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Error: (01/22/2017 12:24:17 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Mobile Partner. OUC service to connect.

Error: (01/22/2017 12:17:37 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Mobile Partner. OUC service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.


CodeIntegrity:
===================================
  Date: 2017-01-22 13:27:16.503
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-22 13:27:15.721
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-22 13:26:47.717
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-22 13:26:38.659
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-22 13:23:19.404
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-22 13:23:19.179
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-22 13:22:13.636
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-22 13:22:11.738
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-22 13:22:07.554
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-22 13:21:22.960
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7 CPU M 620 @ 2.67GHz
Percentage of memory in use: 31%
Total physical RAM: 8051.67 MB
Available physical RAM: 5475.45 MB
Total Virtual: 16101.53 MB
Available Virtual: 13355.39 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:381.42 GB) (Free:52.28 GB) NTFS
Drive d: (DVDVOLUME) (CDROM) (Total:7.71 GB) (Free:0 GB) UDF
Drive g: (CANON_DC) (Removable) (Total:15.01 GB) (Free:14.34 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: DE2F4001)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=381.4 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=84.2 GB) - (Type=05)

========================================================
Disk: 1 (Size: 15 GB) (Disk ID: 00000000)

Partition: GPT.

==================== End of Addition.txt ============================

M-K-D-B 23.01.2017 15:29
Servus,


bis jetzt nichts, was dein Problem erklären könnte. Wir haben nur ein bisschen unerwünschte Software auf dem PC, welche wir noch fertig entfernen. ;)



Deine Google Chrome-Reste auf dem PC solltest du JETZT so entfernen:
Installiere dir zuerst Google Chrome von hier und deinstalliere es anschließend wieder über die Systemsteuerung und wähle die Option "Alle Browserdaten löschen" (oder so ähnlich) mit aus.
Rechner jeweils neu starten.





Wir entfernen die letzten Reste und kontrollieren nochmal alles. :)





Hinweis: Der Suchlauf mit ESET kann länger dauern.



Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument


Code:
start
CloseProcesses:
HKLM-x32\...\Run: [] => [X]
FF user.js: detected! => C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\user.js [2016-03-04]
AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`26hfm [0]
RemoveProxy:
CMD: ipconfig /flushdns
CMD: netsh winsock reset
EmptyTemp:
end

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.







Schritt 2

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset







Schritt 3
Downloade dir die passende Version von HitmanPro auf deinen Desktop: HitmanPro - 32 Bit | HitmanPro - 64 Bit.
  • Starte die HitmanPro.exe
  • Klicke auf
  • Entferne den Haken bei
  • Klicke auf
    und
  • Akzeptiere die Lizenzbedingungen und klicke auf
  • Klicke auf

    und auf
  • Wenn der Scan beendet wurde, nichts löschen lassen etc. sondern wähle unten links auf der Button-Leiste
    und speichere die Logdatei auf Deinem Desktop.
  • Schließe HitmanPro und poste mir das Log.

 







Schritt 4
  • Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Untersuchen.
  • FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
  • Poste mir beide Logdateien mit deiner nächsten Antwort.





http://www.trojaner-board.de/extra/lesestoff.pngGibt es jetzt noch Probleme mit dem PC? Wenn ja, welche?







Bitte poste mit deiner nächsten Antwort
  • die Logdatei des FRST-Fix,
  • die Logdatei von ESET,
  • die Logdatei von HitmanPro,
  • die beiden neuen Logdateien von FRST,
  • die Beantwortung der gestellten Fragen.

Dominik H. 25.01.2017 13:30
Danke schon einmal für die Hilfe. Komme erst heute dazu, die weiteren Schritte durchzuführen.

Grüße
Dominik

Code:
Fix result of Farbar Recovery Scan Tool (x64) Version: 22-01-2017
Ran by user (25-01-2017 09:15:05) Run:1
Running from C:\Users\user\Desktop
Loaded Profiles: user (Available Profiles: user & Guest)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start
CloseProcesses:
HKLM-x32\...\Run: [] => [X]
FF user.js: detected! => C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\user.js [2016-03-04]
AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`26hfm [0]
RemoveProxy:
CMD: ipconfig /flushdns
CMD: netsh winsock reset
EmptyTemp:
end
*****************

Processes closed successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\user.js => not found.
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\user.js => not found.
C:\ProgramData\Reprise => ":wupeogjxldtlfudivq`qsp`26hfm" ADS removed successfully.

========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully
HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully


========= End of RemoveProxy: =========


========= ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


========= netsh winsock reset =========


Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.


========= End of CMD: =========


=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 102579754 B
Java, Flash, Steam htmlcache => 1235 B
Windows/system/drivers => 489568817 B
Edge => 0 B
Chrome => 0 B
Firefox => 374984322 B
Opera => 21948208 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 79397603 B
systemprofile32 => 66088 B
LocalService => 66228 B
NetworkService => 11381761 B
user => 1421884874 B
Guest => 3465134 B

RecycleBin => 19577045 B
EmptyTemp: => 2.4 GB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 09:20:50 ====
Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=6f90a6a109fb46419148f3d5c719fad1
# end=init
# utc_time=2015-08-16 03:50:59
# local_time=2015-08-16 05:50:59 (+0100, W. Europe Daylight Time)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
Update Finalize
Updated modules version: 25301
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=6f90a6a109fb46419148f3d5c719fad1
# end=updated
# utc_time=2015-08-16 03:53:18
# local_time=2015-08-16 05:53:18 (+0100, W. Europe Daylight Time)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=6f90a6a109fb46419148f3d5c719fad1
# engine=25301
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-08-16 06:00:36
# local_time=2015-08-16 08:00:36 (+0100, W. Europe Daylight Time)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 8039582 62696030 0 0
# scanned=302098
# found=1
# cleaned=0
# scan_time=7637
sh=F346D91A2E5F5FBEFF8F19023463F079E6E89B7A ft=0 fh=0000000000000000 vn="Win32/Somoto.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Dominik\Programme\streamtransport\streamtransport_1.1.6.2.zip"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=6f90a6a109fb46419148f3d5c719fad1
# end=init
# utc_time=2017-01-25 08:32:20
# local_time=2017-01-25 09:32:20 (+0100, W. Europe Standard Time)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
Update Finalize
Updated modules version: 32179
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=6f90a6a109fb46419148f3d5c719fad1
# end=updated
# utc_time=2017-01-25 08:53:30
# local_time=2017-01-25 09:53:30 (+0100, W. Europe Standard Time)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=6f90a6a109fb46419148f3d5c719fad1
# engine=32179
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2017-01-25 11:52:35
# local_time=2017-01-25 12:52:35 (+0100, W. Europe Standard Time)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 2344105 108293149 0 0
# scanned=322307
# found=2
# cleaned=0
# scan_time=10743
sh=B5209CDF0C77CB358CC5579C59A02BC4EA8260DF ft=0 fh=0000000000000000 vn="LNK/Agent.CH Trojaner" ac=I fn="C:\Dominik\Musik\Cds\Fat Boy Slim\Fatboy_Slim-That_Old_Pair_Of_Jeans_and_Remixes-Promo-CDM-2006-XXL\Noch schneller downloaden! Jetzt kostenlos anmelden!.url"
sh=F346D91A2E5F5FBEFF8F19023463F079E6E89B7A ft=0 fh=0000000000000000 vn="Win32/Somoto.Q eventuell unerwünschte Anwendung" ac=I fn="C:\Dominik\Programme\streamtransport\streamtransport_1.1.6.2.zip"
Code:

       
Code:

       
HitmanPro 3.7.15.281
www.hitmanpro.com

   Computer name . . . . : USER-PC
   Windows . . . . . . . : 6.1.1.7601.X64/4
   User name . . . . . . : user-PC\user
   UAC . . . . . . . . . : Disabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2017-01-25 13:11:50
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 9m 35s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 0
   Traces  . . . . . . . : 4

   Objects scanned . . . : 1.955.199
   Files scanned . . . . : 51.790
   Remnants scanned  . . : 468.168 files / 1.435.241 keys

Suspicious files ____________________________________________________________

   C:\Users\user\Desktop\FRST-OlderVersion\FRST64(1).exe
      Size . . . . . . . : 2.419.712 bytes
      Age  . . . . . . . : 4.8 days (2017-01-20 17:49:59)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : A6F5705974D580CD90356F383715E682E824FFE3E81E121AA97181C7CD7414AC
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.

   C:\Users\user\Desktop\FRST64.exe
      Size . . . . . . . : 2.420.736 bytes
      Age  . . . . . . . : 3.0 days (2017-01-22 13:29:32)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : 945C56ADCD33C43D4D6954E99B4427C92C0528C797B08783CD9BE3E9D95A5299
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.
      Forensic Cluster
         -0.3s C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F
         -0.3s C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F
          0.0s C:\Users\user\Desktop\FRST64.exe
          2.6s C:\Users\user\Desktop\FRST-OlderVersion\
          5.9s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MetaStore\2\26\6C777905AFDBE8DE.dat

   C:\Users\user\Downloads\FRST-OlderVersion\FRST64.exe
      Size . . . . . . . : 2.169.856 bytes
      Age  . . . . . . . : 544.6 days (2015-07-30 22:01:51)
      Entropy  . . . . . : 7.5
      SHA-256  . . . . . : 7C39DFFCFB8732465FD8FBE60780646E9BE3A10DE78CEB0C7CF70FF0BF6B6644
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 22.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

   C:\Users\user\Downloads\FRST64.exe
      Size . . . . . . . : 2.168.832 bytes
      Age  . . . . . . . : 544.6 days (2015-07-30 22:02:03)
      Entropy  . . . . . : 7.5
      SHA-256  . . . . . : 6503FD8E07E666D69E0A5B4A17DC4A51CDA903444B353625E3A0195FC8CB8690
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 22.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.


FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 22-01-2017
Ran by user (administrator) on USER-PC (25-01-2017 13:22:44)
Running from C:\Users\user\Desktop
Loaded Profiles: user & Guest (Available Profiles: user & Guest)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
() C:\Program Files\Cold Turkey\CTService.exe
(Cisco Systems, Inc.) C:\Dominik\Programme\ciscoclient\cvpnd.exe
() C:\Program Files\Cold Turkey\CTConfigServer.exe
() C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler64.exe
() C:\Program Files (x86)\XSManager\WTGService.exe
() C:\ProgramData\ZDSupport\ZDServ\ZDServ.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
() C:\ProgramData\ZDSupport\ZDServ\CancelAutoPlay_Server.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(© 2015 Microsoft Corporation) C:\Users\user\AppData\Local\Microsoft\BingSvc\BingSvc.exe
(Spotify Ltd) C:\Users\user\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Dropbox, Inc.) C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\acrotray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Opera Software) C:\Program Files (x86)\Opera\42.0.2393.137\opera_autoupdate.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1353680 2016-11-14] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-07-01] (Adobe Systems Incorporated)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2776528 2016-12-14] (Malwarebytes)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Acrotray.exe [1870928 2016-12-23] (Adobe Systems Inc.)
HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Run: [Dropbox Update] => C:\Users\user\AppData\Local\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-05] (Dropbox, Inc.)
HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Run: [BingSvc] => C:\Users\user\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-17] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Run: [Spotify Web Helper] => C:\Users\user\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1444976 2016-12-25] (Spotify Ltd)
HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [50605696 2016-02-02] (Skype Technologies S.A.)
HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Run: [Adobe Acrobat Synchronizer] => C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe [886352 2016-12-23] (Adobe Systems Incorporated)
HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Run: [Spotify] => C:\Users\user\AppData\Roaming\Spotify\Spotify.exe [7153264 2016-12-25] (Spotify Ltd)
HKU\S-1-5-21-3705937506-1407253618-1579061599-501\...\Run: [Lync] => C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe [22982848 2016-12-29] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [  DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [  DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [  DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.11.0.dll [2017-01-18] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt.11.0.dll [2017-01-18] (Dropbox, Inc.)
Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2017-01-24]
ShortcutTarget: Dropbox.lnk -> C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{E1796407-EE12-4BF9-A2CF-56DFA7F556C0}: [DhcpNameServer] 192.168.0.1 192.168.0.1
Tcpip\..\Interfaces\{F803A312-9FB2-4B80-830E-D0882C84BC70}: [DhcpNameServer] 192.168.178.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000 -> OldSearch URL = hxxp://www.bing.com/search?FORM=SK2MDF&PC=SK2M&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-3705937506-1407253618-1579061599-501 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2016-12-28] (Microsoft Corporation)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\URLREDIR.DLL [2016-12-28] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2016-12-28] (Microsoft Corporation)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2016-12-28] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-01-26] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\URLREDIR.DLL [2016-12-28] (Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2016-12-28] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-01-26] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-28] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

FireFox:
========
FF DefaultProfile: 2dz2xpoy.default-1414599074507
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\g2mr5o1m.default-1413196550790 [2017-01-25]
FF Homepage: Mozilla\Firefox\Profiles\g2mr5o1m.default-1413196550790 -> hxxps://www.malwarebytes.org/restorebrowser/-bfr-sm-rhb-30__alt__ddc_dsssyc_bd_com
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507 [2017-01-25]
FF Extension: (Flash Video Downloader - YouTube HD Download [4K]) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\artur.dubovoy@gmail.com [2017-01-07]
FF Extension: (Bing Search Engine) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\bingsearch.full@microsoft.com [2017-01-22] [not signed]
FF Extension: (Grooveshark Unlocker) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\groovesharkUnlocker@overlord1337.xpi [2016-05-01]
FF Extension: (ProxTube) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\ich@maltegoetz.de.xpi [2016-10-18]
FF Extension: (1-Click YouTube Video Downloader) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\YoutubeDownloader@PeterOlayev.com.xpi [2016-08-25]
FF Extension: (EPUBReader) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F} [2017-01-18]
FF Extension: (hd shield) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\{aa991923-b0b8-4938-b763-2aacc9c6992f}.xpi [2015-12-19] [not signed]
FF Extension: (Adblock Plus) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-24]
FF Extension: (DivX Wizard) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2dz2xpoy.default-1414599074507\Extensions\{e93aa736-6c93-453a-a708-2fd62fbd573e}.xpi [2016-05-25] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension.15@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn
FF Extension: (Adobe Acrobat DC - Create PDF) - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn [2017-01-13]
FF HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\hxod2v34.default-1408804336995\extensions\cliqz@cliqz.com => not found
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-19] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2015-07-29] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-19] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2016-10-06] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-01-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-01-26] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-12-28] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-12-28] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2013-11-11] (VideoLAN)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-12-21] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2015-07-29] (Adobe Systems)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2207960 2016-09-26] (Adobe Systems, Incorporated)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [3699904 2016-12-28] (Microsoft Corporation)
R2 CTService; C:\Program Files\Cold Turkey\CTService.exe [62976 2013-12-08] () [File not signed]
R2 CVPND; C:\Dominik\Programme\ciscoclient\cvpnd.exe [1529856 2011-03-04] (Cisco Systems, Inc.)
S2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [351824 2014-01-15] ()
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4317648 2016-12-14] (Malwarebytes)
S2 Mobile Partner. RunOuc; C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [651856 2014-12-02] ()
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [7500048 2016-09-20] (TeamViewer GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WTGService; C:\Program Files (x86)\XSManager\WTGService.exe [329848 2013-05-06] ()
R2 ZDServ; C:\ProgramData\ZDSupport\ZDServ\ZDServ.exe [427264 2014-07-07] ()

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 atmeltpm; C:\Windows\System32\DRIVERS\atmeltpm64.sys [19456 2011-08-05] (Atmel, Inc.)
S3 cmnsusbser; C:\Windows\System32\DRIVERS\cmnsusbser.sys [126080 2015-03-12] (QUALCOMM Incorporated)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77416 2016-12-14] ()
S3 hwusb_cdcacm; C:\Windows\System32\DRIVERS\ew_cdcacm.sys [125952 2014-07-25] (Huawei Technologies Co., Ltd.)
S3 hwusb_wwanecm; C:\Windows\System32\DRIVERS\ew_wwanecm.sys [380672 2014-09-30] (Huawei Technologies Co., Ltd.)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-31] (Intel Corporation)
S3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv.sys [49304 2014-12-29] (Visicom Media Inc.)
R2 MBAMChameleon; C:\Windows\system32\drivers\MBAMChameleon.sys [176064 2017-01-22] (Malwarebytes)
R3 MBAMFarflt; C:\Windows\system32\drivers\farflt.sys [102856 2017-01-25] (Malwarebytes)
R3 MBAMProtection; C:\Windows\system32\drivers\mbam.sys [43968 2017-01-25] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [250816 2017-01-25] (Malwarebytes)
S3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [81696 2017-01-24] (Malwarebytes)
S3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [35992 2014-12-29] (Visicom Media Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation)
S3 TPPWRIF; C:\Dominik\Programme\Lenovo Battery Utility 2014\TPPWR64V.sys [20736 2014-03-05] (Lenovo Group Limited)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-25 13:11 - 2017-01-25 13:22 - 00000000 ____D C:\ProgramData\HitmanPro
2017-01-25 13:10 - 2017-01-25 13:10 - 11581544 _____ (SurfRight B.V.) C:\Users\user\Desktop\HitmanPro_x64.exe
2017-01-25 09:30 - 2017-01-25 09:30 - 02870984 _____ (ESET) C:\Users\user\Desktop\esetsmartinstaller_deu(1).exe
2017-01-25 09:15 - 2017-01-25 09:20 - 00002924 _____ C:\Users\user\Desktop\Fixlog.txt
2017-01-25 08:57 - 2017-01-25 08:57 - 01065376 _____ (Google Inc.) C:\Users\user\Downloads\ChromeSetup.exe

2017-01-25 08:49 - 2017-01-25 08:49 - 00000000 ___HD C:\OneDriveTemp
2017-01-25 08:48 - 2017-01-25 08:48 - 00003168 _____ C:\Windows\System32\Tasks\OneDrive Standalone Update Task v2
2017-01-25 08:48 - 2017-01-25 08:48 - 00002156 _____ C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2017-01-25 08:48 - 2017-01-25 08:48 - 00002104 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2017-01-25 08:48 - 2017-01-25 08:48 - 00002104 _____ C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2017-01-25 08:48 - 2017-01-25 08:47 - 20466392 _____ (Microsoft Corporation) C:\Users\user\Downloads\OneDriveSetup.exe
2017-01-24 19:10 - 2017-01-24 19:10 - 00000000 ____D C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2017-01-22 13:29 - 2017-01-22 13:29 - 02420736 _____ (Farbar) C:\Users\user\Desktop\FRST64.exe
2017-01-22 13:29 - 2017-01-22 13:29 - 00000000 ____D C:\Users\user\Desktop\FRST-OlderVersion
2017-01-22 13:20 - 2017-01-22 13:20 - 00010157 _____ C:\Users\user\Desktop\JRT.txt
2017-01-22 13:11 - 2017-01-22 13:11 - 01663040 _____ (Malwarebytes) C:\Users\user\Desktop\JRT.exe
2017-01-22 13:10 - 2017-01-22 13:10 - 00023678 _____ C:\Users\user\Desktop\mbam.txt
2017-01-22 12:38 - 2017-01-25 09:27 - 00250816 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-01-22 12:38 - 2017-01-25 09:27 - 00102856 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2017-01-22 12:38 - 2017-01-25 09:27 - 00043968 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-01-22 12:38 - 2017-01-24 19:06 - 00081696 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2017-01-22 12:38 - 2017-01-22 14:39 - 00176064 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys
2017-01-22 12:37 - 2017-01-22 12:37 - 00001867 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-01-22 12:37 - 2017-01-22 12:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-01-22 12:37 - 2017-01-22 12:37 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-01-22 12:37 - 2017-01-22 12:37 - 00000000 ____D C:\Program Files\Malwarebytes
2017-01-22 12:37 - 2016-12-14 12:55 - 00077416 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-01-22 12:36 - 2017-01-22 12:36 - 54199488 _____ (Malwarebytes ) C:\Users\user\Downloads\mb3-setup-consumer-3.0.5.1299.exe
2017-01-22 12:25 - 2017-01-22 12:26 - 00566128 _____ (Malwarebytes) C:\Users\user\Desktop\mbam-clean-2.3.0.1001.exe
2017-01-22 12:19 - 2017-01-22 12:19 - 00003650 _____ C:\Users\user\Desktop\AdwCleaner[C0].txt
2017-01-22 12:08 - 2017-01-22 12:09 - 03988944 _____ C:\Users\user\Desktop\AdwCleaner_6.042.exe
2017-01-20 18:31 - 2017-01-22 12:09 - 00214208 _____ C:\TDSSKiller.3.1.0.12_20.01.2017_18.31.54_log.txt
2017-01-20 17:57 - 2017-01-20 18:30 - 00214206 _____ C:\TDSSKiller.3.1.0.12_20.01.2017_17.57.44_log.txt
2017-01-20 17:57 - 2017-01-20 17:57 - 04747704 _____ (AO Kaspersky Lab) C:\Users\user\Desktop\tdsskiller.exe
2017-01-20 17:52 - 2017-01-22 13:31 - 00041260 _____ C:\Users\user\Desktop\Addition.txt
2017-01-20 17:51 - 2017-01-25 13:23 - 00025851 _____ C:\Users\user\Desktop\FRST.txt
2017-01-17 16:26 - 2017-01-19 07:30 - 56355840 _____ C:\Users\user\Desktop\Lüneburg.ppt
2017-01-15 20:59 - 2017-01-15 20:59 - 00000040 ____H C:\6A4F84AA7F7F
2017-01-11 21:34 - 2017-01-05 19:55 - 00154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2017-01-11 21:34 - 2017-01-05 19:55 - 00095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2017-01-11 21:34 - 2017-01-05 19:52 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00730624 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2017-01-11 21:34 - 2017-01-05 19:52 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2017-01-11 21:34 - 2017-01-05 18:43 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2017-01-11 21:34 - 2017-01-05 18:42 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2017-01-11 21:34 - 2017-01-05 18:32 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2017-01-11 21:34 - 2017-01-05 18:25 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-01-11 21:34 - 2017-01-05 18:24 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-01-11 21:34 - 2017-01-05 18:24 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-01-11 21:34 - 2017-01-05 18:24 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2017-01-11 21:34 - 2017-01-05 18:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2017-01-11 21:34 - 2017-01-05 18:19 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2017-01-08 02:10 - 2016-11-21 19:12 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\hlink.dll
2017-01-08 02:10 - 2016-11-20 17:19 - 00084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hlink.dll
2017-01-08 02:10 - 2016-11-20 15:07 - 00467392 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2017-01-08 02:10 - 2016-11-17 17:41 - 00370920 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2017-01-08 02:10 - 2016-11-15 00:27 - 00394448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-01-08 02:10 - 2016-11-14 23:39 - 00346320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2017-01-08 02:10 - 2016-11-12 20:48 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2017-01-08 02:10 - 2016-11-12 20:48 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2017-01-08 02:10 - 2016-11-12 20:28 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2017-01-08 02:10 - 2016-11-12 20:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2017-01-08 02:10 - 2016-11-12 20:26 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2017-01-08 02:10 - 2016-11-12 20:25 - 00576000 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-01-08 02:10 - 2016-11-12 20:25 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-01-08 02:10 - 2016-11-12 20:21 - 02896384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-01-08 02:10 - 2016-11-12 20:15 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2017-01-08 02:10 - 2016-11-12 20:14 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2017-01-08 02:10 - 2016-11-12 20:09 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2017-01-08 02:10 - 2016-11-12 20:08 - 25759744 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-01-08 02:10 - 2016-11-12 20:08 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2017-01-08 02:10 - 2016-11-12 20:08 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2017-01-08 02:10 - 2016-11-12 20:07 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-01-08 02:10 - 2016-11-12 20:07 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2017-01-08 02:10 - 2016-11-12 19:56 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2017-01-08 02:10 - 2016-11-12 19:53 - 06049280 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-01-08 02:10 - 2016-11-12 19:52 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2017-01-08 02:10 - 2016-11-12 19:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2017-01-08 02:10 - 2016-11-12 19:41 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-01-08 02:10 - 2016-11-12 19:40 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2017-01-08 02:10 - 2016-11-12 19:35 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2017-01-08 02:10 - 2016-11-12 19:34 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-01-08 02:10 - 2016-11-12 19:31 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-01-08 02:10 - 2016-11-12 19:30 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2017-01-08 02:10 - 2016-11-12 19:29 - 00498688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2017-01-08 02:10 - 2016-11-12 19:29 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2017-01-08 02:10 - 2016-11-12 19:29 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2017-01-08 02:10 - 2016-11-12 19:28 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2017-01-08 02:10 - 2016-11-12 19:27 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2017-01-08 02:10 - 2016-11-12 19:20 - 02287616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2017-01-08 02:10 - 2016-11-12 19:20 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2017-01-08 02:10 - 2016-11-12 19:19 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2017-01-08 02:10 - 2016-11-12 19:17 - 20302848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-01-08 02:10 - 2016-11-12 19:15 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2017-01-08 02:10 - 2016-11-12 19:14 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2017-01-08 02:10 - 2016-11-12 19:14 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2017-01-08 02:10 - 2016-11-12 19:14 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-01-08 02:10 - 2016-11-12 19:14 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2017-01-08 02:10 - 2016-11-12 19:11 - 00725504 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-01-08 02:10 - 2016-11-12 19:10 - 00806912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-01-08 02:10 - 2016-11-12 19:08 - 02131456 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-01-08 02:10 - 2016-11-12 19:08 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2017-01-08 02:10 - 2016-11-12 19:03 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2017-01-08 02:10 - 2016-11-12 18:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2017-01-08 02:10 - 2016-11-12 18:56 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2017-01-08 02:10 - 2016-11-12 18:52 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2017-01-08 02:10 - 2016-11-12 18:51 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2017-01-08 02:10 - 2016-11-12 18:49 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2017-01-08 02:10 - 2016-11-12 18:47 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2017-01-08 02:10 - 2016-11-12 18:41 - 15257088 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-01-08 02:10 - 2016-11-12 18:40 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2017-01-08 02:10 - 2016-11-12 18:38 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2017-01-08 02:10 - 2016-11-12 18:37 - 04608000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-01-08 02:10 - 2016-11-12 18:36 - 02055680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2017-01-08 02:10 - 2016-11-12 18:36 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2017-01-08 02:10 - 2016-11-12 18:35 - 02920960 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-01-08 02:10 - 2016-11-12 18:21 - 13653504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-01-08 02:10 - 2016-11-12 18:20 - 01543680 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-01-08 02:10 - 2016-11-12 18:11 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-01-08 02:10 - 2016-11-12 18:05 - 02444800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-01-08 02:10 - 2016-11-12 18:02 - 01312256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-01-08 02:10 - 2016-11-12 18:02 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2017-01-08 02:10 - 2016-11-10 17:32 - 01009152 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2017-01-08 02:10 - 2016-11-10 17:19 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2017-01-08 02:10 - 2016-11-09 17:41 - 00114408 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2017-01-08 02:10 - 2016-11-09 17:33 - 03244032 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2017-01-08 02:10 - 2016-11-09 17:33 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2017-01-08 02:10 - 2016-11-09 17:33 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2017-01-08 02:10 - 2016-11-09 17:33 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2017-01-08 02:10 - 2016-11-09 17:33 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2017-01-08 02:10 - 2016-11-09 17:33 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2017-01-08 02:10 - 2016-11-09 17:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2017-01-08 02:10 - 2016-11-09 17:17 - 01806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2017-01-08 02:10 - 2016-11-09 17:17 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2017-01-08 02:10 - 2016-11-09 17:17 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2017-01-08 02:10 - 2016-11-09 17:17 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2017-01-08 02:10 - 2016-11-09 17:02 - 00128512 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2017-01-08 02:10 - 2016-11-09 16:55 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2017-01-08 02:10 - 2016-11-06 17:33 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2017-01-08 02:10 - 2016-11-06 17:16 - 00312832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2017-01-08 02:10 - 2016-11-06 17:01 - 03219456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-01-08 02:10 - 2016-10-27 16:33 - 00802304 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2017-01-08 02:10 - 2016-10-27 16:20 - 00627712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2017-01-08 02:10 - 2016-10-11 16:40 - 00631176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2017-01-08 02:10 - 2016-10-11 16:37 - 05547752 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-01-08 02:10 - 2016-10-11 16:37 - 00706792 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2017-01-08 02:10 - 2016-10-11 16:34 - 01732864 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\nlsbres.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2017-01-08 02:10 - 2016-10-11 16:32 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:24 - 04000488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2017-01-08 02:10 - 2016-10-11 16:24 - 03944680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2017-01-08 02:10 - 2016-10-11 16:21 - 01314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlsbres.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 16:03 - 00148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2017-01-08 02:10 - 2016-10-11 16:03 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2017-01-08 02:10 - 2016-10-11 16:03 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2017-01-08 02:10 - 2016-10-11 15:59 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2017-01-08 02:10 - 2016-10-11 15:59 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2017-01-08 02:10 - 2016-10-11 15:55 - 00346112 _____ (Microsoft Corporation) C:\Windows\system32\bcdedit.exe
2017-01-08 02:10 - 2016-10-11 15:55 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2017-01-08 02:10 - 2016-10-11 15:51 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2017-01-08 02:10 - 2016-10-11 15:51 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2017-01-08 02:10 - 2016-10-11 15:51 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2017-01-08 02:10 - 2016-10-11 15:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2017-01-08 02:10 - 2016-10-11 15:50 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 15:50 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 15:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 15:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2017-01-08 02:10 - 2016-10-11 14:18 - 00419648 _____ C:\Windows\SysWOW64\locale.nls
2017-01-08 02:10 - 2016-10-11 14:17 - 00419648 _____ C:\Windows\system32\locale.nls
2017-01-08 02:10 - 2016-10-08 14:06 - 00633296 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2017-01-08 02:10 - 2016-10-04 16:31 - 01483264 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2017-01-08 02:10 - 2016-10-04 16:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2017-01-08 02:10 - 2016-10-04 16:31 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2017-01-08 02:10 - 2016-10-04 16:31 - 00141824 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2017-01-08 02:10 - 2016-10-04 16:13 - 01176064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2017-01-08 02:10 - 2016-10-04 16:13 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2017-01-08 02:10 - 2016-10-04 16:13 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2017-01-08 02:10 - 2016-10-04 16:13 - 00106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2016-12-31 16:54 - 2016-12-31 16:54 - 00002423 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access 2016.lnk
2016-12-28 15:02 - 2016-11-02 16:36 - 00382696 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2016-12-28 15:02 - 2016-11-02 16:22 - 00308456 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2016-12-28 15:02 - 2016-10-15 16:31 - 00976896 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2016-12-28 15:02 - 2016-10-15 16:13 - 00741888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2016-12-28 15:02 - 2016-10-11 16:31 - 01148416 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10.IME
2016-12-28 15:02 - 2016-10-11 16:31 - 01068544 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2016-12-28 15:02 - 2016-10-11 16:31 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2016-12-28 15:02 - 2016-10-11 16:31 - 00457216 _____ (Microsoft Corporation) C:\Windows\system32\imkr80.ime
2016-12-28 15:02 - 2016-10-11 16:31 - 00246784 _____ (Microsoft Corporation) C:\Windows\system32\input.dll
2016-12-28 15:02 - 2016-10-11 16:31 - 00176128 _____ (Microsoft Corporation) C:\Windows\system32\tintlgnt.ime
2016-12-28 15:02 - 2016-10-11 16:31 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\quick.ime
2016-12-28 15:02 - 2016-10-11 16:31 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\qintlgnt.ime
2016-12-28 15:02 - 2016-10-11 16:31 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\phon.ime
2016-12-28 15:02 - 2016-10-11 16:31 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\cintlgnt.ime
2016-12-28 15:02 - 2016-10-11 16:31 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\chajei.ime
2016-12-28 15:02 - 2016-10-11 16:31 - 00132608 _____ (Microsoft Corporation) C:\Windows\system32\pintlgnt.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 01027584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10.IME
2016-12-28 15:02 - 2016-10-11 16:18 - 00829952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2016-12-28 15:02 - 2016-10-11 16:18 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL
2016-12-28 15:02 - 2016-10-11 16:18 - 00430080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imkr80.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 00202240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\input.dll
2016-12-28 15:02 - 2016-10-11 16:18 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tintlgnt.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quick.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qintlgnt.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\phon.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cintlgnt.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\chajei.ime
2016-12-28 15:02 - 2016-10-11 16:18 - 00090112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pintlgnt.ime
2016-12-28 15:02 - 2016-10-11 14:33 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2016-12-28 15:02 - 2016-10-11 14:06 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2016-12-28 15:02 - 2016-10-07 16:32 - 03649536 _____ (Microsoft Corporation) C:\Windows\system32\MSVidCtl.dll
2016-12-28 15:02 - 2016-10-07 16:32 - 00877056 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2016-12-28 15:02 - 2016-10-07 16:32 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2016-12-28 15:02 - 2016-10-07 16:12 - 02291712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVidCtl.dll
2016-12-28 15:02 - 2016-10-07 16:12 - 00581632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2016-12-28 15:02 - 2016-10-07 16:12 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\asycfilt.dll
2016-12-28 15:02 - 2016-10-05 15:54 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bowser.sys
2016-12-28 15:02 - 2016-09-15 15:56 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2016-12-28 15:02 - 2016-09-09 19:20 - 00756736 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2016-12-28 15:02 - 2016-09-09 19:00 - 00497152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2016-12-28 15:02 - 2016-08-22 17:19 - 01386496 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2016-12-28 15:01 - 2016-11-02 16:32 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2016-12-28 15:01 - 2016-11-02 16:32 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2016-12-28 15:01 - 2016-11-02 16:32 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2016-12-28 15:01 - 2016-11-02 16:32 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2016-12-28 15:01 - 2016-11-02 16:16 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2016-12-28 15:01 - 2016-11-02 16:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2016-12-28 15:01 - 2016-11-02 16:16 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2016-12-28 15:01 - 2016-11-02 15:53 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2016-12-28 15:01 - 2016-10-15 16:31 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll
2016-12-28 15:01 - 2016-10-15 16:13 - 00084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\INETRES.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-25 13:24 - 2015-06-20 10:07 - 00001220 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3705937506-1407253618-1579061599-1000UA.job
2017-01-25 13:22 - 2014-08-20 11:40 - 00000000 ____D C:\FRST
2017-01-25 09:35 - 2009-07-14 05:45 - 00022080 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-01-25 09:35 - 2009-07-14 05:45 - 00022080 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-01-25 09:34 - 2016-10-12 19:58 - 00000000 ____D C:\Users\Public\Documents\AdobeGC
2017-01-25 09:32 - 2009-07-14 06:13 - 00797422 _____ C:\Windows\system32\PerfStringBackup.INI
2017-01-25 09:32 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2017-01-25 09:29 - 2014-04-10 10:59 - 00000000 ___RD C:\Users\user\Dropbox
2017-01-25 09:28 - 2016-08-12 20:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-01-25 09:28 - 2015-09-18 21:49 - 00000000 ____D C:\Users\user\AppData\Roaming\Spotify
2017-01-25 09:27 - 2015-09-18 21:50 - 00000000 ____D C:\Users\user\AppData\Local\Spotify
2017-01-25 09:26 - 2014-01-15 19:26 - 00000000 ____D C:\Users\user\AppData\Roaming\Skype
2017-01-25 09:26 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-01-25 09:19 - 2015-11-17 21:01 - 00000000 ____D C:\Users\user\AppData\LocalLow\Temp
2017-01-25 09:05 - 2013-12-08 01:41 - 00000000 ____D C:\Users\user\AppData\Local\Google
2017-01-25 09:05 - 2013-12-08 01:41 - 00000000 ____D C:\Program Files (x86)\Google
2017-01-25 08:48 - 2016-02-03 22:15 - 00000000 ___RD C:\Users\user\OneDrive
2017-01-25 08:48 - 2016-02-03 22:15 - 00000000 ____D C:\Program Files (x86)\Microsoft OneDrive
2017-01-24 21:23 - 2015-06-20 10:07 - 00001168 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3705937506-1407253618-1579061599-1000Core.job
2017-01-24 19:10 - 2014-04-10 10:55 - 00000000 ____D C:\Users\user\AppData\Roaming\Dropbox
2017-01-22 16:38 - 2014-01-18 08:16 - 00000000 ____D C:\Users\user\AppData\Roaming\vlc
2017-01-22 13:19 - 2016-01-12 20:23 - 00002453 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat DC.lnk
2017-01-22 13:02 - 2016-09-17 11:44 - 02755911 ____H C:\Users\user\AppData\Local\IconCache.db.backup
2017-01-22 12:15 - 2015-08-13 17:49 - 00000000 ____D C:\AdwCleaner
2017-01-20 18:25 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2017-01-19 19:41 - 2014-08-05 22:41 - 00811108 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2017-01-19 12:07 - 2016-05-26 18:16 - 00003844 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1464282961
2017-01-19 12:07 - 2016-05-26 18:15 - 00000000 ____D C:\Program Files (x86)\Opera
2017-01-15 20:59 - 2013-12-08 03:14 - 00000000 ____D C:\Users\user\AppData\Roaming\Adobe
2017-01-14 20:45 - 2016-02-03 21:56 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-01-14 20:41 - 2016-02-03 21:53 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2017-01-14 12:09 - 2013-12-08 02:11 - 00000000 ____D C:\Windows\system32\MRT
2017-01-14 12:05 - 2013-12-08 02:11 - 135657872 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-01-13 13:18 - 2016-01-12 20:23 - 00002037 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller DC.lnk
2017-01-13 10:24 - 2014-12-25 13:21 - 00004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2017-01-08 11:39 - 2009-07-14 05:45 - 00455784 _____ C:\Windows\system32\FNTCACHE.DAT
2016-12-29 10:07 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\catroot
2016-12-29 10:06 - 2009-07-14 04:20 - 00000000 ___SD C:\ProgramData\Microsoft
2016-12-29 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\migration
2016-12-29 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\migration
2016-12-29 09:44 - 2013-12-08 01:44 - 00002117 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2016-12-29 09:44 - 2013-12-08 01:44 - 00001945 _____ C:\Windows\epplauncher.mif
2016-12-29 09:44 - 2013-12-08 01:44 - 00000000 ____D C:\Program Files\Microsoft Security Client
2016-12-29 09:44 - 2013-12-08 01:44 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2016-12-26 23:05 - 2016-08-12 14:31 - 00000000 ____D C:\Users\Guest\AppData\Local

==================== Files in the root of some directories =======

2015-05-01 20:23 - 2015-05-01 20:23 - 1065984 _____ () C:\Users\user\AppData\Local\file__0.localstorage
2014-01-27 16:16 - 2014-01-27 16:16 - 0000337 _____ () C:\Users\user\AppData\Local\Perfmon.PerfmonCfg

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-01-23 18:57

==================== End of FRST.txt ============================
--- --- ---

--- --- ---

--- --- ---

Dominik H. 25.01.2017 13:34
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-01-2017
Ran by user (25-01-2017 13:24:12)
Running from C:\Users\user\Desktop
Windows 7 Professional Service Pack 1 (X64) (2013-12-08 00:14:01)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3705937506-1407253618-1579061599-500 - Administrator - Disabled)
Guest (S-1-5-21-3705937506-1407253618-1579061599-501 - Limited - Enabled) => C:\Users\Guest
HomeGroupUser$ (S-1-5-21-3705937506-1407253618-1579061599-1002 - Limited - Enabled)
user (S-1-5-21-3705937506-1407253618-1579061599-1000 - Administrator - Enabled) => C:\Users\user

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {71A27EC9-3DA6-45FC-60A7-004F623C6189}
AS: Microsoft Security Essentials (Enabled - Up to date) {CAC39F2D-1B9C-4A72-5A17-3B3D19BB2B34}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

1&1 Surf-Stick (HKLM-x32\...\{7438DA7D-782C-450F-BCDC-5FC54E6831B8}) (Version: 1.0.0.2 - ZTE Corporation)
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
Adobe Acrobat DC (HKLM-x32\...\{AC76BA86-1033-FFFF-7760-0C0F074E4100}) (Version: 15.023.20056 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 21 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 21.0.0.242 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 5.4 64-bit (HKLM\...\{558B5965-CC1B-4AF1-BA07-5D6832404050}) (Version: 5.4.0 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
CDisplayEx 1.10.18 (HKLM-x32\...\CDisplayEx_is1) (Version:  - cdisplayex.com)
Cisco Systems VPN Client 5.0.07.0440 (HKLM\...\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}) (Version: 5.0.7 - Cisco Systems, Inc.)
Cliqz (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.22 - Cliqz.com)
Clonk Planet (HKLM-x32\...\Clonk Planet) (Version: 4.65 - RedWolf Design)
Cold Turkey version 0.9 (HKLM\...\{6498E673-B9C2-4544-A722-1E854B5B573E}_is1) (Version: 0.9 - Felix Belzile)
Command & Conquer Tiberian Sun (HKLM-x32\...\{52F25D7D-DEE1-42E7-AB48-D0F014E1F795}_is1) (Version:  - Command & Conquer Communications Center)
Conexant 20585 SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.95.49.53 - Conexant)
Dia (nur entfernen) (HKLM-x32\...\Dia) (Version:  - )
Dota 2 (HKLM-x32\...\Steam App 570) (Version:  - Valve)
Dropbox (HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Dropbox) (Version: 18.4.32 - Dropbox, Inc.)
Exact Audio Copy 1.0beta3 (HKLM-x32\...\Exact Audio Copy) (Version: 1.0beta3 - Andre Wiethoff)
Free YouTube to MP3 Converter version 3.12.42.716 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.42.716 - DVDVideoSoft Ltd.)
Futuremark SystemInfo (HKLM-x32\...\{BEE64C14-BEF1-4610-8A68-A16EAA47B882}) (Version: 4.15.0 - Futuremark Corporation)
Google Earth (HKLM-x32\...\{A0C18B96-AB79-46BD-8321-6FA83E6D25B9}) (Version: 7.1.7.2606 - Google)
Google Earth Pro (HKLM-x32\...\{44FC61F0-2F8A-11E3-8CAE-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
GPL Ghostscript 8.71 (HKLM\...\GPL Ghostscript 8.71) (Version:  - )
GSview 5.0 (HKLM\...\GSview 5.0) (Version: 5.0 - Ghostgum Software Pty Ltd)
Half-Life 2: Demo (HKLM-x32\...\Steam App 219) (Version:  - Valve)
Image Composite Editor (HKLM\...\{92AB5708-1AAA-4B1B-A8D5-45CF3AD77519}) (Version: 2.0.3 - Microsoft Corporation)
InfraRecorder 0.53 (x64 edition) (HKLM\...\{2C22EA92-CB30-4932-0053-000001000000}) (Version: 0.53.00.00 - Christian Kindahl)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 18.7 - Intel)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version:  - )
Lenovo Battery Utility 2014 1.2 (HKLM-x32\...\{62D5A67D-E5CC-4D79-8998-DDFDB7750346}_is1) (Version: 1.2 - Lenovo Corp)
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.03.13 - )
Malwarebytes Version 3.0.5.1299 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.0.5.1299 - Malwarebytes)
Medieval II Total War (HKLM-x32\...\{C0698BDA-0D29-40EE-8570-A31106DF9AB1}) (Version: 1.00.0000 - SEGA)
Meltdown (HKLM-x32\...\{673B2230-6035-11DE-6784-5813CA2118BE}) (Version: 3 - Poda)
Metro 2033 Demo (HKLM-x32\...\{74027A70-698F-49B4-969D-AA64BE2A8D8B}_is1) (Version:  - THQ)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 365 Business - de-de (HKLM\...\O365BusinessRetail - de-de) (Version: 16.0.7571.2109 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\OneDriveSetup.exe) (Version: 17.3.6743.1212 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.10.209.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MiKTeX 2.9 (HKLM\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
Mobile Partner (HKLM-x32\...\Mobile Partner) (Version: 23.015.11.00.382 - Huawei Technologies Co.,Ltd)
Mozilla Firefox 38.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.5 (x86 de)) (Version: 38.0.5 - Mozilla)
Mozilla Firefox 43.0.1 (x86 de) (HKU\S-1-5-21-3705937506-1407253618-1579061599-501\...\Mozilla Firefox 43.0.1 (x86 de)) (Version: 43.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 45.1.1.5990 - Mozilla)
Mozilla Thunderbird 24.2.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.2.0 (x86 de)) (Version: 24.2.0 - Mozilla)
Mozilla Thunderbird 45.1.1 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 45.1.1 (x86 de)) (Version: 45.1.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MuseScore 2 (HKLM-x32\...\{D0969A82-E79E-45D9-95D2-B2824880F780}) (Version: 2.0.2 - Werner Schweer and Others)
No More Room in Hell (HKLM-x32\...\Steam App 224260) (Version:  - No More Room in Hell Team)
NVIDIA Graphics Driver 327.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.23 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{54194F60-988C-4D03-B922-C2B00EFDA39A}) (Version: 9.10.0222 - NVIDIA Corporation)
Office 16 Click-to-Run Extensibility Component (x32 Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (x32 Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
online-foto Bestellsoftware (HKLM-x32\...\online-foto Bestellsoftware) (Version: 5.1.7 - CEWE Stiftung u Co. KGaA)
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
OpenOffice 4.0.1 (HKLM-x32\...\{47F460DA-D1BE-4D85-8DF2-AA1F31D3445F}) (Version: 4.01.9714 - Apache Software Foundation)
OpenProj (HKLM-x32\...\{13702021-43FB-480C-912F-D9B74A538288}) (Version: 1.4.0 - Serena Software Inc.)
Opera Stable 42.0.2393.137 (HKLM-x32\...\Opera 42.0.2393.137) (Version: 42.0.2393.137 - Opera Software)
Painkiller Demo (HKLM-x32\...\Steam App 3210) (Version:  - People Can Fly)
Painkiller Hell & Damnation Demo (HKLM-x32\...\Steam App 223370) (Version:  - The Farm 51)
paint.net (HKLM\...\{19BD2C33-16A8-4ED1-B9EA-D9E35B21EC42}) (Version: 4.0.5 - dotPDN LLC)
QGIS Dufour 2.0.1 Dufour (HKLM\...\QGIS Dufour) (Version:  - QGIS Development Team)
Quake Live (HKLM-x32\...\Steam App 282440) (Version:  - id Software)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
SereneScreen Marine Aquarium 2 (HKLM-x32\...\SereneScreen Marine Aquarium 2_is1) (Version: 2.0 - Prolific Publishing, Inc.)
SketchUp 2015 (HKLM\...\{A83795B9-570F-40FF-ACB4-710B568EBA22}) (Version: 15.3.331 - Trimble Navigation Limited)
Skype™ 7.18 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.18.111 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\...\Spotify) (Version: 1.0.45.186.g3b5036d6 - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
StreamTransport version: 1.1.6.1 (HKLM-x32\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version:  - )
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
TeamViewer 11 (HKLM-x32\...\TeamViewer) (Version: 11.0.66695 - TeamViewer)
TeXnicCenter Version 2.02 Stable (HKLM\...\TeXnicCenter_is1) (Version: 2.02 Stable - The TeXnicCenter Team)
Tinypic 3.18 (HKLM-x32\...\{E3723A04-A894-4036-A78E-282E18F43C0A}_is1) (Version: Tinypic 3.18 - E. Fiedler)
Unigine Valley Benchmark version 1.0 (HKLM-x32\...\Unigine Valley Benchmark_is1) (Version: 1.0 - Unigine Corp.) <==== ATTENTION
VLC media player 2.1.1 (HKLM-x32\...\VLC media player) (Version: 2.1.1 - VideoLAN)
War2Combat 3.05 (HKLM-x32\...\War2Combat_is1) (Version: 3.05 - il)
WAV To MP3 V2 (HKLM-x32\...\WAV To MP3_is1) (Version:  - hxxp://www.WAVMP3.net)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WinRAR 5.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
XSManager (HKLM-x32\...\XSManager) (Version: 3.2 - XSManager)
YANG (Yet Another Netplay Guider) (HKLM-x32\...\YANG) (Version:  - )
yEd Graph Editor 3.11.1 (HKLM-x32\...\3309-7404-0599-8908) (Version: 3.11.1 - yWorks GmbH)
ZDaemon (remove only) (HKLM-x32\...\ZDaemon) (Version:  - )
ZDServer (HKLM-x32\...\{C8197F5F-E0DC-44f1-8AF2-1AA5A84F695D}) (Version: 1.0.1.2 - ZTE Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{162C6FB5-44D3-435B-903D-E613FA093FB5}\InprocServer32 -> C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\amd64\FileCoAuthLib64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3705937506-1407253618-1579061599-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.11.0.dll (Dropbox, Inc.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {05F64073-CD20-4C58-9269-A4DCE9F29752} - System32\Tasks\{8661ED1F-3571-4265-A579-5F7FBB9315C0} => Firefox.exe hxxp://ui.skype.com/ui/0/7.27.64.101/de/abandoninstall?page=tsMain
Task: {343FA0EC-472E-4898-A351-72A150107C9E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {5BE089BD-0064-4D1C-88C5-0D97F35960D9} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-12-19] (Adobe Systems Incorporated)
Task: {64A798E8-C7F2-4A31-8F01-EB9DA0C0507D} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-12-28] (Microsoft Corporation)
Task: {6ED1EFC9-583E-4C07-B289-5FCBD1B3F776} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\\MpCmdRun.exe [2016-11-14] (Microsoft Corporation)
Task: {A25576EC-6A2A-4DB2-A7EB-5E784629C973} - System32\Tasks\{7728094E-8498-4266-BA28-E921C2676EDE} => pcalua.exe -a "C:\Dominik\Programme\Virenschutz\RevoUninstaller\Revo Uninstaller\Revouninstaller.exe" -d "C:\Dominik\Programme\Virenschutz\RevoUninstaller\Revo Uninstaller"
Task: {B162D77B-0A94-4408-B4D7-634FC86C033F} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-3705937506-1407253618-1579061599-1000Core => C:\Users\user\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-11-05] (Dropbox, Inc.)
Task: {B3B3FAA1-D1C3-451E-B168-0A6809385D78} - System32\Tasks\Opera scheduled Autoupdate 1464282961 => C:\Program Files (x86)\Opera\launcher.exe [2017-01-16] (Opera Software)
Task: {C630EE30-91AF-4826-84E7-E9CD8A4E0098} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-3705937506-1407253618-1579061599-1000UA => C:\Users\user\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-11-05] (Dropbox, Inc.)
Task: {D17C79C6-2BC0-453A-806B-A2CBABEBC727} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-12-28] (Microsoft Corporation)
Task: {E1271D86-7755-4B6D-92EE-686C911254D9} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2016-12-29] (Microsoft Corporation)
Task: {E2EB2F22-B9FF-4D3D-996D-5D06AD57806A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3705937506-1407253618-1579061599-1000Core.job => C:\Users\user\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3705937506-1407253618-1579061599-1000UA.job => C:\Users\user\AppData\Local\Dropbox\Update\DropboxUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2013-12-28 22:48 - 2013-09-12 08:25 - 00097568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-01-30 22:58 - 2013-12-08 01:04 - 00062976 _____ () C:\Program Files\Cold Turkey\CTService.exe
2014-01-30 22:58 - 2012-12-21 16:54 - 00006656 _____ () C:\Program Files\Cold Turkey\NetworkTime.dll
2014-01-30 22:58 - 2013-10-27 10:04 - 00557056 _____ () C:\Program Files\Cold Turkey\CTConfigServer.exe
2016-09-22 09:45 - 2014-12-02 10:28 - 00651856 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
2015-03-12 09:13 - 2013-05-06 14:45 - 00329848 ____N () C:\Program Files (x86)\XSManager\WTGService.exe
2015-03-11 21:04 - 2014-07-07 17:34 - 00427264 _____ () C:\ProgramData\ZDSupport\ZDServ\ZDServ.exe
2017-01-22 12:37 - 2016-12-14 12:55 - 02259232 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll
2017-01-22 12:37 - 2016-12-14 12:55 - 02813904 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\arwlib.dll
2015-03-11 21:04 - 2014-07-07 17:34 - 00426752 _____ () C:\ProgramData\ZDSupport\ZDServ\CancelAutoPlay_Server.exe
2011-03-04 12:49 - 2011-03-04 12:49 - 00202752 _____ () C:\Dominik\Programme\ciscoclient\vpnapi.dll
2016-09-22 09:45 - 2013-08-31 06:44 - 02417152 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtCore4.dll
2016-09-22 09:45 - 2009-01-10 19:32 - 00011362 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\mingwm10.dll
2016-09-22 09:45 - 2009-06-23 03:42 - 00043008 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\libgcc_s_dw2-1.dll
2016-09-22 09:45 - 2013-08-31 06:46 - 01148416 _____ () C:\ProgramData\Mobile Partner\OnlineUpdate\QtNetwork4.dll
2017-01-24 19:09 - 2017-01-18 19:39 - 00801600 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\dropbox_watchdog.dll
2017-01-24 19:09 - 2016-12-21 09:44 - 00035792 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\_multiprocessing.pyd
2017-01-24 19:09 - 2016-12-21 09:44 - 00100296 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\_ctypes.pyd
2017-01-24 19:09 - 2016-12-21 09:44 - 00018888 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\select.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00019776 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\tornado.speedups.pyd
2017-01-24 19:09 - 2016-12-21 09:44 - 00694224 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\unicodedata.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00020824 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._constant_time.pyd
2017-01-24 19:09 - 2016-12-21 09:45 - 00123856 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\_cffi_backend.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 01682768 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._openssl.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00020816 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\cryptography.hazmat.bindings._padding.pyd
2017-01-24 19:09 - 2016-12-21 09:44 - 00145864 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\pyexpat.pyd
2017-01-24 19:09 - 2016-12-21 09:45 - 00019408 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\faulthandler.pyd
2017-01-24 19:09 - 2016-12-21 09:44 - 00116688 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\pywintypes27.dll
2017-01-24 19:09 - 2016-12-21 09:46 - 00105928 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32api.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00022864 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\winffi.crt.compiled._winffi_crt.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00052032 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\psutil._psutil_windows.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00038712 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\fastpath.pyd
2017-01-24 19:09 - 2016-12-21 09:44 - 00392144 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\pythoncom27.dll
2017-01-24 19:09 - 2016-12-21 09:46 - 00020936 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\mmapfile.pyd
2017-01-24 19:09 - 2016-12-21 09:46 - 00024528 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32event.pyd
2017-01-24 19:09 - 2016-12-21 09:47 - 00116176 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32security.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00381760 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32com.shell.shell.pyd
2017-01-24 19:09 - 2016-12-21 09:46 - 00124880 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32file.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00026456 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\winffi.kernel32.compiled._winffi_kernel32.pyd
2017-01-24 19:09 - 2016-12-21 09:46 - 00024016 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32clipboard.pyd
2017-01-24 19:09 - 2016-12-21 09:46 - 00175560 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32gui.pyd
2017-01-24 19:09 - 2016-12-21 09:46 - 00030160 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32pipe.pyd
2017-01-24 19:09 - 2016-12-21 09:46 - 00043472 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32process.pyd
2017-01-24 19:09 - 2016-12-21 09:47 - 00048592 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32service.pyd
2017-01-24 19:09 - 2016-12-21 09:46 - 00057808 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32evtlog.pyd
2017-01-24 19:09 - 2016-12-21 09:46 - 00024016 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32profile.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00246608 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\breakpad.client.windows.handler.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00027488 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\dropbox.infinite.win.compiled._driverinstallation.pyd
2017-01-24 19:09 - 2016-12-21 09:45 - 00241104 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\_jpegtran.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00022336 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\cpuid.compiled._cpuid.pyd
2017-01-24 19:09 - 2016-12-21 09:47 - 00028616 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32ts.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00025432 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\winscreenshot.compiled._CaptureScreenshot.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00022872 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\winffi.iphlpapi.compiled._winffi_iphlpapi.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00021848 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\winffi.winerror.compiled._winffi_winerror.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00022872 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\winffi.wininet.compiled._winffi_wininet.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 01826104 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\PyQt5.QtCore.pyd
2017-01-24 19:09 - 2016-12-21 09:45 - 00083912 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\sip.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00531264 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\PyQt5.QtNetwork.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 03928896 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\PyQt5.QtWidgets.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 01972536 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\PyQt5.QtGui.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00133432 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKit.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00224064 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\PyQt5.QtWebKitWidgets.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00207680 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\PyQt5.QtPrintSupport.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00021840 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\winffi.user32.compiled._winffi_user32.pyd
2017-01-24 19:09 - 2016-12-21 09:47 - 00350152 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\winxpgui.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00023896 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\winverifysignature.compiled._VerifySignature.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00025936 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\librsyncffi.compiled._librsyncffi.pyd
2017-01-24 19:09 - 2016-12-21 09:42 - 00036296 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\librsync.dll
2017-01-24 19:09 - 2017-01-18 19:42 - 00084288 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\dropbox_sqlite_ext.DLL
2017-01-24 19:09 - 2016-12-21 09:50 - 00017864 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\libEGL.dll
2017-01-24 19:09 - 2016-12-21 09:50 - 01631184 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2017-01-24 19:09 - 2017-01-18 19:42 - 00042816 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\PyQt5.QtWebChannel.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00171336 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\PyQt5.QtWebEngineWidgets.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00357688 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\PyQt5.QtQml.pyd
2017-01-24 19:09 - 2016-12-21 09:46 - 00060880 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\win32print.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00026456 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\winffi.winhttp.compiled._winffi_winhttp.pyd
2017-01-24 19:09 - 2017-01-18 19:42 - 00546104 _____ () C:\Users\user\AppData\Roaming\Dropbox\bin\PyQt5.QtQuick.pyd
2015-03-17 01:34 - 2015-03-17 01:34 - 00010240 _____ () C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\locale\de_de\acrotray.deu

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2016-08-15 13:29 - 00000278 ____R C:\Windows\system32\Drivers\etc\hosts

127.0.0.1      localhost



































































































==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3705937506-1407253618-1579061599-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-3705937506-1407253618-1579061599-501\Control Panel\Desktop\\Wallpaper -> C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is disabled.

==================== MSCONFIG/TASK MANAGER disabled items ==


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => %SystemRoot%\system32\sppsvc.exe
FirewallRules: [TCP Query User{9521B3B1-64C2-484C-9E5E-477B3E068843}C:\program files (x86)\gsc world publishing\s.t.a.l.k.e.r. ìóëüòèïëååð\bin\xr_3da.exe] => C:\program files (x86)\gsc world publishing\s.t.a.l.k.e.r. ìóëüòèïëååð\bin\xr_3da.exe
FirewallRules: [UDP Query User{0186AE12-FED2-4ED2-81DA-D482E8E0D00F}C:\program files (x86)\gsc world publishing\s.t.a.l.k.e.r. ìóëüòèïëååð\bin\xr_3da.exe] => C:\program files (x86)\gsc world publishing\s.t.a.l.k.e.r. ìóëüòèïëååð\bin\xr_3da.exe
FirewallRules: [TCP Query User{462A49B6-9A3B-40B1-98A5-472C77761E66}C:\programme\yed\yed.exe] => C:\programme\yed\yed.exe
FirewallRules: [UDP Query User{00F14B30-F1C7-409F-A696-96549D995D2C}C:\programme\yed\yed.exe] => C:\programme\yed\yed.exe
FirewallRules: [{B49643CE-673C-441F-8CB1-037D0FACB36D}] => C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{F3AF97AD-A720-4061-948E-9176F6DD282D}] => C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{9C16A566-EEEA-482A-869A-160142998928}C:\users\user\appdata\roaming\dropbox\bin\dropbox.exe] => C:\users\user\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{B3116B0B-9865-4CEF-AB6B-9593D7EF7F0B}C:\users\user\appdata\roaming\dropbox\bin\dropbox.exe] => C:\users\user\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [TCP Query User{98720FB8-E084-429A-853C-049B411263BD}C:\dominik\sonstiges\spiele\commandandconquer\game.exe] => C:\dominik\sonstiges\spiele\commandandconquer\game.exe
FirewallRules: [UDP Query User{E8C44E1B-599C-41B8-A4CC-DC80A19532CA}C:\dominik\sonstiges\spiele\commandandconquer\game.exe] => C:\dominik\sonstiges\spiele\commandandconquer\game.exe
FirewallRules: [TCP Query User{B5FC9B5B-67D2-40A8-8FF3-8E6B754F727F}C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe] => C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe
FirewallRules: [UDP Query User{AD592A74-B612-43BB-9B1B-818AEF8034F3}C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe] => C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe
FirewallRules: [TCP Query User{254C91A3-9EE1-4BBE-A86E-85263691D0DC}C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\duke matcher 1.0\duke matcher\dukematcher.exe] => C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\duke matcher 1.0\duke matcher\dukematcher.exe
FirewallRules: [UDP Query User{40E81D0A-B19A-47CA-AF53-5295099F9506}C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\duke matcher 1.0\duke matcher\dukematcher.exe] => C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\duke matcher 1.0\duke matcher\dukematcher.exe
FirewallRules: [TCP Query User{D1121D48-5DA4-47F3-89FD-F26CBF52FFA0}C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\yang\yang.exe] => C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\yang\yang.exe
FirewallRules: [UDP Query User{210E18D4-D37A-4F69-AA08-CAAE9E92634F}C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\yang\yang.exe] => C:\dominik\sonstiges\spiele\dukennukem3d\duke matcher - windows client\yang\yang.exe
FirewallRules: [TCP Query User{8C6478E0-8A42-459A-876C-900383A1315D}C:\dominik\sonstiges\spiele\war2combat\warcraft ii bne.exe] => C:\dominik\sonstiges\spiele\war2combat\warcraft ii bne.exe
FirewallRules: [UDP Query User{75E7DD15-3E99-4B2C-8352-EC4212AEC9D9}C:\dominik\sonstiges\spiele\war2combat\warcraft ii bne.exe] => C:\dominik\sonstiges\spiele\war2combat\warcraft ii bne.exe
FirewallRules: [TCP Query User{C29D7DAE-6848-4B7A-87AB-81D0513F5793}C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe] => C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe
FirewallRules: [UDP Query User{157FD495-46FE-468F-A1C0-8F24A69740C7}C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe] => C:\dominik\sonstiges\spiele\tiberian sun\tiberian sun.exe
FirewallRules: [{F1524149-1CCF-40A9-9845-C4C23F26104A}] => C:\Dominik\sonstiges\spiele\steam\Steam.exe
FirewallRules: [{DA1297BC-F638-4726-B4E8-D4449DE4ED91}] => C:\Dominik\sonstiges\spiele\steam\Steam.exe
FirewallRules: [{CB6F7F79-40DA-483C-85F7-67FB9FD7E5FF}] => C:\Dominik\sonstiges\spiele\steam\bin\steamwebhelper.exe
FirewallRules: [{B3C18334-6D0B-4674-B3D2-BB63370F0CD0}] => C:\Dominik\sonstiges\spiele\steam\bin\steamwebhelper.exe
FirewallRules: [{F2266684-5CBF-4D69-8EC6-34957747C67E}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Half-Life 2\hl2.exe
FirewallRules: [{378C492B-7394-46AF-A582-BB659D6D0B65}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Half-Life 2\hl2.exe
FirewallRules: [{9ADBDC08-51C6-4E6F-8B0E-1E2E917EE54D}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\nmrih\sdk\hl2.exe
FirewallRules: [{04231C4A-E445-4D5D-8C7B-4FE4D25D7703}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\nmrih\sdk\hl2.exe
FirewallRules: [{62B22E62-4C1B-451E-A4E3-EEDEA3DEED74}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Painkiller Hell & Damnation Demo\Binaries\Win32\PKHDGame-Win32-Shipping.exe
FirewallRules: [{3E2C22D8-AAC5-4ED1-93DE-C2750F577CE5}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Painkiller Hell & Damnation Demo\Binaries\Win32\PKHDGame-Win32-Shipping.exe
FirewallRules: [{0E4D3E4D-AAFD-40AA-9538-48886017B085}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Quake Live\quakelive_steam.exe
FirewallRules: [{6D53EF41-9530-4E1E-B9C6-163F1C47C677}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Quake Live\quakelive_steam.exe
FirewallRules: [{FC32617B-A2B1-4FFA-AD55-834297D9EA7F}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Painkiller Demo\Bin\PainGame.exe
FirewallRules: [{833E9490-E8F4-4353-A889-D61125DAC61C}] => C:\Dominik\sonstiges\spiele\steam\SteamApps\common\Painkiller Demo\Bin\PainGame.exe
FirewallRules: [{A7C85A09-6500-4071-A861-0E467B36FDA8}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{63D0D9E9-D6D6-4498-8287-5BF133F2CB49}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4F92E3F2-D8B0-40EB-BFAB-ED124C808E3D}] => C:\Dominik\sonstiges\spiele\Meltdown.exe
FirewallRules: [{70686225-14CA-4B71-BC37-291DC3463A53}] => C:\Dominik\sonstiges\spiele\Meltdown.exe
FirewallRules: [{7CA644FD-0789-483C-9693-2907B841ABD3}] => C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{34335651-6E5E-4ABC-A7EC-960A60A4F0F6}] => C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{8512BBE7-88DD-40A1-8C0C-A850D7092A9B}] => C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{E5F2C46D-366C-4FA7-A350-1FD52A9BF749}] => C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{7148B556-CB31-4867-86F5-38859D93B4DD}] => C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{90BEB6D8-E1B5-42E2-988A-AD43626888B4}] => C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{12B90CEF-EA1B-4B66-A14F-ED8AC56EC44C}] => C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{A63E9E6D-0616-4525-BD4B-0C18CE2CA27A}] => C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{9C832647-D59C-44FA-9314-26D52F9ECAD2}] => C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{F3195A86-A3C6-4686-B36F-B98DBB62F511}] => C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{0494DE03-CAF2-4A2D-A77E-EDD96427B0D8}] => C:\Program Files (x86)\Opera\42.0.2393.137\opera.exe

==================== Restore Points =========================

22-01-2017 11:52:52 Windows Update
22-01-2017 13:14:56 JRT Pre-Junkware Removal

==================== Faulty Device Manager Devices =============

Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/25/2017 01:10:49 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Users\user\Downloads\esetsmartinstaller_deu.exe".Error in manifest or policy file "" on line .
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.

Error: (01/25/2017 01:07:33 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe".Error in manifest or policy file "" on line .
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.

Error: (01/25/2017 09:31:03 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Users\user\Desktop\esetsmartinstaller_deu(1).exe".Error in manifest or policy file "" on line .
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.

Error: (01/25/2017 09:30:58 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Users\user\Desktop\esetsmartinstaller_deu(1).exe".Error in manifest or policy file "" on line .
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.

Error: (01/25/2017 09:30:54 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Users\user\Desktop\esetsmartinstaller_deu(1).exe".Error in manifest or policy file "" on line .
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.

Error: (01/25/2017 09:27:08 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (01/25/2017 09:15:05 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (01/25/2017 09:11:21 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (01/24/2017 07:04:22 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (01/23/2017 07:03:33 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Activation context generation failed for "c:\program files (x86)\microsoft office\root\Office16\lync.exe.Manifest".Error in manifest or policy file "c:\program files (x86)\microsoft office\root\Office16\UccApi.DLL" on line 1.
Component identity found in manifest does not match the identity of the component requested.
Reference is UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0".
Definition is UccApi,processorArchitecture="x86",type="win32",version="16.0.0.0".
Please use sxstrace.exe for detailed diagnosis.


System errors:
=============
Error: (01/25/2017 09:53:22 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The eapihdrv service failed to start due to the following error:
This driver has been blocked from loading

Error: (01/25/2017 09:53:22 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\user\AppData\Local\Temp\ehdrv.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Error: (01/25/2017 09:53:21 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The eapihdrv service failed to start due to the following error:
This driver has been blocked from loading

Error: (01/25/2017 09:53:21 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\user\AppData\Local\Temp\ehdrv.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Error: (01/25/2017 09:53:21 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The eapihdrv service failed to start due to the following error:
This driver has been blocked from loading

Error: (01/25/2017 09:53:21 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\user\AppData\Local\Temp\ehdrv.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Error: (01/25/2017 09:33:15 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The eapihdrv service failed to start due to the following error:
This driver has been blocked from loading

Error: (01/25/2017 09:33:15 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\user\AppData\Local\Temp\ehdrv.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Error: (01/25/2017 09:33:13 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The eapihdrv service failed to start due to the following error:
This driver has been blocked from loading

Error: (01/25/2017 09:33:13 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\user\AppData\Local\Temp\ehdrv.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.


CodeIntegrity:
===================================
  Date: 2017-01-25 13:19:36.717
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-25 13:19:35.529
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-25 13:17:36.616
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-25 13:12:13.639
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-25 13:09:45.509
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-25 13:08:59.637
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-25 13:08:58.055
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-25 13:08:55.066
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-25 13:08:51.080
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.

  Date: 2017-01-25 13:08:36.524
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CX64CQ17.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7 CPU M 620 @ 2.67GHz
Percentage of memory in use: 45%
Total physical RAM: 8051.67 MB
Available physical RAM: 4365.8 MB
Total Virtual: 16101.53 MB
Available Virtual: 12448.54 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:381.42 GB) (Free:52.31 GB) NTFS
Drive d: (DVDVOLUME) (CDROM) (Total:7.71 GB) (Free:0 GB) UDF
Drive g: (CANON_DC) (Removable) (Total:15.01 GB) (Free:14.34 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: DE2F4001)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=381.4 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=84.2 GB) - (Type=05)

========================================================
Disk: 1 (Size: 15 GB) (Disk ID: 00000000)

Partition: GPT.

==================== End of Addition.txt ============================
Das Mausproblem besteht leider nach wie vor. Die rechte Maustaste funktioniert überhaupt nicht (mit externer Maus allerdings schon).

Kann es sich evtl. hierbei schlicht um einen Hardewarefehler handeln? Ich habe auf dem Rechner ebenfalls Linux installiert und auch dort tritt der Mausfehler auf. Allerdings auch bei der externen Maus (!). :confused::confused:

Danke und Grüße
Dominik

PS: War mein Windowssystem stark verunreinigt?

M-K-D-B 25.01.2017 16:02
Servus,


nein, dein Windows war nicht stark verunreinigt. Wir haben nur etwas unerwünschte Software entfernt.
Ich glaube allerdings auch, dass Malware nicht dein Problem ist, sondern ein Hardware- oder Treiberpoblem.


Wenn du keine Probleme mehr mit Malware hast, dann sind wir hier fertig. Deine Logdateien sind sauber. :daumenhoc
Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern.




http://deeprybka.trojaner-board.de/b...cleanupneu.png
Cleanup:
Alle Logs gepostet? Dann lade Dir bitte http://filepony.de/icon/tiny/delfix.pngDelFix herunter.
  • Schließe alle offenen Programme.
  • Starte die delfix.exe mit einem Doppelklick.
  • Setze vor jede Funktion ein Häkchen.
  • Klicke auf Start.
Hinweis:
DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner anschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.




http://deeprybka.trojaner-board.de/b...ast/schild.png
Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:
[/url] Java
 Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.




Sofern du noch unentschieden bist, verwende ein einziges der folgenden Antivirusprogramme mit Echtzeitscanner und stets aktueller Signaturendatenbank:

   
 

Microsoft Security Essentials (MSE) / Windows Defender (WD) ist ab Windows 8 fest eingebaut, wenn du also Windows 8, 8.1 oder 10 und dich für MSE/WD entschieden hast, brauchst du nicht extra MSE/WD zu installieren. Bei Windows 7 muss es aber manuell installiert oder über die Windows Updates als optionales Update bezogen werden. Selbstverständlich ist ein legales/aktiviertes Windows Voraussetzung dafür.




Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.




Optional:
http://filepony.de/icon/adblock_firefox.pngAdblock Plus Kann Banner, Pop-ups, Videowerbung, Tracking und Malware-Seiten blockieren.
http://filepony.de/icon/noscript.png NoScript Verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.

Lade Software von einem sauberen Portal wie http://filepony.de/images/microbanner.gif.
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .




Abschließend noch ein paar grundsätzliche Bemerkungen:
  • Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
  • Lade keine Software von Chip, Softonic oder SourceForge. Die dort angebotene Software wird häufig mit einem sog. "Installer" verteilt, mit dem man sich nur unerwünschte Software oder Adware installiert.
  • Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Selbst Microsoft unterstützt sog. Registry-Cleaner nicht. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.




Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...:dankeschoen:und/oder das Forum mit einer kleinen Spende http://www.trojaner-board.de/extra/spende.png unterstützen. :applaus:

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.

Dominik H. 25.01.2017 20:37
Alles durchgeführt.
Zwei Fragen noch:

- woher weiß ich, welchen Maustreiber ich installieren muss. Kann ich das im System irgendwo nachlesen?

- gibt es ein Proramm, womit ich festlegen kann, welche Programme beim Windowsstart gestartet werden? Würde da gerne etwas eingrenzen...

Danke und Grüße
Dominik

M-K-D-B 26.01.2017 15:58
Servus,


das mit dem Treiber hängt davon ab, welche Maus du von welchem Hersteller verwendest. Ich würde beim jeweiligen Hersteller auf der Homepage nachsehen, ob es spezielle Treiber gibt.


Windows+R - Tasten gleichzeitig drücken > msconfig eingeben > Enter
Dort kannst du alle Programme einsehen, die beim Systemstart mitstarten.




Ich bin froh, dass wir helfen konnten :abklatsch:

In diesem Forum kannst du eine kurze Rückmeldung zur Bereinigung abgeben, sofern du das möchtest:
Lob, Kritik und Wünsche
Klicke dazu auf den Button "NEUES THEMA" und poste ein kleines Feedback. Vielen Dank! :)

Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen.


Alle Zeitangaben in WEZ +1. Es ist jetzt 01:26 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55