Trojaner-Board - Easycalender lässt sich nicht entfernen

Seite 1 von 2

100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Easycalender lässt sich nicht entfernen (https://www.trojaner-board.de/172754-easycalender-laesst-entfernen.html)

Martiba

05.11.2015 12:34

Easycalender lässt sich nicht entfernen

Hallo zusammen,

ich habe seit gestern ein Problem:

Und zwar habe ich mir scheinbar gestern beim runterladen eine Freeware noch paar Malwares o.ä. hinzugezogen.
Ich habe sofort über die Systemsteuerung alles was neu dazu kam deinstalliert allerdings bin ich mir nun nicht sicher ob auch alles weg ist. Denn im Google Chrome Browser befindet sich immer noch das EasyCalender AddOn welches sich nicht löschen lässt da es "Durch Unternehmensrichtlinie installiert" wurde....

Nun plage ich mich auf Chrome durch dutzende Werbebanner rum die meine Surfqualität ziemlich beeinträchtigen.

Über eure Hilfe würde ich mich sehr freuen!

Mit freundlichen Grüßen,
Martin

P.S.:
Das Problem habe ich bereits mit CCleaner und AdwCleaner versucht zu bekämpfen, aber scheinbar ohne Erfolg..

M-K-D-B

05.11.2015 12:57

:hallo:

Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.

Bitte beachte folgende Hinweise:

Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support unterbrechen bis jegliche Art von illegaler Software vom Rechner entfernt wurde.
Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
Solltest du mir nicht innerhalb von 3 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo. Solltest du einmal länger abwesend sein, so gib mir bitte Bescheid!
Während der Bereinigung bitte nichts installieren oder deinstallieren, außer ich bitte dich darum!
Bitte beachten: Download bei filepony.de: So ladet Ihr unsere Tools richtig!
Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort zu starten!

Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags:

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke aauf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

Danke für deine Mitarbeit!

Zur ersten Analyse bitte FRST und TDSS-Killer ausführen:

Schritt 1
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Schritt 2
Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Bitte poste mit deiner nächsten Antwort

die Logdatei von TDSS-Killer,
die beiden neuen Logdateien von FRST.

Martiba

05.11.2015 14:48

Hallo Matthias,

vielen Dank erstmal, dass du mir hilfst!

Anbei der:

FRST.txt:

Code:

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:04-11-2015

durchgeführt von Admin (Administrator) auf PC (05-11-2015 14:32:34)

Gestartet von C:\Users\Admin\Desktop

Geladene Profile: Admin (Verfügbare Profile: Admin)

Platform: Windows 10 Pro (X64) Sprache: Deutsch (Deutschland)

Internet Explorer Version 11 (Standard-Browser: Edge)

Start-Modus: Normal

Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Prozesse (Nicht auf der Ausnahmeliste) =================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
 

(AMD) C:\Windows\System32\atiesrxx.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

() C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe

(@ByELDI) C:\Program Files\KMSpico\Service_KMS.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe

(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe

(cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\spd.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe

(Microsoft Corporation) C:\Windows\System32\browser_broker.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\cfosspeed.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(FNet Co., Ltd.) C:\Program Files (x86)\XFastUSB\XFastUsb.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Kone Pure Mouse\KonePureMonitor.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

() C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe

(Valve Corporation) C:\Program Files (x86)\Steam\GameOverlayUI.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
 
 

==================== Registry (Nicht auf der Ausnahmeliste) ===========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13636824 2013-07-26] (Realtek Semiconductor)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)

HKLM\...\Run: [XFast LAN] => C:\Program Files\ASRock\XFast LAN\cFosSpeed.exe [2009952 2013-05-31] (cFos Software GmbH)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169744 2015-09-12] (Apple Inc.)

HKLM-x32\...\Run: [XFastUSB] => C:\Program Files (x86)\XFastUSB\XFastUsb.exe [6311104 2014-12-15] (FNet Co., Ltd.)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-21] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [RoccatKonePure] => C:\Program Files (x86)\ROCCAT\Kone Pure Mouse\KonePureMonitor.EXE [561152 2014-01-20] (ROCCAT GmbH)

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [GoogleChromeAutoLaunch_A5B343D047FD8BD2F268B0EA0F8DBD7C] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [811848 2015-10-20] (Google Inc.)

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.)

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Spotify Web Helper] => C:\Users\Admin\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2021944 2015-06-17] (Spotify Ltd)

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Spotify] => C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe [7323192 2015-06-17] (Spotify Ltd)

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8551848 2015-10-19] (Piriform Ltd)

HKU\S-1-5-18\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [43816 2015-04-26] (Apple Inc.)

Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2015-02-06]

ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation)

GroupPolicy: Beschränkung - Chrome <======= ACHTUNG

CHR HKLM\SOFTWARE\Policies\Google: Beschränkung <======= ACHTUNG
 

==================== Internet (Nicht auf der Ausnahmeliste) ====================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
 

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

Tcpip\..\Interfaces\{947ba08f-6d7e-4686-b9ff-2806db41b1ff}: [DhcpNameServer] 192.168.0.1
 

Internet Explorer:

==================

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com

BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-09-29] (Microsoft Corporation)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-25] (Google Inc.)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-15] (Microsoft Corporation)

BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-09-29] (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-21] (Oracle Corporation)

BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-25] (Google Inc.)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-15] (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-21] (Oracle Corporation)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-25] (Google Inc.)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-25] (Google Inc.)

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-10-14] (Microsoft Corporation)
 

FireFox:

========

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-09-04] ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-03] (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-03] (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-21] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-21] (Oracle Corporation)

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-03-31] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-19] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-19] (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-09-27] (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-03-31] (Microsoft Corporation)
 

Chrome: 

=======

CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-05]

CHR Extension: (Google Drive) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-23]

CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24]

CHR Extension: (Google-Suche) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-28]

CHR Extension: (LoungeDestroyer) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghahcnmfjfckcedfajbhekgknjdplfcl [2015-10-07]

CHR Extension: (Google Text & Tabellen Offline) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-03]

CHR Extension: (EasyCalendar) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcgcoifbkbphhjnekfkmohklfaimhikk [2015-11-05]

CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-25]

CHR Extension: (Google Mail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-29]
 

==================== Dienste (Nicht auf der Ausnahmeliste) ========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-09-02] (Apple Inc.)

R2 ASRockIOMon; C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe [454656 2013-05-28] () [Datei ist nicht signiert]

R2 cFosSpeedS; C:\Program Files\ASRock\XFast LAN\spd.exe [652640 2013-05-31] (cFos Software GmbH)

S3 Futuremark SystemInfo Service; C:\Program Files (x86)\Futuremark\SystemInfo\FMSISvc.exe [614624 2014-12-10] (Futuremark)

R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)

R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [Datei ist nicht signiert]

S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-03] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-03] (Intel Corporation)

R2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [966336 2014-10-10] (@ByELDI) [Datei ist nicht signiert]

R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation)
 

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.)

S3 AsrDrv101; C:\Windows\SysWOW64\Drivers\AsrDrv101.sys [22280 2014-12-16] (ASRock Incorporation)

R0 AsrRamDisk; C:\Windows\System32\drivers\AsrRamDisk.sys [40200 2013-05-09] (ASRock Inc.)

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [102912 2015-07-15] (Advanced Micro Devices)

S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)

S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)

R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [16648 2014-12-15] (FNet Co., Ltd.)

R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-03] (Intel Corporation)

R3 sthid; C:\Windows\System32\drivers\sthid.sys [21216 2014-08-06] (Splashtop Inc.)

S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] ()

S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-07-10] (Microsoft Corporation)

R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [291680 2015-07-10] (Microsoft Corporation)

R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation)

S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]
 

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
 

==================== Ein Monat: Erstellte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2015-11-05 14:32 - 2015-11-05 14:32 - 00016825 _____ C:\Users\Admin\Desktop\FRST.txt

2015-11-05 14:31 - 2015-11-05 14:31 - 04404952 _____ (Kaspersky Lab ZAO) C:\Users\Admin\Desktop\tdsskiller.exe

2015-11-05 14:30 - 2015-11-05 14:32 - 00000000 ____D C:\FRST

2015-11-05 14:30 - 2015-11-05 14:30 - 02198016 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe

2015-11-05 14:13 - 2015-11-05 14:13 - 04944608 _____ (Advanced Micro Devices, Inc.) C:\Users\Admin\Downloads\autodetectutility.exe

2015-11-05 14:07 - 2015-11-05 14:07 - 00016148 _____ C:\WINDOWS\system32\PC_Admin_HistoryPrediction.bin

2015-11-05 14:00 - 2015-11-05 14:00 - 00000000 ___HD C:\OneDriveTemp

2015-11-05 12:12 - 2015-11-05 12:12 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (3).exe

2015-11-05 12:12 - 2015-11-05 12:12 - 01708032 _____ C:\Users\Admin\Desktop\adwcleaner_5.017.exe

2015-11-04 17:15 - 2015-11-04 17:15 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (2).exe

2015-11-04 17:08 - 2015-11-05 12:13 - 00000000 ____D C:\AdwCleaner

2015-11-04 17:08 - 2015-11-04 17:08 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (1).exe

2015-11-04 16:49 - 2015-11-05 14:07 - 00000275 _____ C:\WINDOWS\WindowsUpdate.log

2015-11-04 16:49 - 2015-11-04 16:49 - 00000000 ____D C:\$SysReset

2015-11-04 16:34 - 2015-11-04 16:34 - 00002844 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC

2015-11-04 16:34 - 2015-11-04 16:34 - 00000863 _____ C:\Users\Public\Desktop\CCleaner.lnk

2015-11-04 16:34 - 2015-11-04 16:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

2015-11-04 16:34 - 2015-11-04 16:34 - 00000000 ____D C:\Program Files\CCleaner

2015-11-04 16:33 - 2015-11-04 16:34 - 05524624 _____ (Piriform Ltd) C:\Users\Admin\Downloads\ccsetup511_slim.exe

2015-11-04 16:14 - 2015-11-04 16:23 - 00000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job

2015-11-04 16:13 - 2015-11-04 16:13 - 00000000 ____D C:\WINDOWS\pss

2015-11-04 16:07 - 2015-11-04 16:07 - 00003380 _____ C:\WINDOWS\System32\Tasks\{6761BBC9-893A-456B-822C-C0DF98AE0062}

2015-11-04 15:46 - 2015-11-04 15:46 - 00000608 __RSH C:\ProgramData\ntuser.pol

2015-11-04 15:21 - 2015-11-05 14:08 - 00001004 _____ C:\WINDOWS\Tasks\28Arly8BQ3IUn.job

2015-11-04 15:21 - 2015-11-04 15:21 - 00004136 _____ C:\WINDOWS\System32\Tasks\28Arly8BQ3IUn

2015-11-04 15:21 - 2015-11-04 15:21 - 00002022 _____ C:\WINDOWS\Tasks\temp_813a5cd0-04f6-4ddb-a269-e350a08d2cae-10_user.job

2015-11-04 15:19 - 2015-11-05 14:08 - 00001014 _____ C:\WINDOWS\Tasks\bSUwmicbiyVJJ5rnrs.job

2015-11-04 15:19 - 2015-11-04 15:19 - 00004156 _____ C:\WINDOWS\System32\Tasks\bSUwmicbiyVJJ5rnrs

2015-11-04 15:17 - 2015-11-04 16:00 - 00000004 _____ C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7

2015-11-04 15:17 - 2013-08-22 14:25 - 00000824 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak

2015-11-04 15:16 - 2015-11-04 15:21 - 00000000 ____D C:\Program Files (x86)\mbot_de_014010136

2015-11-04 15:16 - 2015-11-04 15:16 - 00003144 _____ C:\WINDOWS\System32\Tasks\uhy3013

2015-11-04 15:16 - 2015-11-04 15:16 - 00000000 ____D C:\Users\Public\Documents\Guid

2015-11-04 15:16 - 2015-11-04 15:16 - 00000000 ____D C:\Users\Public\Documents\Baidu

2015-11-04 15:15 - 2015-11-04 15:39 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Opera Software

2015-11-04 15:15 - 2015-11-04 15:39 - 00000000 ____D C:\Users\Admin\AppData\Local\Opera Software

2015-11-04 15:12 - 2015-11-04 15:39 - 00000000 ____D C:\Program Files (x86)\Opera

2015-10-30 17:15 - 2015-10-30 17:15 - 00000000 ____D C:\ProgramData\ROCCAT

2015-10-30 17:15 - 2015-10-30 17:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ROCCAT

2015-10-30 17:14 - 2015-10-30 17:14 - 24907859 _____ C:\Users\Admin\Downloads\ROCCAT_Kone_Pure_DRV1.14_FW1.21.zip

2015-10-30 17:14 - 2015-10-30 17:14 - 00000000 ____D C:\Program Files (x86)\ROCCAT

2015-10-30 17:14 - 2014-01-20 10:53 - 73113600 _____ (ROCCAT GmbH) C:\Users\Admin\Desktop\KonePureOption.exe

2015-10-30 17:13 - 2015-10-28 00:38 - 21871616 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll

2015-10-30 17:13 - 2015-10-28 00:16 - 18801664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll

2015-10-30 17:13 - 2015-10-21 13:45 - 00541024 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcupdate_GenuineIntel.dll

2015-10-30 17:13 - 2015-10-21 13:44 - 00459104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys

2015-10-30 17:13 - 2015-10-21 13:43 - 01392480 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll

2015-10-30 17:13 - 2015-10-21 13:39 - 03621248 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2015-10-30 17:13 - 2015-10-21 13:00 - 24595968 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2015-10-30 17:13 - 2015-10-21 13:00 - 03248128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll

2015-10-30 17:13 - 2015-10-21 12:59 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll

2015-10-30 17:13 - 2015-10-21 12:57 - 02418688 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll

2015-10-30 17:13 - 2015-10-21 12:52 - 02987520 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll

2015-10-30 17:13 - 2015-10-21 12:50 - 00333312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll

2015-10-30 17:13 - 2015-10-21 12:48 - 01068032 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll

2015-10-30 17:13 - 2015-10-21 12:47 - 00453120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Usb.dll

2015-10-30 17:13 - 2015-10-21 12:46 - 02179584 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll

2015-10-30 17:13 - 2015-10-21 12:46 - 01602560 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2015-10-30 17:13 - 2015-10-21 12:44 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll

2015-10-30 17:13 - 2015-10-21 12:44 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe

2015-10-30 17:13 - 2015-10-21 12:43 - 02675200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll

2015-10-30 17:13 - 2015-10-21 12:42 - 00627712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll

2015-10-30 17:13 - 2015-10-21 12:41 - 01795072 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll

2015-10-30 17:13 - 2015-10-21 12:40 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll

2015-10-30 17:13 - 2015-10-21 12:38 - 00502272 _____ (Microsoft Corporation) C:\WINDOWS\system32\dlnashext.dll

2015-10-30 17:13 - 2015-10-21 06:53 - 00961376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll

2015-10-30 17:13 - 2015-10-21 06:49 - 02878512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2015-10-30 17:13 - 2015-10-21 06:13 - 19326464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2015-10-30 17:13 - 2015-10-21 06:11 - 02647040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll

2015-10-30 17:13 - 2015-10-21 06:08 - 01918976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll

2015-10-30 17:13 - 2015-10-21 06:05 - 02639872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll

2015-10-30 17:13 - 2015-10-21 06:03 - 01380864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2015-10-30 17:13 - 2015-10-21 06:03 - 00311296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Usb.dll

2015-10-30 17:13 - 2015-10-21 05:58 - 02049536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepository.dll

2015-10-30 17:13 - 2015-10-21 05:58 - 00464896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll

2015-10-30 17:13 - 2015-10-21 05:55 - 00441344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dlnashext.dll

2015-10-26 19:45 - 2015-10-26 19:45 - 00014336 _____ C:\Users\Admin\Downloads\wenn-2.xls

2015-10-26 19:38 - 2015-10-26 19:38 - 03135063 _____ C:\Users\Admin\Downloads\Pruefung_1_Jugendarbeitsschutzgesetz_.zip

2015-10-17 13:48 - 2015-10-10 08:12 - 00078528 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll

2015-10-17 13:48 - 2015-10-06 04:03 - 16708608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll

2015-10-17 13:48 - 2015-10-06 03:46 - 13027840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll

2015-10-17 13:48 - 2015-10-01 05:01 - 01294352 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi

2015-10-17 13:48 - 2015-10-01 05:01 - 01123400 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe

2015-10-17 13:48 - 2015-10-01 05:01 - 01018568 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi

2015-10-17 13:48 - 2015-10-01 05:01 - 00858408 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe

2015-10-17 13:48 - 2015-10-01 05:00 - 08020320 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2015-10-17 13:48 - 2015-10-01 04:03 - 00757760 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll

2015-10-17 13:48 - 2015-09-25 05:01 - 02573768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll

2015-10-17 13:48 - 2015-09-25 05:01 - 00498016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys

2015-10-17 13:48 - 2015-09-25 04:56 - 22322624 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2015-10-17 13:48 - 2015-09-25 04:52 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi

2015-10-17 13:48 - 2015-09-25 04:33 - 01997336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll

2015-10-17 13:48 - 2015-09-25 04:26 - 20858360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2015-10-17 13:48 - 2015-09-25 04:11 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataAccountApis.dll

2015-10-17 13:48 - 2015-09-25 04:11 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneCallHistoryApis.dll

2015-10-17 13:48 - 2015-09-25 04:09 - 12504064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2015-10-17 13:48 - 2015-09-25 04:07 - 01276416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll

2015-10-17 13:48 - 2015-09-25 04:04 - 00826880 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll

2015-10-17 13:48 - 2015-09-25 04:04 - 00771072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll

2015-10-17 13:48 - 2015-09-25 04:03 - 00796160 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll

2015-10-17 13:48 - 2015-09-25 04:03 - 00576000 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll

2015-10-17 13:48 - 2015-09-25 04:02 - 07523840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll

2015-10-17 13:48 - 2015-09-25 04:02 - 00949248 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll

2015-10-17 13:48 - 2015-09-25 04:02 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll

2015-10-17 13:48 - 2015-09-25 04:01 - 04792320 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2015-10-17 13:48 - 2015-09-25 04:01 - 03586560 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys

2015-10-17 13:48 - 2015-09-25 04:00 - 01423872 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll

2015-10-17 13:48 - 2015-09-25 04:00 - 01382400 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys

2015-10-17 13:48 - 2015-09-25 04:00 - 00856576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContactApis.dll

2015-10-17 13:48 - 2015-09-25 04:00 - 00752640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChatApis.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 01205248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\EmailApis.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 00685568 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppointmentApis.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\MessagingDataModel2.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 00288256 _____ (Microsoft Corporation) C:\WINDOWS\system32\PimIndexMaintenance.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\CallHistoryClient.dll

2015-10-17 13:48 - 2015-09-25 03:58 - 01871360 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll

2015-10-17 13:48 - 2015-09-25 03:47 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll

2015-10-17 13:48 - 2015-09-25 03:47 - 00172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhoneCallHistoryApis.dll

2015-10-17 13:48 - 2015-09-25 03:38 - 03580416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2015-10-17 13:48 - 2015-09-25 03:38 - 00650240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll

2015-10-17 13:48 - 2015-09-25 03:38 - 00574464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll

2015-10-17 13:48 - 2015-09-25 03:38 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll

2015-10-17 13:48 - 2015-09-25 03:37 - 00766976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll

2015-10-17 13:48 - 2015-09-25 03:37 - 00613376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll

2015-10-17 13:48 - 2015-09-25 03:37 - 00480256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll

2015-10-17 13:48 - 2015-09-25 03:36 - 11262976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2015-10-17 13:48 - 2015-09-25 03:36 - 05454848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll

2015-10-17 13:48 - 2015-09-25 03:34 - 00928256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll

2015-10-17 13:48 - 2015-09-25 03:34 - 00625152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContactApis.dll

2015-10-17 13:48 - 2015-09-25 03:34 - 00579584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentApis.dll

2015-10-17 13:48 - 2015-09-25 03:34 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ChatApis.dll

2015-10-17 13:48 - 2015-09-25 03:34 - 00525312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EmailApis.dll

2015-10-17 13:48 - 2015-09-25 03:33 - 00131072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CallHistoryClient.dll

2015-10-17 13:48 - 2015-09-25 03:32 - 01594368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll

2015-10-17 13:48 - 2015-09-25 03:32 - 00466432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MessagingDataModel2.dll

2015-10-17 13:39 - 2015-11-04 16:28 - 00000000 ____D C:\Users\Admin\Desktop\Felgen

2015-10-17 13:36 - 2015-10-17 13:36 - 00001822 _____ C:\Users\Public\Desktop\iTunes.lnk

2015-10-17 13:36 - 2015-10-17 13:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2015-10-17 13:35 - 2015-10-17 13:36 - 00000000 ____D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7

2015-10-17 13:35 - 2015-10-17 13:36 - 00000000 ____D C:\Program Files\iTunes

2015-10-17 13:35 - 2015-10-17 13:35 - 00002535 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\WINDOWS\System32\Tasks\Apple

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files\iPod

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files\Bonjour

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\iTunes

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\Bonjour

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\Apple Software Update

2015-10-17 13:30 - 2015-10-17 13:34 - 152447768 _____ (Apple Inc.) C:\Users\Admin\Downloads\iTunes6464Setup (1).exe

2015-10-12 18:13 - 2015-10-12 18:15 - 167601944 _____ (Apple Inc.) C:\Users\Admin\Downloads\iTunes6464Setup.exe

2015-10-12 17:20 - 2015-10-12 17:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud

2015-10-12 17:09 - 2015-10-12 17:19 - 71807792 _____ (Apple Inc.) C:\Users\Admin\Downloads\iCloudSetup.exe

2015-10-12 17:03 - 2015-10-12 17:24 - 1971067436 _____ C:\Users\Admin\Downloads\iPhone7,2_8.4.1_12H321_Restore.ipsw

2015-10-09 15:13 - 2015-10-09 15:13 - 00000000 ____D C:\Users\Admin\AppData\LocalLow\Hyper Hippo Productions Ltd_

2015-10-09 15:12 - 2015-10-09 15:12 - 00000222 _____ C:\Users\Admin\Desktop\AdVenture Capitalist.url

2015-10-08 16:47 - 2015-10-08 16:47 - 00000000 ____D C:\ProgramData\ATI

2015-10-07 18:54 - 2015-10-07 18:54 - 00062253 _____ C:\WINDOWS\SysWOW64\CCCInstall_201510071954276182.log

2015-10-07 18:54 - 2015-10-07 18:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center

2015-10-07 18:54 - 2015-10-07 18:54 - 00000000 ____D C:\Program Files\ATI Technologies

2015-10-07 18:53 - 2015-10-07 18:54 - 00000000 ____D C:\Program Files (x86)\ATI Technologies

2015-10-07 18:53 - 2015-10-07 18:53 - 00052907 _____ C:\WINDOWS\SysWOW64\CCCInstall_201510071953453509.log

2015-10-07 18:52 - 2015-10-07 18:52 - 47794160 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\amdocl64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 39721456 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\amdocl.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 30776304 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atio6axx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 27544560 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\amdocl12cl64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 25320432 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atioglxx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 22327280 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\amdocl12cl.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 15725552 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticaldd64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 14310896 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticaldd.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 09355016 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdxc64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 08009360 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiumdva.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 07683096 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdxc32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 07482560 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiumdag.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 06686192 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdmantle64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 05216240 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdmantle32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 03471376 _____ C:\WINDOWS\SysWOW64\atiumdva.cap

2015-10-07 18:52 - 2015-10-07 18:52 - 03437632 _____ C:\WINDOWS\system32\atiumd6a.cap

2015-10-07 18:52 - 2015-10-07 18:52 - 01196032 _____ C:\WINDOWS\system32\amdocl_as64.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 01070592 _____ C:\WINDOWS\system32\amdocl_ld64.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 01004032 _____ C:\WINDOWS\SysWOW64\amdocl_as32.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00935408 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atiadlxy.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00935408 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atiadlxx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00833800 _____ C:\WINDOWS\system32\amdicdxx.dat

2015-10-07 18:52 - 2015-10-07 18:52 - 00807424 _____ C:\WINDOWS\SysWOW64\amdocl_ld32.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00662392 _____ C:\WINDOWS\SysWOW64\atiapfxx.blb

2015-10-07 18:52 - 2015-10-07 18:52 - 00662392 _____ C:\WINDOWS\system32\atiapfxx.blb

2015-10-07 18:52 - 2015-10-07 18:52 - 00631280 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\amdlvr64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00524272 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\amdlvr32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00471320 _____ C:\WINDOWS\system32\amdmiracast.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00375792 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atiapfxx.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00341488 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\ATIODE.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00243696 _____ C:\WINDOWS\system32\clinfo.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00213488 _____ C:\WINDOWS\system32\amdgfxinfo64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00199664 _____ (AMD) C:\WINDOWS\system32\atitmm64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00198640 _____ C:\WINDOWS\SysWOW64\amdgfxinfo32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00177344 _____ C:\WINDOWS\system32\ativce03.dat

2015-10-07 18:52 - 2015-10-07 18:52 - 00175648 _____ C:\WINDOWS\system32\amde31a.dat

2015-10-07 18:52 - 2015-10-07 18:52 - 00168944 _____ C:\WINDOWS\system32\atieah64.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00165360 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atig6txx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00152560 _____ C:\WINDOWS\SysWOW64\atieah32.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00151936 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\amdhcp64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00150512 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atigktxx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00143344 _____ C:\WINDOWS\system32\amdhdl64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00138384 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\amdhcp32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00136176 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\mantle64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00132080 _____ C:\WINDOWS\SysWOW64\amdhdl32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00122352 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\mantle32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00117608 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdave64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00112368 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiu9pag.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00111600 _____ C:\WINDOWS\system32\hsa-thunk64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00111088 _____ C:\WINDOWS\SysWOW64\hsa-thunk.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00110320 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdave32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00103408 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\mantleaxl64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00100816 _____ C:\WINDOWS\system32\ativce02.dat

2015-10-07 18:52 - 2015-10-07 18:52 - 00097776 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atisamu64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00096752 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\mantleaxl32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00089584 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atisamu32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00088000 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atimpc64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00088000 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdpcom64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00083952 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atig6pxx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00081168 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atimpc32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00081160 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdpcom32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00078320 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiglpxx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00078320 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiglpxx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00073712 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00071152 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticalrt64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00068080 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00064496 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticalcl64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00060912 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticalrt.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00059888 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\ATIODCLI.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00059376 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdmmcl6.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00057840 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticalcl.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00052208 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\ati2erec.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00048112 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdmmcl.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00047664 _____ C:\WINDOWS\system32\kapp_ci.sbin

2015-10-07 18:52 - 2015-10-07 18:52 - 00043536 _____ C:\WINDOWS\system32\kapp_si.sbin

2015-10-07 18:52 - 2015-10-07 18:52 - 00038384 _____ (AMD) C:\WINDOWS\system32\atimuixx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00012784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\detoured.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00012784 _____ (Microsoft Corporation) C:\WINDOWS\system32\detoured.dll
 

==================== Ein Monat: Geänderte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2015-11-05 14:23 - 2014-12-31 19:28 - 00000000 ____D C:\Program Files (x86)\Steam

2015-11-05 14:19 - 2014-12-15 23:33 - 00001124 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2015-11-05 14:13 - 2015-08-05 21:51 - 01793546 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2015-11-05 14:13 - 2015-07-10 17:34 - 00772138 _____ C:\WINDOWS\system32\perfh007.dat

2015-11-05 14:13 - 2015-07-10 17:34 - 00154500 _____ C:\WINDOWS\system32\perfc007.dat

2015-11-05 14:08 - 2014-12-15 23:33 - 00001120 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2015-11-05 14:07 - 2015-07-10 13:21 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2015-11-05 14:05 - 2015-08-05 22:01 - 00000000 ___RD C:\Users\Admin\OneDrive

2015-11-05 14:04 - 2015-08-05 21:41 - 00000000 ____D C:\Users\Admin

2015-11-05 13:15 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\sru

2015-11-05 12:14 - 2015-07-10 10:05 - 00262144 ___SH C:\WINDOWS\system32\config\BBI

2015-11-05 12:13 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\AppReadiness

2015-11-04 17:09 - 2015-08-05 21:41 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-11-04 17:09 - 2014-12-15 23:33 - 00001327 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2015-11-04 17:09 - 2014-12-15 23:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2015-11-04 16:43 - 2015-01-06 20:23 - 00000000 ____D C:\Users\Admin\AppData\Roaming\TS3Client

2015-11-04 16:42 - 2015-08-05 22:33 - 00000000 ___DC C:\WINDOWS\Panther

2015-11-04 16:42 - 2014-12-30 23:19 - 00000000 ____D C:\Users\Admin\AppData\Local\CrashDumps

2015-11-04 16:09 - 2014-12-18 21:20 - 00000000 ____D C:\Program Files (x86)\Adobe

2015-11-04 16:08 - 2014-12-15 22:53 - 00000000 ____D C:\Program Files\KMSpico

2015-11-04 15:46 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy

2015-11-04 15:46 - 2013-08-22 16:36 - 00000000 ___HD C:\WINDOWS\system32\GroupPolicy

2015-11-04 15:39 - 2015-01-21 20:03 - 00000000 __SHD C:\Users\Admin\AppData\Local\EmieUserList

2015-11-04 15:39 - 2015-01-21 20:03 - 00000000 __SHD C:\Users\Admin\AppData\Local\EmieSiteList

2015-11-04 15:26 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\appraiser

2015-11-03 10:51 - 2015-08-05 22:01 - 00002358 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

2015-11-02 14:26 - 2015-07-10 11:55 - 00000000 ____D C:\WINDOWS\CbsTemp

2015-11-01 00:33 - 2015-01-05 18:20 - 00003972 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task

2015-10-30 17:14 - 2014-12-15 23:42 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2015-10-27 19:48 - 2014-12-31 18:33 - 00000000 ____D C:\Users\Admin\AppData\Local\Spotify

2015-10-27 19:48 - 2014-12-31 18:32 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Spotify

2015-10-26 20:55 - 2015-04-12 21:14 - 00000000 ____D C:\Users\Admin\Desktop\Mailin

2015-10-26 20:17 - 2014-12-30 19:00 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013

2015-10-26 20:17 - 2014-12-30 15:46 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-10-26 20:15 - 2013-08-22 14:25 - 00000167 _____ C:\WINDOWS\win.ini

2015-10-26 19:47 - 2014-12-15 22:56 - 00000000 ____D C:\Users\Admin\AppData\Local\Packages

2015-10-17 13:35 - 2015-04-10 06:25 - 00000000 ____D C:\Program Files\Common Files\Apple

2015-10-17 13:34 - 2015-04-10 06:25 - 00000000 ____D C:\ProgramData\Apple

2015-10-16 11:13 - 2014-12-18 21:21 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2015-10-16 04:10 - 2015-07-10 12:06 - 00810488 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2015-10-16 04:10 - 2015-07-10 12:06 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2015-10-12 18:13 - 2015-09-08 19:52 - 00000000 ____D C:\WINDOWS\system32\appmgmt

2015-10-12 18:11 - 2014-12-30 17:39 - 00000000 ____D C:\Users\Admin\AppData\Local\Akamai

2015-10-12 17:47 - 2015-07-10 13:20 - 00348328 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2015-10-12 17:45 - 2015-07-10 17:44 - 00000000 ____D C:\Program Files\Windows Journal

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___SD C:\WINDOWS\system32\F12

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___RD C:\WINDOWS\PurchaseDialog

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\Provisioning

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\L2Schemas

2015-10-09 15:12 - 2015-01-06 13:55 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2015-10-07 18:53 - 2015-07-30 15:44 - 00000000 ____D C:\Program Files (x86)\AMD

2015-10-07 18:53 - 2014-12-15 22:57 - 00000000 ____D C:\AMD

2015-10-07 18:52 - 2015-07-16 01:12 - 00162240 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiuxp64.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 12088008 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atidxx64.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 10211016 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atidxx32.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 08982440 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiumd6a.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 08864928 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiumd64.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 01479808 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\aticfx64.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 01223552 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\aticfx32.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 00143056 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiuxpag.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 00130072 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiu9p64.dll

2015-10-07 18:52 - 2015-07-16 01:06 - 21648880 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\atikmdag.sys

2015-10-07 18:52 - 2015-07-16 00:17 - 00683504 _____ (AMD) C:\WINDOWS\system32\atieclxx.exe

2015-10-07 18:52 - 2015-07-16 00:17 - 00451056 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atidemgy.dll

2015-10-07 18:52 - 2015-07-16 00:17 - 00255472 _____ (AMD) C:\WINDOWS\system32\atiesrxx.exe

2015-10-07 18:52 - 2015-07-16 00:13 - 01256432 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atiadlxx.dll

2015-10-07 18:52 - 2015-07-16 00:13 - 00674288 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\atikmpag.sys

2015-10-07 18:52 - 2015-07-16 00:12 - 00874480 _____ (AMD) C:\WINDOWS\system32\coinst_15.20.dll
 

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
 

2015-04-19 13:20 - 2015-04-19 13:20 - 0005872 _____ () C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn

2015-04-20 15:05 - 2015-04-20 15:05 - 1579520 _____ () C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe

2015-04-19 13:20 - 2015-04-19 13:20 - 0005872 _____ () C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs

2015-04-20 15:05 - 2015-04-20 15:05 - 1579520 _____ () C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe

2015-09-08 19:37 - 2015-09-08 19:37 - 0003225 _____ () C:\Users\Admin\AppData\Local\recently-used.xbel
 

Einige Dateien in TEMP:

====================

C:\Users\Admin\AppData\Local\Temp\225.exe

C:\Users\Admin\AppData\Local\Temp\4156.exe

C:\Users\Admin\AppData\Local\Temp\8548.exe

C:\Users\Admin\AppData\Local\Temp\9768.exe

C:\Users\Admin\AppData\Local\Temp\avgD177.exe

C:\Users\Admin\AppData\Local\Temp\HarryPotterAndTheOrderOfThePhoenixGame__11652_il54233.exe

C:\Users\Admin\AppData\Local\Temp\InstallHelper.exe

C:\Users\Admin\AppData\Local\Temp\mytmpinstaller.exe

C:\Users\Admin\AppData\Local\Temp\Opera_NI_stable.exe

C:\Users\Admin\AppData\Local\Temp\sqlite3.dll

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe

C:\Users\Admin\AppData\Local\Temp\UninstallModule.exe

C:\Users\Admin\AppData\Local\Temp\VLX_Player.exe
 
 

==================== Bamital & volsnap =================
 

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
 

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert

C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert

C:\WINDOWS\explorer.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert

C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert

C:\WINDOWS\system32\services.exe => Datei ist digital signiert

C:\WINDOWS\system32\User32.dll => Datei ist digital signiert

C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert

C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert

C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert

C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert

C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert

C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
 
 

LastRegBack: 2015-11-02 14:19
 

==================== Ende von FRST.txt ============================

Die Addition.txt:

Code:

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:04-11-2015

durchgeführt von Admin (2015-11-05 14:33:15)

Gestartet von C:\Users\Admin\Desktop

Windows 10 Pro (X64) (2015-08-05 20:58:30)

Start-Modus: Normal

==========================================================
 
 

==================== Konten: =============================
 

Admin (S-1-5-21-3896126499-3315573620-1378135710-1001 - Administrator - Enabled) => C:\Users\Admin

Administrator (S-1-5-21-3896126499-3315573620-1378135710-500 - Administrator - Disabled)

DefaultAccount (S-1-5-21-3896126499-3315573620-1378135710-503 - Limited - Disabled)

Gast (S-1-5-21-3896126499-3315573620-1378135710-501 - Limited - Disabled)
 

==================== Sicherheits-Center ========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
 

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installierte Programme ======================
 

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
 

3DMark (HKLM-x32\...\{7330098c-3669-4f39-9e82-4221d489db39}) (Version: 1.4.828.0 - Futuremark)

3DMark (Version: 1.4.828.0 - Futuremark) Hidden

Adobe Reader XI (11.0.13) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.13 - Adobe Systems Incorporated)

AdVenture Capitalist (HKLM-x32\...\Steam App 346900) (Version:  - Hyper Hippo Games)

Akamai NetSession Interface (HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Akamai) (Version:  - Akamai Technologies, Inc)

AMD Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)

AMD Catalyst Install Manager (HKLM\...\{572C982F-95F5-0562-AE8F-8A9D7D024A88}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)

APP Shop v1.0.13 (HKLM-x32\...\{90242E9B-BC60-46E3-8EE7-8E953F702280}_is1) (Version: 1.0.13 - ASRock Inc.)

Apple Application Support (32-Bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)

Apple Application Support (64-Bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{FD244E19-6EFE-4A2D-948A-0D45D4C168BE}) (Version: 9.0.0.26 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)

ASRock App Charger v1.0.6 (HKLM\...\ASRock App Charger_is1) (Version: 1.0.6 - ASRock Inc.)

ASRock Restart to UEFI v1.0.3 (HKLM-x32\...\ASRock Restart to UEFI_is1) (Version:  - )

ASRock XFast RAM v3.0.2 (HKLM\...\ASRock XFast RAM_is1) (Version:  - ASRock Inc.)

A-Tuning v2.0.51.1 (HKLM-x32\...\A-Tuning_is1) (Version: 2.0.51.1 - )

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

CCleaner (HKLM\...\CCleaner) (Version: 5.11 - Piriform)

Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)

Futuremark SystemInfo (HKLM-x32\...\{2FE4C157-30AD-47F3-9D93-D9A2AFF25D3F}) (Version: 4.33.485.0 - Futuremark)

GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 46.0.2490.80 - Google Inc.)

Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6904.2028 - Google Inc.)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden

iCloud (HKLM\...\{709A2D23-C25E-47B5-9268-CB6FEE648504}) (Version: 4.1.1.53 - Apple Inc.)

Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation)

Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{0EC7F9CC-4741-45AE-9F55-6E9343F726F5}) (Version: 1.1.0.36960 - Intel Corporation)

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)

Intel(R) Network Connections 18.5.54.0 (HKLM\...\PROSetDX) (Version: 18.5.54.0 - Intel)

Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation)

iTunes (HKLM\...\{CEC7613B-E286-4A31-BEE3-3F7798488D9F}) (Version: 12.1.3.6 - Apple Inc.)

Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)

KMSpico (HKLM\...\{8B29D47F-92E2-4C20-9EE0-F710991F5D7C}_is1) (Version:  - )

Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)

MyDriveConnect 4.0.2.2123 (HKLM-x32\...\MyDriveConnect) (Version: 4.0.2.2123 - TomTom)

Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.)

ROCCAT Kone Pure Mouse Driver (HKLM-x32\...\{4905245D-56E7-4176-BE68-962728B803D6}) (Version:  - Roccat GmbH)

Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)

Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version:  - Microsoft) Hidden

Splashtop Software Updater (HKLM-x32\...\Splashtop Software Updater) (Version: 1.5.6.15 - Splashtop Inc.)

Splashtop Streamer (HKLM-x32\...\{B7C5EA94-B96A-41F5-BE95-25D78B486678}) (Version: 2.6.2.4 - Splashtop Inc.)

Spotify (HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Spotify) (Version: 1.0.6.80.g2a801a53 - Spotify AB)

Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)

TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)

Update for Skype for Business 2015 (KB2889853) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{CBCC2FD8-7DFE-4752-95B5-2E447C226F45}) (Version:  - Microsoft)

Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version:  - Microsoft)

Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version:  - Microsoft)

Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version:  - Microsoft)

VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden

Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)

VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN)

WinRAR 5.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)

XFast LAN v9.05 (HKLM\...\XFast LAN) (Version: 9.05 - cFos Software GmbH, Bonn)

XFastUSB (HKLM-x32\...\XFastUSB) (Version: 3.02.38 - ASRock Inc.)
 

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

CustomCLSID: HKU\S-1-5-21-3896126499-3315573620-1378135710-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Admin\AppData\Local\Microsoft\OneDrive\17.3.6201.1019\FileCoAuth.exe (Microsoft Corporation)
 

==================== Wiederherstellungspunkte =========================
 

07-10-2015 18:51:41 Windows Update

12-10-2015 17:19:18 Installed iCloud

17-10-2015 13:21:53 Removed iTunes

26-10-2015 19:59:23 Windows Update

02-11-2015 14:19:58 Windows Update

04-11-2015 15:33:50 Wiederherstellungsvorgang
 

==================== Hosts Inhalt: ===============================
 

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
 

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
 
 

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

Task: {0641E672-CA84-4606-B6D2-9F2BABE58BF5} - System32\Tasks\28Arly8BQ3IUn => C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe [2015-04-20] () <==== ACHTUNG

Task: {07181339-8E57-4CB5-BBFE-76170783B9DB} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG

Task: {12FB6D15-B5C0-4B66-BF0C-21D82690E855} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)

Task: {1780DAB3-4584-4FBD-92C9-8857F3886BA3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)

Task: {18B3B3A2-AFFF-476E-BA62-AB75BE1E7871} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG

Task: {314E7782-948E-4C4F-B24E-BC0CC4B34F09} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG

Task: {35EB728D-F128-4075-B375-D45BF71FE8B2} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\BrowserChoice\browserchoice.exe

Task: {39F87631-C2F8-4269-952F-841E84773CAD} - System32\Tasks\temp_813a5cd0-04f6-4ddb-a269-e350a08d2cae-10_user => C:\Program Files (x86)\MyBrowser 1.0.2V04.11\813a5cd0-04f6-4ddb-a269-e350a08d2cae-10.exe <==== ACHTUNG

Task: {3A4FD38E-5C92-414E-9586-8C3CAA34B95C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)

Task: {3E9757E4-DB07-4418-A44D-2721FDE15694} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG

Task: {4D0FE605-48D7-41B3-AD75-AD266C4238D5} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG

Task: {5769C702-F476-4F1D-8161-7F0B757132B2} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation)

Task: {6B883A1A-4B18-410C-B686-CE03876036BA} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG

Task: {706560C9-EAA0-41D3-833A-15525024E0B5} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-26] (Apple Inc.)

Task: {80A4DADB-BA50-49B2-AA96-134B855D9DA2} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)

Task: {829CE483-8082-49CD-A513-92A43A02E5FB} - System32\Tasks\{6761BBC9-893A-456B-822C-C0DF98AE0062} => pcalua.exe -a "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\Installer\setup.exe" -c --uninstall --system-level

Task: {91B7D1C5-C4A2-47A1-8301-8BB576FF708E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)

Task: {A0AE8DD5-A88B-4716-868D-7DE54D6A193B} - \AutoKMS -> Keine Datei <==== ACHTUNG

Task: {ABDBD144-AC98-4BFB-A605-068E267D2877} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation)

Task: {AF2AD4F7-61F8-4A4D-80A1-EC7534DACF61} - System32\Tasks\bSUwmicbiyVJJ5rnrs => C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe [2015-04-20] () <==== ACHTUNG

Task: {B5D52175-0BF8-41EC-8DE9-7EA06BDD727D} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG

Task: {C094DE92-8467-4C1A-BDA4-A77A51B90A69} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG

Task: {CBA55D8E-91C9-42CD-83D1-CCEA95CCAD58} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG

Task: {D9512478-B671-48F5-AB7D-4DFDF9C1B3D9} - \AutoPico Daily Restart -> Keine Datei <==== ACHTUNG

Task: {DA46E218-00C4-4B54-B5E0-5243E443B1D5} - System32\Tasks\uhy3013 => C:\PROGRA~2\FAST-S~1\uhy3013.exe <==== ACHTUNG

Task: {ECA37C1B-4E7F-4781-B87B-E8B93639BBCB} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG

Task: {F2497E2D-9818-4923-A176-F89FB32151E5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-10-19] (Piriform Ltd)

Task: {F5E604C0-8A2B-485C-9605-9EC1FD317421} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG

Task: {F69C0FCA-220E-4675-A1E1-DD67E0976A15} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
 

Task: C:\WINDOWS\Tasks\28Arly8BQ3IUn.job => C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe <==== ACHTUNG

Task: C:\WINDOWS\Tasks\bSUwmicbiyVJJ5rnrs.job => C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe <==== ACHTUNG

Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\temp_813a5cd0-04f6-4ddb-a269-e350a08d2cae-10_user.job => C:\Program Files (x86)\MyBrowser 1.0.2V04.11\813a5cd0-04f6-4ddb-a269-e350a08d2cae-10.exe <==== ACHTUNG
 

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
 

2015-07-10 12:00 - 2015-07-10 12:00 - 00028160 _____ () C:\WINDOWS\SYSTEM32\efsext.dll

2015-08-05 22:30 - 2015-08-05 22:30 - 00032768 _____ () C:\WINDOWS\SYSTEM32\licensemanagerapi.dll

2015-08-23 21:30 - 2015-08-11 10:14 - 00404480 _____ () C:\WINDOWS\System32\diagtrack_wininternal.dll

2015-03-20 17:12 - 2015-03-20 17:12 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

2015-03-20 17:12 - 2015-03-20 17:12 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

2014-12-15 23:54 - 2013-05-28 17:58 - 00454656 _____ () C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe

2015-10-01 09:14 - 2015-09-17 07:48 - 02494712 _____ () C:\WINDOWS\System32\CoreUIComponents.dll

2015-10-01 09:14 - 2015-09-17 06:43 - 02028544 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RulesService.dll

2015-10-01 09:14 - 2015-09-17 06:42 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll

2015-10-01 09:14 - 2015-09-17 06:42 - 00619008 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SignalsManager.dll

2015-10-01 09:14 - 2015-09-17 06:43 - 00928768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RulesBackgroundTasks.dll

2015-10-01 09:14 - 2015-09-17 06:48 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll

2015-10-01 09:14 - 2015-09-17 07:48 - 02494712 _____ () C:\WINDOWS\system32\CoreUIComponents.dll

2015-07-10 11:59 - 2015-07-10 11:59 - 00143360 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\XamlTileRendering.dll

2015-10-01 09:14 - 2015-09-17 06:44 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll

2015-10-01 09:14 - 2015-09-17 06:49 - 00884736 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll

2015-10-01 09:14 - 2015-09-17 06:42 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll

2015-10-01 09:14 - 2015-09-17 06:43 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll

2015-07-10 12:00 - 2015-07-10 17:43 - 00210432 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.ProxyStub.dll

2015-10-19 21:00 - 2015-10-19 21:00 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll

2015-01-06 13:56 - 2015-08-15 13:15 - 00103424 _____ () C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe

2015-10-23 15:20 - 2015-10-20 15:08 - 01532744 _____ () C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.80\libglesv2.dll

2015-10-23 15:20 - 2015-10-20 15:08 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.80\libegl.dll

2015-10-30 17:15 - 2012-06-23 14:54 - 00061440 _____ () C:\Program Files (x86)\ROCCAT\Kone Pure Mouse\hiddriver.dll

2014-12-15 23:45 - 2013-09-03 16:52 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll

2014-12-31 19:33 - 2015-10-05 17:18 - 00778752 _____ () C:\Program Files (x86)\Steam\SDL2.dll

2015-01-20 22:01 - 2015-07-03 17:12 - 04962816 _____ () C:\Program Files (x86)\Steam\v8.dll

2014-12-31 19:33 - 2015-10-14 21:56 - 02423376 _____ () C:\Program Files (x86)\Steam\video.dll

2015-01-20 22:01 - 2015-07-03 17:12 - 01556992 _____ () C:\Program Files (x86)\Steam\icui18n.dll

2015-01-20 22:01 - 2015-07-03 17:12 - 01187840 _____ () C:\Program Files (x86)\Steam\icuuc.dll

2014-12-31 19:32 - 2015-09-24 01:33 - 02549248 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll

2014-12-31 19:32 - 2015-09-24 01:33 - 00491008 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll

2014-12-31 19:32 - 2015-09-24 01:33 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll

2014-12-31 19:32 - 2015-09-24 01:33 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll

2014-12-31 19:32 - 2015-09-24 01:33 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll

2014-12-31 19:33 - 2015-10-14 21:56 - 00705104 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL

2015-07-22 17:27 - 2015-10-09 19:13 - 00193024 _____ () C:\Program Files (x86)\Steam\bin\openvr_api.dll

2015-11-05 14:22 - 2015-11-05 14:22 - 00155232 ___HT () C:\Users\Admin\AppData\Local\Temp\~D0EA.tmp

2014-12-31 19:33 - 2015-10-08 23:20 - 45010208 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll

2015-01-20 22:01 - 2015-09-25 00:56 - 00119208 _____ () C:\Program Files (x86)\Steam\winh264.dll

2015-01-06 13:55 - 2015-09-17 19:42 - 00198144 _____ () C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\bin\launcher.dll

2015-01-06 13:55 - 2015-09-17 19:42 - 00317440 _____ () C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\bin\tier0.dll

2015-01-06 13:56 - 2015-09-17 19:41 - 00203776 _____ () C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\bin\vstdlib.dll

2015-01-06 13:55 - 2015-09-17 19:41 - 00389120 _____ () C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\bin\filesystem_stdio.dll

2015-01-06 13:55 - 2015-10-30 17:13 - 06696448 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\engine.dll

2015-01-06 13:55 - 2015-09-17 19:42 - 00156160 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\inputsystem.dll

2015-01-06 13:55 - 2015-09-17 19:42 - 01174016 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\vphysics.dll

2015-01-06 13:55 - 2015-10-21 18:49 - 01240064 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\materialsystem.dll

2015-01-06 13:55 - 2015-09-17 19:41 - 00351744 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\datacache.dll

2015-01-06 13:55 - 2015-09-17 19:41 - 00607744 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\studiorender.dll

2015-01-06 13:55 - 2015-09-17 19:42 - 00164864 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\soundemittersystem.dll

2015-01-06 13:55 - 2015-09-17 19:42 - 00708096 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\vscript.dll

2015-01-06 13:56 - 2015-09-17 19:41 - 00134656 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\valve_avi.dll

2015-01-06 13:55 - 2015-09-17 19:42 - 01336320 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\vguimatsurface.dll

2015-01-06 13:55 - 2015-09-17 19:41 - 00394752 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\vgui2.dll

2015-01-06 13:55 - 2015-10-21 18:49 - 03192320 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\scaleformui.dll

2015-01-06 13:55 - 2015-10-09 14:17 - 01763328 _____ () C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\bin\shaderapidx9.dll

2015-01-06 13:56 - 2015-09-17 19:41 - 00143360 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\localize.dll

2015-01-06 13:55 - 2015-09-17 19:42 - 00230912 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\stdshader_dbg.dll

2015-01-06 13:55 - 2015-09-17 19:41 - 00996864 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\stdshader_dx9.dll

2015-01-06 13:55 - 2015-10-21 18:49 - 00582144 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo\bin\matchmaking.dll

2015-01-06 13:55 - 2015-11-01 00:22 - 12490752 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo\bin\client.dll

2015-01-06 13:55 - 2015-10-30 17:15 - 10011136 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo\bin\server.dll

2015-01-06 13:55 - 2015-09-17 19:41 - 00094208 _____ () C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\bin\scenefilecache.dll

2015-01-06 13:55 - 2015-10-02 08:17 - 00084992 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\vaudio_miles.dll

2015-01-06 13:55 - 2015-01-06 13:55 - 00071680 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\mssmp3.asi

2015-01-06 13:55 - 2015-01-06 13:55 - 00012800 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\mssds3d.flt

2015-01-06 13:56 - 2015-01-06 13:56 - 00055808 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\msseax.flt

2015-01-06 13:55 - 2015-10-21 18:49 - 00972800 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\serverbrowser.dll

2015-01-06 13:56 - 2015-09-17 19:41 - 00173568 _____ () c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\bin\vaudio_celt.dll
 

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
 
 

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
 
 

==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
 
 

==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
 
 

==================== Andere Bereiche ============================
 

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
 

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppBackground\{8f613224-081d-4870-95b1-d3401a9c063b}.jpg

DNS Servers: 192.168.0.1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall ist aktiviert.
 

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
 

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
 

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Akamai NetSession Interface"

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Spotify"

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Spotify Web Helper"
 

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139

FirewallRules: [{AA2759FA-EDA9-49D9-8F1E-31DBB008545D}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

FirewallRules: [{21668B50-B857-45A9-B645-E11ECDD0BA49}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

FirewallRules: [{6CB59014-5555-42F1-8B13-C849BCCFE2D5}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe

FirewallRules: [{A3131C8E-696E-4F51-ACFD-B2AB59280978}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe

FirewallRules: [{FEE6B3AF-FAFD-4C1B-B25C-3D7B4B195124}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{B443DA33-A6A7-4033-956B-A93AC3CBC433}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{E6CBFDB1-E319-4DB8-AFE5-A4934C2C92BB}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{6A8E79CC-2575-4BAE-8F1C-D7A7E2F46E1E}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{8E7D9FDF-1879-4244-A2C6-EBC14CC669E7}] => (Allow) %USERPROFILE%\jagexcache\jagexlauncher\bin\JagexLauncher.exe

FirewallRules: [{35A1C72A-BDD3-483A-89A4-27F37D6F2DF0}] => (Allow) %USERPROFILE%\jagexcache\jagexlauncher\bin\JagexLauncher.exe

FirewallRules: [{B6240254-8695-4136-8688-496A32476A12}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe

FirewallRules: [{E7AD38FE-F37D-44CA-9649-1701BCC99048}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe

FirewallRules: [{B0CB35E9-5E30-4F33-B965-F50096A6FF89}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{D97329F3-5344-4F9A-ABBF-5E569CF1D363}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{CAEEFC92-F0A2-4DE5-A2E7-FFCAFF3B70D4}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{DA773FEA-CDF4-4FFB-818E-B255D4ABA4EF}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{22A49953-B3ED-4BC6-8832-A1E30DE6E35D}] => (Block) C:\users\admin\appdata\roaming\spotify\spotify.exe

FirewallRules: [{C130419E-ACEF-4A16-B5CD-F7064DA07399}] => (Block) C:\users\admin\appdata\roaming\spotify\spotify.exe

FirewallRules: [UDP Query User{8F3963CA-4443-496D-B9E4-2A16E020A73E}C:\users\admin\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\admin\appdata\roaming\spotify\spotify.exe

FirewallRules: [TCP Query User{C9892719-B171-4AE8-B087-57F263271C60}C:\users\admin\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\admin\appdata\roaming\spotify\spotify.exe

FirewallRules: [{52E0F1D2-FD56-4E24-A22C-DE206D1494F7}] => (Allow) C:\Windows\AutoKMS\AutoKMS.exe

FirewallRules: [{7039608C-3BAF-4175-B1D5-9DB53104CE60}] => (Allow) C:\Windows\AutoKMS\AutoKMS.exe

FirewallRules: [{A6677B6E-9570-4D98-87FE-84B9780B452C}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe

FirewallRules: [{CD221F27-BA09-4A4E-BC94-50541EBCB868}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe

FirewallRules: [{85BC76F4-96B4-4164-A507-B85036C799E4}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe

FirewallRules: [{05E12DE1-3BF9-4600-BD77-0809E7D8C280}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe

FirewallRules: [UDP Query User{6B3064D8-144A-4C73-834F-582573F693E1}C:\users\admin\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\admin\appdata\local\akamai\netsession_win.exe

FirewallRules: [TCP Query User{4F97824E-B35A-4B0C-97A6-D3BAFD6E693B}C:\users\admin\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\admin\appdata\local\akamai\netsession_win.exe

FirewallRules: [{ACFE8A12-C5A4-41FC-90A6-7D110C49FAEE}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

FirewallRules: [{55CAAA0F-FBB7-462F-8A31-FCCBE685917A}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

FirewallRules: [{046FF7F9-A214-4106-ADBB-6B8AD4D530E1}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe

FirewallRules: [{B26C67AD-595F-4798-8BA9-48A408D1A66A}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe

FirewallRules: [{0812631C-DFED-4D26-BAD8-38EC0D43A5F9}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe

FirewallRules: [{DD625CA9-74CC-4EF5-8787-672253D8102B}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe

FirewallRules: [{92F406C8-75D5-4ABC-B10E-2BCB8528AAD5}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe

FirewallRules: [{2E1B87E5-B37C-4C66-97F9-A7331EB138D4}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe

FirewallRules: [{20E5CF9D-CD2B-48EC-8529-99B170102939}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\AdVenture Capitalist\adventure-capitalist.exe

FirewallRules: [{C1EF0CA2-2081-43FE-8B04-16DE223F8C15}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\AdVenture Capitalist\adventure-capitalist.exe

FirewallRules: [{C20F43D5-69D4-45A1-AD1B-C744E89D4511}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{7E097365-0904-432E-929B-8F1CD4D41E51}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{1E925C46-62CE-4FA6-82B0-ABDF754998C5}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{F8DCB71C-268A-4DB2-8339-FDB932450A7D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{DD491145-F36D-48BC-A4CF-458D412FE1DE}] => (Allow) C:\Program Files\iTunes\iTunes.exe

FirewallRules: [{9E2BD5A0-E113-4596-8766-27355FE2915D}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

FirewallRules: [{E745B22D-7912-4168-B501-8A08C1F3C580}] => (Allow) C:\Program Files (x86)\Max Driver Updater\maxdu.exe

FirewallRules: [{B3E55AD0-D1A7-43AB-921D-E6DDA30B0AA7}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe

FirewallRules: [{E14732EA-52F0-4432-89E4-260E59AA402D}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe

FirewallRules: [{AA9EBF75-40EA-45B3-8E32-6D07EA9B53A9}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\DataProxy.exe
 

==================== Fehlerhafte Geräte im Gerätemanager =============
 
 

==================== Fehlereinträge in der Ereignisanzeige: =========================
 

Applikationsfehler:

==================

Error: (11/05/2015 01:57:18 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC)

Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2147024865. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 

Error: (11/05/2015 01:57:18 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC)

Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2147024865. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 

Error: (11/05/2015 01:57:18 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC)

Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 

Error: (11/04/2015 05:09:31 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: MicrosoftEdge.exe, Version: 11.0.10240.16566, Zeitstempel: 0x56277dbe

Name des fehlerhaften Moduls: CoreUIComponents.dll, Version: 0.0.0.0, Zeitstempel: 0x55fa4b76

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000000000060f73

ID des fehlerhaften Prozesses: 0x1f70

Startzeit der fehlerhaften Anwendung: 0xMicrosoftEdge.exe0

Pfad der fehlerhaften Anwendung: MicrosoftEdge.exe1

Pfad des fehlerhaften Moduls: MicrosoftEdge.exe2

Berichtskennung: MicrosoftEdge.exe3

Vollständiger Name des fehlerhaften Pakets: MicrosoftEdge.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: MicrosoftEdge.exe5
 

Error: (11/04/2015 04:53:58 PM) (Source: System Restore) (EventID: 8210) (User: )

Description: Unbekannter Fehler bei der Systemwiederherstellung: (Windows Update). Zusätzliche Informationen: 0x80070571.
 

Error: (11/04/2015 04:23:32 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC)

Description: Bei der Aktivierung der App „Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe:MicrosoftEdge.AppX9zvsr9qeth9e9a03yr0g7rpdrcrwgn5r.mca“ ist folgender Fehler aufgetreten: -2144927149. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 

Error: (11/04/2015 04:14:43 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC)

Description: Bei der Aktivierung der App „Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe:MicrosoftEdge.AppX9zvsr9qeth9e9a03yr0g7rpdrcrwgn5r.mca“ ist folgender Fehler aufgetreten: -2144927149. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 

Error: (11/04/2015 03:37:41 PM) (Source: System Restore) (EventID: 8210) (User: )

Description: Unbekannter Fehler bei der Systemwiederherstellung: (Windows Update). Zusätzliche Informationen: 0x81000204.
 

Error: (11/04/2015 03:34:50 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC)

Description: Bei der Aktivierung der App „Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe!Microsoft.MicrosoftOfficeHub“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 

Error: (11/04/2015 03:34:04 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
 

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
 

System Error:

Zugriff verweigert

.
 
 

Systemfehler:

=============

Error: (11/05/2015 02:10:52 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)

Description: {784E29F4-5EBE-4279-9948-1E8FE941646D}
 

Error: (11/05/2015 02:07:02 PM) (Source: EventLog) (EventID: 6008) (User: )

Description: Das System wurde zuvor am ‎05.‎11.‎2015 um 14:04:09 unerwartet heruntergefahren.
 

Error: (11/05/2015 02:04:09 PM) (Source: EventLog) (EventID: 6008) (User: )

Description: Das System wurde zuvor am ‎05.‎11.‎2015 um 13:59:08 unerwartet heruntergefahren.
 

Error: (11/05/2015 02:03:01 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)

Description: {784E29F4-5EBE-4279-9948-1E8FE941646D}
 

Error: (11/05/2015 01:59:08 PM) (Source: EventLog) (EventID: 6008) (User: )

Description: Das System wurde zuvor am ‎05.‎11.‎2015 um 13:34:28 unerwartet heruntergefahren.
 

Error: (11/05/2015 01:57:18 PM) (Source: DCOM) (EventID: 10001) (User: PC)

Description: "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca31CortanaUI.AppXjxtspbn4351hrtx8tc95e89kaz3h2f1f.mcaNicht verfügbarNicht verfügbar
 

Error: (11/05/2015 01:57:18 PM) (Source: DCOM) (EventID: 10001) (User: PC)

Description: "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca31CortanaUI.AppXd4tad4d57t4wtdbnnmb8v2xtzym8c1n8.mcaNicht verfügbarNicht verfügbar
 

Error: (11/05/2015 01:57:18 PM) (Source: DCOM) (EventID: 10010) (User: PC)

Description: CortanaUI.AppXtpp90jhw9p0njjb85kvhxpppgrqfp117.mca
 

Error: (11/05/2015 01:57:15 PM) (Source: DCOM) (EventID: 10010) (User: PC)

Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}
 

Error: (11/05/2015 01:57:15 PM) (Source: DCOM) (EventID: 10010) (User: PC)

Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}
 
 

CodeIntegrity:

===================================

  Date: 2015-11-05 12:39:36.174

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-10-26 20:03:56.406

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-09-28 17:52:15.924

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-09-24 22:29:45.054

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-09-15 19:40:31.474

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-08-29 12:12:37.860

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-08-05 23:10:52.350

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 
 

==================== Speicherinformationen =========================== 
 

Prozessor: Intel(R) Pentium(R) CPU G3420 @ 3.20GHz

Prozentuale Nutzung des RAM: 41%

Installierter physikalischer RAM: 8111.13 MB

Verfügbarer physikalischer RAM: 4772.97 MB

Summe virtueller Speicher: 9391.13 MB

Verfügbarer virtueller Speicher: 5462.03 MB
 

==================== Laufwerke ================================
 

Drive c: () (Fixed) (Total:243.36 GB) (Free:163.33 GB) NTFS

Drive d: (Volume) (Fixed) (Total:687.37 GB) (Free:687.19 GB) NTFS
 

==================== MBR & Partitionstabelle ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: C390FBE7)

Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=243.4 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=450 MB) - (Type=27)

Partition 4: (Not Active) - (Size=687.4 GB) - (Type=07 NTFS)
 

==================== Ende von Addition.txt ============================

Martiba

05.11.2015 14:50

Und zu guter letzt die TDSSKiller Datei: (die Datei ist zu groß ich teile die mal auf 2 logs auf, falls ich es anders posten soll, lass es mich bitte wissen!)

Code:

14:35:25.0799 0x1958  TDSS rootkit removing tool 3.1.0.5 Jul 24 2015 12:29:57

14:35:51.0779 0x1958  ============================================================

14:35:51.0779 0x1958  Current date / time: 2015/11/05 14:35:51.0779

14:35:51.0779 0x1958  SystemInfo:

14:35:51.0779 0x1958  

14:35:51.0779 0x1958  OS Version: 10.0.10240 ServicePack: 0.0

14:35:51.0779 0x1958  Product type: Workstation

14:35:51.0779 0x1958  ComputerName: PC

14:35:51.0779 0x1958  UserName: Admin

14:35:51.0779 0x1958  Windows directory: C:\WINDOWS

14:35:51.0779 0x1958  System windows directory: C:\WINDOWS

14:35:51.0779 0x1958  Running under WOW64

14:35:51.0779 0x1958  Processor architecture: Intel x64

14:35:51.0779 0x1958  Number of processors: 2

14:35:51.0779 0x1958  Page size: 0x1000

14:35:51.0779 0x1958  Boot type: Normal boot

14:35:51.0779 0x1958  ============================================================

14:35:52.0221 0x1958  KLMD registered as C:\WINDOWS\system32\drivers\23134186.sys

14:35:52.0896 0x1958  System UUID: {D3571052-8531-8C7F-52F0-7A69597B5193}

14:35:53.0322 0x1958  Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

14:35:53.0331 0x1958  ============================================================

14:35:53.0331 0x1958  \Device\Harddisk0\DR0:

14:35:53.0331 0x1958  MBR partitions:

14:35:53.0332 0x1958  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0xAF000

14:35:53.0332 0x1958  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0xAF800, BlocksNum 0x1E6B7800

14:35:53.0332 0x1958  \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x1E848000, BlocksNum 0x55EBD800

14:35:53.0332 0x1958  ============================================================

14:35:53.0364 0x1958  C: <-> \Device\Harddisk0\DR0\Partition2

14:35:53.0388 0x1958  D: <-> \Device\Harddisk0\DR0\Partition3

14:35:53.0388 0x1958  ============================================================

14:35:53.0388 0x1958  Initialize success

14:35:53.0388 0x1958  ============================================================

14:36:29.0255 0x1be8  ============================================================

14:36:29.0255 0x1be8  Scan started

14:36:29.0255 0x1be8  Mode: Manual; SigCheck; TDLFS; 

14:36:29.0255 0x1be8  ============================================================

14:36:29.0255 0x1be8  KSN ping started

14:36:31.0571 0x1be8  KSN ping finished: true

14:36:34.0166 0x1be8  ================ Scan system memory ========================

14:36:34.0166 0x1be8  System memory - ok

14:36:34.0166 0x1be8  ================ Scan services =============================

14:36:34.0269 0x1be8  [ 22CE801AD25C51E2553F41A076BB0CB2, 0520216417F1619FB642734EC937C59D5E79A24306C1E9B793C82FAE077851E6 ] 1394ohci        C:\WINDOWS\System32\drivers\1394ohci.sys

14:36:34.0302 0x1be8  1394ohci - ok

14:36:34.0317 0x1be8  [ 2C49A2441EBB24C6ACFB524C1459115F, 0ABACB6F21C41C0297994E61F1BFABB3905AF6B569D0446FE8E174EB9225B8EF ] 3ware           C:\WINDOWS\system32\drivers\3ware.sys

14:36:34.0326 0x1be8  3ware - ok

14:36:34.0358 0x1be8  [ B87D3D07FE6F15328C6860D542F0E2BD, 46CF069EDD7DBFB4DB800BABA3081DAB363DD2CFD724AFF5916D3419F62A3574 ] ACPI            C:\WINDOWS\system32\drivers\ACPI.sys

14:36:34.0375 0x1be8  ACPI - ok

14:36:34.0386 0x1be8  [ 1E3C4EDBB7F3F668B7205E351010BB79, A3CA12F72836C4F77B671264828B370B9EBA9CD71110E2C0514994760B6B12FF ] acpiex          C:\WINDOWS\system32\Drivers\acpiex.sys

14:36:34.0395 0x1be8  acpiex - ok

14:36:34.0417 0x1be8  [ 13B1C26AEDCB40082CDD97506F968129, 883442206B4C60AA493E84CC3037B6C1568441E1F43D2B1FCBFD8D87D135D511 ] acpipagr        C:\WINDOWS\System32\drivers\acpipagr.sys

14:36:34.0425 0x1be8  acpipagr - ok

14:36:34.0446 0x1be8  [ B3D64FF927D611721DA73A61BF3A18B3, 96B51AFDC3078B5088AAF66F0CF3E07D2FCBBC84A19D309A25DF0A5C6CECB958 ] AcpiPmi         C:\WINDOWS\System32\drivers\acpipmi.sys

14:36:34.0453 0x1be8  AcpiPmi - ok

14:36:34.0460 0x1be8  [ 19F793B2203D94AC1F8AEDB08B494E2E, DC98CCF9935E1F1C32FA88575A9A678B74916EFF48E39A64CF1FF92232F64A52 ] acpitime        C:\WINDOWS\System32\drivers\acpitime.sys

14:36:34.0468 0x1be8  acpitime - ok

14:36:34.0551 0x1be8  [ 5DB2C6B908C50767E2EDAA294A7566B5, 13AE4879D679BB0C6B2A5A5B13910359815A9D2E569BC1DE740B5A387A78CF33 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

14:36:34.0557 0x1be8  AdobeARMservice - ok

14:36:34.0602 0x1be8  [ 2A24E10C1A1DE0E0035E353EED494A1C, CBBFA86578BE74CAADDCA923D65E3BFFC57BC17B887936ADE5C6952530546A22 ] ADP80XX         C:\WINDOWS\system32\drivers\ADP80XX.SYS

14:36:34.0629 0x1be8  ADP80XX - ok

14:36:34.0662 0x1be8  [ 6C12C7E01A4F64E0AA9C88AF66955CC9, 81A413702909341F8694823EC83FBA0089523D7EC927B80E55E0779BB83AD263 ] AFD             C:\WINDOWS\system32\drivers\afd.sys

14:36:34.0679 0x1be8  AFD - ok

14:36:34.0702 0x1be8  [ EF09D07626820F7F89519514C17FE768, C3EC1DC163CD5946270ED876CD414889BBF2C586A8AF5DC7825FA5D77001E827 ] agp440          C:\WINDOWS\system32\drivers\agp440.sys

14:36:34.0709 0x1be8  agp440 - ok

14:36:34.0733 0x1be8  [ 8A289EF0721F95267BF2404BABEE146D, E263D258F03DF3BB405D49AE7230C37E7EB8F392FDEE48059C7C1E3709520D35 ] ahcache         C:\WINDOWS\system32\DRIVERS\ahcache.sys

14:36:34.0747 0x1be8  ahcache - ok

14:36:34.0769 0x1be8  [ C301499987AF909258774AE9DC5778BB, 3ED539C999847116AE9DB9C8C5A34AB09703BAE3018E1EAF6DBC779BB6736F32 ] AJRouter        C:\WINDOWS\System32\AJRouter.dll

14:36:34.0777 0x1be8  AJRouter - ok

14:36:34.0799 0x1be8  [ DD69535D379F9E40AD0D6002887AAA99, 579DD18CE2B264B4058C6069B8AEE6FD9FE6A882B7DA19E300DFE40B37A4E5BE ] ALG             C:\WINDOWS\System32\alg.exe

14:36:34.0809 0x1be8  ALG - ok

14:36:34.0834 0x1be8  [ 6DD5B6F43B389A058FA92C2C955F1296, 66575E05E91D88B1ED9BD2817A667DA91279B480106B6F97A82BB1DD7B731052 ] AMD External Events Utility C:\WINDOWS\system32\atiesrxx.exe

14:36:34.0845 0x1be8  AMD External Events Utility - ok

14:36:34.0869 0x1be8  [ 6763084E8322A4876D1613854640F914, 89EEEB47517A9964FA799821E5E45BDD6009EBDC628D6DADE6A7F03DE7CDA6CD ] AmdK8           C:\WINDOWS\System32\drivers\amdk8.sys

14:36:34.0880 0x1be8  AmdK8 - ok

14:36:34.0904 0x1be8  [ F2FF8C1B41B3784EDBD5C6D5397F403C, 104873700D2BDF4812DC48200B4609F46A63E7A50594A0599100EF1438863708 ] amdkmafd        C:\WINDOWS\system32\drivers\amdkmafd.sys

14:36:34.0912 0x1be8  amdkmafd - ok

14:36:34.0915 0x1be8  amdkmdag - ok

14:36:34.0940 0x1be8  [ 8653B22467365AC4853566B2E20C36DE, AB2896370C6EBFDAE4195E3A25F40E440B709280A472ACCB4F8912E59D4C5DC6 ] amdkmdap        C:\WINDOWS\system32\DRIVERS\atikmpag.sys

14:36:34.0959 0x1be8  amdkmdap - ok

14:36:34.0974 0x1be8  [ DE29D8AB57AD67D4940CAB4A48B3E230, 4E92AFCD9107573DAB8E65AC6318E4B8851DCCBE17E135DFF8CF5733210B52E6 ] AmdPPM          C:\WINDOWS\System32\drivers\amdppm.sys

14:36:34.0984 0x1be8  AmdPPM - ok

14:36:35.0020 0x1be8  [ 4C1F9BBAF5CCD76D4642F3B92B97B454, 514CCAA8B586B1019658BE101046386EB727AD48D7913AEF9A168763E91F0DE5 ] amdsata         C:\WINDOWS\system32\drivers\amdsata.sys

14:36:35.0028 0x1be8  amdsata - ok

14:36:35.0040 0x1be8  [ F8195C1A15955180DD663E7FF4C2F6DD, F3C0C6B38FB9478217EE25EBDBDF7A18F01B97655BC38373E70E71171705D5E9 ] amdsbs          C:\WINDOWS\system32\drivers\amdsbs.sys

14:36:35.0051 0x1be8  amdsbs - ok

14:36:35.0059 0x1be8  [ DD2F5BBCFAC4D8E48DB1A95A7EEBFF08, 619E3106072C6F785144D785C4AFB4C607CAF7ED29AAA4A1411BE262E62B7ADE ] amdxata         C:\WINDOWS\system32\drivers\amdxata.sys

14:36:35.0066 0x1be8  amdxata - ok

14:36:35.0077 0x1be8  [ 46AAF119090573A80D603745582229ED, 8D7C4AED66DD32A104965DC23D17C0815CD1BE2E3D52375C1A63863664EE174F ] AppID           C:\WINDOWS\system32\drivers\appid.sys

14:36:35.0086 0x1be8  AppID - ok

14:36:35.0090 0x1be8  [ 24315B385F515D6D5476757EAFD62633, CE645397BF43CC54B864A0E4FCB86F76C10B9C2D2482E85DBBE15EF7BF045F17 ] AppIDSvc        C:\WINDOWS\System32\appidsvc.dll

14:36:35.0116 0x1be8  AppIDSvc - ok

14:36:35.0125 0x1be8  [ 2CE396457D5C18F034D243EC7E159010, DDF588A568DF5EAE058DF315535BD746760363E2242EF8C705F8DCBA2D5DA4A7 ] Appinfo         C:\WINDOWS\System32\appinfo.dll

14:36:35.0137 0x1be8  Appinfo - ok

14:36:35.0213 0x1be8  [ 3E7C6639E424FD28952C29D66B7E5277, B10AD3FA5CB36328C5DF33AF58F76770E2B54CFBCB70BD84934F925B8E19FA1F ] Apple Mobile Device Service C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

14:36:35.0218 0x1be8  Apple Mobile Device Service - ok

14:36:35.0234 0x1be8  [ 68AF553066C4DAE7D8698322526BDA86, 806A5228D204B18B3B9F88AB87B5918046BE96D1B3AEFEC9331CA7A483547486 ] AppMgmt         C:\WINDOWS\System32\appmgmts.dll

14:36:35.0246 0x1be8  AppMgmt - ok

14:36:35.0265 0x1be8  [ A8AC0B8ED134888731D1A1BCEF930FA1, 917D2C99CB28C5F20BA386148B6A93541AEF900A9A99D310D732B501322945E5 ] AppReadiness    C:\WINDOWS\system32\AppReadiness.dll

14:36:35.0288 0x1be8  AppReadiness - ok

14:36:35.0355 0x1be8  [ 2E71E6B389976FD78609A1AB44F7EEB1, 24F7A6D7B4C3DFFE128AFE70F37FFA6258928DF7CCFF3AB2490A41F595529299 ] AppXSvc         C:\WINDOWS\system32\appxdeploymentserver.dll

14:36:35.0416 0x1be8  AppXSvc - ok

14:36:35.0432 0x1be8  [ 0756EECAC010BE449D07502DF27E7701, 6A895CA80050D021DB5E130102F626027339A22673B7C15C51A375C0401F03D2 ] arcsas          C:\WINDOWS\system32\drivers\arcsas.sys

14:36:35.0441 0x1be8  arcsas - ok

14:36:35.0460 0x1be8  [ E1AFEE1584C74050DE0DD16DE2A54BF3, 77C8D98159D8BCDC7917B04977949823D50C49D0D13587310E060A4B8893AE42 ] AsrAppCharger   C:\WINDOWS\system32\DRIVERS\AsrAppCharger.sys

14:36:35.0464 0x1be8  AsrAppCharger - ok

14:36:35.0516 0x1be8  [ 1A234F4643F5658BAB07BFA611282267, F40435488389B4FB3B945CA21A8325A51E1B5F80F045AB019748D0EC66056A8B ] AsrDrv101       C:\Windows\SysWOW64\Drivers\AsrDrv101.sys

14:36:35.0520 0x1be8  AsrDrv101 - ok

14:36:35.0573 0x1be8  [ D208B82330EB0CA9E1285520630183F1, 1122E08493BFDF639ECB80A7F3BD640971FF3639154F4130434F98E1831E004A ] ASRockIOMon     C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe

14:36:35.0586 0x1be8  ASRockIOMon - detected UnsignedFile.Multi.Generic ( 1 )

14:36:37.0903 0x1be8  Detect skipped due to KSN trusted

14:36:37.0903 0x1be8  ASRockIOMon - ok

14:36:37.0927 0x1be8  [ A149C93231945A5118C63AEACA6D1E72, 60B28184585B389751FCF71651A139D74018DE04AEBF4A497835AF727B64BD53 ] AsrRamDisk      C:\WINDOWS\system32\drivers\AsrRamDisk.sys

14:36:37.0931 0x1be8  AsrRamDisk - ok

14:36:37.0959 0x1be8  [ A5792F971EFE86B7F56EE7299ED1082B, 82DCD15E2C9D8A3EA663941C9CE73020FEEF2F91354D0BB51E8A142AA1E30217 ] AsyncMac        C:\WINDOWS\System32\drivers\asyncmac.sys

14:36:37.0969 0x1be8  AsyncMac - ok

14:36:37.0976 0x1be8  [ 8921DF6060DB5C7700AA48CB12E9EA08, 8F18841B454CDE4926C50B23F818D00ECE0AE884DB198E396445CB44CB39B2C4 ] atapi           C:\WINDOWS\system32\drivers\atapi.sys

14:36:37.0982 0x1be8  atapi - ok

14:36:37.0996 0x1be8  [ AF6DD5993D46AF2492C19E1FF6D9A04C, 720F27791FF5D486AD07A447A4BC44D137AA245B91CE1D624E40B1DA78B6CACF ] AtiHDAudioService C:\WINDOWS\system32\drivers\AtihdWB6.sys

14:36:38.0006 0x1be8  AtiHDAudioService - ok

14:36:38.0040 0x1be8  [ 240FF83DD79546B26F187FAB20F83864, C4DC0159016B4A4630357131E614814C068D07BEA94AAF6393E882A78C9FCA1E ] AudioEndpointBuilder C:\WINDOWS\System32\AudioEndpointBuilder.dll

14:36:38.0056 0x1be8  AudioEndpointBuilder - ok

14:36:38.0081 0x1be8  [ 4C86961C71396D2BA39DAD9783437546, C36A428701D6C0E2FFDF0ECB8917FB6ED48E8014F7C3DD911387DE6E161D7EAD ] Audiosrv        C:\WINDOWS\System32\Audiosrv.dll

14:36:38.0114 0x1be8  Audiosrv - ok

14:36:38.0139 0x1be8  [ 2F7F80543129210CA75995D0DCA488E8, 353E598FF26FA363C02A2B44BA8D7D1ED97B8AC8C69F1B5C5D521BD0D5D5AB94 ] AxInstSV        C:\WINDOWS\System32\AxInstSV.dll

14:36:38.0152 0x1be8  AxInstSV - ok

14:36:38.0170 0x1be8  [ 00D64E82900E4EC9062805ED87C2D75A, 577110F9A7C6C2C4CF86FFF4F60E23F61623ED325FC950033900A5102754A677 ] b06bdrv         C:\WINDOWS\system32\drivers\bxvbda.sys

14:36:38.0187 0x1be8  b06bdrv - ok

14:36:38.0208 0x1be8  [ 5164A66EC1565711A7B4CF2F143B4979, DA29F0FB63F3EB2BF92D51FEB4BB7D2B964553D2F634556325953927464CB3A5 ] BasicDisplay    C:\WINDOWS\System32\drivers\BasicDisplay.sys

14:36:38.0217 0x1be8  BasicDisplay - ok

14:36:38.0225 0x1be8  [ F4C58BBF2972BD84C73F6A14CA35AC4E, B7A226EB861B63ACF4BF9B5A331ACA6FFC9B787DCCAA7697EEFC4F634508A6D5 ] BasicRender     C:\WINDOWS\System32\drivers\BasicRender.sys

14:36:38.0233 0x1be8  BasicRender - ok

14:36:38.0254 0x1be8  [ 25349D0B334E528667980948ED107D89, 70EF9D3B8DCAC6E9720C6F3EBC77392FADC182A6925F9024FE30A21321E0137F ] bcmfn2          C:\WINDOWS\System32\drivers\bcmfn2.sys

14:36:38.0258 0x1be8  bcmfn2 - ok

14:36:38.0284 0x1be8  [ DF78B56EEE6004DEE8CE57763128075E, 5758CAF4B0182F3F2E2508B3BB58B0271F2689808D09675B2753FE373D1D77D2 ] BDESVC          C:\WINDOWS\System32\bdesvc.dll

14:36:38.0300 0x1be8  BDESVC - ok

14:36:38.0328 0x1be8  [ 1E8A9267F8886803AAE02982FC1B5BC4, 655DF84E037BD6E582A6BA89737A4388956219171AF7253D126E54A23F16BE59 ] Beep            C:\WINDOWS\system32\drivers\Beep.sys

14:36:38.0345 0x1be8  Beep - ok

14:36:38.0375 0x1be8  [ 7FAFFFC4C59F5010D6E7CEA152076B92, 945FD6C04E109D4E5A4164BAA9A8120EC85AB809555AAD83E61B9F179F976FD7 ] BFE             C:\WINDOWS\System32\bfe.dll

14:36:38.0402 0x1be8  BFE - ok

14:36:38.0445 0x1be8  [ BD60F5633F6BD617D9ECCA3FFDC0D37E, 2F0DECAEB7096CD628387263381E123C883F483BD87F7F2BA6DEFBB5A184BAA3 ] BITS            C:\WINDOWS\System32\qmgr.dll

14:36:38.0482 0x1be8  BITS - ok

14:36:38.0511 0x1be8  [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD, 17BFFC5DF609CE3B2F0CAB4BD6C118608C66A3AD86116A47E90B2BB7D8954122 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe

14:36:38.0521 0x1be8  Bonjour Service - ok

14:36:38.0532 0x1be8  [ C9FD65687EF89715999C582D3E568812, 42BA59A78A47C510CB2AFDC6C6080B33F9F611F84FEE5262DFF16D7633C50EB1 ] bowser          C:\WINDOWS\system32\DRIVERS\bowser.sys

14:36:38.0542 0x1be8  bowser - ok

14:36:38.0574 0x1be8  [ 3A4A543F135DE9A06ABA9DF982D79DD7, ABA165435C27BE15D7EBD3E7D023E295CB7AE2A099DF9E253C78EC45EADD75EA ] BrokerInfrastructure C:\WINDOWS\System32\bisrv.dll

14:36:38.0595 0x1be8  BrokerInfrastructure - ok

14:36:38.0604 0x1be8  [ 2AAD720B32904B97EDD8C3211344F79E, 41B1AEA5FAA48033B2581E18D68EFC986C3D65B383847E250C054CE3133A893C ] Browser         C:\WINDOWS\System32\browser.dll

14:36:38.0614 0x1be8  Browser - ok

14:36:38.0626 0x1be8  [ F8DD3B0EAC1EF1D087AE47E5819540AC, 866C951B52E3202AC89552AEA72A45123367199335578F03815E2ED55DA2FDAE ] BthAvrcpTg      C:\WINDOWS\System32\drivers\BthAvrcpTg.sys

14:36:38.0635 0x1be8  BthAvrcpTg - ok

14:36:38.0656 0x1be8  [ 647E2A425AD43637EAA01096A58B7089, 8F76D024FEBCBA1AC54363133DE1E0DD5B9D696E5E688EFEBC3B79F7F1B9C568 ] BthHFEnum       C:\WINDOWS\System32\drivers\bthhfenum.sys

14:36:38.0666 0x1be8  BthHFEnum - ok

14:36:38.0675 0x1be8  [ B95040CAD3434D9EE003065363A0FAFF, D441E0676EA1AE1ABC305732024311CA59715E6763B3D7ADB728DEEFC403E182 ] bthhfhid        C:\WINDOWS\System32\drivers\BthHFHid.sys

14:36:38.0684 0x1be8  bthhfhid - ok

14:36:38.0711 0x1be8  [ F334BF7B0737CEB3B6822631EAD55A87, 4E5AEB1F8E109BA01A5D1CDE2E3C677FF07F2AFE8B195CB5F82AA28816D2060E ] BthHFSrv        C:\WINDOWS\System32\BthHFSrv.dll

14:36:38.0727 0x1be8  BthHFSrv - ok

14:36:38.0737 0x1be8  [ 29AEE352AED4FCD2191436D263D75347, 3D21262EA26BF423BFA4A9146E53F8B036B2A1157DBE91A11C5603AF7A670B6F ] BTHMODEM        C:\WINDOWS\System32\drivers\bthmodem.sys

14:36:38.0747 0x1be8  BTHMODEM - ok

14:36:38.0761 0x1be8  [ 26DD0127A05B333E36316E6EA9A6AAE2, A2DC4483FF5639EE8DD315AB2989865CA6A6992C578FD7F7D31698A015355941 ] bthserv         C:\WINDOWS\system32\bthserv.dll

14:36:38.0771 0x1be8  bthserv - ok

14:36:38.0786 0x1be8  [ 854AF190F55E6D70EC65A85798F896E2, 6D39F9131BE93F934502BA1DB109E7AD35D3987B636F7B32F9C34823DF25746B ] buttonconverter C:\WINDOWS\System32\drivers\buttonconverter.sys

14:36:38.0795 0x1be8  buttonconverter - ok

14:36:38.0807 0x1be8  [ A10A1E05A943B10ECE5D57D131B7404D, 71BB816B6841001A4305DF1814926B639265E91895CA5D06284B0970E40CE386 ] CapImg          C:\WINDOWS\System32\drivers\capimg.sys

14:36:38.0818 0x1be8  CapImg - ok

14:36:38.0831 0x1be8  [ F2829DC6D292DCAC5029893BB2E9FEE3, AF2A25722D3BE37BABD1F6668786AAF39E9D6CA18CE8E845E63266E218C64526 ] cdfs            C:\WINDOWS\system32\DRIVERS\cdfs.sys

14:36:38.0841 0x1be8  cdfs - ok

14:36:38.0866 0x1be8  [ F3A9E38AE23AD4015764AF89E4AE3519, 57ED6AC834177E128720FEC5B5793F35C7C36474E2D787F182B6730933222CC9 ] CDPSvc          C:\WINDOWS\System32\CDPSvc.dll

14:36:38.0884 0x1be8  CDPSvc - ok

14:36:38.0914 0x1be8  [ CA160E02F35A61C6F5C681FB4669C519, E6BC66156EE226F16804C4FDC8A60EB15CE6212EAFB9FB841FAC899979E140E2 ] cdrom           C:\WINDOWS\System32\drivers\cdrom.sys

14:36:38.0925 0x1be8  cdrom - ok

14:36:38.0934 0x1be8  [ 320E7A02D81A468E8C1FEEFDB856AFAE, E65127D3D6B628F9D19EA509FEBD9E4DC1BF20D0C62C3C9E1D7087DF972B2AA7 ] CertPropSvc     C:\WINDOWS\System32\certprop.dll

14:36:38.0949 0x1be8  CertPropSvc - ok

14:36:39.0002 0x1be8  [ 1BF0745142C07A6967C6DB7DEBFF6B16, 50C60F59CC1FE6EFF4E79A0A2545B14FF4851881C9262D6CFA6EE0ECF027D1D6 ] cFosSpeed       C:\WINDOWS\system32\DRIVERS\cfosspeed6.sys

14:36:39.0035 0x1be8  cFosSpeed - ok

14:36:39.0105 0x1be8  [ 49C58338E9572E2570E2C636A3CDAA42, 9E2271B008EABD1263507A4185FE0CFDE84C65A659DF350EF000325FA0340B66 ] cFosSpeedS      C:\Program Files\ASRock\XFast LAN\spd.exe

14:36:39.0119 0x1be8  cFosSpeedS - ok

14:36:39.0138 0x1be8  [ 60D7D304DF75DFF6A46CF633F583B592, 4141D8D1C6FE829C02053DA91AC6B0628BDEB3322CAAD4AD958190F9D173340E ] circlass        C:\WINDOWS\System32\drivers\circlass.sys

14:36:39.0147 0x1be8  circlass - ok

14:36:39.0166 0x1be8  [ FF9D4BCE19E5D36CB3A845A3286DA6C3, A0E2C38D629359EEC6F8EEC6F92A3E571AEF018BAF259F395DC497ED4827460B ] CLFS            C:\WINDOWS\system32\drivers\CLFS.sys

14:36:39.0179 0x1be8  CLFS - ok

14:36:39.0211 0x1be8  [ 5C4648673693724C8D4A1A92E1AA06E6, 5D548241715687BFA52E40B867EF73CB45D01B7F9A9B7F00B92BF2B4C97BE1D0 ] ClipSVC         C:\WINDOWS\System32\ClipSVC.dll

14:36:39.0230 0x1be8  ClipSVC - ok

14:36:39.0254 0x1be8  [ 8EBA63416EC166EBA6EF6D34A505D8C8, 5EB0236ABEA2277B71D9F009DA71934C618606B20BBEC07B8595195E40C12A2B ] CmBatt          C:\WINDOWS\System32\drivers\CmBatt.sys

14:36:39.0263 0x1be8  CmBatt - ok

14:36:39.0290 0x1be8  [ 3B64DA873CEA5BEC42570BFF1054A014, 3649B25855CB9BE5BA3B3FEE4221575381FB2D488B8B050B5DD0088386AA0F7B ] CNG             C:\WINDOWS\system32\Drivers\cng.sys

14:36:39.0307 0x1be8  CNG - ok

14:36:39.0314 0x1be8  [ 5EEA0856000F81B3D709BC81B3AA1EF2, C04E4E31D3FC38102BA410D312F58AF848920EE37004A5C306D79229C9B6079A ] cnghwassist     C:\WINDOWS\system32\DRIVERS\cnghwassist.sys

14:36:39.0321 0x1be8  cnghwassist - ok

14:36:39.0371 0x1be8  [ 74CD3BF688E2B408227FE012A2F2D8ED, CC01AC79CEB9DC94FA5675D66F048928C9968B8944E34F5482A73C14B70EE8A8 ] CompositeBus    C:\WINDOWS\System32\DriverStore\FileRepository\compositebus.inf_amd64_98334ba6e76853ba\CompositeBus.sys

14:36:39.0379 0x1be8  CompositeBus - ok

14:36:39.0382 0x1be8  COMSysApp - ok

14:36:39.0394 0x1be8  [ D38774D1D383A2CDB9A4F64B7206913B, 6CDDC46D1D431342F00CA537FC327B23B8AA4D513CEEEE61F3E19C77975DF9C8 ] condrv          C:\WINDOWS\system32\drivers\condrv.sys

14:36:39.0402 0x1be8  condrv - ok

14:36:39.0439 0x1be8  [ 8AFDD74F2DC5BAD9B2215FB19DB65240, A2BDDA4C77C63D3D8E9F1D397D7B41EC1BF093A6399C14D311D4D230B5F1E093 ] CoreMessagingRegistrar C:\WINDOWS\system32\coremessaging.dll

14:36:39.0461 0x1be8  CoreMessagingRegistrar - ok

14:36:39.0490 0x1be8  [ 35DB06AACD8AD5999161DA71FF0E16F0, 22AD27811AAD14666ACEF4115447B0CFAA70D1E73923059FB2A9B4C3CBE500A6 ] CryptSvc        C:\WINDOWS\system32\cryptsvc.dll

14:36:39.0500 0x1be8  CryptSvc - ok

14:36:39.0515 0x1be8  [ 838755238B2BAE5A4802B038443B8A22, 1A89E413C6E5C3E8C2B64F8A1D41271D3FA39BC67291331FEC8DCFD4F8CCE994 ] CSC             C:\WINDOWS\system32\drivers\csc.sys

14:36:39.0536 0x1be8  CSC - ok

14:36:39.0570 0x1be8  [ 7D64B14DAFEBBC19A87EC9D5B862F6AA, BE7510E618566FEA013E2E77CE4C7C160BADE105C493424595A15D0A7F1615CF ] CscService      C:\WINDOWS\System32\cscsvc.dll

14:36:39.0596 0x1be8  CscService - ok

14:36:39.0621 0x1be8  [ F038EAF73AAB72A4A89185A5A7B9FD75, 8213A60B3BEAFC1C554C5D049DFE3C6E44CEFE639EDD6A335AC18A9DAEDA2D4B ] dam             C:\WINDOWS\system32\drivers\dam.sys

14:36:39.0629 0x1be8  dam - ok

14:36:39.0664 0x1be8  [ 5E57B9FBB4E9C43EE5B69BEE01A1819F, A1F8D1E52AF446CEA2EB50064E3A24B713B19197D61C3EAECB81B3CCD80558E7 ] DcomLaunch      C:\WINDOWS\system32\rpcss.dll

14:36:39.0693 0x1be8  DcomLaunch - ok

14:36:39.0702 0x1be8  [ 0605AB12BF1856DF21AB708F28EA91CF, 3A6A7F8F84044DC1EA490A007E6DBC52203BA237ECF1B845961D9BB95E9BF8C8 ] DcpSvc          C:\WINDOWS\system32\dcpsvc.dll

14:36:39.0718 0x1be8  DcpSvc - ok

14:36:39.0733 0x1be8  [ BABB7BB5AD3CECFF466E6080F43CFC58, 1B8FF66557EC4C749156ED6DACC4D61D5DC4E25DD58F6DB3713C356214B80FDA ] defragsvc       C:\WINDOWS\System32\defragsvc.dll

14:36:39.0756 0x1be8  defragsvc - ok

14:36:39.0774 0x1be8  [ 63C9464B165D31ACC46B6B089AB36B41, DE38DE4E6331D07630B63224F8014C27368C29791EDB58CC5DAE7CBACD37160A ] DeviceAssociationService C:\WINDOWS\system32\das.dll

14:36:39.0795 0x1be8  DeviceAssociationService - ok

14:36:39.0806 0x1be8  [ 7B3DA16FAA498838BB457E0B7E380EDF, B73DCFFA60886F10765E4B76A58CFF18C08CAFEE620700361FC8FEC7E80B5958 ] DeviceInstall   C:\WINDOWS\system32\umpnpmgr.dll

14:36:39.0820 0x1be8  DeviceInstall - ok

14:36:39.0828 0x1be8  [ CF3895DD260ADE05BC91D8FBE0A82907, D7D8A29E873BE5C3832C9264F0165F6CD50D42ED0E04B0FCF07F054793092334 ] DevQueryBroker  C:\WINDOWS\system32\DevQueryBroker.dll

14:36:39.0837 0x1be8  DevQueryBroker - ok

14:36:39.0857 0x1be8  [ 25435407D97419627F4B10653433BF2B, 5429B0DB7C5302E9A6AF92C046637183D4147D4A206963ABEA3A611214D6AB04 ] Dfsc            C:\WINDOWS\system32\Drivers\dfsc.sys

14:36:39.0868 0x1be8  Dfsc - ok

14:36:39.0891 0x1be8  [ 73BDD44A6088916964945886F9025409, 8E2ECC9AAEF3C6EBA2E61D25F657FDFCC72AB517CC4FD5FFF992E1F9EB942662 ] dg_ssudbus      C:\WINDOWS\system32\DRIVERS\ssudbus.sys

14:36:39.0897 0x1be8  dg_ssudbus - ok

14:36:39.0905 0x1be8  [ E59C209F1F633C1AEAF151B2CA46BBAA, 6A4DA927418B56A228CC8D9DFA3351B2B53A9328F5C56C10F0C7B19974B2ED89 ] Dhcp            C:\WINDOWS\system32\dhcpcore.dll

14:36:39.0929 0x1be8  Dhcp - ok

14:36:39.0976 0x1be8  [ 95AA7877FD4161BFBC8493F9279B1901, F6B7DF75D763A89901BD12454BEF92D161B392F721B8568505073929D9F419BD ] diagnosticshub.standardcollector.service C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

14:36:39.0984 0x1be8  diagnosticshub.standardcollector.service - ok

14:36:40.0027 0x1be8  [ 58395E37ED838B93A56F1D089C2F53CF, 57D167B58DF5B33F7E2A98E1B8B33C8F076D34CA032D22F050AE6F83A48DC8E6 ] DiagTrack       C:\WINDOWS\system32\diagtrack.dll

14:36:40.0064 0x1be8  DiagTrack - ok

14:36:40.0076 0x1be8  [ FDCD449AE9E75D7690593D16ADAF4DB4, 3366C4BDB031EB525F85850E903C46802A2AC762C0772C6F6E543DDA4AF1E9D5 ] disk            C:\WINDOWS\system32\drivers\disk.sys

14:36:40.0084 0x1be8  disk - ok

14:36:40.0111 0x1be8  [ 43A1B8B43CA4E213E0FD920F2FD6BCBA, 839C6047FD6EA951538209C30C9D8AE68F9B47A58DA151D071C03408250B0ECD ] DmEnrollmentSvc C:\WINDOWS\system32\Windows.Internal.Management.dll

14:36:40.0126 0x1be8  DmEnrollmentSvc - ok

14:36:40.0144 0x1be8  [ F10A8F6D036CEDD14A5471782C52F041, E0DA3C4F76DBBEAED549375E57819F8825B33A118F7674D417D294054863F648 ] dmvsc           C:\WINDOWS\System32\drivers\dmvsc.sys

14:36:40.0152 0x1be8  dmvsc - ok

14:36:40.0183 0x1be8  [ 7228733177F673B4D51BD1AA082D47C1, DBE155CDCFAA7C32407A207F637F252FA0CE30F1DE7E7DBEC42DB37FADB5BFA7 ] dmwappushservice C:\WINDOWS\system32\dmwappushsvc.dll

14:36:40.0210 0x1be8  dmwappushservice - ok

14:36:40.0234 0x1be8  [ 592E41B3C11CA12203D3708AD8FC3D37, 6C69D5D603FBF038C069EDDCE29F7C6A60CAAE58B985AB218E1497F2BA934D42 ] Dnscache        C:\WINDOWS\System32\dnsrslvr.dll

14:36:40.0248 0x1be8  Dnscache - ok

14:36:40.0267 0x1be8  [ 6184C7A2F12625C108AEFD3A43429967, 689153F319BB1013FF60F71317E8380A6945EEE8141EDBDD6B185A966E23BB93 ] dot3svc         C:\WINDOWS\System32\dot3svc.dll

14:36:40.0282 0x1be8  dot3svc - ok

14:36:40.0304 0x1be8  [ 27069CFFF29B7F04F4B1BB10154BE52B, 6869626F9A1D3F64224883C5E661638CEE893A3E29651C7B9302A03E52180415 ] dot4            C:\WINDOWS\system32\DRIVERS\Dot4.sys

14:36:40.0310 0x1be8  dot4 - ok

14:36:40.0323 0x1be8  [ 0BD906A79F9CE3013F7D9D0AC45F9F9D, 2F7D5082E7E226D5EBEA164A8ACEE0A447C96EB1829224A6EFA3E7B4EFEE1D14 ] Dot4Print       C:\WINDOWS\System32\drivers\Dot4Prt.sys

14:36:40.0327 0x1be8  Dot4Print - ok

14:36:40.0339 0x1be8  [ B7D595F2F464F7B628AD53F06547792C, F5D06A91EF54FBF56305FCC882B854350B266B2A005D80CC77AEBC2929440729 ] dot4usb         C:\WINDOWS\system32\DRIVERS\dot4usb.sys

14:36:40.0343 0x1be8  dot4usb - ok

14:36:40.0362 0x1be8  [ A616D8297C1BEA690BBC796736A7A78D, 9365470F4609606410AD79D98E1E77D815DC7C5AA924FB639FCF713EE8EDEA76 ] DPS             C:\WINDOWS\system32\dps.dll

14:36:40.0373 0x1be8  DPS - ok

14:36:40.0394 0x1be8  [ 45771610FF181434073B5A0A00F20F8D, 6A17DB09AA6D021F000F7315317235E1FCF41FD58EA7DF81A7C9F5A6DE999984 ] drmkaud         C:\WINDOWS\system32\drivers\drmkaud.sys

14:36:40.0400 0x1be8  drmkaud - ok

14:36:40.0428 0x1be8  [ 00D9A948FB7344C62CEBED88E50EE39A, EF33FE7FB34DE571F3956C1F7AC8EFAA25BFD9F3AFA3ECD25DD34C5890873245 ] DsmSvc          C:\WINDOWS\System32\DeviceSetupManager.dll

14:36:40.0441 0x1be8  DsmSvc - ok

14:36:40.0465 0x1be8  [ EA354224BAD970CF0F438E6567F26A49, 900F2454F085BC6D2C2149A96452F3375111C601C4464066B6DA1DD7B795021A ] DsSvc           C:\WINDOWS\System32\DsSvc.dll

14:36:40.0478 0x1be8  DsSvc - ok

14:36:40.0536 0x1be8  [ 89C9C3745F270EF93988DA57BC6AA62B, 947886F3121919427BDCB123C6FC28E29CA73D427E92025E1BEAA743D27306D3 ] DXGKrnl         C:\WINDOWS\System32\drivers\dxgkrnl.sys

14:36:40.0579 0x1be8  DXGKrnl - ok

14:36:40.0607 0x1be8  [ C413D1219AFF3005E1318CC8EA38DB4F, 2DBED36CA9B9BCC443C0D8FD41BAED5FFD38F5531FF9BE5B7A9DAD22087C5707 ] e1iexpress      C:\WINDOWS\System32\drivers\e1i63x64.sys

14:36:40.0650 0x1be8  e1iexpress - ok

14:36:40.0675 0x1be8  [ 6E36BDBB46DF7F865D0DD30663AE3891, 98967B01EA450AD4D5FE8085F710359C022D783B839A51BD4A266718156B01EB ] Eaphost         C:\WINDOWS\System32\eapsvc.dll

14:36:40.0692 0x1be8  Eaphost - ok

14:36:40.0764 0x1be8  [ 3070013B01EDA42C7EB67D731340C396, C083CA05650750876E70CB6AB51D5C047C06098C2ED86B083A74C97830247BFC ] ebdrv           C:\WINDOWS\system32\drivers\evbda.sys

14:36:40.0835 0x1be8  ebdrv - ok

14:36:40.0859 0x1be8  [ 9A83FA0EC9B0DCED2CBC49DD05901920, 14D2F241235E2693C68BCCF05D83F2A1C9A7BE185C83E7C6C63EF0F654892F95 ] EFS             C:\WINDOWS\System32\lsass.exe

14:36:40.0868 0x1be8  EFS - ok

14:36:40.0872 0x1be8  [ 59EE187E333EE9914DD9BEA5F4E0D85D, E34BB8075E38FC6AEC056323C6E3B5B4E7041EE6F4D51699B706DEEA18BDB911 ] EhStorClass     C:\WINDOWS\system32\drivers\EhStorClass.sys

14:36:40.0881 0x1be8  EhStorClass - ok

14:36:40.0904 0x1be8  [ 9297F1CC486F24BDFD2874156AC5430F, 1AF8689ADE4E658FC9418F7886B6C19F7D005EAB2AEF9B0E14FC81C61A74CECF ] EhStorTcgDrv    C:\WINDOWS\system32\drivers\EhStorTcgDrv.sys

14:36:40.0913 0x1be8  EhStorTcgDrv - ok

14:36:40.0937 0x1be8  [ 9E8FF6B95FD420FA9E40BE548E5C8D92, 8825B81418335D03CFAADB792C1466023C459BE489ACACBD6686FFB544F22D30 ] embeddedmode    C:\WINDOWS\System32\embeddedmodesvc.dll

14:36:40.0962 0x1be8  embeddedmode - ok

14:36:40.0972 0x1be8  [ DC2F91EAE9A28FA8C6610A9B7701B70D, 480DB509BF944AAC3617594F1245B4603069DE39186BC1FA7EDB8E0536B05E79 ] EntAppSvc       C:\WINDOWS\system32\EnterpriseAppMgmtSvc.dll

14:36:40.0986 0x1be8  EntAppSvc - ok

14:36:41.0007 0x1be8  [ F7FCCA6300485EF60CEA6D991D6C8C78, 24080D80CF1FD678DF4C9CAE70F65F8D9232F5F6A6F2B73A77B5E3C91E6505F3 ] ErrDev          C:\WINDOWS\System32\drivers\errdev.sys

14:36:41.0015 0x1be8  ErrDev - ok

14:36:41.0042 0x1be8  [ 2093F65AA84478E28C8E9D05BC413845, 086D4E0D4B993F4041AA8A9DCBEEDB53BD05B88E2BEFB218837FB10FACDF4233 ] EventSystem     C:\WINDOWS\system32\es.dll

14:36:41.0078 0x1be8  EventSystem - ok

14:36:41.0111 0x1be8  [ DCCDC3F35F0618692117DF90800A4284, B636B2A39AE89A9C2CDE17EC52DA669DA8AA9E2B04CA5CA19926DA8009655244 ] exfat           C:\WINDOWS\system32\drivers\exfat.sys

14:36:41.0127 0x1be8  exfat - ok

14:36:41.0152 0x1be8  [ 5A1C6AFFF6946C5C21A27AE05084C0D1, 558CB87E596E85182F6976F215EE0E35F57BF901409A2805E6A3C29D8984B048 ] fastfat         C:\WINDOWS\system32\drivers\fastfat.sys

14:36:41.0166 0x1be8  fastfat - ok

14:36:41.0204 0x1be8  [ 046FC9CF53A91E2FBA498CA7B0C3B028, BCFB06DF53065706DD6287E8C47BF5047F8A1E33981E1881E6ED7510337F5BC8 ] Fax             C:\WINDOWS\system32\fxssvc.exe

14:36:41.0228 0x1be8  Fax - ok

14:36:41.0260 0x1be8  [ 4E4B7D935DBF522B2F23D3573596181D, 9D0EC9F65920EE0FFFB2D49C58E4D5151C8CEEB7AA82543D226E4B84EEE4B3F0 ] fcvsc           C:\WINDOWS\System32\drivers\fcvsc.sys

14:36:41.0268 0x1be8  fcvsc - ok

14:36:41.0279 0x1be8  [ 583EB1C7690E361213BBD0472155128B, 5F5871490A6DAC4A824F4428941AC86FBFA9AA349B99B5D9544E5D62EB459FA8 ] fdc             C:\WINDOWS\System32\drivers\fdc.sys

14:36:41.0287 0x1be8  fdc - ok

14:36:41.0298 0x1be8  [ 94B1A46EDD335F0C54C7BDAFC43348E6, 58073D58D0BE7389C2A4736AFE108835E5AE9C9950FF630644F585C99B964043 ] fdPHost         C:\WINDOWS\system32\fdPHost.dll

14:36:41.0309 0x1be8  fdPHost - ok

14:36:41.0318 0x1be8  [ BC855BB7DFE06F27F78E0EB2A8CCB70D, D16C3DAB99C16B077BA5DA5E9E0646B0B9237B00ABAE867D9F81A2D072D583B1 ] FDResPub        C:\WINDOWS\system32\fdrespub.dll

14:36:41.0330 0x1be8  FDResPub - ok

14:36:41.0337 0x1be8  [ F1125F20D56F28DDCD1A6F3E81EB4F5F, A6620ECCB15FAA70E4A43ADA4CE82CF97D708B6FA07F3FAED276359E7F92FD0F ] fhsvc           C:\WINDOWS\system32\fhsvc.dll

14:36:41.0351 0x1be8  fhsvc - ok

14:36:41.0355 0x1be8  [ CDFD81CACE0E11596A3BB61EC4CF6467, 569FA86A215B054131AA9AFEECFEE7FD7143DCFFE275B84196004AEA538B2476 ] FileCrypt       C:\WINDOWS\system32\drivers\filecrypt.sys

14:36:41.0365 0x1be8  FileCrypt - ok

14:36:41.0378 0x1be8  [ 3F02FEDAE894CBF4BAADDF8C8E1D53A8, DA32ABB1CDA867B8456C46F8581FA7F3A8D8B89D9F6E7422F51941D5FFA15B13 ] FileInfo        C:\WINDOWS\system32\drivers\fileinfo.sys

14:36:41.0386 0x1be8  FileInfo - ok

14:36:41.0396 0x1be8  [ 2824933386E30DE5BA089DF539CE19A3, 7B33E514576C68B444AE99CBA1360EBFAE8A46EEE5C01F4EE4CF471A712AB148 ] Filetrace       C:\WINDOWS\system32\drivers\filetrace.sys

14:36:41.0407 0x1be8  Filetrace - ok

14:36:41.0424 0x1be8  [ 6A598249640F8BEDD79EC73917E1664F, A675238EA19E6632CDEB4EEFF7CF509EAAEF76AD8DFD247664E5607555D9CEE1 ] flpydisk        C:\WINDOWS\System32\drivers\flpydisk.sys

14:36:41.0433 0x1be8  flpydisk - ok

14:36:41.0459 0x1be8  [ 44B6A6832134DF651E887E941478CA35, FCF4EB726D00F5A17DD66C81CFDA49427281C94CF9CA2008397D591AEA61AE05 ] FltMgr          C:\WINDOWS\system32\drivers\fltmgr.sys

14:36:41.0473 0x1be8  FltMgr - ok

14:36:41.0494 0x1be8  [ E341178C116DAC6A3A764587E68DFA7B, 91B4C79057908A622666FF069CF1C7ECA42952A6587432F5E99E33E8B19D29AF ] FNETURPX        C:\WINDOWS\system32\drivers\FNETURPX.SYS

14:36:41.0499 0x1be8  FNETURPX - ok

14:36:41.0556 0x1be8  [ C197284A9D565A38497733AF2BDFA111, C6615AF0D366C2DD6D431B073901EED02D49AA3F252230735DBB52A90BCFA833 ] FontCache       C:\WINDOWS\system32\FntCache.dll

14:36:41.0605 0x1be8  FontCache - ok

14:36:41.0678 0x1be8  [ 109AACC7FB0170535F71491F673AFD38, 212B6761ABBAC29993DA0A47C3DDE8074EA9E5A8FFA8FF6EAB95AC69D8FDD5A0 ] FontCache3.0.0.0 C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

14:36:41.0685 0x1be8  FontCache3.0.0.0 - ok

14:36:41.0692 0x1be8  [ 3F3B9E8CECD5604BC7746EF3A852EB67, 51AF62A9563379266C0C873E82F55427900032DFD7AC3EBDCDF77F8F8DE91A5D ] FsDepends       C:\WINDOWS\system32\drivers\FsDepends.sys

14:36:41.0700 0x1be8  FsDepends - ok

14:36:41.0708 0x1be8  [ A60583221C7BB7CEC35C63285A297BE1, 3C842FBEAD1FA2BD8D37B2B0E8EDF77F4F50508C56FB25DFA81DE9679090D51D ] Fs_Rec          C:\WINDOWS\system32\drivers\Fs_Rec.sys

14:36:41.0715 0x1be8  Fs_Rec - ok

14:36:41.0808 0x1be8  [ 145F65521C983CBB68D994B4C2339AB4, 1AB4330B8F0A01B27F4D0A2900A5660B89FE22F2884A709890FE1297E35C40A1 ] Futuremark SystemInfo Service C:\Program Files (x86)\Futuremark\SystemInfo\FMSISvc.exe

14:36:41.0854 0x1be8  Futuremark SystemInfo Service - ok

14:36:41.0918 0x1be8  [ 58013A50225174EEF1410E37795D7908, F8E557CA4110ABB203192DEAF59D91A5FEF2A5EA394637276DAB7F4D2E7BFA39 ] fvevol          C:\WINDOWS\system32\DRIVERS\fvevol.sys

14:36:41.0937 0x1be8  fvevol - ok

14:36:41.0959 0x1be8  [ 0DAAE3EFCE00133AB3E383A36C47CDAF, 9145665F4F0575F951803AAFAA1A7DC0FAA35430CAE7D90E902074D60D6F4C62 ] gagp30kx        C:\WINDOWS\system32\drivers\gagp30kx.sys

14:36:41.0967 0x1be8  gagp30kx - ok

14:36:41.0983 0x1be8  [ 8E98D21EE06192492A5671A6144D092F, B8F656B34D361EA5AFB47F3A67AB2221580DADA59C8CD0CB83181E4AD8B562B4 ] GEARAspiWDM     C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys

14:36:41.0987 0x1be8  GEARAspiWDM - ok

14:36:42.0006 0x1be8  [ F59155B95D01C08F9ED774B626B504A1, EF0FCF35AD9CD5E5D695F0C064244D2B327E7FB10FD7CBB0586253EC75562918 ] gencounter      C:\WINDOWS\System32\drivers\vmgencounter.sys

14:36:42.0014 0x1be8  gencounter - ok

14:36:42.0023 0x1be8  [ AE24452F55C6F1784CBD7489D0CDDB02, 4E13C51CBF30A8662B1180AC74E968CFC428B6EA7931F09357E7D120063D4823 ] genericusbfn    C:\WINDOWS\System32\drivers\genericusbfn.sys

14:36:42.0032 0x1be8  genericusbfn - ok

14:36:42.0046 0x1be8  [ 96F0D3A583A91B634EE2AC2507356EDC, 43D2575F33D28F61C13D2DCF358BFA9DCEAE276C83152DBE7AE2020A66929CD9 ] GPIOClx0101     C:\WINDOWS\system32\Drivers\msgpioclx.sys

14:36:42.0055 0x1be8  GPIOClx0101 - ok

14:36:42.0095 0x1be8  [ E50CE978F571B900D9A7E2F1C5BCC070, EA14873A5F1B700D7CDBE55B9D214DC457262866A90D80B3E8325A8EB7932CE7 ] gpsvc           C:\WINDOWS\System32\gpsvc.dll

14:36:42.0138 0x1be8  gpsvc - ok

14:36:42.0145 0x1be8  [ BA2455D93BD57989A04FE4094AA6F941, B579FB367C063EA30C034381148410D49D38E183A5A4D51D2334A81DAEE95CEC ] GpuEnergyDrv    C:\WINDOWS\system32\drivers\gpuenergydrv.sys

14:36:42.0156 0x1be8  GpuEnergyDrv - ok

14:36:42.0208 0x1be8  [ DD7423ABBE2913E70D50E9318AD57EE4, 74BC123808F3FA60ADDC51C1383F8250608D3DBA3A8DC175B3418A1CF0BC53E9 ] gupdate         C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

14:36:42.0214 0x1be8  gupdate - ok

14:36:42.0218 0x1be8  [ DD7423ABBE2913E70D50E9318AD57EE4, 74BC123808F3FA60ADDC51C1383F8250608D3DBA3A8DC175B3418A1CF0BC53E9 ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

14:36:42.0224 0x1be8  gupdatem - ok

14:36:42.0247 0x1be8  [ 5D4BC124FAAE6730AC002CDB67BF1A1C, 00294F4DC7D17F6DD2A22B9C3299BED40146BA45C972367154D20DB502472551 ] gusvc           C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe

14:36:42.0254 0x1be8  gusvc - ok

14:36:42.0261 0x1be8  [ C277A49F8A8295840DEBC9240B75A282, 8B2BA0E6A8300323765D95ECD843105B0FC4B80B85EE2220E677C4E9A760C9D8 ] HDAudBus        C:\WINDOWS\System32\drivers\HDAudBus.sys

14:36:42.0270 0x1be8  HDAudBus - ok

14:36:42.0290 0x1be8  [ D5A57EF4822A0388352FFF9F5CD53495, 509F365386859157E9078821FAA56D2A3C0BA296CA129E0D42453428A14687A5 ] HidBatt         C:\WINDOWS\System32\drivers\HidBatt.sys

14:36:42.0298 0x1be8  HidBatt - ok

14:36:42.0313 0x1be8  [ 39575B53EB80C77FF2A3F1449D00B7F5, 37E66B38BACE00AFEF7093F990A234399D8451A9D2C2C8CBECAB69C664E63EA6 ] HidBth          C:\WINDOWS\System32\drivers\hidbth.sys

14:36:42.0322 0x1be8  HidBth - ok

14:36:42.0331 0x1be8  [ 35C3B602664116E737FF729F9A7156AD, 7A3C5CAD716E819CC53405971F3ACD135BCF023EC2228C1095E2116BCC384E62 ] hidi2c          C:\WINDOWS\System32\drivers\hidi2c.sys

14:36:42.0340 0x1be8  hidi2c - ok

14:36:42.0349 0x1be8  [ C4ABE526BBF2A18E8AF70177FBAD9C6E, 4DA06B563A08AC15D949F4599F73F172B3BFCB5D23B34240D1E2114438A11929 ] hidinterrupt    C:\WINDOWS\System32\drivers\hidinterrupt.sys

14:36:42.0356 0x1be8  hidinterrupt - ok

14:36:42.0363 0x1be8  [ 348416C7D7EB05BC3099FE2F2B27985C, F30E8682E9DD731A1AD7328FB8A48A2BB7D6E52780AE1FDE839D26E84B4FA7B5 ] HidIr           C:\WINDOWS\System32\drivers\hidir.sys

14:36:42.0372 0x1be8  HidIr - ok

14:36:42.0379 0x1be8  [ 5576DF399CF2D3B63608F7F282151249, 04939E79B8B8035547CE6FFE9001252CA810BAD46D8DB75FF5C13EB10EEB5C57 ] hidserv         C:\WINDOWS\system32\hidserv.dll

14:36:42.0387 0x1be8  hidserv - ok

14:36:42.0396 0x1be8  [ 01F732724AF6EFE69886DA95A4E51820, E048A480F9396418BDE9659596E7EDA5FF97D3CE029D186048609B47575BEAE1 ] HidUsb          C:\WINDOWS\System32\drivers\hidusb.sys

14:36:42.0404 0x1be8  HidUsb - ok

14:36:42.0427 0x1be8  [ 7433A8D28EE11A661C7A45AF28BA7987, 8A73DB423924E84CD3629BF6C7298CD093D2437B73B3F4520D39330923DDA2D6 ] HomeGroupListener C:\WINDOWS\system32\ListSvc.dll

14:36:42.0441 0x1be8  HomeGroupListener - ok

14:36:42.0473 0x1be8  [ 3FDBFBE5AE639996EB8D482C16BA7EA9, 7E48304818AABB4C5B0CB7FD32D96D6F90F4180AB0F668A2FE653A7097A40673 ] HomeGroupProvider C:\WINDOWS\system32\provsvc.dll

14:36:42.0492 0x1be8  HomeGroupProvider - ok

14:36:42.0516 0x1be8  [ 3844CE7DD23530CAD59D8CABA57CCB05, A44BB60686A0E98FF370D9DED5B32C3F34F0352ACFA3B3052BA4023922B53DB7 ] HpSAMD          C:\WINDOWS\system32\drivers\HpSAMD.sys

14:36:42.0523 0x1be8  HpSAMD - ok

14:36:42.0560 0x1be8  [ CA6EADBB8731CA27BDA4037BF290AC14, 31EC9397D55D4EEC416AD722134E2D6B5D14E46D2150CB94889C4BFDAACBF421 ] HTTP            C:\WINDOWS\system32\drivers\HTTP.sys

14:36:42.0585 0x1be8  HTTP - ok

14:36:42.0591 0x1be8  [ 8841D927EB1F7FFC8B1805BC0CF190ED, B063E686380EEF582CF736E33751812F0041C593C7F30EE97D13DEDC9B246AB5 ] hwpolicy        C:\WINDOWS\system32\drivers\hwpolicy.sys

14:36:42.0598 0x1be8  hwpolicy - ok

14:36:42.0615 0x1be8  [ 53436C3835E80F4421652A67F44D6313, 8731091945A839713348DF3060A4C96033874E2B3DC7E099BEEC8C65B07F98CF ] hyperkbd        C:\WINDOWS\System32\drivers\hyperkbd.sys

14:36:42.0622 0x1be8  hyperkbd - ok

14:36:42.0632 0x1be8  [ B2DC6C2F313EBB967B556B4E73A75451, B1816A0AE15705F0325F167EA76166779607D6086EC36A4A960E3BA47B4EBC4B ] HyperVideo      C:\WINDOWS\system32\DRIVERS\HyperVideo.sys

14:36:42.0639 0x1be8  HyperVideo - ok

14:36:42.0662 0x1be8  [ D4CDEE4A62BDFFF6E8558A9552148EA7, 55306786CB45082AE374937EBA256FF9CD640BB2E8C19DC6C704489D4743F5CC ] i8042prt        C:\WINDOWS\System32\drivers\i8042prt.sys

14:36:42.0672 0x1be8  i8042prt - ok

14:36:42.0679 0x1be8  [ 16A10CCEDCF5AC4CAAE43DC9FC40392F, F77696AE55B992154A3B35F7660BD73E0AB35A6ECEEC1931C0D35748CFA605C0 ] iaLPSSi_GPIO    C:\WINDOWS\System32\drivers\iaLPSSi_GPIO.sys

14:36:42.0685 0x1be8  iaLPSSi_GPIO - ok

14:36:42.0693 0x1be8  [ F1DF87463AC308047B089E9F0456B4C8, DFFF3C63D3124C2B879B888104042406FE326D4E7C8C1881A269BD4287B9CD33 ] iaLPSSi_I2C     C:\WINDOWS\System32\drivers\iaLPSSi_I2C.sys

14:36:42.0699 0x1be8  iaLPSSi_I2C - ok

14:36:42.0735 0x1be8  [ 57CD95DEB3529181BCC931DD2DFB2341, 03ACF906E4C3CF954F503900F42C7A60FCD5624772B90A956F032484146E42B7 ] iaStorA         C:\WINDOWS\system32\drivers\iaStorA.sys

14:36:42.0750 0x1be8  iaStorA - ok

14:36:42.0781 0x1be8  [ 9FDD4763A115D04F565C38183DE4646F, A8B0653E7C5F5B3CB2A1B642F502269FB1BB1E35DBB1CBABDBDADF92C9815727 ] iaStorAV        C:\WINDOWS\system32\drivers\iaStorAV.sys

14:36:42.0801 0x1be8  iaStorAV - ok

14:36:42.0856 0x1be8  [ 20E83F4632E15A5E9E716FF2E8AC7FAE, 7CA1A4924F432AD30ED7FA6247C6513DA173EE31132AE115E85C0ED7E5971029 ] IAStorDataMgrSvc C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

14:36:42.0861 0x1be8  IAStorDataMgrSvc - ok

14:36:42.0889 0x1be8  [ 4E69EE8F8E5DA036535D433C544AF9E2, 2ADE9B97CE1C19FF984D8BB99CF31415872C2D9628864BD78C0E44D21CC94EE3 ] iaStorV         C:\WINDOWS\system32\drivers\iaStorV.sys

14:36:42.0904 0x1be8  iaStorV - ok

14:36:42.0923 0x1be8  [ 15C59DF20F74A0C2C764B991FED7F4A5, 6E9804775E815F32A4D73C346E627D64A3096525E78FAE3B6E43CFECAE270428 ] ibbus           C:\WINDOWS\System32\drivers\ibbus.sys

14:36:42.0938 0x1be8  ibbus - ok

14:36:43.0015 0x1be8  [ E199288F016C354255C39A84378A48F6, 881B41D64D73F7A3A1680EDD68201E14AC5C60B848374EEAE44CCDDE46010E81 ] ICCS            C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe

14:36:43.0021 0x1be8  ICCS - ok

14:36:43.0041 0x1be8  [ 88E6A429944544346EC3AE1FD7D24BCC, B6B8D51E5491C91D2FCDC77C1D82A5168B0C860252208E1B4612D8D5C19401AD ] icssvc          C:\WINDOWS\System32\tetheringservice.dll

14:36:43.0055 0x1be8  icssvc - ok

14:36:43.0057 0x1be8  IEEtwCollectorService - ok

14:36:43.0096 0x1be8  [ 6F9C31435DD3E3D3BC247212EA144EBF, 05C4A0BD4BABD27783CEFEE6108C1A05911A212189233F09AF1A56BDC60F60F8 ] IKEEXT          C:\WINDOWS\System32\ikeext.dll

14:36:43.0127 0x1be8  IKEEXT - ok

14:36:43.0204 0x1be8  [ E9740A3BC0AE6EA035FF7ECE3A1B27B6, 4CA3E094B0057E143955DE5D41C3344688B6D2C4FFC0417235FF46312B600F99 ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RTKVHD64.sys

14:36:43.0264 0x1be8  IntcAzAudAddService - ok

14:36:43.0309 0x1be8  [ 0DB1E3F6189C628675F855C0EB510419, 989F539E82105019D2D81255369B96DC65826CD2A421DA09809155B26F69C555 ] Intel(R) Capability Licensing Service Interface C:\Program Files\Intel\iCLS Client\HeciServer.exe

14:36:43.0330 0x1be8  Intel(R) Capability Licensing Service Interface - detected UnsignedFile.Multi.Generic ( 1 )

14:36:45.0661 0x1be8  Detect skipped due to KSN trusted

14:36:45.0661 0x1be8  Intel(R) Capability Licensing Service Interface - ok

14:36:45.0699 0x1be8  [ 492AAF2FF66F437F0E796574B116EFC3, 6BF21C61ED05705DD58203952A750D1AB4D4B62F3A2B640BBBD9B85D1ECC3E5C ] Intel(R) Capability Licensing Service TCP IP Interface C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe

14:36:45.0717 0x1be8  Intel(R) Capability Licensing Service TCP IP Interface - ok

14:36:45.0748 0x1be8  [ 57739E742ABC085C2A4340D4404B4A8B, B4B85C35AC96D11F5940AFCB15A2B2A41D70E3C392E1D4D9353899FA140FF281 ] Intel(R) ME Service C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

14:36:45.0753 0x1be8  Intel(R) ME Service - ok

14:36:45.0783 0x1be8  [ CBF7341E55A8348C7AB01A9870C7D948, A5084DF3C6321788C88A9E6B5F43FE5BCFDBB579BDE3A4D5F55558C6D13035A5 ] Intel(R) PROSet Monitoring Service C:\Windows\system32\IProsetMonitor.exe

14:36:45.0791 0x1be8  Intel(R) PROSet Monitoring Service - ok

14:36:45.0813 0x1be8  [ 498759139F71142888CF7EFA1ABE18C8, 9CD0CD748B143F947B4DEDE39344A8C284717CC8AC97E25827EB73CF10831419 ] intelide        C:\WINDOWS\system32\drivers\intelide.sys

14:36:45.0819 0x1be8  intelide - ok

14:36:45.0827 0x1be8  [ DC270DDCDDC2EF65D484A65CC5166222, A88BEAD819ABEFE28B6F9A10586ADCB0EE2A5ED9273F176E9313750609C7892F ] intelpep        C:\WINDOWS\system32\drivers\intelpep.sys

14:36:45.0834 0x1be8  intelpep - ok

14:36:45.0850 0x1be8  [ B4D9C777762B1F7356958B9C0AA93BEB, F11B07FE939A107AB4EED4857854DF269C2D86A80C8507C8B1E95F7805975EDB ] intelppm        C:\WINDOWS\System32\drivers\intelppm.sys

14:36:45.0861 0x1be8  intelppm - ok

14:36:45.0869 0x1be8  [ 22BD83268B80A8C89AAC0BDF46E4EB5D, E7DC0C2E4104B51EA545BA8D0CFF11FD6A15BFD8EE16E546E8FC220853402CB3 ] IoQos           C:\WINDOWS\system32\drivers\ioqos.sys

14:36:45.0877 0x1be8  IoQos - ok

14:36:45.0888 0x1be8  [ A49E47A6E1429123F46A7CA9C05AEFC1, FFD68CA46DFAA4954FD76145808E2C74BDC34FFD6979BB3FB6A3EE4DC33CDC78 ] IpFilterDriver  C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

14:36:45.0899 0x1be8  IpFilterDriver - ok

14:36:45.0939 0x1be8  [ 8FBA61B7CB44F136226BE3B346FC6D19, 2190A523AC948B18C2C7B6DC96ABB654DAB471AD5E5E13F79899416E91777AED ] iphlpsvc        C:\WINDOWS\System32\iphlpsvc.dll

14:36:45.0971 0x1be8  iphlpsvc - ok

14:36:45.0980 0x1be8  [ E0C276985AF968CE295B8E09C121321F, 07B54165E80D4254C29A6CF00CC634E70F190EF0EB8EEF73EC14F38B841087A5 ] IPMIDRV         C:\WINDOWS\System32\drivers\IPMIDrv.sys

14:36:45.0989 0x1be8  IPMIDRV - ok

14:36:46.0011 0x1be8  [ 5D3744E6FDEC1A6FB3FA9B1DD4AF0694, 209BE9FC25C8BF8CE058B7E993B6A902B881380DADC69F5208733077DA7F4382 ] IPNAT           C:\WINDOWS\system32\drivers\ipnat.sys

14:36:46.0022 0x1be8  IPNAT - ok

14:36:46.0050 0x1be8  [ 0BE777523E5CB0E4F2CA2135DB4C60C8, 979BBAC7EAD3F5C913155BC12BB1B87D1EFD39D92293195D50805D657ABECC6D ] iPod Service    C:\Program Files\iPod\bin\iPodService.exe

14:36:46.0065 0x1be8  iPod Service - ok

14:36:46.0072 0x1be8  [ B18202D72C0EF4B53CEC6F59E3E1B955, 6DA244E6485372C16CF0B38838DC90B48079A85F5D22B0F2F197C8DA37F0A293 ] IRENUM          C:\WINDOWS\system32\drivers\irenum.sys

14:36:46.0082 0x1be8  IRENUM - ok

14:36:46.0104 0x1be8  [ CD04CBCCCB4C0E4BB06B98E0F45C888A, 106B3E823C188BD14328F2BEA28559D2F637C270064B2FD214522FAC4E616F4C ] isapnp          C:\WINDOWS\system32\drivers\isapnp.sys

14:36:46.0111 0x1be8  isapnp - ok

14:36:46.0123 0x1be8  [ 5D90E942C94B20E0F321015C0ABF3EEA, 4110551B172D4A5524DD857D7CB65FAF2594310BE7883D5641BC0DF5EF49C82C ] iScsiPrt        C:\WINDOWS\System32\drivers\msiscsi.sys

14:36:46.0134 0x1be8  iScsiPrt - ok

14:36:46.0159 0x1be8  [ 52069AEB42D3D0F97CBCA1085EBF55E6, ADB2EFFF563B3FE113FCD156FD1E469BC24FC1D68AFEDCA21306F76592C9FF88 ] jhi_service     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe

14:36:46.0166 0x1be8  jhi_service - ok

14:36:46.0175 0x1be8  [ 4192DFE6CA143C0AD8AF42C51A82BECA, 31FB3A261D0D5241CC87EF7DFF8BFC1A1EACE8CEC42138918EC5958DAEE100CD ] kbdclass        C:\WINDOWS\System32\drivers\kbdclass.sys

14:36:46.0183 0x1be8  kbdclass - ok

14:36:46.0191 0x1be8  [ B63C0DB341DCB46CF7AA259333A737DD, F1B43BA68707F3F99CD31AB2035F5E86CD967AE4E5393928C69861785E960872 ] kbdhid          C:\WINDOWS\System32\drivers\kbdhid.sys

14:36:46.0199 0x1be8  kbdhid - ok

14:36:46.0206 0x1be8  [ 53C79A7FABDAAFD11EAB31963FB2CED7, 357418645DDCEFA5546AE78EDCAE86D50928710CA7A3F65F01CF721AADA36623 ] kdnic           C:\WINDOWS\System32\drivers\kdnic.sys

14:36:46.0214 0x1be8  kdnic - ok

14:36:46.0227 0x1be8  [ 9A83FA0EC9B0DCED2CBC49DD05901920, 14D2F241235E2693C68BCCF05D83F2A1C9A7BE185C83E7C6C63EF0F654892F95 ] KeyIso          C:\WINDOWS\system32\lsass.exe

14:36:46.0235 0x1be8  KeyIso - ok

14:36:46.0246 0x1be8  [ 1E99B26BDB9B9C9BC775ED4543558560, 890870A6737B4910735D1B23F714AA73FCCD1C131D135FACBA6909F06D31B3FF ] KSecDD          C:\WINDOWS\system32\Drivers\ksecdd.sys

14:36:46.0255 0x1be8  KSecDD - ok

14:36:46.0269 0x1be8  [ 6198A79011C67497B324798B3D4272CE, C587F7D86837550D07918F6AACF26BF65EBAF7FF57475DC9196B4D011E83AE47 ] KSecPkg         C:\WINDOWS\system32\Drivers\ksecpkg.sys

14:36:46.0279 0x1be8  KSecPkg - ok

14:36:46.0287 0x1be8  [ 503597D9B72DBD9998F722F12A51ACFC, 9B3585282191163AA70243BAD921ED8725A98454E0D3879E0F671E0E4F56AB4F ] ksthunk         C:\WINDOWS\system32\drivers\ksthunk.sys

14:36:46.0296 0x1be8  ksthunk - ok

14:36:46.0331 0x1be8  [ ED5AE20C27F27F293C6C61AEC9881054, 4D5BE394D129BD559B0A9D237F3F59CB3D24C15ABDD97AE2E64931D6B9D14FF1 ] KtmRm           C:\WINDOWS\system32\msdtckrm.dll

14:36:46.0348 0x1be8  KtmRm - ok

14:36:46.0370 0x1be8  [ C529DA0AD5A21878E318801B024AF8E7, A14E8ADCA33C37B1D256CB4926A19F56D2D19B94EDF314A4ED34A8B5AB62CA5A ] LanmanServer    C:\WINDOWS\system32\srvsvc.dll

14:36:46.0386 0x1be8  LanmanServer - ok

14:36:46.0420 0x1be8  [ D6D9F4CAFD3F1A7E30AD02E508552CD2, F0D225E5951CFE1D8349F634CC91BDD5B3F9DCF6233CCB965E99BFEAFE642265 ] LanmanWorkstation C:\WINDOWS\System32\wkssvc.dll

14:36:46.0436 0x1be8  LanmanWorkstation - ok

14:36:46.0461 0x1be8  [ 24881F16D2829764681F5FAE7B86D7D3, 290348CFAF3165847E4B53965D22E9D417EE20FFD23293B5C1855C57E6328599 ] lfsvc           C:\WINDOWS\System32\lfsvc.dll

14:36:46.0470 0x1be8  lfsvc - ok

14:36:46.0479 0x1be8  [ 6ED675774BDC3735AB6DA12D29F825CF, 4317C7CF491F4E806975E7A973CFF11CFEE9E94730DDABCC67C3D693691DDDE5 ] LicenseManager  C:\WINDOWS\system32\LicenseManagerSvc.dll

14:36:46.0487 0x1be8  LicenseManager - ok

14:36:46.0500 0x1be8  [ DB789F57CE94C827FBFF709CA5ABD29E, 4CA4DD079A63649C36F76A31C4081F11F5CF6574AC573B63EF930DB19B1D1C95 ] lltdio          C:\WINDOWS\system32\drivers\lltdio.sys

14:36:46.0511 0x1be8  lltdio - ok

14:36:46.0530 0x1be8  [ FECBC6C4981772E5D0F517B34A5496EE, 15DB097BFB221B91E580E5CD1DD6B34A9A2C78A1A6FCE4162A855BB4AFE673E9 ] lltdsvc         C:\WINDOWS\System32\lltdsvc.dll

14:36:46.0546 0x1be8  lltdsvc - ok

14:36:46.0568 0x1be8  [ 24C87BDC66AB192FEB273BEE5FD5AA38, BFAAE1F2450DEBD1A14877C046C6EBA91014DB0B5D0FB95EC14CB714B773B3C0 ] lmhosts         C:\WINDOWS\System32\lmhsvc.dll

14:36:46.0576 0x1be8  lmhosts - ok

14:36:46.0624 0x1be8  [ 90C864827E1722F5BB6EEA8896A4E8EF, 6F9D96B7A65BD79ED5A384025393F36A5DEAC4EE01CA173874906B54F57150EF ] LMS             C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

14:36:46.0634 0x1be8  LMS - ok

14:36:46.0662 0x1be8  [ 3BB39166E446D456C277C17DFEA3DAC6, 1A08E1D017BBCE91E508D876835FA7AD2DA0859A8CFE8F8F31B4F12B48E2573D ] LSI_SAS         C:\WINDOWS\system32\drivers\lsi_sas.sys

14:36:46.0671 0x1be8  LSI_SAS - ok

14:36:46.0681 0x1be8  [ 25CF625E46307A5D6674C8DFA1A289AA, 1D00EB70B6B0157013A7C15EF194F51B8596612066EF31B337D8134D6BD0BBBE ] LSI_SAS2i       C:\WINDOWS\system32\drivers\lsi_sas2i.sys

14:36:46.0690 0x1be8  LSI_SAS2i - ok

14:36:46.0700 0x1be8  [ 722C52B12EA4C198D56994934C9DDAB6, 5F4AB818251C770821BAF41C19B1C483A31CCC28EB96F2084D4092E33EAF906B ] LSI_SAS3i       C:\WINDOWS\system32\drivers\lsi_sas3i.sys

14:36:46.0709 0x1be8  LSI_SAS3i - ok

14:36:46.0721 0x1be8  [ 3371FF1D5D745C3306C6A2C4E99C25A9, DD6F0099001501BAEDDF8411FBCD930BD6472662D209199249203CB2FDAA23FB ] LSI_SSS         C:\WINDOWS\system32\drivers\lsi_sss.sys

14:36:46.0730 0x1be8  LSI_SSS - ok

14:36:46.0757 0x1be8  [ E2EEF074F5260378F9AAFBCD592319A3, DC56674A08FA03FA7AF7DD8B3CC55D8324D1CB51546092A990A935FF9AB48A3C ] LSM             C:\WINDOWS\System32\lsm.dll

14:36:46.0783 0x1be8  LSM - ok

14:36:46.0813 0x1be8  [ C692B9C0352315417CF49FFA664957A3, C2D4F9A936B809889F7C51FE48214A1923175913A6C5D0B72D3BA469214B5174 ] luafv           C:\WINDOWS\system32\drivers\luafv.sys

14:36:46.0826 0x1be8  luafv - ok

14:36:46.0859 0x1be8  [ 6A4C75FD28F60062FEA3DF3B15D956C0, 4FC58F3320D33BDACCF759A50C623A3E58E4320749E6691B397DF0C8EAAA8A6F ] MapsBroker      C:\WINDOWS\System32\moshost.dll

14:36:46.0868 0x1be8  MapsBroker - ok

14:36:46.0887 0x1be8  [ B2ED9A7A5587A128A0EFD0DBE7662E95, 63070AAFD44E3CD2A4B262DF27222B103455A4D8C2E45914502BFA03D84D32C9 ] megasas         C:\WINDOWS\system32\drivers\megasas.sys

14:36:46.0895 0x1be8  megasas - ok

14:36:46.0915 0x1be8  [ 083F71488E6780A67290273180256EA5, 5F43CE66F5A48850BABB70F4D219FDD002F9BC2B2F0E58E66FE2C492AA335E50 ] megasr          C:\WINDOWS\system32\drivers\megasr.sys

14:36:46.0933 0x1be8  megasr - ok

14:36:46.0964 0x1be8  [ 926C135CFB0C75B32FB714B5C0C58FAA, AF627CD125794B69D450D298D5608D357F2C91FB89EBFAA0DA2A0F07C6A304A8 ] MEIx64          C:\WINDOWS\system32\DRIVERS\TeeDriverx64.sys

14:36:46.0969 0x1be8  MEIx64 - ok

14:36:47.0003 0x1be8  [ 5907A10D46747A2B6DBFD6A198254DC2, 6C283E9DC75C7ABFD270D6FABBF4F54628A1786E7CE2F603BF664CBB9E4FE583 ] mlx4_bus        C:\WINDOWS\System32\drivers\mlx4_bus.sys

14:36:47.0023 0x1be8  mlx4_bus - ok

14:36:47.0042 0x1be8  [ 91ED6F0EDF4158D63C52194F17D4F42E, ACF543978E253650C167C6C370699AEA7340EBCECF7CAB904CBDD334D1BD6928 ] MMCSS           C:\WINDOWS\system32\drivers\mmcss.sys

14:36:47.0050 0x1be8  MMCSS - ok

14:36:47.0070 0x1be8  [ 2C4CC9F6ADBED5A6D131FDB97A78FF68, 04DC76E3F0959C0A9B00DF2133B075194FB7DCBD76832B9D25B0E37223D300DC ] Modem           C:\WINDOWS\system32\drivers\modem.sys

14:36:47.0080 0x1be8  Modem - ok

14:36:47.0097 0x1be8  [ D8DB13529C8AD6FBAF8E2F382024374F, 13025035C479E2EF76EDCB90D83BE65B4ADD9F7000AD31FEAD628D5DDFE69158 ] monitor         C:\WINDOWS\System32\drivers\monitor.sys

14:36:47.0104 0x1be8  monitor - ok

14:36:47.0117 0x1be8  [ 2DAAF1EE1C30F2FCF59851A64ADA0422, 08CD801E63E2862DE058CD732C3DB3D87B1A2898732365440E3F8919932E96FC ] mouclass        C:\WINDOWS\System32\drivers\mouclass.sys

14:36:47.0125 0x1be8  mouclass - ok

14:36:47.0136 0x1be8  [ D30FE074503283829ED194BCAE6239C3, A3A127381ECC798417D01F6B8A1894EED7D71989047BC4D1D74D0E7C8394AD65 ] mouhid          C:\WINDOWS\System32\drivers\mouhid.sys

14:36:47.0144 0x1be8  mouhid - ok

14:36:47.0170 0x1be8  [ D5EC9413527B286CFEEB0294C53ABB95, B094C611F5A7E33D2F8667B2A4D6260E1D57BD135867F984EE5B674C7EE72B95 ] mountmgr        C:\WINDOWS\system32\drivers\mountmgr.sys

14:36:47.0179 0x1be8  mountmgr - ok

14:36:47.0189 0x1be8  [ 989A1BBD9C49B107B4A47D06E6827A69, 62D90B22AE13AC84324DFD5FEBA595813AD07469B7FEC41380CE223D93020CCA ] mpsdrv          C:\WINDOWS\system32\drivers\mpsdrv.sys

14:36:47.0198 0x1be8  mpsdrv - ok

14:36:47.0235 0x1be8  [ A0DBB9386BEA8DA1A159C2A2E07081A3, 9D3F26005A76A72F9512F040D45C16124D17F8C8DA45C51FFAF74F066357D0A4 ] MpsSvc          C:\WINDOWS\system32\mpssvc.dll

14:36:47.0264 0x1be8  MpsSvc - ok

14:36:47.0281 0x1be8  [ C1E74DD1D84861D8F12FF8BC0BA11975, 5912A0455C840F5C8AD6383823C9C7DE6FF8B5CAF1B72EA181864999891EAF30 ] MRxDAV          C:\WINDOWS\system32\drivers\mrxdav.sys

14:36:47.0295 0x1be8  MRxDAV - ok

14:36:47.0316 0x1be8  [ 1DF2C5FD2710A13B07E663A12F0E0EEA, 8EBCA9269F52A5CF602F5DE2B0C2AB2BFD82F415465DBB74C73D43F321D9FD46 ] mrxsmb          C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

14:36:47.0333 0x1be8  mrxsmb - ok

14:36:47.0364 0x1be8  [ 185932B1149BD707F8A13174CDAB365B, BC26CB10DD6E81A94477564444E91F76D47E685E897BD77B9C1393F0D31AB718 ] mrxsmb10        C:\WINDOWS\system32\DRIVERS\mrxsmb10.sys

14:36:47.0377 0x1be8  mrxsmb10 - ok

14:36:47.0383 0x1be8  [ 99E24D4DBACBC569833B9A67710D65E7, 93BC765E7B6E19E83AFF783DE8080A80A1D69A406B496F1E36C47AE6E86AFB76 ] mrxsmb20        C:\WINDOWS\system32\DRIVERS\mrxsmb20.sys

14:36:47.0396 0x1be8  mrxsmb20 - ok

14:36:47.0412 0x1be8  [ 6F8BE4FB6262012E61BBADB5444628DC, E87489207AA48106C08E4BADDD8D66D14BC9DD6AD2A4CDD880BA655932CDDE60 ] MsBridge        C:\WINDOWS\system32\drivers\bridge.sys

14:36:47.0424 0x1be8  MsBridge - ok

14:36:47.0447 0x1be8  [ 283BDF3602F442336DAF242BDD07FB98, 185F046B6AA24FFD1567F00AA70357C82002FF627E329CEF9B926645A6DDB172 ] MSDTC           C:\WINDOWS\System32\msdtc.exe

14:36:47.0458 0x1be8  MSDTC - ok

14:36:47.0473 0x1be8  [ 7C55F1751CAC199680D4489D1EE46544, 967EC8137D321F6139C3382D19A338FD97A3023EB654747AC57C2008BE4AF677 ] Msfs            C:\WINDOWS\system32\drivers\Msfs.sys

14:36:47.0482 0x1be8  Msfs - ok

14:36:47.0507 0x1be8  [ 988588C16A53C2581488C15FF18934BF, F021FD31163CB5C7012CF96EF642C5E551708C835039075268F4CBED002D441D ] msgpiowin32     C:\WINDOWS\System32\drivers\msgpiowin32.sys

14:36:47.0514 0x1be8  msgpiowin32 - ok

14:36:47.0517 0x1be8  [ 09622DBC24D0178F15DB8461BB6970DF, C0B3F9B2219AAF87E417EE9FF54C64B8AD9944E101EA79B5DC81D99E8C2ECF30 ] mshidkmdf       C:\WINDOWS\System32\drivers\mshidkmdf.sys

14:36:47.0525 0x1be8  mshidkmdf - ok

14:36:47.0534 0x1be8  [ 34BB07495C0159BE4189841E16F3BC2F, 264B5735D9A68C85BEDE363D4C0AE1FCC381B39EA884B4BAEE185EB8A873184A ] mshidumdf       C:\WINDOWS\System32\drivers\mshidumdf.sys

14:36:47.0542 0x1be8  mshidumdf - ok

14:36:47.0548 0x1be8  [ 7BF3F0DA362C053918F5F2EC43CE39E2, AA773FA3F83C0C572160D3D0286A697DC628FF4F3655EF21D01C6D1B7BE5DF1C ] msisadrv        C:\WINDOWS\system32\drivers\msisadrv.sys

14:36:47.0555 0x1be8  msisadrv - ok

14:36:47.0576 0x1be8  [ 669DA2006C0B9D882D2014617E1E88F5, 090F558818806CAEF6C81D369F8BFFE4A8240295EF37CAA7102A18F4CD20D868 ] MSiSCSI         C:\WINDOWS\system32\iscsiexe.dll

14:36:47.0587 0x1be8  MSiSCSI - ok

14:36:47.0589 0x1be8  msiserver - ok

14:36:47.0598 0x1be8  [ B2D0FD21FE67D6434769CC6F7A7883CA, B2368BD72952C6EE6DAF1AA006DF575A3019E4721BEFB108D3DF1B9E07B2BC5D ] MSKSSRV         C:\WINDOWS\system32\drivers\MSKSSRV.sys

14:36:47.0606 0x1be8  MSKSSRV - ok

14:36:47.0618 0x1be8  [ FB3801F176376286A3F8F20FFB8CDC53, EEF89081665B9BBA93AE9F5912C40C1698E8BA8DBBCCC3BBE0BAB5A86B7E05D4 ] MsLldp          C:\WINDOWS\system32\drivers\mslldp.sys

14:36:47.0630 0x1be8  MsLldp - ok

14:36:47.0649 0x1be8  [ 8CBDF0E7A6CD824352F37A682A33DF7E, 4567FF4C73648FF26EA68EAE2B524B767099789086C158875C97768C77B81359 ] MSPCLOCK        C:\WINDOWS\system32\drivers\MSPCLOCK.sys

14:36:47.0656 0x1be8  MSPCLOCK - ok

14:36:47.0674 0x1be8  [ 33E5B6261D69ACD4948A5C64B9D8F29F, 1D32340640312372E52E59AFB5DB872E6F9DFE3AC16B56F9D928AE230DA02B8A ] MSPQM           C:\WINDOWS\system32\drivers\MSPQM.sys

14:36:47.0682 0x1be8  MSPQM - ok

14:36:47.0694 0x1be8  [ 557DF8C0DBBBF518AC395C6EB1B179AE, B294B5A7882C0C60D91FB853FC87505B6E7638D25E360FDAE002AEBB714ED471 ] MsRPC           C:\WINDOWS\system32\drivers\MsRPC.sys

14:36:47.0708 0x1be8  MsRPC - ok

14:36:47.0720 0x1be8  [ 0A29AFA668F5DD50482A98ECE70C77A7, 4C1F23B062361D97B1C8D864AB227E5F398F774A99B5E60A1149A4F78D5BEC20 ] mssmbios        C:\WINDOWS\System32\drivers\mssmbios.sys

14:36:47.0727 0x1be8  mssmbios - ok

14:36:47.0743 0x1be8  [ 30CE30877FD5BFADE74FA27D7829BF89, B5EA1F8C91E75722DB1E3E2172C8607FEDBF35BDC4141258A3E6D29D8B0E193B ] MSTEE           C:\WINDOWS\system32\drivers\MSTEE.sys

14:36:47.0750 0x1be8  MSTEE - ok

14:36:47.0756 0x1be8  [ 13D88C0B8A2FA001CD72D454955A6974, 19DD5C8BBD07B64F355737436BF702FFC209D84A8855D2224D3377E233D4BB34 ] MTConfig        C:\WINDOWS\System32\drivers\MTConfig.sys

14:36:47.0764 0x1be8  MTConfig - ok

14:36:47.0786 0x1be8  [ 00C7F0F06A0A48B9CDB6B3AC3BE288F0, BF469A2DDF495ACB9FEE9063C6680C95BCC8686682C9EDAE6D1893D4058E8AA6 ] Mup             C:\WINDOWS\system32\Drivers\mup.sys

14:36:47.0794 0x1be8  Mup - ok

14:36:47.0812 0x1be8  [ 8E237527CA260C71D39ED4081BDF3419, CA52DD174C756A404B1FAD3F2A70E50085C2820BF12369259F61DA649101A179 ] mvumis

Martiba

05.11.2015 14:51

Code:

C:\WINDOWS\system32\drivers\mvumis.sys

14:36:47.0820 0x1be8  mvumis - ok

14:36:47.0842 0x1be8  [ 48D0587A8302FD3302CFE6F59F7345B0, 26D48AF3F7FF4867E179347CD635055DEA9A751C6C61CE2C391A7F74FC0DC1DE ] NativeWifiP     C:\WINDOWS\system32\DRIVERS\nwifi.sys

14:36:47.0862 0x1be8  NativeWifiP - ok

14:36:47.0886 0x1be8  [ 11BE8117653C542D264788A700AC5BFE, 87EAAC2DF62BB26619DA72950F5EE41DCA1DBDF93F098647F9D200D588F14003 ] NcaSvc          C:\WINDOWS\System32\ncasvc.dll

14:36:47.0898 0x1be8  NcaSvc - ok

14:36:47.0911 0x1be8  [ 286C6276B2BA86F29A0F687D05466277, AC8551536F37717A0ACE4A260F5696D1276F7AC62F669E8F12AA158DD86F71A5 ] NcbService      C:\WINDOWS\System32\ncbservice.dll

14:36:47.0927 0x1be8  NcbService - ok

14:36:47.0934 0x1be8  [ C55DA734ED2A831E0BACAAFA01CEB7FF, 9D989B03D07BBAD287B317D238691664B0694331D6A69B7A1AA3D8AB7D1323FC ] NcdAutoSetup    C:\WINDOWS\System32\NcdAutoSetup.dll

14:36:47.0960 0x1be8  NcdAutoSetup - ok

14:36:47.0967 0x1be8  [ CF8296427834CF8BBB3EE1444C17362D, 6EFBE1F015DFFA0704C66DF5C88089DD5771E1542018E4AE98389CFF3D0B2309 ] ndfltr          C:\WINDOWS\System32\drivers\ndfltr.sys

14:36:47.0975 0x1be8  ndfltr - ok

14:36:48.0015 0x1be8  [ 616F40B897DA651221F86A1741E9609B, 22D66029726313D92FC8E074BCC51C1E1560CB5FE36DCB735E7E063EA53E299A ] NDIS            C:\WINDOWS\system32\drivers\ndis.sys

14:36:48.0044 0x1be8  NDIS - ok

14:36:48.0055 0x1be8  [ A0719D1EBA971DFC5DF5F7CC010385F8, A982487D3A74E66F3C29AAA5B46CE9A0969F07F267DDEFE58C58573573AB0024 ] NdisCap         C:\WINDOWS\system32\drivers\ndiscap.sys

14:36:48.0063 0x1be8  NdisCap - ok

14:36:48.0079 0x1be8  [ 0C557932CCCC65AEB37326DD36504527, C0AF3066DEE4BCC32DB30CCC16B7A91442A8383BB36C7C4E3CC0A5EFE0FAAA9B ] NdisImPlatform  C:\WINDOWS\system32\drivers\NdisImPlatform.sys

14:36:48.0091 0x1be8  NdisImPlatform - ok

14:36:48.0102 0x1be8  [ 56F9345D1945826135FBAB7589592B1F, 6BC2A5900076B917823C7392C582A2648D0C8000F2F65D309D5B48E36D4FB4D6 ] NdisTapi        C:\WINDOWS\system32\DRIVERS\ndistapi.sys

14:36:48.0111 0x1be8  NdisTapi - ok

14:36:48.0130 0x1be8  [ AADFC340939D99E5D756E713E1D452EB, EFEFDBB2188DE82C2C5E67929861B269FD4C127D34D1DE6D0596ABC33E2C2B51 ] Ndisuio         C:\WINDOWS\system32\drivers\ndisuio.sys

14:36:48.0139 0x1be8  Ndisuio - ok

14:36:48.0147 0x1be8  [ 312DFD787D99D3BF1427B0388BC04F71, C082CA1F332AD57FF2100748518D3D7B3D0F1B042F69BD7401C44B77AFE97462 ] NdisVirtualBus  C:\WINDOWS\System32\drivers\NdisVirtualBus.sys

14:36:48.0156 0x1be8  NdisVirtualBus - ok

14:36:48.0179 0x1be8  [ 2103F43E0A1ECFB14B7E1B889F5F24D7, 6A86E854C89E132DBC9183DE2B9464DC592E7492BE267BA02FE4DAFE6FA87528 ] NdisWan         C:\WINDOWS\System32\drivers\ndiswan.sys

14:36:48.0193 0x1be8  NdisWan - ok

14:36:48.0199 0x1be8  [ 2103F43E0A1ECFB14B7E1B889F5F24D7, 6A86E854C89E132DBC9183DE2B9464DC592E7492BE267BA02FE4DAFE6FA87528 ] ndiswanlegacy   C:\WINDOWS\system32\DRIVERS\ndiswan.sys

14:36:48.0213 0x1be8  ndiswanlegacy - ok

14:36:48.0225 0x1be8  [ 6E98F16983C4AE8703FF9F90AB4B31DD, BB8BD5DB4B5FB31F3A257747C27CBEFA4B7837EC5C0CF3D4F408E626E4003F4C ] ndproxy         C:\WINDOWS\system32\DRIVERS\NDProxy.sys

14:36:48.0236 0x1be8  ndproxy - ok

14:36:48.0245 0x1be8  [ F1B7CC77F412C8D45B2DDCF76EDA4F9D, 25F2AA76E675D9BCC0B1FD47AFEC6DF2D0B47E7B1C8AF6FB27C1ED2FB902961A ] Ndu             C:\WINDOWS\system32\drivers\Ndu.sys

14:36:48.0255 0x1be8  Ndu - ok

14:36:48.0264 0x1be8  [ 824FDC990A3F79069BE468A132EB6888, D09F7A9EC04E37DA504CE54EEC25C312B407B6A8B214CBB074BEB50DE420F52A ] NetBIOS         C:\WINDOWS\system32\drivers\netbios.sys

14:36:48.0272 0x1be8  NetBIOS - ok

14:36:48.0288 0x1be8  [ F0D791348AD254360CC3C3E501CCB745, E4CAB4D3C2CD3169731283B00DEBFE26438BB66A3F0D78BDB68E876A14FC7070 ] NetBT           C:\WINDOWS\system32\DRIVERS\netbt.sys

14:36:48.0302 0x1be8  NetBT - ok

14:36:48.0311 0x1be8  [ 9A83FA0EC9B0DCED2CBC49DD05901920, 14D2F241235E2693C68BCCF05D83F2A1C9A7BE185C83E7C6C63EF0F654892F95 ] Netlogon        C:\WINDOWS\system32\lsass.exe

14:36:48.0319 0x1be8  Netlogon - ok

14:36:48.0345 0x1be8  [ 7C8A7380CBE45DFD3DF118D8601499A7, C137280B7696F8CF4258BDC8B241C66BB3AA5708C5410D85255E46C7E8284826 ] Netman          C:\WINDOWS\System32\netman.dll

14:36:48.0361 0x1be8  Netman - ok

14:36:48.0392 0x1be8  [ BBE9D72EFC7BD66B28309C3607683DBA, FC372EFBC650CE0BDB117858D840A1FB361947B1C67D1DD16BABA95D0286856A ] netprofm        C:\WINDOWS\System32\netprofmsvc.dll

14:36:48.0415 0x1be8  netprofm - ok

14:36:48.0433 0x1be8  [ 5D046D71B18BEFB2E4D164C3DEEDD672, 536834D020889973854830919B23DF22CC1B27236AFAEDEBDF42D432CE48FCDE ] NetSetupSvc     C:\WINDOWS\System32\NetSetupSvc.dll

14:36:48.0447 0x1be8  NetSetupSvc - ok

14:36:48.0472 0x1be8  [ FBF2ACE9B10DDE0B4108930D78370E86, 2A4910F071747B786EA49A638B3AAB698DCD0AD7FE702078BA83F85C533A227E ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

14:36:48.0480 0x1be8  NetTcpPortSharing - ok

14:36:48.0496 0x1be8  [ 46E862DA2CF8F351375EF537276B69B5, AC0FE0977E56380849DCE668AC0F5AF183AAB115ED84ADD964E390CC0BEDF6D3 ] netvsc          C:\WINDOWS\System32\drivers\netvsc.sys

14:36:48.0505 0x1be8  netvsc - ok

14:36:48.0527 0x1be8  [ 88CE4AC85F36B6347C1D820FA373B998, E10B5DF8883928A2062FC6180DE4CF0DE33C68622C2E3E4E1AFC56A0682F8E75 ] NgcCtnrSvc      C:\WINDOWS\System32\NgcCtnrSvc.dll

14:36:48.0541 0x1be8  NgcCtnrSvc - ok

14:36:48.0545 0x1be8  [ 9A83FA0EC9B0DCED2CBC49DD05901920, 14D2F241235E2693C68BCCF05D83F2A1C9A7BE185C83E7C6C63EF0F654892F95 ] NgcSvc          C:\WINDOWS\system32\lsass.exe

14:36:48.0553 0x1be8  NgcSvc - ok

14:36:48.0594 0x1be8  [ EA1C2DAB8A63712B94897A58557B086C, 98DD7E5C84F3CDF2DAA89484892D6B439F5D14297B5243436925BEEAA0C02EE1 ] NlaSvc          C:\WINDOWS\System32\nlasvc.dll

14:36:48.0611 0x1be8  NlaSvc - ok

14:36:48.0622 0x1be8  [ 41557BE174E9EC6AC703A8A4ADBC6650, 8CF6DF3FDC3C7C44B32851538A67BF86A54AB6444A424D7A20B7A9A94B4158D8 ] Npfs            C:\WINDOWS\system32\drivers\Npfs.sys

14:36:48.0632 0x1be8  Npfs - ok

14:36:48.0639 0x1be8  [ AC3F70FCFBCE97AA2F12BA43EE13B86E, D0AC50FB022C0F3031531CEE210D47FC3244C6FB55FAAD4AAB04081F0A21DAE4 ] npsvctrig       C:\WINDOWS\System32\drivers\npsvctrig.sys

14:36:48.0647 0x1be8  npsvctrig - ok

14:36:48.0657 0x1be8  [ 0AF4872D3D6FD3A030E836DAC2B3EF2D, 03EE7B6FAFC0BB5C26793BC5FF8BD1019AC96B3104688009C1E062C3F4F34D6D ] nsi             C:\WINDOWS\system32\nsisvc.dll

14:36:48.0666 0x1be8  nsi - ok

14:36:48.0671 0x1be8  [ 66A98C407085B8920DF1E6D722F1ADB8, 3FE307E4A9E41B08E0453507E50D6D0C67FA6F4245A863D90181463C749C83B5 ] nsiproxy        C:\WINDOWS\system32\drivers\nsiproxy.sys

14:36:48.0680 0x1be8  nsiproxy - ok

14:36:48.0738 0x1be8  [ 466EC5659C02ED53DBD47DC1BC2B8086, 1F35DE75386F7D029C01D67B09D5E5157141C6892858885C11972CE73D6078AC ] NTFS            C:\WINDOWS\system32\drivers\NTFS.sys

14:36:48.0788 0x1be8  NTFS - ok

14:36:48.0805 0x1be8  [ 383E546EF4982262A0EF6CC2B6E9D525, 3C6C90B62E8EB094E6928C388E5081A3F73DF87B0F34F716B72EA7B6EF71FBB7 ] Null            C:\WINDOWS\system32\drivers\Null.sys

14:36:48.0813 0x1be8  Null - ok

14:36:48.0823 0x1be8  [ 466F875F1D4C6ABB46AF28007009237C, 26F5A5579737A7CF2267F79DDE5A551149C682D5FD24663B53FCEC5AA6B448CE ] nvraid          C:\WINDOWS\system32\drivers\nvraid.sys

14:36:48.0834 0x1be8  nvraid - ok

14:36:48.0846 0x1be8  [ 76F19EAE7A52CBAF7B8EC428BE6E0DA0, CF1E55D92FA32744A20AB75D466A3E05E6FACF4694F9265C41F5C27C1E7243DC ] nvstor          C:\WINDOWS\system32\drivers\nvstor.sys

14:36:48.0855 0x1be8  nvstor - ok

14:36:48.0868 0x1be8  [ 0D0CB77D74B38E0EC62341C19E469D8D, A05D3CC67FEEB2FD219BFAA34BF98CB3F3718042124AF28F0E9FDFB9F132DD76 ] nv_agp          C:\WINDOWS\system32\drivers\nv_agp.sys

14:36:48.0877 0x1be8  nv_agp - ok

14:36:48.0899 0x1be8  [ EA3FFE8617B9FCA1620AD9876E92F4F1, 68D5143CA71D10A2BB44E29B3C76580596669D0624076BCF6CCBA7AF3140538E ] OneSyncSvc      C:\WINDOWS\System32\APHostService.dll

14:36:48.0917 0x1be8  OneSyncSvc - ok

14:36:49.0009 0x1be8  [ 11E0B35479C895888BA3D7F619DCFFF3, 6ED82C19898101EC00BD64A9F90595C3D20AD2D2902AA8765B740FB3B9312DDF ] ose64           C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

14:36:49.0017 0x1be8  ose64 - ok

14:36:49.0046 0x1be8  [ CAFB5A95883158A0579DED2ED5CB0627, B23F7D19142DD3544F96ADB36F152F4EA7F6C524A1281EC26A2B95D7D044822C ] p2pimsvc        C:\WINDOWS\system32\pnrpsvc.dll

14:36:49.0062 0x1be8  p2pimsvc - ok

14:36:49.0093 0x1be8  [ 3612CE3432E0A2BE0081E6B488ACF84C, F1A641735FD374CA293FB98FADA2C41E2033B17FECCA3B6D225D0E591AFFF413 ] p2psvc          C:\WINDOWS\system32\p2psvc.dll

14:36:49.0112 0x1be8  p2psvc - ok

14:36:49.0136 0x1be8  [ 38F1AE32339731F6E5A7281AE8042545, 308954518C45D29FC199525F0CC7FE4EA805322EC0B871DDDCBEEC15355514C8 ] Parport         C:\WINDOWS\System32\drivers\parport.sys

14:36:49.0146 0x1be8  Parport - ok

14:36:49.0170 0x1be8  [ 707889D2F95AAE8C9DD254D8767AD908, BE7BD94728D7629F8B7567523FFB42B8979941CEA2EA03E11BFCD51CF119FC27 ] partmgr         C:\WINDOWS\system32\drivers\partmgr.sys

14:36:49.0178 0x1be8  partmgr - ok

14:36:49.0198 0x1be8  [ A09B0D8F9F0FC17EBCE6481AC9FD5CDF, 8E8D68992D98CF3DBC4B70C7902B3EC28A1E2DA8D4DB38F0AD9D52B1A5A1D40F ] PcaSvc          C:\WINDOWS\System32\pcasvc.dll

14:36:49.0215 0x1be8  PcaSvc - ok

14:36:49.0264 0x1be8  [ 2834089EA4E550FF3B96E61FB4AA34ED, D25DAB47F9778675E984E0738D2014024C2758D52D7E071167A12FF466B7898E ] pci             C:\WINDOWS\system32\drivers\pci.sys

14:36:49.0276 0x1be8  pci - ok

14:36:49.0306 0x1be8  [ 3D587E4295B11B8480F7ACB09A89D718, 8C3BD62B3451E1B2E7197EDAE381785406DF86C03BEEC486602C642FDD37DBC1 ] pciide          C:\WINDOWS\system32\drivers\pciide.sys

14:36:49.0313 0x1be8  pciide - ok

14:36:49.0322 0x1be8  [ B8F07002B5F1DA23CFF979C2806B09F3, AD5C589A02BB8185AA070420BF30E78BC8BE3C6F9B0F66319A8CA05B70A5ED32 ] pcmcia          C:\WINDOWS\system32\drivers\pcmcia.sys

14:36:49.0331 0x1be8  pcmcia - ok

14:36:49.0340 0x1be8  [ FF588077D0C6AC2EA3FCBF1903CE08D0, 64BE1646FB6D8CC902B6F386255F7C0420E3C334E14DECD527DD541B43A1DCD6 ] pcw             C:\WINDOWS\system32\drivers\pcw.sys

14:36:49.0348 0x1be8  pcw - ok

14:36:49.0360 0x1be8  [ 70469C8AC4AD367295E70CFDD81B754C, 3EC6FD742C7C60363939E5343477810D751D91D32A2F24285976C08A7C4477AB ] pdc             C:\WINDOWS\system32\drivers\pdc.sys

14:36:49.0369 0x1be8  pdc - ok

14:36:49.0408 0x1be8  [ 688F47C342E1BBC87A48AB71D316233E, CE99AB67C7E7A11AC69C2F4513AEBDACA385BA7F8CC49BE6313CE04ED404A0E7 ] PEAUTH          C:\WINDOWS\system32\drivers\peauth.sys

14:36:49.0436 0x1be8  PEAUTH - ok

14:36:49.0481 0x1be8  [ 303D2C90139ABFC1D12E279F0F101710, CE02E335A72011004395DC635EB819B3ED8D00041B9C59024DE246366AF00559 ] PeerDistSvc     C:\WINDOWS\system32\peerdistsvc.dll

14:36:49.0537 0x1be8  PeerDistSvc - ok

14:36:49.0551 0x1be8  [ 189265498945593D5256CFF7FEBB9665, 9CB88CC3C726BFE6EDCE8D9E4544306AACD3FB9E969E3A438D9FD533F25C1281 ] percsas2i       C:\WINDOWS\system32\drivers\percsas2i.sys

14:36:49.0558 0x1be8  percsas2i - ok

14:36:49.0571 0x1be8  [ 9B86965114F6831A5130EFE6657B17D9, 4C5B657DB9A9F96BFD3EAFA756ED60D911EB58857C439F5FA6E495A473ED1145 ] percsas3i       C:\WINDOWS\system32\drivers\percsas3i.sys

14:36:49.0579 0x1be8  percsas3i - ok

14:36:49.0633 0x1be8  [ 8A5A52C855FB5BFEF019AE9938AEA8AE, 77CB8A09B209DB5895319BA9D073A67148926E22C47836343050DFC178AFAEEE ] PerfHost        C:\WINDOWS\SysWow64\perfhost.exe

14:36:49.0642 0x1be8  PerfHost - ok

14:36:49.0676 0x1be8  [ 839BD56425530973FF3F6F7C0057CD22, 9BADF39BC4628409CFCD5F1300C6040C49B2ED72D0FA389C6BB042E5B17E1A40 ] PimIndexMaintenanceSvc C:\WINDOWS\System32\PimIndexMaintenance.dll

14:36:49.0692 0x1be8  PimIndexMaintenanceSvc - ok

14:36:49.0738 0x1be8  [ 82FDEC2A262728F62F2111A84CC04B16, A1FCE38D4F55F10BB9B3BFB7D9E3EF7C27D499D9C8882218C8A9A73487798188 ] pla             C:\WINDOWS\system32\pla.dll

14:36:49.0786 0x1be8  pla - ok

14:36:49.0815 0x1be8  [ 7B3DA16FAA498838BB457E0B7E380EDF, B73DCFFA60886F10765E4B76A58CFF18C08CAFEE620700361FC8FEC7E80B5958 ] PlugPlay        C:\WINDOWS\system32\umpnpmgr.dll

14:36:49.0830 0x1be8  PlugPlay - ok

14:36:49.0835 0x1be8  [ F1E9C35A8DFD4D64382CFB9019A950F9, 24E0381C6909F9876D6DC4697DC6405FE18DF91531891B2CCA6DB0191B9C6DF4 ] PNRPAutoReg     C:\WINDOWS\system32\pnrpauto.dll

14:36:49.0844 0x1be8  PNRPAutoReg - ok

14:36:49.0863 0x1be8  [ CAFB5A95883158A0579DED2ED5CB0627, B23F7D19142DD3544F96ADB36F152F4EA7F6C524A1281EC26A2B95D7D044822C ] PNRPsvc         C:\WINDOWS\system32\pnrpsvc.dll

14:36:49.0880 0x1be8  PNRPsvc - ok

14:36:49.0908 0x1be8  [ 62C0BD179961132EF2C5B952210C11F5, 2473FBB3619D0DDA229D4BEC30CEFE7497C27ED3844A5B7655F6F2D328FEAF61 ] PolicyAgent     C:\WINDOWS\System32\ipsecsvc.dll

14:36:49.0927 0x1be8  PolicyAgent - ok

14:36:49.0938 0x1be8  [ 6390391EDFC43DD11CE9E6AADCAC20EA, C8BC222FFBB9E47489D16BB5248E0E2E594011C46CFF71F5DBCC4D5CC6788098 ] Power           C:\WINDOWS\system32\umpo.dll

14:36:49.0949 0x1be8  Power - ok

14:36:49.0970 0x1be8  [ 1433EB7908E5E1E20FFD50E4126C3484, 34D81680C8F2F2C5892FC0E0A6DFCBB241AFF493267A1FE182ED28AE9F712456 ] PptpMiniport    C:\WINDOWS\System32\drivers\raspptp.sys

14:36:49.0981 0x1be8  PptpMiniport - ok

14:36:50.0083 0x1be8  [ E3514CE7CB4AF80ECCA383F065BC77C0, 1EA06D358A07EB9DFB703CEFC4EB834B947B899E0ACFE1C494E2DAED63F1D4B5 ] PrintNotify     C:\WINDOWS\system32\spool\drivers\x64\3\PrintConfig.dll

14:36:50.0162 0x1be8  PrintNotify - ok

14:36:50.0178 0x1be8  [ 22DE54C3974E4FD98F61D095C22C59B7, 64E78D6DEC4A28ABB0A23F2CF078459D81796EC79235AE45976ABB4F72B1D1E6 ] Processor       C:\WINDOWS\System32\drivers\processr.sys

14:36:50.0188 0x1be8  Processor - ok

14:36:50.0216 0x1be8  [ 27D0B024BB356C6BEB1214B61E47DE02, 8CBDD62E243CC652F2197AE83DEDD21D91D2792558A6D7D1CC680B37607DEF4B ] ProfSvc         C:\WINDOWS\system32\profsvc.dll

14:36:50.0233 0x1be8  ProfSvc - ok

14:36:50.0241 0x1be8  [ EDD52C352CBAAAD13FD7BD5DCEA309B3, EC7D294B23FD5C309E5C4C455896937B85DC615E1B36C9F8F3BDC90E75EBF9CF ] Psched          C:\WINDOWS\system32\drivers\pacer.sys

14:36:50.0250 0x1be8  Psched - ok

14:36:50.0278 0x1be8  [ DD3FF2053356D11C785999BBC633F3E0, E9A5B7C657F4523E5DEF7AEE7ECFCC94E911FC65F1D491BEF01239F357B8D8E0 ] QWAVE           C:\WINDOWS\system32\qwave.dll

14:36:50.0294 0x1be8  QWAVE - ok

14:36:50.0320 0x1be8  [ 51590F442C6E5D43244BA30DDB0CE79D, 9C7FD0A19753C13FD4A27EBFD60703A2414D5A2F6F451F0B32769C8D7C953980 ] QWAVEdrv        C:\WINDOWS\system32\drivers\qwavedrv.sys

14:36:50.0328 0x1be8  QWAVEdrv - ok

14:36:50.0346 0x1be8  [ E951E70019865B06126AF850BCCA2026, C590DE38C7603149AFA0271D57EEBAF956F18F50584FCF04BC2C8D8CEC5C5932 ] RasAcd          C:\WINDOWS\system32\DRIVERS\rasacd.sys

14:36:50.0355 0x1be8  RasAcd - ok

14:36:50.0374 0x1be8  [ 0BF8607133AE264BC3C41A5BAA5FFB7B, 9A4F6AC6013AB5C2A99BCFC2CCF161DD225DE8D85D61579655ADBF04A4383A61 ] RasAgileVpn     C:\WINDOWS\System32\drivers\AgileVpn.sys

14:36:50.0386 0x1be8  RasAgileVpn - ok

14:36:50.0397 0x1be8  [ FE0976379F9E7DB6F7945FCEB88C7E29, BA331CE55C02E86478714DA87FAC547B50D53BC7D02BCA5A64D484DED44BFAA5 ] RasAuto         C:\WINDOWS\System32\rasauto.dll

14:36:50.0410 0x1be8  RasAuto - ok

14:36:50.0428 0x1be8  [ CA60F6C03611AF1710BC903ED9F566FB, B5C9E8BAC631738761E11168AB68EB1ECC5EC96BF9A8248B9127DCF744CA4691 ] Rasl2tp         C:\WINDOWS\System32\drivers\rasl2tp.sys

14:36:50.0440 0x1be8  Rasl2tp - ok

14:36:50.0472 0x1be8  [ 586A17C10D417D889F1FF7D8636E2F34, EEDA4EE8D2BC5C8C7756AB79F1F19AF8B1C4057996748FAE4E3F37844DB0EB33 ] RasMan          C:\WINDOWS\System32\rasmans.dll

14:36:50.0499 0x1be8  RasMan - ok

14:36:50.0530 0x1be8  [ E5FA41160F5A3D78D8F7765E5C5F6BB0, 31BA423FFFC3206717DC34B482149421EE28B27A4A3BA2DC78C3B3A9EE0C1365 ] RasPppoe        C:\WINDOWS\System32\drivers\raspppoe.sys

14:36:50.0541 0x1be8  RasPppoe - ok

14:36:50.0553 0x1be8  [ DF0834AE921E633E05D1FDC55C318957, 851A00961224DACBEF9DA427122F6B4B73BB99849D5ECB55DBBD311B2EA84C33 ] RasSstp         C:\WINDOWS\System32\drivers\rassstp.sys

14:36:50.0564 0x1be8  RasSstp - ok

14:36:50.0580 0x1be8  [ FC9B7AC6E2B837EF7CD6C64F7068D41D, 9B0DD842033E82BC7EE80416A62B084BF5200923EB7A6C80415BB28004E9B5E3 ] rdbss           C:\WINDOWS\system32\DRIVERS\rdbss.sys

14:36:50.0597 0x1be8  rdbss - ok

14:36:50.0604 0x1be8  [ FB7375657F8A5932C35EAA45E9B4B416, 99594708BFD6DC9F8CECBF092058D4D0D4F1BC3204E86F9FDAD5207ED5ECF194 ] rdpbus          C:\WINDOWS\System32\drivers\rdpbus.sys

14:36:50.0612 0x1be8  rdpbus - ok

14:36:50.0621 0x1be8  [ A32AED8C644734B283A7C9D08D76064D, A12F67C57E43B6A2FE6449EA3822B1108FE70C66AF9911798777F85D760E384C ] RDPDR           C:\WINDOWS\system32\drivers\rdpdr.sys

14:36:50.0632 0x1be8  RDPDR - ok

14:36:50.0654 0x1be8  [ 37CC7E41243EFBB4FBC0510E5CA32A02, 634E2F81D61F937F30E5ECE01FB581E090C6DA073EF7B1A3F6083ECAF363CB46 ] RdpVideoMiniport C:\WINDOWS\system32\drivers\rdpvideominiport.sys

14:36:50.0662 0x1be8  RdpVideoMiniport - ok

14:36:50.0692 0x1be8  [ DAF957B25A35757E9D814611FAE8FE3B, 5244A427B2DEB5349B9F336A4A39A6834A6E8118A8EDA00738C6CE09F2452C24 ] rdyboost        C:\WINDOWS\system32\drivers\rdyboost.sys

14:36:50.0702 0x1be8  rdyboost - ok

14:36:50.0746 0x1be8  [ 2C72E029C153D25325CA182A669E4ADE, 5CE0E04A6B53A1F11E8159DFD1E59F2AE6631E3B5BD27BAAEC4A35BC02A55722 ] ReFSv1          C:\WINDOWS\system32\drivers\ReFSv1.sys

14:36:50.0772 0x1be8  ReFSv1 - ok

14:36:50.0817 0x1be8  [ BABEE4A896D005BD0D205F1C932DA25E, 269FDF65BE3A226FA2A5CA25085366E32ADAD30A020484FE844962E8C61CB1D2 ] RemoteAccess    C:\WINDOWS\System32\mprdim.dll

14:36:50.0838 0x1be8  RemoteAccess - ok

14:36:50.0864 0x1be8  [ 066062967A77867BDCF665960EFDAD32, 68143DBDFA7C68786C22F5CC4E80200255C663A844069C080E7816F423ABB1F4 ] RemoteRegistry  C:\WINDOWS\system32\regsvc.dll

14:36:50.0879 0x1be8  RemoteRegistry - ok

14:36:50.0924 0x1be8  [ 891C83BE8BA62B7547B9A6576A360C71, B808FE4B5A93B8C971C2AF6CC7F0BAE7154A43A87D6CE0826277D1D7D7948E24 ] RetailDemo      C:\WINDOWS\system32\RDXService.dll

14:36:50.0957 0x1be8  RetailDemo - ok

14:36:50.0976 0x1be8  [ 6451FE42C35FDE3862D99579444F4A8F, BD56A1120AACF6143E6EB739E12BEE86DF142F1159865608BDF1BBE54B66AFCE ] RpcEptMapper    C:\WINDOWS\System32\RpcEpMap.dll

14:36:50.0986 0x1be8  RpcEptMapper - ok

14:36:51.0003 0x1be8  [ F24131EAD1D0B73463052BB042A37B6C, 43B5772310B200DF1914C8E4D10401A0BCE9082BDEAC34736AFB2920B39D7956 ] RpcLocator      C:\WINDOWS\system32\locator.exe

14:36:51.0011 0x1be8  RpcLocator - ok

14:36:51.0028 0x1be8  [ 5E57B9FBB4E9C43EE5B69BEE01A1819F, A1F8D1E52AF446CEA2EB50064E3A24B713B19197D61C3EAECB81B3CCD80558E7 ] RpcSs           C:\WINDOWS\system32\rpcss.dll

14:36:51.0057 0x1be8  RpcSs - ok

14:36:51.0079 0x1be8  [ DC66C1D262D64E30A30B68E9F21AC74B, A5ED3D31BCD68DBC00A956787517ACA167C86F5FFDAF7C9A85505FA2B705C6CB ] rspndr          C:\WINDOWS\system32\drivers\rspndr.sys

14:36:51.0090 0x1be8  rspndr - ok

14:36:51.0111 0x1be8  [ 88F7703F2A4677C828124AE2110D3EBC, 529F6A5815806F2EA2235802BD28AF8D7A40E7799356BD3EC337C9E71B6B53E6 ] s3cap           C:\WINDOWS\System32\drivers\vms3cap.sys

14:36:51.0133 0x1be8  s3cap - ok

14:36:51.0177 0x1be8  [ 9A83FA0EC9B0DCED2CBC49DD05901920, 14D2F241235E2693C68BCCF05D83F2A1C9A7BE185C83E7C6C63EF0F654892F95 ] SamSs           C:\WINDOWS\system32\lsass.exe

14:36:51.0185 0x1be8  SamSs - ok

14:36:51.0210 0x1be8  [ B467E932FE4E16E201DC7E56870CB559, 6FCE9A2DFC5D222BBEA4AA271A17B830FCF8EAE44B07BEE5FF34AE50CABCBB6A ] sbp2port        C:\WINDOWS\system32\drivers\sbp2port.sys

14:36:51.0218 0x1be8  sbp2port - ok

14:36:51.0234 0x1be8  [ 3E115C63649402D321D396F8D606C9B0, F4BA7FE0E89D563A57B6865E4CF1334998987D11A0D70FF7491726A507B40DF4 ] SCardSvr        C:\WINDOWS\System32\SCardSvr.dll

14:36:51.0251 0x1be8  SCardSvr - ok

14:36:51.0279 0x1be8  [ 67EFFD3D1BB6D2B67DF7F8FDCB1A51FC, DE41539FAC730F5CFF6C8754ECFF1253AFDC1C86743AE71B61D716B7A84E85FD ] ScDeviceEnum    C:\WINDOWS\System32\ScDeviceEnum.dll

14:36:51.0294 0x1be8  ScDeviceEnum - ok

14:36:51.0300 0x1be8  [ 31DDA0716EC265CA57DAF9D2295FD76F, E6F39C1B3CF81918277DB8C6E3DF9A82812E1C9063DEB1FB85FE433DC9A16CBA ] scfilter        C:\WINDOWS\system32\DRIVERS\scfilter.sys

14:36:51.0312 0x1be8  scfilter - ok

14:36:51.0353 0x1be8  [ 1BFAC03B6422E878EFCDA934BF4C4823, 0BA537A4B9E8020E6B709A44F1382DB3B41CEF631B847201F812152FEB303CD3 ] Schedule        C:\WINDOWS\system32\schedsvc.dll

14:36:51.0386 0x1be8  Schedule - ok

14:36:51.0412 0x1be8  [ 320E7A02D81A468E8C1FEEFDB856AFAE, E65127D3D6B628F9D19EA509FEBD9E4DC1BF20D0C62C3C9E1D7087DF972B2AA7 ] SCPolicySvc     C:\WINDOWS\System32\certprop.dll

14:36:51.0426 0x1be8  SCPolicySvc - ok

14:36:51.0451 0x1be8  [ 004C66464D8FE76D5DA78BE6777D61AF, 58B5C436798EEBBE7081D54B55B70DEB15331856802CD45E3FF8BDE794F06A27 ] sdbus           C:\WINDOWS\System32\drivers\sdbus.sys

14:36:51.0463 0x1be8  sdbus - ok

14:36:51.0487 0x1be8  [ A906C527B838A4922611C63EBD250F91, 6BB0054A9C2408138BDF49D834FF99B5B9764E7747ABC15016F54FBA1D28394F ] SDRSVC          C:\WINDOWS\System32\SDRSVC.dll

14:36:51.0498 0x1be8  SDRSVC - ok

14:36:51.0509 0x1be8  [ F4BF50A7D16A97A887BFA0F193693C42, EEBF5AAC149C72F490BAC954B25BB6882B10FC38F93CA4F4829A06702B1ECEF9 ] sdstor          C:\WINDOWS\System32\drivers\sdstor.sys

14:36:51.0517 0x1be8  sdstor - ok

14:36:51.0526 0x1be8  [ 648A299839E8F48A946C41DE270D28F5, EEC9A5FCBE3FF78FB5E0452FF1932A8B0C7399688041E22555703CB1977A4428 ] seclogon        C:\WINDOWS\system32\seclogon.dll

14:36:51.0535 0x1be8  seclogon - ok

14:36:51.0549 0x1be8  [ 29452A9DA3E3482F0C2963312F979053, E1782D36C336C4B4C261AD665C1E9051905AA86020E08FC94069972AF4C4DB4B ] SENS            C:\WINDOWS\System32\sens.dll

14:36:51.0562 0x1be8  SENS - ok

14:36:51.0594 0x1be8  [ 919BA7E3054E4F1D61A3524ADCE6A970, 3C382673DF5AF2F38A5AE4A268F5856B0CC9E65D52213DE6D2C06E252753B73C ] SensorDataService C:\WINDOWS\System32\SensorDataService.exe

14:36:51.0627 0x1be8  SensorDataService - ok

14:36:51.0653 0x1be8  [ 01C2EEA7870FE26A4A6CCBA5421CC7E5, 9E643AB6BCBECE4F2A5FD4C96547A4E3F2BDFEFC5FE24B802467718EC69929F8 ] SensorService   C:\WINDOWS\system32\SensorService.dll

14:36:51.0667 0x1be8  SensorService - ok

14:36:51.0678 0x1be8  [ D2FEE824B4AA0BE377F1353E5F915BF4, 00D754C62F3482BBD0EA72C896139C39D15192B2D9FCC7B755D1FB9DF9FCFD9B ] SensrSvc        C:\WINDOWS\system32\sensrsvc.dll

14:36:51.0691 0x1be8  SensrSvc - ok

14:36:51.0703 0x1be8  [ 9DB0BBE3ABE1F49651AE51EC5BCABE58, 0B46C1F231F41766AB73EE7E9834D3CDACA602D12E702D9277E28B47417D9CA4 ] SerCx           C:\WINDOWS\system32\drivers\SerCx.sys

14:36:51.0711 0x1be8  SerCx - ok

14:36:51.0737 0x1be8  [ C4AF79C37334D995D95C22C14FDBF7FD, 4D4985921261909F2123467A22EDB102B490710F60AB935624435E5BB808A0E9 ] SerCx2          C:\WINDOWS\system32\drivers\SerCx2.sys

14:36:51.0747 0x1be8  SerCx2 - ok

14:36:51.0755 0x1be8  [ FC541A272F47BE03E67A9FCB87FA8C3E, 730A3616FD67E9F2832442144B2655A8EF78B9AFCB204113E73E257256491354 ] Serenum         C:\WINDOWS\System32\drivers\serenum.sys

14:36:51.0763 0x1be8  Serenum - ok

14:36:51.0772 0x1be8  [ 2A5F5F95FCA123DCBF53B5F603B64789, DE5C9E1D88B2C180B137DA7839F3EF6C936A171ABA49F89C10EE9C73A2226F3F ] Serial          C:\WINDOWS\System32\drivers\serial.sys

14:36:51.0782 0x1be8  Serial - ok

14:36:51.0801 0x1be8  [ C8738887228B7BFA3B1A906816A8BB12, 328283569201791891D5E9FB3028DB5B9FD93A7BEFC00C7DEBC2CC5731DE64D5 ] sermouse        C:\WINDOWS\System32\drivers\sermouse.sys

14:36:51.0809 0x1be8  sermouse - ok

14:36:51.0850 0x1be8  [ 0CBE2081CAC41BD0093AF69E167B6559, D446B1B31B823875E0536CA8A2F784093B0DA77A875FB0F2D5EABB6DE711CFFC ] Service KMSELDI C:\Program Files\KMSpico\Service_KMS.exe

14:36:51.0885 0x1be8  Service KMSELDI - detected UnsignedFile.Multi.Generic ( 1 )

14:36:54.0263 0x1be8  Service KMSELDI ( UnsignedFile.Multi.Generic ) - warning

14:36:56.0639 0x1be8  [ B1CB58853153397DFFA2D13A81451D09, CC9B3B064711E9B5CB38DC1C84DC410033939848BD31BB0D12F990E8154F357E ] SessionEnv      C:\WINDOWS\system32\sessenv.dll

14:36:56.0658 0x1be8  SessionEnv - ok

14:36:56.0670 0x1be8  [ 67832B68752CDF7FDE56949E4A2E70BF, A72320EA8575A751DF86A1EE7969AD9D548D6185F2520197262E11B79FF8222B ] sfloppy         C:\WINDOWS\System32\drivers\sfloppy.sys

14:36:56.0678 0x1be8  sfloppy - ok

14:36:56.0710 0x1be8  [ F10E5536E1C753E01CF19FA4F466CE90, C9897F22B176D84CA233F864078895E3DAD4DAD090FACBB01BD6E59EE337B47C ] SharedAccess    C:\WINDOWS\System32\ipnathlp.dll

14:36:56.0731 0x1be8  SharedAccess - ok

14:36:56.0759 0x1be8  [ 4AC12D495B3CB4275F74C68A7A017561, DC53EBD606ECCD8BCF6D618C0EB58B03F5C20F09E0F0AEDE9B8082D6B208B19A ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll

14:36:56.0790 0x1be8  ShellHWDetection - ok

14:36:56.0798 0x1be8  [ ED058030296CF9B79C8D48BF43724323, 01DC7C2590DF48116CD1A126F207FE5DE439A53286BAE3736E22EE3D1CA80BE3 ] SiSRaid2        C:\WINDOWS\system32\drivers\SiSRaid2.sys

14:36:56.0805 0x1be8  SiSRaid2 - ok

14:36:56.0813 0x1be8  [ 633D3D1581E9DCCD5A2D8F039104C9A5, C44B5097016C2AEC8B41F77425FE44413562F9DCF0C0C11CA69D8178970B4706 ] SiSRaid4        C:\WINDOWS\system32\drivers\sisraid4.sys

14:36:56.0821 0x1be8  SiSRaid4 - ok

14:36:56.0849 0x1be8  [ 35B8FC714C2E7F07F7DC7C64452153F8, 6D45EB01B5F972ED0E5520E771F007FFEE892054FABDB3DD00D3E9915D3A0A31 ] smphost         C:\WINDOWS\System32\smphost.dll

14:36:56.0861 0x1be8  smphost - ok

14:36:56.0890 0x1be8  [ DE3A5C27EC842A113F68A2705FF63B00, B134EF63708A892B673B539F544F7980FF72838D822E8E4CCDDB359B22CB8805 ] SmsRouter       C:\WINDOWS\system32\SmsRouterSvc.dll

14:36:56.0915 0x1be8  SmsRouter - ok

14:36:56.0940 0x1be8  [ CD1056818A6FCEF4D32BD1D6E34070D5, F5BFB61ACB220A73B0DC4487B049F52E9F9FA2D4188C001E7A5838D47CEA6343 ] SNMPTRAP        C:\WINDOWS\System32\snmptrap.exe

14:36:56.0950 0x1be8  SNMPTRAP - ok

14:36:56.0968 0x1be8  [ 187B4AD4446C59F8FCC4A10F473EE3D1, 0AAD961B3D7B3484DC89CB86F3EC96CEBFABB7224A5BFB48083DE8F1805EA7B4 ] spaceport       C:\WINDOWS\system32\drivers\spaceport.sys

14:36:56.0983 0x1be8  spaceport - ok

14:36:56.0996 0x1be8  [ 2799FCA215919FDC9A87C5FCAB530828, BDE968BF26693AA4D70AB669896BCA49C6F533EA226386B35B0EA589A55227B5 ] SpbCx           C:\WINDOWS\system32\drivers\SpbCx.sys

14:36:57.0004 0x1be8  SpbCx - ok

14:36:57.0087 0x1be8  [ 788BA30B95BEFA1F0142723CD0070940, B3E0AC94AD7D59D8FF0985B353AE40DF6EB7C7788984F3FD835430272326E69B ] SplashtopRemoteService C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe

14:36:57.0105 0x1be8  SplashtopRemoteService - ok

14:36:57.0125 0x1be8  [ 58C17D92AD61EC7A98B05F4FAD0D205A, B881134A1BD9194145A9D18BDB34D57E2C167F06C2A9368459D0C33E6E0D6501 ] Spooler         C:\WINDOWS\System32\spoolsv.exe

14:36:57.0153 0x1be8  Spooler - ok

14:36:57.0273 0x1be8  [ 5C31E109943E67CFC801810C00AB63EE, 9A80D7CDA1135EBCE10E753986A59CFA3D8D49F9B0BE38FDF99880B1DD88C41D ] sppsvc          C:\WINDOWS\system32\sppsvc.exe

14:36:57.0402 0x1be8  sppsvc - ok

14:36:57.0416 0x1be8  [ AA1F23501511EFE9CF9771F6B20E8D45, E786852D9877CCFD35444F8FC694467132F868D87A8C344FD1016FFDE74695A5 ] srv             C:\WINDOWS\system32\DRIVERS\srv.sys

14:36:57.0433 0x1be8  srv - ok

14:36:57.0447 0x1be8  [ F5B169EDF9D5E3C7200D89D30E065D13, 12BAF3A3CB76F0900FA53681C9AD16F40308F493BA22C0F60E1E268D0D6AF825 ] srv2            C:\WINDOWS\system32\DRIVERS\srv2.sys

14:36:57.0470 0x1be8  srv2 - ok

14:36:57.0477 0x1be8  [ 2E142E027F0AA698BA4DCE49CBDB43CD, A21027BBBC75A55A8B302D028113A0683016E4C72790A8C561DDB1AE7FDB4289 ] srvnet          C:\WINDOWS\system32\DRIVERS\srvnet.sys

14:36:57.0490 0x1be8  srvnet - ok

14:36:57.0501 0x1be8  [ BF71B3FB5B7557CB740CDB09C5FB50D9, D6F9E65FDC9C4ADAFE82D94F71A1F5960DB3BEEBF4FE5B2D087515C4FAA5F287 ] SSDPSRV         C:\WINDOWS\System32\ssdpsrv.dll

14:36:57.0517 0x1be8  SSDPSRV - ok

14:36:57.0538 0x1be8  [ EF1BC04215C201ADA3F7F5A2F034EA21, E1A7A0FA2032B9E7D3951100E74C04D93CD848C88D23D57FBA0BFA2816B29C61 ] SstpSvc         C:\WINDOWS\system32\sstpsvc.dll

14:36:57.0553 0x1be8  SstpSvc - ok

14:36:57.0581 0x1be8  [ 5252D7BC56E5E0ED715AEA8FE173A455, 1408B3E98B35A449434718777EE70595F0D306197A428279C6281D2F1953F259 ] ssudmdm         C:\WINDOWS\system32\DRIVERS\ssudmdm.sys

14:36:57.0589 0x1be8  ssudmdm - ok

14:36:57.0612 0x1be8  [ 504C33FE3B4E2AF11FE5875DDCA8EBEA, 7A3A5B5B23422A58F597DDE5FC0593EDE8EF31A7FB9CB77DB3A6AAFCCA369F3D ] SSUService      C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe

14:36:57.0626 0x1be8  SSUService - ok

14:36:57.0706 0x1be8  [ 0FC4FA53C3F666CD7AFB138A978D3CB8, F65D88324D6007CE4AAB9486B6D00EE6352CA0F3B1A2D0616811AF1279799501 ] StateRepository C:\WINDOWS\system32\windows.staterepository.dll

14:36:57.0779 0x1be8  StateRepository - ok

14:36:57.0835 0x1be8  [ D31201BD8782752BD69DBE1E5DDF9AC5, 98B72690B4E6CC1B694C655DD31CB1FB56B76B62A32CFB748AF78F4C072D9740 ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe

14:36:57.0852 0x1be8  Steam Client Service - ok

14:36:57.0875 0x1be8  [ DDE064A4298FD1FBF804D3ED691E7EDB, B0D117B1FC0DA2CB76F5F63699E2F108930B6C6721AC443111D48215ED624278 ] stexstor        C:\WINDOWS\system32\drivers\stexstor.sys

14:36:57.0882 0x1be8  stexstor - ok

14:36:57.0900 0x1be8  [ A10A6FC3F643F82777345ADDC182799A, 8D09A7643A0095A0077710423E7D8D7134F9197B6F73DA427333790BA3774A61 ] sthid           C:\WINDOWS\System32\drivers\sthid.sys

14:36:57.0903 0x1be8  sthid - ok

14:36:57.0937 0x1be8  [ 60F04DF1AB55D6D4BDA02052DD20537E, 52996EDF2C06968DADC9BDF24E4039929B81643493C7193B8CC4A6BD1A3AE761 ] stisvc          C:\WINDOWS\System32\wiaservc.dll

14:36:57.0962 0x1be8  stisvc - ok

14:36:57.0989 0x1be8  [ 32C95F44108C3E7DB58F773346E3C9D0, F852D8ECA06080EA6DE1A90509071965A750D9CFC9627F0D4DB8ECC57133B0B5 ] storahci        C:\WINDOWS\system32\drivers\storahci.sys

14:36:57.0999 0x1be8  storahci - ok

14:36:58.0011 0x1be8  [ 8883C8CE4942A99B84E1CC6EFA19738E, 60C1CDA4382F8EE70D810DBB1BCAF5F389433563FF23EEB84859612F396D8CE6 ] storflt         C:\WINDOWS\system32\drivers\vmstorfl.sys

14:36:58.0018 0x1be8  storflt - ok

14:36:58.0039 0x1be8  [ AE7B7E1E95BFB9340B1956C98CA52C81, 3E0214A0C486C1CD05D9BC57E58A998A3CEADDC1D24AE2A75098F56B37069160 ] stornvme        C:\WINDOWS\system32\drivers\stornvme.sys

14:36:58.0048 0x1be8  stornvme - ok

14:36:58.0061 0x1be8  [ 63513EF3121689B3A59BD217618A2E42, DE9B89732801DEC60BD116D58CFB427F7E37F093BE8A9F6E0CAC729B5346B314 ] storqosflt      C:\WINDOWS\system32\drivers\storqosflt.sys

14:36:58.0070 0x1be8  storqosflt - ok

14:36:58.0101 0x1be8  [ CC96FF061C772340F2ED89ABBA567ADC, 028CD44405B7FAFC7BF331DD729E44E0594A63386F48CF39D7725A58B3DE22D6 ] StorSvc         C:\WINDOWS\system32\storsvc.dll

14:36:58.0118 0x1be8  StorSvc - ok

14:36:58.0136 0x1be8  [ 000F5CFCEF0F06DC8FD1D2F568E48AE4, C1FE485E57A1B912CE79556E0EFF03CC11362E7966D250E3AA4962DCCB8F8EE6 ] storufs         C:\WINDOWS\system32\drivers\storufs.sys

14:36:58.0143 0x1be8  storufs - ok

14:36:58.0157 0x1be8  [ 7415087F9006D6818F85F3CBD79B1A50, C768EBB2263375D285D689FEEF546147D42D7376977424A4D6FD655CC78EA7CD ] storvsc         C:\WINDOWS\system32\drivers\storvsc.sys

14:36:58.0164 0x1be8  storvsc - ok

14:36:58.0189 0x1be8  [ E49858EA5865A015EB78B7F7C1C07DE2, 1ADBBAC2D2E2E3C40AB0BDDE068001E76A8DAB79C54F06479F7A4567DAD7A7A8 ] svsvc           C:\WINDOWS\system32\svsvc.dll

14:36:58.0201 0x1be8  svsvc - ok

14:36:58.0264 0x1be8  [ 802278EE4ACCE9EA1F1481DF20EB1667, E78F0DA2CA0B2C2DF3B7E3B2A22C03380FE649813EE6EB31067C5FB6727DB7BD ] swenum          C:\WINDOWS\System32\DriverStore\FileRepository\swenum.inf_amd64_2a699e44676b7781\swenum.sys

14:36:58.0271 0x1be8  swenum - ok

14:36:58.0285 0x1be8  [ 313D2C0DBA0B23A8302254FD317D2EC8, 20B98D6F33FEC7ACBCEED9757A3FEAD837FA7BA378BA25575A33EA45E076FC6B ] swprv           C:\WINDOWS\System32\swprv.dll

14:36:58.0308 0x1be8  swprv - ok

14:36:58.0332 0x1be8  [ 12D0CB1DCAE6725B6CA54CC2038C4C8C, 7D224298E440B8C5FDD99A52485A6245DE5109C9A02E65AD38F1EC6DBF4AEEF2 ] Synth3dVsc      C:\WINDOWS\System32\drivers\Synth3dVsc.sys

14:36:58.0340 0x1be8  Synth3dVsc - ok

14:36:58.0365 0x1be8  [ D5B31B2F14848015C211F1D674A82F3A, 58C18254C817693DB727090D1CC518032B3A67C5B3FC7F2F8CE4613A33790CFA ] SysMain         C:\WINDOWS\system32\sysmain.dll

14:36:58.0402 0x1be8  SysMain - ok

14:36:58.0431 0x1be8  [ D5AAA188C70146977CFEE8D128599F3F, 9ABC30982E552EAF41FE84397EEEE5A3187444062C662D7CF35A03E3B274AFB8 ] SystemEventsBroker C:\WINDOWS\System32\SystemEventsBrokerServer.dll

14:36:58.0450 0x1be8  SystemEventsBroker - ok

14:36:58.0473 0x1be8  [ 95875059929EF91B55EA612D7967DD3D, 5F734209C8C9725376F7C146ED84999CC6D019C4C10B1795F53E72BE8853E2DD ] TabletInputService C:\WINDOWS\System32\TabSvc.dll

14:36:58.0485 0x1be8  TabletInputService - ok

14:36:58.0513 0x1be8  [ 3C32FF010F869BC184DF71290477384E, 55CFCEC7F026C6E2E96A2FBE846AB513BB12BB0348735274FE1B71AF019C837B ] tap0901         C:\WINDOWS\System32\drivers\tap0901.sys

14:36:58.0518 0x1be8  tap0901 - ok

14:36:58.0546 0x1be8  [ FE33F417DFD9847CB571D3C7EE5FA7E3, B3C7BE7998B9B093DD969A2588EE8CEBD9771331A63D4B1D86A188317B5EE71C ] TapiSrv         C:\WINDOWS\System32\tapisrv.dll

14:36:58.0562 0x1be8  TapiSrv - ok

14:36:58.0611 0x1be8  [ 7EBD20284AC9BF9F0A020B86769BB074, 26D8CC9C1EE069BB617973BA7CBCFC36BAF1EABF975F395077547F930197A56A ] Tcpip           C:\WINDOWS\system32\drivers\tcpip.sys

14:36:58.0662 0x1be8  Tcpip - ok

14:36:58.0711 0x1be8  [ 7EBD20284AC9BF9F0A020B86769BB074, 26D8CC9C1EE069BB617973BA7CBCFC36BAF1EABF975F395077547F930197A56A ] Tcpip6          C:\WINDOWS\system32\drivers\tcpip.sys

14:36:58.0762 0x1be8  Tcpip6 - ok

14:36:58.0777 0x1be8  [ D378A1AF58AFA84BB6AC753F2C1BE9F4, 8BBA623193D51E6A8DD0627FA08C93B918EF1BA2EEBA46CDBB86FE6A1007FDEE ] tcpipreg        C:\WINDOWS\system32\drivers\tcpipreg.sys

14:36:58.0787 0x1be8  tcpipreg - ok

14:36:58.0818 0x1be8  [ 28E1E63A1AC65E17B3194238FA2CF3BF, 9A52D6DD14BEBB7B407B2703A111D1B302F1B84AA40A14D21FCA554F395E935D ] tdx             C:\WINDOWS\system32\DRIVERS\tdx.sys

14:36:58.0826 0x1be8  tdx - ok

14:36:58.0843 0x1be8  [ CCDBD2817C10A4F631280CBB3AE44FFB, A022DEF4D3CF75F41FA26275347F4BA38A513AD32FF18385C2E756DECB61D404 ] terminpt        C:\WINDOWS\System32\drivers\terminpt.sys

14:36:58.0849 0x1be8  terminpt - ok

14:36:58.0883 0x1be8  [ A0608264209A836821D6AB8C67B108AB, 7912C75F72BCAB7426A2E00C597C8D94C185B5DD31BD6C4BE5D56FECD5B0D9EA ] TermService     C:\WINDOWS\System32\termsrv.dll

14:36:58.0917 0x1be8  TermService - ok

14:36:58.0926 0x1be8  [ 261830B1E3650E4471E1F98850B929B7, D281B8A93315E64C7AF5002E5BFBE6AFF8B35FD6AA747AE07D7AA96F4AFAA613 ] Themes          C:\WINDOWS\system32\themeservice.dll

14:36:58.0941 0x1be8  Themes - ok

14:36:58.0978 0x1be8  [ 8D23F0819A00C547814409B734DD3747, 0E1B25A53C84486F8A57F309F3C016114F90F5AF5E576889BD230931F38594A5 ] tiledatamodelsvc C:\WINDOWS\system32\tileobjserver.dll

14:36:58.0999 0x1be8  tiledatamodelsvc - ok

14:36:59.0040 0x1be8  [ 354DAA630928CD4DA2BC84A0DA4ADA9D, AFAE4948EA4F899267DC52DF9A06450FC3E77083B563E541581DA90685C7E98C ] TimeBroker      C:\WINDOWS\System32\TimeBrokerServer.dll

14:36:59.0053 0x1be8  TimeBroker - ok

14:36:59.0076 0x1be8  [ F4AEDABC8F3A9D632F8206D0C7F8CA09, 6E76749CD4B857B4D930267E3CF448AF4D14FAC851873C5E71572E62CAD2FA36 ] TPM             C:\WINDOWS\system32\drivers\tpm.sys

14:36:59.0086 0x1be8  TPM - ok

14:36:59.0105 0x1be8  [ 2D0338A3009075FCCB119CB7F3280F82, F42F3B8DA0F8B2C99892E66CDEF471A1CD30A30CF437ADFF464A2C786A6B87A6 ] TrkWks          C:\WINDOWS\System32\trkwks.dll

14:36:59.0117 0x1be8  TrkWks - ok

14:36:59.0172 0x1be8  [ 62D6A900C5DFF2ECF131384E5A5C85AB, 1AF1FB868C59DFF452E3351EE5070B2C746DE606B9E2F1834CE2256F41ABE7A9 ] TrustedInstaller C:\WINDOWS\servicing\TrustedInstaller.exe

14:36:59.0182 0x1be8  TrustedInstaller - ok

14:36:59.0188 0x1be8  [ 676C801CAA61AADD0C918CC536A74B78, DB5DEC9445272E46D32DC2A9A99A9AE45729E424E61C679ECFD973AA88457BE6 ] TsUsbFlt        C:\WINDOWS\system32\drivers\TsUsbFlt.sys

14:36:59.0197 0x1be8  TsUsbFlt - ok

14:36:59.0220 0x1be8  [ 2BB6CC0DD1CEE86330743B56FA9FE91F, EE71E3DEECA7599947AB09E8967FE8066348D82B4C17D8CBE800FCDE9CF4989D ] TsUsbGD         C:\WINDOWS\System32\drivers\TsUsbGD.sys

14:36:59.0228 0x1be8  TsUsbGD - ok

14:36:59.0258 0x1be8  [ 14B46248612DF1B1A695040FFFBCFAFC, 8C373A3C416FC9AB3872A187E64AC7A6E69FF605BD8784E8F2B1C28C293A0495 ] tunnel          C:\WINDOWS\System32\drivers\tunnel.sys

14:36:59.0269 0x1be8  tunnel - ok

14:36:59.0288 0x1be8  [ D0BE5EA1652D55029C9A898FB8ACFCE0, 80C4BC30B967C79B3457F43EB9B530CA2571C6158958879AC55E5A81F71CFF15 ] uagp35          C:\WINDOWS\system32\drivers\uagp35.sys

14:36:59.0295 0x1be8  uagp35 - ok

14:36:59.0307 0x1be8  [ 13C15E4B238895FE4731DB1D612EEB5F, 211E4B05AA09F7FBE2487C3241A98D1F970FEE5B9B1BAED2788B57233BFC4104 ] UASPStor        C:\WINDOWS\System32\drivers\uaspstor.sys

14:36:59.0315 0x1be8  UASPStor - ok

14:36:59.0327 0x1be8  [ BEBB8B55C5F99B69EEE39A9D7BADB21E, 08A094EA38AB58CC70108A3BDFDD3251897DC4B13FDDAD54C1B063137836EF34 ] UcmCx0101       C:\WINDOWS\system32\Drivers\UcmCx.sys

14:36:59.0336 0x1be8  UcmCx0101 - ok

14:36:59.0357 0x1be8  [ DE3EDAF609D00EA2E54986E6459796A6, 61A9AB51869F38300CC5CC5D302B962FB966F54CBB2E393954F36372B3A479FE ] UcmUcsi         C:\WINDOWS\System32\drivers\UcmUcsi.sys

14:36:59.0367 0x1be8  UcmUcsi - ok

14:36:59.0383 0x1be8  [ FB1C1D8B96A482F3581338D6752E1D6C, 0FFAEE3E088614B3483C459513BB9D78EB76B574696FD877A3CDF6A11378F46C ] Ucx01000        C:\WINDOWS\system32\drivers\ucx01000.sys

14:36:59.0394 0x1be8  Ucx01000 - ok

14:36:59.0408 0x1be8  [ 4E1543ACE2F6E2846713E5123D9D4159, 1A6AFC525A80D1F19B14CDAD38790DF7293911C4D0E8301161D92201B934C3D4 ] UdeCx           C:\WINDOWS\system32\drivers\udecx.sys

14:36:59.0417 0x1be8  UdeCx - ok

14:36:59.0431 0x1be8  [ CDCA9CC1D8293E75218D8FF85F2337A4, 173086C08DDC7625E026E425F1E2B5D6C795771BEAE9BFF6093E3592FBEBD323 ] udfs            C:\WINDOWS\system32\DRIVERS\udfs.sys

14:36:59.0451 0x1be8  udfs - ok

14:36:59.0475 0x1be8  [ BC683E19307C533C7161DB7A58051347, 5553BE3421986FDD9992EBFD883CDA151F7166C01BBFA3E9183A3C93E41D79B6 ] UEFI            C:\WINDOWS\System32\drivers\UEFI.sys

14:36:59.0483 0x1be8  UEFI - ok

14:36:59.0496 0x1be8  [ D14B42C26DE402F316D49667D15446F0, 61CC9FF03EF78631C800EFD8D587975CB94D53DB80E6F60BD13BA52EC5690D3D ] Ufx01000        C:\WINDOWS\system32\drivers\ufx01000.sys

14:36:59.0507 0x1be8  Ufx01000 - ok

14:36:59.0517 0x1be8  [ 192470BE4321791FBB25F379D0141D6F, AD120F8F98BD99014471CE60630B5FEE7555AB261C98B7D9819FE23C386655F7 ] UfxChipidea     C:\WINDOWS\System32\drivers\UfxChipidea.sys

14:36:59.0525 0x1be8  UfxChipidea - ok

14:36:59.0536 0x1be8  [ F7BD838E84E6B286DBCE068EFB8C0800, A55188C8F8BDC739A7ED7D29CDCB2A17468BBB158E13D804963B31ED73449520 ] ufxsynopsys     C:\WINDOWS\System32\drivers\ufxsynopsys.sys

14:36:59.0546 0x1be8  ufxsynopsys - ok

14:36:59.0568 0x1be8  [ C844E39B900FFA46CA8DD2BBA670A077, 0CB6232BCE47C59821DF25D6ED33E85C3E32DDAB101AA8A2C22B5401E73F5D5B ] UI0Detect       C:\WINDOWS\system32\UI0Detect.exe

14:36:59.0581 0x1be8  UI0Detect - ok

14:36:59.0603 0x1be8  [ A25842AC180F0E8B02380ECB8ADA1AF5, AF22E7559C5EF8DC22A2B9E27FFFFF075B1D1B68A8307266BD9473E0FAF36BEF ] uliagpkx        C:\WINDOWS\system32\drivers\uliagpkx.sys

14:36:59.0611 0x1be8  uliagpkx - ok

14:36:59.0620 0x1be8  [ 21088F43172525C7E02D335A3327F46C, B04AD471A7DFE83AB557DB4540616B7DF4A1904F8BDDCB920D449FCEE6F36FD5 ] umbus           C:\WINDOWS\System32\drivers\umbus.sys

14:36:59.0630 0x1be8  umbus - ok

14:36:59.0646 0x1be8  [ 294A291B5D48FE8F38DD94B7272442C5, 66C9139636760C92C1E04FCF440C432FF6C5A94E1577CAFE1D61FCF2D30472ED ] UmPass          C:\WINDOWS\System32\drivers\umpass.sys

14:36:59.0653 0x1be8  UmPass - ok

14:36:59.0674 0x1be8  [ 3427889AECC3B6912A0A01D095E32B98, 322AE14B74295ACFC124719BBEF8809201150A184E262EC55E26D2B45787BF9D ] UmRdpService    C:\WINDOWS\System32\umrdp.dll

14:36:59.0690 0x1be8  UmRdpService - ok

14:36:59.0728 0x1be8  [ 0D5C9E27E93AAEA3E30A1E59A7AC3DFF, 31A203DA03877E6B887930990C5BB53402F0DFFB22A6F8FC5A34EF0B99CD8A7E ] UnistoreSvc     C:\WINDOWS\System32\unistore.dll

14:36:59.0768 0x1be8  UnistoreSvc - ok

14:36:59.0788 0x1be8  [ BD693208673F40BA21AA70B69F1D439C, E324947C2DD34386A83B09E73668F1CCED127AC91194B8BF7EC4C8E36CF8203E ] upnphost        C:\WINDOWS\System32\upnphost.dll

14:36:59.0810 0x1be8  upnphost - ok

14:36:59.0826 0x1be8  [ A7A52EDDC3FAF183D6AC4774690ADF13, 630A0331F2EFA2DC7EFDACD08D8DF5C85BFDA30FF1525050FF54E069AFA45F6C ] UrsChipidea     C:\WINDOWS\System32\drivers\urschipidea.sys

14:36:59.0833 0x1be8  UrsChipidea - ok

14:36:59.0847 0x1be8  [ 2EEA0897DD9E30E958B508D557F0B5E4, BE051A3AA5DFF56310FAB67AD19AC0443A3580542886EF3554EBE18F1323596F ] UrsCx01000      C:\WINDOWS\system32\drivers\urscx01000.sys

14:36:59.0854 0x1be8  UrsCx01000 - ok

14:36:59.0860 0x1be8  [ DC54D775A3A61E4CDE871B4E38A1459A, CC996A9D293201BBD285E7B629B12EE88574702B8AC7BB4149439D6A25A07F7E ] UrsSynopsys     C:\WINDOWS\System32\drivers\urssynopsys.sys

14:36:59.0867 0x1be8  UrsSynopsys - ok

14:36:59.0893 0x1be8  [ F957092C63CD71D85903CA0D8370F473, 4DEC2FC20329F248135DA24CB6694FD972DCCE8B1BBEA8D872FDE41939E96AAF ] USBAAPL64       C:\WINDOWS\System32\Drivers\usbaapl64.sys

14:36:59.0902 0x1be8  USBAAPL64 - ok

14:36:59.0924 0x1be8  [ 18B63A0980F4AA1E6D7879B253980E37, 05F96DBE0A3DE2A685DEEBA8B6838A47AEB7CE2EBE8EB6BAD67B36DCF7E73589 ] usbccgp         C:\WINDOWS\System32\drivers\usbccgp.sys

14:36:59.0934 0x1be8  usbccgp - ok

14:36:59.0961 0x1be8  [ 1C60A1A3C8E1E819E16F12BAEB1C83F8, E255BD173DBF091C5EA07381862E23C1FD761489EC396E312974FBC124E1F33A ] usbcir          C:\WINDOWS\System32\drivers\usbcir.sys

14:36:59.0972 0x1be8  usbcir - ok

14:37:00.0002 0x1be8  [ 9A3E39F85DC6E3B9F792F1095ACFF788, 66B8E137A5232E9F717907CFD49FE624AE101F4DE14E2960849DABF7A877E87A ] usbehci         C:\WINDOWS\System32\drivers\usbehci.sys

14:37:00.0010 0x1be8  usbehci - ok

14:37:00.0046 0x1be8  [ 0A368247A900656CC0678117DFC3A87C, 9BEAD14DA067439D913F609955E95CFA0B88ED4F1BC60B473E00F9D9CBC01B9C ] usbhub          C:\WINDOWS\System32\drivers\usbhub.sys

14:37:00.0063 0x1be8  usbhub - ok

14:37:00.0100 0x1be8  [ C08449092043601887A1743350888635, 5CD916649D2CD8823B89C9E7459AD76AA8E54D70B6D9F40AD4A41144E22ACBE0 ] USBHUB3         C:\WINDOWS\System32\drivers\UsbHub3.sys

14:37:00.0117 0x1be8  USBHUB3 - ok

14:37:00.0138 0x1be8  [ 72EA850B59F40C25A4FEDDA5FE84EFEB, FB4801AA1FB72FC1C41024916368823E88D53E338640E3BEA865B0F0E7B8EE91 ] usbohci         C:\WINDOWS\System32\drivers\usbohci.sys

14:37:00.0148 0x1be8  usbohci - ok

14:37:00.0154 0x1be8  [ 47B2B2DE152E25546944049CA1170BB1, DDA0A806D3108B2475AB13F584EA8CE6F0932C5E394C2C3FA691DFAB8A2BCAC0 ] usbprint        C:\WINDOWS\System32\drivers\usbprint.sys

14:37:00.0164 0x1be8  usbprint - ok

14:37:00.0189 0x1be8  [ 923CA145CD0A9DFBA4CBBA60AB684C2C, EFAA1E730802490E9A53718D70484832A38345FE0A670937FC546FD245DF2CC9 ] usbscan         C:\WINDOWS\system32\DRIVERS\usbscan.sys

14:37:00.0199 0x1be8  usbscan - ok

14:37:00.0228 0x1be8  [ 1F72E1A7E1858B7B3FF81522FCEBDE95, 4FAD243DA73C45CD5CA5E50F824F30EF0DC777D83957FD21FF43D8C89EC15AAC ] usbser          C:\WINDOWS\System32\drivers\usbser.sys

14:37:00.0239 0x1be8  usbser - ok

14:37:00.0252 0x1be8  [ CD35467670DF1E6FBF36DA308F0C872B, E1F4F9B1EBD476394CBD0C934842AEE2502B030D97351B0A1E751FF23B011B57 ] USBSTOR         C:\WINDOWS\System32\drivers\USBSTOR.SYS

14:37:00.0261 0x1be8  USBSTOR - ok

14:37:00.0270 0x1be8  [ DFA92EA105DD1073B43FB210EEB03DD4, D940432458F0A04F5013B48197CEA0412C8A909C50605AA21DD08271C90E2FE3 ] usbuhci         C:\WINDOWS\System32\drivers\usbuhci.sys

14:37:00.0280 0x1be8  usbuhci - ok

14:37:00.0313 0x1be8  [ C67A03F54A1EA683F4880A481EE5FF6C, 346185B378577FF14EFAD01ECB7DFC9AFC0D50F16DF081C3BA99AEFF710A0EE9 ] USBXHCI         C:\WINDOWS\System32\drivers\USBXHCI.SYS

14:37:00.0328 0x1be8  USBXHCI - ok

14:37:00.0361 0x1be8  [ 32212C0FE0556915E763C29DEB6D267E, C5BC9DA3AB0C41604E8F3D01AFC2C25351FF5D3967E766DD0CDB4C0239ED6312 ] UserDataSvc     C:\WINDOWS\System32\userdataservice.dll

14:37:00.0407 0x1be8  UserDataSvc - ok

14:37:00.0448 0x1be8  [ D76A6C338A81C3B14AD37B22AA422B4B, 39489B44068CAA86232B513FF7A5DA56F5AAAB595D8DBC0CCDDD4ED4A1318E07 ] UserManager     C:\WINDOWS\System32\usermgr.dll

14:37:00.0474 0x1be8  UserManager - ok

14:37:00.0508 0x1be8  [ 0CFEA30C0217EE74FF853B2B0CC0BE6D, 1F0856D2D94F46D7B24B7EE18ED868C9EFAE972039D35D1FAA9058A12CF40493 ] UsoSvc          C:\WINDOWS\system32\usocore.dll

14:37:00.0525 0x1be8  UsoSvc - ok

14:37:00.0538 0x1be8  [ 9A83FA0EC9B0DCED2CBC49DD05901920, 14D2F241235E2693C68BCCF05D83F2A1C9A7BE185C83E7C6C63EF0F654892F95 ] VaultSvc        C:\WINDOWS\system32\lsass.exe

14:37:00.0546 0x1be8  VaultSvc - ok

14:37:00.0558 0x1be8  [ 26223003DDFB347B5CF3EC0B56DB066B, 78848BE1334C05F28FA431B08225EAE8345B2C66E7D677F9936892FC941EA961 ] vdrvroot        C:\WINDOWS\system32\drivers\vdrvroot.sys

14:37:00.0565 0x1be8  vdrvroot - ok

14:37:00.0601 0x1be8  [ 0C3F4E7684C1D72E85A98689E65A98A1, F7928D3EFC1A83125887ADA5F8E008022B58F0DBA8A711B4D60975D8CE82B595 ] vds             C:\WINDOWS\System32\vds.exe

14:37:00.0629 0x1be8  vds - ok

14:37:00.0655 0x1be8  [ A417284BC6B5C2EEF63F2C5154473530, 55146660CDDD829630C216038E6500CFAC906E67C82881047B665BFEEB286D10 ] VerifierExt     C:\WINDOWS\system32\drivers\VerifierExt.sys

14:37:00.0666 0x1be8  VerifierExt - ok

14:37:00.0684 0x1be8  [ 4C39C05A72EB14C0567501C7E087E564, D3DC122B7E4A5BD345517FE3A9E9E58CD3C78887F9F327AB782BADCAD0F8F2EB ] vhdmp           C:\WINDOWS\System32\drivers\vhdmp.sys

14:37:00.0703 0x1be8  vhdmp - ok

14:37:00.0725 0x1be8  [ C42206A15078596FDE8E89BB629DE342, B95F9EC2413ADE658A7CE4A9BB57A0E125C29205C24BBB120153DACAF4CF9482 ] vhf             C:\WINDOWS\System32\drivers\vhf.sys

14:37:00.0732 0x1be8  vhf - ok

14:37:00.0756 0x1be8  [ 248D9F911A5C94CF8477125DD0C3A291, 418C7285184BCC9DE4E56175960585867A5DB21FEF761C49FF6F1AF1C07D8088 ] vmbus           C:\WINDOWS\system32\drivers\vmbus.sys

14:37:00.0765 0x1be8  vmbus - ok

14:37:00.0774 0x1be8  [ 3E98DD4E0CBD6B4F9CBD0E9E0EDF541E, 2B5CF364F4D1D3359FBEA8BB2E72A1FCE1277E8D893977B751D9AC10A27DF018 ] VMBusHID        C:\WINDOWS\System32\drivers\VMBusHID.sys

14:37:00.0782 0x1be8  VMBusHID - ok

14:37:00.0811 0x1be8  [ 977603C51C997435D59ECFE7E24E0653, 32AB9BBFFEB73F5282848748B46584238BD1B812A1435F7759180D36B33FE806 ] vmicguestinterface C:\WINDOWS\System32\ICSvc.dll

14:37:00.0831 0x1be8  vmicguestinterface - ok

14:37:00.0840 0x1be8  [ 977603C51C997435D59ECFE7E24E0653, 32AB9BBFFEB73F5282848748B46584238BD1B812A1435F7759180D36B33FE806 ] vmicheartbeat   C:\WINDOWS\System32\ICSvc.dll

14:37:00.0861 0x1be8  vmicheartbeat - ok

14:37:00.0870 0x1be8  [ 977603C51C997435D59ECFE7E24E0653, 32AB9BBFFEB73F5282848748B46584238BD1B812A1435F7759180D36B33FE806 ] vmickvpexchange C:\WINDOWS\System32\ICSvc.dll

14:37:00.0890 0x1be8  vmickvpexchange - ok

14:37:00.0899 0x1be8  [ 977603C51C997435D59ECFE7E24E0653, 32AB9BBFFEB73F5282848748B46584238BD1B812A1435F7759180D36B33FE806 ] vmicrdv         C:\WINDOWS\System32\ICSvc.dll

14:37:00.0919 0x1be8  vmicrdv - ok

14:37:00.0928 0x1be8  [ 977603C51C997435D59ECFE7E24E0653, 32AB9BBFFEB73F5282848748B46584238BD1B812A1435F7759180D36B33FE806 ] vmicshutdown    C:\WINDOWS\System32\ICSvc.dll

14:37:00.0948 0x1be8  vmicshutdown - ok

14:37:00.0957 0x1be8  [ 977603C51C997435D59ECFE7E24E0653, 32AB9BBFFEB73F5282848748B46584238BD1B812A1435F7759180D36B33FE806 ] vmictimesync    C:\WINDOWS\System32\ICSvc.dll

14:37:00.0977 0x1be8  vmictimesync - ok

14:37:00.0986 0x1be8  [ 977603C51C997435D59ECFE7E24E0653, 32AB9BBFFEB73F5282848748B46584238BD1B812A1435F7759180D36B33FE806 ] vmicvmsession   C:\WINDOWS\System32\ICSvc.dll

14:37:01.0006 0x1be8  vmicvmsession - ok

14:37:01.0015 0x1be8  [ 977603C51C997435D59ECFE7E24E0653, 32AB9BBFFEB73F5282848748B46584238BD1B812A1435F7759180D36B33FE806 ] vmicvss         C:\WINDOWS\System32\ICSvc.dll

14:37:01.0035 0x1be8  vmicvss - ok

14:37:01.0047 0x1be8  [ 91F165C5D71D9DCB18D4661CF10D1084, 1D55C1FF0F5D860E6DB60EEFE303C0797C98BB0B053ECC255F9B316872288818 ] volmgr          C:\WINDOWS\system32\drivers\volmgr.sys

14:37:01.0055 0x1be8  volmgr - ok

14:37:01.0064 0x1be8  [ 17042748AC05862A0283D32575220080, A85B480CB969CB7678545D2A9EE99CBD2ADFF210FA016A43E092D0711FBB633D ] volmgrx         C:\WINDOWS\system32\drivers\volmgrx.sys

14:37:01.0077 0x1be8  volmgrx - ok

14:37:01.0085 0x1be8  [ 823A237D871CD652C6BFD47BECB6810A, 99310521451CB54C29A5DEA54C3A666F95E2A1FF0979D5F9792885A161E90C65 ] volsnap         C:\WINDOWS\system32\drivers\volsnap.sys

14:37:01.0100 0x1be8  volsnap - ok

14:37:01.0109 0x1be8  [ 78727FA284C2095EED660D71CD3C9AEF, 323F0BD5A624DF77973F28C7CF31EC6B3A525496EBF063666623A62B1DB0EA65 ] vpci            C:\WINDOWS\System32\drivers\vpci.sys

14:37:01.0116 0x1be8  vpci - ok

14:37:01.0132 0x1be8  [ 2415961D561E02F5E46B7C1C687A6788, 68A54B9595A0D15D410D5F1656B6EBE3B913A4BA5F71C658C9B99420E6ED327A ] vsmraid         C:\WINDOWS\system32\drivers\vsmraid.sys

14:37:01.0141 0x1be8  vsmraid - ok

14:37:01.0177 0x1be8  [ 16419CBDB04DB9FF298169AA93413822, 743AD26F08AF5EFF5DD353E75C3D659B10C3FEC2FEDABB76387B87721B5B98F8 ] VSS             C:\WINDOWS\system32\vssvc.exe

14:37:01.0221 0x1be8  VSS - ok

14:37:01.0236 0x1be8  [ 6AE9A843AE979F2DCCA5A25C07C7A5F8, 3CEC26DE2EEC97929A0FBBD87FF75F8DC387C0988B2047074C8F069ACBEF2587 ] VSTXRAID        C:\WINDOWS\system32\drivers\vstxraid.sys

14:37:01.0248 0x1be8  VSTXRAID - ok

14:37:01.0268 0x1be8  [ BD232C761C59FA8D8EF626CA630E2D2E, E494EFDCE8F6343F49F33F1F03DCD5DEC9CB6F349B1AD302B4D3333B5F6BD8E5 ] vwifibus        C:\WINDOWS\System32\drivers\vwifibus.sys

14:37:01.0275 0x1be8  vwifibus - ok

14:37:01.0306 0x1be8  [ 3039687AB65CEE26CF478C1F42FFCD7D, 40E140C6F94B6203767A1493DF8CAE6BA1FB67FBD0C13789444F72410D0E6FF1 ] vwififlt        C:\WINDOWS\system32\drivers\vwififlt.sys

14:37:01.0317 0x1be8  vwififlt - ok

14:37:01.0355 0x1be8  [ EC9B6544C569E8D7FAB91772BD7D23F2, 06CC5F21E9A9DD35099CB3E44C3E2BF2F944CE5B71284E6A85E1B681F12BD31B ] W32Time         C:\WINDOWS\system32\w32time.dll

14:37:01.0379 0x1be8  W32Time - ok

14:37:01.0402 0x1be8  [ FC40A7527D39F06D032A6553D22E4BF6, F572FCB5EB3DE16FD6222A5B6A43C81E3A1F838890667D9F0453F82FFCA772FF ] WacomPen        C:\WINDOWS\System32\drivers\wacompen.sys

14:37:01.0411 0x1be8  WacomPen - ok

14:37:01.0438 0x1be8  [ 2CFE8CBE358CC4D5715E010E3B13559F, 54E9BFCE202FA123EB261C226094054950429AAFA304AA714F461B003E070BD9 ] WalletService   C:\WINDOWS\system32\WalletService.dll

14:37:01.0458 0x1be8  WalletService - ok

14:37:01.0469 0x1be8  [ E9E22E116F810DAC98C5EC207F24C916, C518DC57CECA5174E7695F5632555FA08571D5F3A7D6B0C295BA4221AEA67C04 ] wanarp          C:\WINDOWS\system32\DRIVERS\wanarp.sys

14:37:01.0480 0x1be8  wanarp - ok

14:37:01.0484 0x1be8  [ E9E22E116F810DAC98C5EC207F24C916, C518DC57CECA5174E7695F5632555FA08571D5F3A7D6B0C295BA4221AEA67C04 ] wanarpv6        C:\WINDOWS\system32\DRIVERS\wanarp.sys

14:37:01.0496 0x1be8  wanarpv6 - ok

14:37:01.0527 0x1be8  [ CF9EF65FA66B0F4982FD1FACAB3009B6, 681C1CD5DCAF87EF436B907534E98B0AB4F66BD62E46B8977A7880B854766A27 ] wbengine        C:\WINDOWS\system32\wbengine.exe

14:37:01.0573 0x1be8  wbengine - ok

14:37:01.0603 0x1be8  [ 8F2B0ED6FCA72B34BEEA37E32D0EE106, A86C641A13FDF056B7BA13641551582199DDB08E9490003C74D999518B097C00 ] WbioSrvc        C:\WINDOWS\System32\wbiosrvc.dll

14:37:01.0627 0x1be8  WbioSrvc - ok

14:37:01.0660 0x1be8  [ A40484AC27EE08DBE7F8DA5E1F6651ED, E3259694450C4F1DEC5E0EA5E23BF3A51F1819374DF47FECF70282AFD46114A1 ] Wcmsvc          C:\WINDOWS\System32\wcmsvc.dll

14:37:01.0685 0x1be8  Wcmsvc - ok

14:37:01.0705 0x1be8  [ 8E7FD07D2C82ACBCA52C4100C20F6542, FB2CD88557ABB5EBE6555CD4E41BF4BDC6FE6BCF26288338F2FB034B966FCBD3 ] wcncsvc         C:\WINDOWS\System32\wcncsvc.dll

14:37:01.0725 0x1be8  wcncsvc - ok

14:37:01.0734 0x1be8  [ 9C776ED423CD03F8ABD54C2557E34416, 282C1208977070EC0280D5ABA0E03A847AEAEE31F35CDAA3C7A02D8477614EB1 ] WcsPlugInService C:\WINDOWS\System32\WcsPlugInService.dll

14:37:01.0743 0x1be8  WcsPlugInService - ok

14:37:01.0829 0x1be8  [ C8BA574B3BA6AE88741AC86B1FE3C1DC, B2422CDE3A6A27B52D270D24298FF69D91D389C68456EC1805BA30AA59BAB839 ] WdBoot          C:\WINDOWS\system32\drivers\WdBoot.sys

14:37:01.0836 0x1be8  WdBoot - ok

14:37:01.0860 0x1be8  [ 927AD29D7F91B9A0C5294932374DA15E, ABB2722EF4153771D15683B5CE603D2B7D8A585357F64A3DC26114F37BE2906E ] Wdf01000        C:\WINDOWS\system32\drivers\Wdf01000.sys

14:37:01.0880 0x1be8  Wdf01000 - ok

14:37:01.0894 0x1be8  [ C5BB7C612B4C852836BEA39593BA5F46, 1E2B123F34500C2A8E983AAAF7F14E409B88DC396A655F19F3E7F15D0C51A762 ] WdFilter        C:\WINDOWS\system32\drivers\WdFilter.sys

14:37:01.0905 0x1be8  WdFilter - ok

14:37:01.0917 0x1be8  [ 9E0442D3880438D006D95C6F63C27274, DB1ED2BCF9986495EFA8A0B3B0156119F2E4F77AE9BDC6377ADF3A6B53C658F6 ] WdiServiceHost  C:\WINDOWS\system32\wdi.dll

14:37:01.0931 0x1be8  WdiServiceHost - ok

14:37:01.0935 0x1be8  [ 9E0442D3880438D006D95C6F63C27274, DB1ED2BCF9986495EFA8A0B3B0156119F2E4F77AE9BDC6377ADF3A6B53C658F6 ] WdiSystemHost   C:\WINDOWS\system32\wdi.dll

14:37:01.0949 0x1be8  WdiSystemHost - ok

14:37:01.0967 0x1be8  [ 9B2039C5673EEBF1D4E34ABC0AFB88C7, BBC85546BD86B9027426DAF148194CFE992B80FF89311B28BE0BD82C88630E8C ] wdiwifi         C:\WINDOWS\system32\DRIVERS\wdiwifi.sys

14:37:01.0992 0x1be8  wdiwifi - ok

14:37:02.0004 0x1be8  [ BD193A7BD34B2E829FAF56306FEE3B09, ADD746D198E21242CEFA01840952B792074EFC473113CD3E7F1ABBA6A4E26AF6 ] WdNisDrv        C:\WINDOWS\system32\Drivers\WdNisDrv.sys

14:37:02.0013 0x1be8  WdNisDrv - ok

14:37:02.0030 0x1be8  WdNisSvc - ok

14:37:02.0118 0x1be8  [ 6A3B5013D5C7840E8CABD63DD021C112, 371CCEEAC7816CFE79ACA8A218CDA16469D9567CB63CC9D18C55FF047011EF25 ] WebClient       C:\WINDOWS\System32\webclnt.dll

14:37:02.0136 0x1be8  WebClient - ok

14:37:02.0150 0x1be8  [ EED4043BC3C2D00067411730EE118354, 5E268DA4DB78C06D8F181E9408B4769F8A12C38DA52C1E986EE0CEE1101E9485 ] Wecsvc          C:\WINDOWS\system32\wecsvc.dll

14:37:02.0166 0x1be8  Wecsvc - ok

14:37:02.0171 0x1be8  [ 6ECD7A49AFC6533821BEEA1876CEB21D, 2E972245F56F589EF1AB9DABB9214B9DE6E290878735476323A3357D8CDFC71F ] WEPHOSTSVC      C:\WINDOWS\system32\wephostsvc.dll

14:37:02.0183 0x1be8  WEPHOSTSVC - ok

14:37:02.0193 0x1be8  [ 09B434867028AF4895A87959EA668686, 26A7DB82E42DCBF3A77092D58AC6392754FD7C538B9EAAEFA88E9AF81DFE8E96 ] wercplsupport   C:\WINDOWS\System32\wercplsupport.dll

14:37:02.0226 0x1be8  wercplsupport - ok

14:37:02.0246 0x1be8  [ DE4E417B867841EE55114E588098B8D5, 878708C93FC1D919E2B9E1C5F94A0EAFC5F28BDAA58D3F29DEEDC8EC3F72D9ED ] WerSvc          C:\WINDOWS\System32\WerSvc.dll

14:37:02.0261 0x1be8  WerSvc - ok

14:37:02.0263 0x1be8  wfpcapture - ok

14:37:02.0269 0x1be8  [ DBF5255B759212E5217A2748567A0B5C, 5E81A9289EC39702179038B686A35FADF9974651E74222F3354B4CBE919887B0 ] WFPLWFS         C:\WINDOWS\system32\drivers\wfplwfs.sys

14:37:02.0278 0x1be8  WFPLWFS - ok

14:37:02.0290 0x1be8  [ 4CD8826BB8320741842A9E53E48AF2BC, 97B22D9DCD0FD31D3A801946173369B0E70B1850576682C8A8180874A61CAD1A ] WiaRpc          C:\WINDOWS\System32\wiarpc.dll

14:37:02.0300 0x1be8  WiaRpc - ok

14:37:02.0320 0x1be8  [ 4375BCBA419D19695CF566082CEF27D3, 6F86FA14B41A03F2BA51B8702F3D59B85FD488405601FA177495E4B7C576850D ] WIMMount        C:\WINDOWS\system32\drivers\wimmount.sys

14:37:02.0327 0x1be8  WIMMount - ok

14:37:02.0329 0x1be8  WinDefend - ok

14:37:02.0336 0x1be8  [ 037BC6DE5F58D4A74A5BB0C12DCECDCA, 92921A2615A41C434BADEB33594DABC166FC9418FBD311A3B2022410B14BFDAC ] WindowsTrustedRT C:\WINDOWS\system32\drivers\WindowsTrustedRT.sys

14:37:02.0345 0x1be8  WindowsTrustedRT - ok

14:37:02.0358 0x1be8  [ 70BCD70BD53F2FE660ED94B025A043EB, B23B96DCAB30C62CB1651B3A2292155AEE8217CE3120574F5158D5E7DA09DE56 ] WindowsTrustedRTProxy C:\WINDOWS\system32\drivers\WindowsTrustedRTProxy.sys

14:37:02.0365 0x1be8  WindowsTrustedRTProxy - ok

14:37:02.0404 0x1be8  [ 8921ECEC2C7D1B1333D77325C60D3AEA, 67C6B6A92B34D99165B5591D0730322C31E967E599BA44924249BF5AD505C132 ] WinHttpAutoProxySvc C:\WINDOWS\system32\winhttp.dll

14:37:02.0434 0x1be8  WinHttpAutoProxySvc - ok

14:37:02.0457 0x1be8  [ 7792AE5403BF8975B6460DFC3428D129, D88F77E973D58C2CA629CC9249877A34ABF31CA1DC2A570666921A8A0DC8DEC7 ] WinMad          C:\WINDOWS\System32\drivers\winmad.sys

14:37:02.0464 0x1be8  WinMad - ok

14:37:02.0514 0x1be8  [ 73B5230F03DC7002A70F11EA1B0BAA37, DFE8BBE52B58589686E402ACED51021E298A491F907EBA5689DF9DAFC3002BA5 ] Winmgmt         C:\WINDOWS\system32\wbem\WMIsvc.dll

14:37:02.0527 0x1be8  Winmgmt - ok

14:37:02.0599 0x1be8  [ 2FE85D6AFF90F56A78743CC93B9CA684, B515765C4EE64E7EC16BD6AF037C084CCA6E81180AEF59E18F260406ABE6DF58 ] WinRM           C:\WINDOWS\system32\WsmSvc.dll

14:37:02.0672 0x1be8  WinRM - ok

14:37:02.0688 0x1be8  [ 811F30EB6EE8318C4171CB95AE30B9BD, 765F6BEA3D35D523B5D7ED7356EC0C97A48066A5C4D77C1E6EDAC6F220153385 ] WINUSB          C:\WINDOWS\System32\drivers\WinUSB.SYS

14:37:02.0698 0x1be8  WINUSB - ok

14:37:02.0712 0x1be8  [ DF00381AB8665D48DE3FF794BC6760AB, 749AC7048601061A34BFF507B574AF028FC662C0A98692E7331E667D105EC09D ] WinVerbs        C:\WINDOWS\System32\drivers\winverbs.sys

14:37:02.0720 0x1be8  WinVerbs - ok

14:37:02.0767 0x1be8  [ 3C096082A9232B7CEE4653B9C9031769, CFD4C7D0874097ED70735FD99206F21C12749B7956C4B5D4287F160EC6A21DCC ] WlanSvc         C:\WINDOWS\System32\wlansvc.dll

14:37:02.0830 0x1be8  WlanSvc - ok

14:37:02.0885 0x1be8  [ 0968D575D9108497A6DC37749D4A6C4F, 8BFEDBE642DA0FD8AC1E60180C192527F3D36E43089090A7BB6D8B27AB6E4F7F ] wlidsvc         C:\WINDOWS\system32\wlidsvc.dll

14:37:02.0946 0x1be8  wlidsvc - ok

14:37:02.0965 0x1be8  [ 623ED8E10DFEEAB7AE2CD11A0451DB79, 7DDE15F22FD24556D4765F6CFD0F8E2F27370A89A962919646DE2613B33D43D6 ] WmiAcpi         C:\WINDOWS\System32\drivers\wmiacpi.sys

14:37:02.0973 0x1be8  WmiAcpi - ok

14:37:03.0006 0x1be8  [ B2BB87531C4127ED4120E9BF5566827F, 1DDC0F00F215D77D3698F81B56D4488F384E9D017267840EDFA4846742B99B6A ] wmiApSrv        C:\WINDOWS\system32\wbem\WmiApSrv.exe

14:37:03.0019 0x1be8  wmiApSrv - ok

14:37:03.0039 0x1be8  WMPNetworkSvc - ok

14:37:03.0068 0x1be8  [ 78CA1FF6FE37EEFAFF99DD1C956AF60A, 883C7890C83BAB3B846A0C969D7B67031BD2EF65FA58A0620DD0CD1655C5B2C5 ] Wof             C:\WINDOWS\system32\drivers\Wof.sys

14:37:03.0079 0x1be8  Wof - ok

14:37:03.0140 0x1be8  [ C7503A49364DB2AF7A7DE177B233081F, 85DC6D8B5631E51FCF395A884F58571A96C8C55C38CA9ABEBD9C75BABAD21E38 ] workfolderssvc  C:\WINDOWS\system32\workfolderssvc.dll

14:37:03.0193 0x1be8  workfolderssvc - ok

14:37:03.0215 0x1be8  [ 388F2A3C771B8BEE76FD1AAF9614D08E, C064EC6136CC20C4EE19C86E91CA071974933BB52C9EF8521DF4AFD060FED4A2 ] wpcfltr         C:\WINDOWS\system32\DRIVERS\wpcfltr.sys

14:37:03.0223 0x1be8  wpcfltr - ok

14:37:03.0246 0x1be8  [ A6FCFE1F691B4A4D266F5D487FADB9FE, 2135D0C13C1295A2F76885E380CD72CB71CEB8E0D9F1C183A35935B27737D423 ] WPDBusEnum      C:\WINDOWS\system32\wpdbusenum.dll

14:37:03.0256 0x1be8  WPDBusEnum - ok

14:37:03.0276 0x1be8  [ 37DCE976B3935380F2F6E39ABB6BF40D, B14E875F6D6503DF0DB6D9D2363316073AEEF394D830EA2270A0DCDA56E1CEC4 ] WpdUpFltr       C:\WINDOWS\system32\drivers\WpdUpFltr.sys

14:37:03.0283 0x1be8  WpdUpFltr - ok

14:37:03.0295 0x1be8  [ 80F0154FD4293E562D54E97811E03499, EDE920F7F95EFBE542FE3CE066B6F7CDE3B9A37DDF3411DC86EACE9EEF294C1D ] WpnService      C:\WINDOWS\system32\WpnService.dll

14:37:03.0304 0x1be8  WpnService - ok

14:37:03.0333 0x1be8  [ 3CD22DD5A790CF7C24D65455E565EA83, 49DB06DF6F38940E7F8691C16586A78BB20E702FD48A34E50987C06B08BDF4DB ] ws2ifsl         C:\WINDOWS\system32\drivers\ws2ifsl.sys

14:37:03.0343 0x1be8  ws2ifsl - ok

14:37:03.0356 0x1be8  [ EBA916109A176714E6A7BD152387F13C, 7B38B1708B83271ADA8D1CEC7F5F0A75C7F2572185C0961EFC749D5DF16A03F0 ] wscsvc          C:\WINDOWS\System32\wscsvc.dll

14:37:03.0371 0x1be8  wscsvc - ok

14:37:03.0374 0x1be8  WSearch - ok

14:37:03.0448 0x1be8  [ 9EB85802AB625970E05879D15DE56335, B7DCE5E1924A5CEE76CC07FF3B8CEDBBD0DDBB4C4ED0A3BFB8D1ABCAD7C0AA23 ] WSService       C:\WINDOWS\System32\WSService.dll

14:37:03.0523 0x1be8  WSService - ok

14:37:03.0575 0x1be8  [ B70FF53144AC4B3C7D98BFB7D7C239BD, 996F6253F24C6D734B777988CDE03CD3A32FFBAD6D7A198F1C590B762CD8DC0E ] wuauserv        C:\WINDOWS\system32\wuaueng.dll

14:37:03.0643 0x1be8  wuauserv - ok

14:37:03.0652 0x1be8  [ 835F60262E7E310080EA05F6752BF248, 3010B731DF3D52B56EA16FD29B66F5D3AB9412E49CA4C547BAAECA3225C5DC40 ] WudfPf          C:\WINDOWS\system32\drivers\WudfPf.sys

14:37:03.0664 0x1be8  WudfPf - ok

14:37:03.0690 0x1be8  [ 4E848DE29E4279C7F25EF5B34ED94FDD, FD7B0673F4CFA6EB66D7212288223419BFFA02EBF1F1D85F155B5397C6FB21E9 ] WUDFRd          C:\WINDOWS\System32\drivers\WUDFRd.sys

14:37:03.0704 0x1be8  WUDFRd - ok

14:37:03.0721 0x1be8  [ 44CF3130AEC8914705487C4AEF756A19, 30B09E32DEC02141F9B99ED012E441056C1663A72E4130EF4221ECC0ED87BF4B ] wudfsvc         C:\WINDOWS\System32\WUDFSvc.dll

14:37:03.0733 0x1be8  wudfsvc - ok

14:37:03.0739 0x1be8  [ 4E848DE29E4279C7F25EF5B34ED94FDD, FD7B0673F4CFA6EB66D7212288223419BFFA02EBF1F1D85F155B5397C6FB21E9 ] WUDFWpdFs       C:\WINDOWS\system32\DRIVERS\WUDFRd.sys

14:37:03.0753 0x1be8  WUDFWpdFs - ok

14:37:03.0760 0x1be8  [ 4E848DE29E4279C7F25EF5B34ED94FDD, FD7B0673F4CFA6EB66D7212288223419BFFA02EBF1F1D85F155B5397C6FB21E9 ] WUDFWpdMtp      C:\WINDOWS\system32\DRIVERS\WUDFRd.sys

14:37:03.0773 0x1be8  WUDFWpdMtp - ok

14:37:03.0807 0x1be8  [ D23F211E1AA0787EFEC373D172D4A1C2, 6CCAB272D121C9946B2CF6B19F50E09946F0187713D54BFBD371B5C017367204 ] WwanSvc         C:\WINDOWS\System32\wwansvc.dll

14:37:03.0846 0x1be8  WwanSvc - ok

14:37:03.0873 0x1be8  [ 9BDC2AFCEF4CF1C630D728DE1DBD495A, 5CE19974380CCEC46C181315B349E9A7CE757E19118EC5978A2293D63268BA66 ] XblAuthManager  C:\WINDOWS\System32\XblAuthManager.dll

14:37:03.0906 0x1be8  XblAuthManager - ok

14:37:03.0935 0x1be8  [ 3EDB6162310EA223890C2DF44C68358B, 12053291809CA9C38A30EA4B2DE7115F535531F0925220C63B0312979F9CC707 ] XblGameSave     C:\WINDOWS\System32\XblGameSave.dll

14:37:03.0971 0x1be8  XblGameSave - ok

14:37:03.0985 0x1be8  [ 30021D1E0407B71E8D5D4F8DAE4E656A, EE2E366A1CC033C068176C7E9F876FFA0EF86A15A482B6964E170DE863CFF542 ] xboxgip         C:\WINDOWS\System32\drivers\xboxgip.sys

14:37:03.0997 0x1be8  xboxgip - ok

14:37:04.0035 0x1be8  [ 729B70C81F207541BC6A4ABAE3A8D594, 31F9BC41169D28B397C0D988C367C32FA9A95289E68AB8F38061DA478752A765 ] XboxNetApiSvc   C:\WINDOWS\system32\XboxNetApiSvc.dll

14:37:04.0068 0x1be8  XboxNetApiSvc - ok

14:37:04.0087 0x1be8  [ 6851673B90D8CB332439E0339F81A6B6, 4E95F1A63E6DD58BB5BD6FC1D9784837D5E6F5BCF870C7ECC92DCA1AF20B6A4C ] xinputhid       C:\WINDOWS\System32\drivers\xinputhid.sys

14:37:04.0095 0x1be8  xinputhid - ok

14:37:04.0099 0x1be8  ================ Scan global ===============================

14:37:04.0137 0x1be8  [ C6BC6E49A7F76AA2BBA58CD08196755F, D02B6B285899E966D19323566A4780D51303D00E66674D7FF4B61991430A69A6 ] C:\WINDOWS\system32\basesrv.dll

14:37:04.0160 0x1be8  [ 70EC9717DC3A1CDF79C703A145E0E5B7, D5ABF42063DFF799FD4099D8A347256CC79B89582B987B3DEE240AFA5BA421BE ] C:\WINDOWS\system32\winsrv.dll

14:37:04.0194 0x1be8  [ F435AFA375ACBAEE44324DD464EDCC11, 815DE470439AE5D96348BEBF971A14FBDCA1D36F31CA0D25F69E5F41817D43D5 ] C:\WINDOWS\system32\sxssrv.dll

14:37:04.0215 0x1be8  [ BB3D8E1C108F7244613FF3993291A922, 1642AF23F200D46F54239C3BA743F1D5ADDC6A32D5F6481264D0C1D7F3E9D533 ] C:\WINDOWS\system32\services.exe

14:37:04.0222 0x1be8  [ Global ] - ok

14:37:04.0222 0x1be8  ================ Scan MBR ==================================

14:37:04.0227 0x1be8  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0

14:37:04.0422 0x1be8  \Device\Harddisk0\DR0 - ok

14:37:04.0423 0x1be8  ================ Scan VBR ==================================

14:37:04.0424 0x1be8  [ 31194A5BC033113C8F2ADADC0B531DB0 ] \Device\Harddisk0\DR0\Partition1

14:37:04.0477 0x1be8  \Device\Harddisk0\DR0\Partition1 - ok

14:37:04.0479 0x1be8  [ 59D6649D13DE29A400A47EC9082AEEF3 ] \Device\Harddisk0\DR0\Partition2

14:37:04.0507 0x1be8  \Device\Harddisk0\DR0\Partition2 - ok

14:37:04.0509 0x1be8  [ 8C1F92150F3D5923FB61ED24811E5CE9 ] \Device\Harddisk0\DR0\Partition3

14:37:04.0559 0x1be8  \Device\Harddisk0\DR0\Partition3 - ok

14:37:04.0559 0x1be8  ================ Scan generic autorun ======================

14:37:04.0828 0x1be8  [ 324B8DDDF70D28B7A767E0608256DF36, 2FA4AA3F5E6D9C16A50F986027708AF657ADE9AE2A286E4F7686A1DF510FC2C1 ] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

14:37:05.0110 0x1be8  RtHDVCpl - ok

14:37:05.0168 0x1be8  [ 4A0477ADCD07EC9D21257A2E456B16C5, CEF9C81730C12283A7600C3D921D89A62B14D1C46544B493F3AF7520DD2D1F79 ] C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe

14:37:05.0179 0x1be8  IAStorIcon - detected UnsignedFile.Multi.Generic ( 1 )

14:37:07.0511 0x1be8  Detect skipped due to KSN trusted

14:37:07.0511 0x1be8  IAStorIcon - ok

14:37:07.0592 0x1be8  [ 9DFE8B0B6C982C31144CED1795304A60, DFE0253CD9DEE63D94F7538833048F48BFBDAC39B18A17F1CAE7413B94A8DE4D ] C:\Program Files\ASRock\XFast LAN\cFosSpeed.exe

14:37:07.0628 0x1be8  XFast LAN - ok

14:37:07.0664 0x1be8  [ 21D9910EF7EA9C58C8E31EE2C29D5F49, 7F68C168AA029B61810297F21D340B6756F4140642DAD0E3F2CA22AF525312EB ] C:\Program Files\iTunes\iTunesHelper.exe

14:37:07.0671 0x1be8  iTunesHelper - ok

14:37:07.0803 0x1be8  [ 4B6FB7DE94D91974950976108D2B837E, 8F6FD897DA2DE048020679AE1309922EC41DDA87FB57FB195292A2B8A73665A4 ] C:\Program Files (x86)\XFastUSB\XFastUsb.exe

14:37:07.0904 0x1be8  XFastUSB - ok

14:37:08.0101 0x1be8  [ EA4F9B19B3614349C79CC97DCA4C23A8, EC330F2E4F002FE450CDC1FC84AC0122C21C7912A483A99143450822004795E3 ] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe

14:37:08.0119 0x1be8  StartCCC - ok

14:37:08.0157 0x1be8  [ 36A6B9DF1A19D2007DC22A77C66E3764, DEA5AEC4DFD7AFD2F3BB455933A7AF97AA6027284940DF063793F989FDC31325 ] C:\Program Files (x86)\ROCCAT\Kone Pure Mouse\KonePureMonitor.EXE

14:37:08.0194 0x1be8  RoccatKonePure - detected UnsignedFile.Multi.Generic ( 1 )

14:37:10.0521 0x1be8  RoccatKonePure ( UnsignedFile.Multi.Generic ) - warning

14:37:12.0677 0x03d0  Object required for P2P: [ 7EBD20284AC9BF9F0A020B86769BB074 ] Tcpip

14:37:13.0041 0x1be8  [ 88F8A731DEA7F49D92F84A0A77C5CC67, 030458922DA43AAF6C95EC430860A73032616851E03E58170F71E918720717CB ] C:\Windows\SysWOW64\OneDriveSetup.exe

14:37:13.0216 0x1be8  OneDriveSetup - ok

14:37:13.0357 0x1be8  [ 88F8A731DEA7F49D92F84A0A77C5CC67, 030458922DA43AAF6C95EC430860A73032616851E03E58170F71E918720717CB ] C:\Windows\SysWOW64\OneDriveSetup.exe

14:37:13.0483 0x1be8  OneDriveSetup - ok

14:37:13.0625 0x1be8  [ 0BE64FAB577BFA54443C680343AEC85F, E734355E9D195A60C41CA17073F5F5E2FFED0314A00DE78F1208C15ACFE611CA ] C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

14:37:13.0656 0x1be8  GoogleChromeAutoLaunch_A5B343D047FD8BD2F268B0EA0F8DBD7C - ok

14:37:13.0807 0x1be8  [ D6E2ED7F1F7BE7CCB8676491BF950B57, CBF07EE746F2C27ACC532E83ADC43FBE954DC3C598C4333F13B1A7615AEA9AD5 ] C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe

14:37:13.0919 0x1be8  Akamai NetSession Interface - ok

14:37:14.0009 0x1be8  [ C3E6128725B7C509EB6742A6F2310576, C8348D91AF275185FE90BAB2315AC05B4009E36ECF321E5CECF34D1C3F8AC8B6 ] C:\Users\Admin\AppData\Roaming\Spotify\SpotifyWebHelper.exe

14:37:14.0050 0x1be8  Spotify Web Helper - ok

14:37:14.0108 0x1be8  [ 9F2ECA252720B25E8FEC1CAB2984B98D, 476EE2929901CD43F15869B763376393AA0942A3B934532055E037C6DCE3CD2D ] C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe

14:37:14.0124 0x1be8  OneDrive - ok

14:37:14.0274 0x1be8  [ 62A076C5767090FA3D5128735ADF2995, 2B68994E6BBCBE2EE90867E7C503433DF0C1D59C04DAD368122CC9FE9D7C30B1 ] C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

14:37:14.0427 0x1be8  Spotify - ok

14:37:14.0813 0x1be8  [ B05E1CE24CC555E189FCEB1AD07DFCED, 074E7F84C64B6BB54EE3F1BA4EF1804FA33A21ADB1E80904BF56706AA5EB457D ] C:\Program Files\CCleaner\CCleaner64.exe

14:37:14.0984 0x1be8  CCleaner Monitoring - ok

14:37:14.0989 0x1be8  Waiting for KSN requests completion. In queue: 147

14:37:15.0111 0x03d0  Object send P2P result: true

14:37:15.0112 0x03d0  Object required for P2P: [ 7EBD20284AC9BF9F0A020B86769BB074 ] Tcpip6

14:37:15.0991 0x1be8  Waiting for KSN requests completion. In queue: 146

14:37:16.0991 0x1be8  Waiting for KSN requests completion. In queue: 146

14:37:17.0514 0x03d0  Object send P2P result: true

14:37:17.0521 0x03d0  Object required for P2P: [ 0968D575D9108497A6DC37749D4A6C4F ] wlidsvc

14:37:17.0991 0x1be8  Waiting for KSN requests completion. In queue: 29

14:37:18.0992 0x1be8  Waiting for KSN requests completion. In queue: 29

14:37:19.0931 0x03d0  Object send P2P result: true

14:37:20.0004 0x1be8  AV detected via SS2: Windows Defender, C:\Program Files\Windows Defender\MSASCui.exe ( 4.8.10240.16384 ), 0x61100 ( enabled : updated )

14:37:20.0006 0x1be8  Win FW state via NFP2: enabled ( trusted )

14:37:22.0341 0x1be8  ============================================================

14:37:22.0341 0x1be8  Scan finished

14:37:22.0341 0x1be8  ============================================================

14:37:22.0347 0x0bfc  Detected object count: 2

14:37:22.0347 0x0bfc  Actual detected object count: 2

14:38:07.0205 0x0bfc  Service KMSELDI ( UnsignedFile.Multi.Generic ) - skipped by user

14:38:07.0206 0x0bfc  Service KMSELDI ( UnsignedFile.Multi.Generic ) - User select action: Skip 

14:38:07.0206 0x0bfc  RoccatKonePure ( UnsignedFile.Multi.Generic ) - skipped by user

14:38:07.0206 0x0bfc  RoccatKonePure ( UnsignedFile.Multi.Generic ) - User select action: Skip

:dankeschoen:

Mit freundlichen Grüßen,
Martin

M-K-D-B

06.11.2015 11:36

Servus,

wir beginnen erst einmal so:

Schritt 1
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 2
Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 3

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Schritt 4

Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Scan.
FRST erstellt nun zwei Logdateien (FRST.txt und Addition.txt).
Poste mir beide Logdateien mit deiner nächsten Antwort.

Bitte poste mit deiner nächsten Antwort

die Logdatei von AdwCleaner,
die Logdatei von MBAM,
die Logdatei von JRT,
die beiden neuen Logdateien von FRST.

Martiba

06.11.2015 12:55

Hallo!

Anbei erstmal die Logdatei vom AdwCleaner:

Code:

# AdwCleaner v5.018 - Bericht erstellt am 06/11/2015 um 12:07:38

# Aktualisiert am 05/11/2015 von Xplode

# Datenbank : 2015-11-03.2 [Server]

# Betriebssystem : Windows 10 Pro  (x64)

# Benutzername : Admin - PC

# Gestartet von : C:\Users\Admin\Downloads\AdwCleaner_5.018.exe

# Option : Löschen

# Unterstützung : hxxp://toolslib.net/forum
 

***** [ Dienste ] *****
 
 

***** [ Ordner ] *****
 

[-] Ordner Gelöscht : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcgcoifbkbphhjnekfkmohklfaimhikk
 

***** [ Dateien ] *****
 

[-] Datei Gelöscht : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_jcgcoifbkbphhjnekfkmohklfaimhikk_0.localstorage

[-] Datei Gelöscht : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_jcgcoifbkbphhjnekfkmohklfaimhikk_0.localstorage-journal

[-] Datei Gelöscht : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.pricepeep00.pricepeep.net_0.localstorage

[-] Datei Gelöscht : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.pricepeep00.pricepeep.net_0.localstorage-journal

[-] Datei Gelöscht : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_pstatic.bestpriceninja.com_0.localstorage

[-] Datei Gelöscht : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_pstatic.bestpriceninja.com_0.localstorage-journal
 

***** [ DLLs ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Aufgabenplanung ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 
 

***** [ Internetbrowser ] *****
 

[-] [C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Gelöscht : jcgcoifbkbphhjnekfkmohklfaimhikk
 

*************************
 

:: "Tracing" Schlüssel gelöscht

:: Proxy Einstellungen zurückgesetzt

:: Winsock Einstellungen zurückgesetzt

:: Chrome Richtlinien gelöscht
 

########## EOF - C:\AdwCleaner\AdwCleaner[C3].txt - [1994 Bytes] ##########

Die MBAM Logdatei:

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlaufdatum: 06.11.2015

Suchlaufzeit: 12:12

Protokolldatei: mbam.txt

Administrator: Ja
 

Version: 2.2.0.1024

Malware-Datenbank: v2015.11.06.03

Rootkit-Datenbank: v2015.11.04.02

Lizenz: Testversion

Malware-Schutz: Aktiviert

Schutz vor bösartigen Websites: Aktiviert

Selbstschutz: Deaktiviert
 

Betriebssystem: Windows 10

CPU: x64

Dateisystem: NTFS

Benutzer: Admin
 

Suchlauftyp: Bedrohungssuchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 368790

Abgelaufene Zeit: 14 Min., 32 Sek.
 

Speicher: Aktiviert

Start: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Deaktiviert

Heuristik: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(keine bösartigen Elemente erkannt)
 

Module: 0

(keine bösartigen Elemente erkannt)
 

Registrierungsschlüssel: 11

PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\temp_813a5cd0-04f6-4ddb-a269-e350a08d2cae-10_user, Löschen bei Neustart, [814acfabe8a342f461e7293add26f60a], 

PUP.Optional.FasterSearch, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\uhy3013, Löschen bei Neustart, [e3e83e3c0b80989edb1308c63fc49c64], 

PUP.Optional.MyBrowser, HKLM\SOFTWARE\WOW6432NODE\MyBrowser, In Quarantäne, [5d6e7efc711acb6b4fa3d8c3ca3908f8], 

PUP.Optional.SwiftSearch, HKLM\SOFTWARE\WOW6432NODE\SwiftSearch_1.10.0.25, In Quarantäne, [dcef86f4a4e7f1459750f19c1de64cb4], 

PUP.Optional.CinemaPlus, HKU\S-1-5-18\SOFTWARE\CinemaPlus_1.3dV04.11-nv, In Quarantäne, [b21957230c7f3ef84c3c352753b04fb1], 

PUP.Optional.CinemaPlus, HKU\S-1-5-18\SOFTWARE\CinemaPlus_1.3dV04.11-nv-ie, In Quarantäne, [ccffabcf7516c076078177e524df4cb4], 

PUP.Optional.CinePlus, HKU\S-1-5-18\SOFTWARE\CinePlus-1.44V04.11-nv, In Quarantäne, [f7d4a3d777149b9b5e8f015b27dcc040], 

PUP.Optional.CinePlus, HKU\S-1-5-18\SOFTWARE\CinePlus-1.44V04.11-nv-ie, In Quarantäne, [18b3a1d9f99242f46489510b3ec5847c], 

PUP.Optional.CinemaPlus, HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\CinemaPlus_1.3dV04.11-nv-ie, In Quarantäne, [a9224238098292a41375500ccb38a957], 

PUP.Optional.CinePlus, HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\CinePlus-1.44V04.11-nv-ie, In Quarantäne, [745793e7bfcc1e18e30a134904ff33cd], 

PUP.Optional.MyBrowser, HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\MyBrowser, In Quarantäne, [3992dd9dbdce56e0c98ea4f8b2519070], 
 

Registrierungswerte: 0

(keine bösartigen Elemente erkannt)
 

Registrierungsdaten: 0

(keine bösartigen Elemente erkannt)
 

Ordner: 3

PUP.Optional.GlobalUpdate, C:\Users\Admin\AppData\Local\Temp\comh.360610, In Quarantäne, [d6f59ae04b40290d72edadb4aa5806fa], 

PUP.Optional.GlobalUpdate, C:\Users\Admin\AppData\Local\Temp\comh.442473, In Quarantäne, [913a4e2c7813c76f17481b46748e2fd1], 

PUP.Optional.MBot, C:\Program Files (x86)\mbot_de_014010136, In Quarantäne, [a9229ae0a4e773c315aee77ea75be719], 
 

Dateien: 50

PUP.Optional.CrossRider, C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe, In Quarantäne, [8e3dd2a8533857df7856e145ee1323dd], 

PUP.Optional.CrossRider, C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe, In Quarantäne, [ac1ff7839fec0b2bb8165fc7ee1304fc], 

PUP.Optional.CrossBrowse, C:\Users\Admin\AppData\Local\Temp\225.exe, In Quarantäne, [5f6cec8e95f6ee48d7f578aeaf52d52b], 

PUP.Optional.MyBrowser, C:\Users\Admin\AppData\Local\Temp\4156.exe, In Quarantäne, [52792852c6c500363b2b174ce81cc53b], 

PUP.Optional.BonDon, C:\Users\Admin\AppData\Local\Temp\mytmpinstaller.exe, In Quarantäne, [1ead03778605c670ae6994b2b24f5aa6], 

PUP.Optional.ConvertAd, C:\Users\Admin\AppData\Local\Temp\nsa22EC.tmp, In Quarantäne, [98334436b2d946f02c070ee51ce54eb2], 

PUP.Optional.NoteUp, C:\Users\Admin\AppData\Local\Temp\nsl8B9B.tmp, In Quarantäne, [7a511466602b71c5a562b1a11ee3e917], 

PUP.Optional.CrossRider, C:\Users\Admin\AppData\Local\Temp\9768.exe, In Quarantäne, [0cbf95e57318c670b5d36dfb40c48878], 

PUP.Optional.Amonetize, C:\Users\Admin\AppData\Local\Temp\HarryPotterAndTheOrderOfThePhoenixGame__11652_il54233.exe, In Quarantäne, [b5166d0d33587eb8d3cce88ede23619f], 

PUP.Optional.MyStartSearch.ShrtCln, C:\Users\Admin\AppData\Local\Temp\f9626892-7a78-3199-abd2-97bbce96297b\adv_76.exe, In Quarantäne, [75560d6d63280b2b82fcee7342c2d52b], 

PUP.Optional.SwiftSearch, C:\Users\Admin\AppData\Local\Temp\is-1QRA7.tmp\465.exe, In Quarantäne, [04c7a4d65c2fcf67d19da6c36f9501ff], 

PUP.Optional.Amonetize, C:\Users\Admin\AppData\Local\Temp\Rar$EXa0.430\HarryPotterAndTheOrderOfThePhoenixGame__11652_il54233.exe, In Quarantäne, [62698eec5239b086326d5a1c7190cc34], 

PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.360610\globalupdate.exe, In Quarantäne, [517a710929620b2ba7263bb41de34db3], 

PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.360610\globalupdateBroker.exe, In Quarantäne, [99327cfe4843c17537966a8524dc748c], 

PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.360610\globalupdateCrashHandler.exe, In Quarantäne, [7f4c403a147739fdffce88678878af51], 

PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.360610\globalupdateOnDemand.exe, In Quarantäne, [e8e34a30f99256e0f8d578773ac67987], 

PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.360610\goopdate.dll, In Quarantäne, [d3f898e2e9a2dc5afdd0b73826dadc24], 

PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.360610\goopdateres_en.dll, In Quarantäne, [85467dfd2566ee48af1e9956a06044bc], 

PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.360610\npglobalupdateUpdate4.dll, In Quarantäne, [e8e391e9fe8d2d090cc10ee19d63eb15], 

PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.360610\psmachine.dll, In Quarantäne, [5c6fc5b5216a94a2cd00cb242dd3dc24], 

PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.360610\psuser.dll, In Quarantäne, [d9f213676526fd3915b815da9f615fa1], 

PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.442473\globalupdate.exe, In Quarantäne, [993232487e0dcf67dfee707fef11a25e], 

PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.442473\globalupdateBroker.exe, In Quarantäne, [62699edce2a93ff7438af7f82ad6cf31], 

PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.442473\globalupdateCrashHandler.exe, In Quarantäne, [9f2cc4b6dbb077bf814c0be4c33dd22e], 

PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.442473\globalupdateOnDemand.exe, In Quarantäne, [4784e8923556989ed3fa678808f8f808], 

PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.442473\goopdate.dll, In Quarantäne, [b5162b4f6b20cb6b5c717d72887860a0], 

PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.442473\goopdateres_en.dll, In Quarantäne, [01cabfbb7b102016e0ed509fc63a1ae6], 

PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.442473\npglobalupdateUpdate4.dll, In Quarantäne, [dcef6812f5961e18e1ec757afd032cd4], 

PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.442473\psmachine.dll, In Quarantäne, [39927208e9a29e9803ca5e9101ff738d], 

PUP.Optional.ModGoog, C:\Users\Admin\AppData\Local\Temp\comh.442473\psuser.dll, In Quarantäne, [3a9196e4e8a3e353e2eb727d05fbe818], 

PUP.Optional.EoRezo, C:\Users\Admin\AppData\Local\Temp\is-E6IQG.tmp\643.exe, In Quarantäne, [f2d9d2a87912e0569bcec85fe21f17e9], 

PUP.Optional.EoRezo, C:\Users\Admin\AppData\Local\Temp\is-LQGHH.tmp\465.exe, In Quarantäne, [369517635c2fe6508bde0c1b778a40c0], 

PUP.Optional.EoRezo, C:\Users\Admin\AppData\Local\Temp\is-LQGHH.tmp\package_SByoutube_installer_multilang.exe, In Quarantäne, [0cbfa6d4602bf343d693e83f1be6c937], 

Adware.FakeAV, C:\Users\Admin\Downloads\Gimp_Downloader.exe, In Quarantäne, [597271095437da5c54a1cd73b74a7090], 

PUP.Optional.ABengine, C:\Users\Admin\AppData\Local\Temp\lengine.ini.log, In Quarantäne, [725911696d1e23130fec99ba2bd842be], 

PUP.Optional.ABengine, C:\Windows\Temp\lengine.ini.log, In Quarantäne, [15b6601aa3e8c571bc3f73e0966d669a], 

PUP.Optional.Acengine, C:\Users\Admin\AppData\Local\Temp\acengine.log, In Quarantäne, [e4e765159dee30069372193bdb28e21e], 

PUP.Optional.Acengine, C:\Windows\Temp\acengine.log, In Quarantäne, [408b1367a2e937ff0500df7526dd6a96], 

PUP.Optional.CrossRider, C:\Windows\System32\Tasks\temp_813a5cd0-04f6-4ddb-a269-e350a08d2cae-10_user, In Quarantäne, [8f3c05753e4d221456a07be6d42fa65a], 

PUP.Optional.CrossRider, C:\Windows\Tasks\temp_813a5cd0-04f6-4ddb-a269-e350a08d2cae-10_user.job, In Quarantäne, [98339cde206b53e3a94ef36e3bc821df], 

PUP.Optional.Vitruvian, C:\Users\Admin\AppData\Local\Temp\vitruvian-installer-hardwareprofile-v0001, In Quarantäne, [5774acce0d7ea88eb56dcec546bdf20e], 

PUP.Optional.Vitruvian, C:\Users\Admin\AppData\Local\Temp\vitruvian-installer-install-v0003, In Quarantäne, [00cb542617748ea872b06b281ae9d52b], 

PUP.Optional.Vitruvian, C:\Users\Admin\AppData\Local\Temp\vitruvian-installer-processes-v0002, In Quarantäne, [6269a7d38b0059dd47db7e1538cb12ee], 

PUP.Optional.Vitruvian, C:\Users\Admin\AppData\Local\Temp\vitruvian-installer-scheduledtasks-v0001, In Quarantäne, [8d3ed6a4543740f64cd6761df70c2ad6], 

PUP.Optional.Vitruvian, C:\Users\Admin\AppData\Local\Temp\vitruvian-installer-uninstall-v0002, In Quarantäne, [66653941b0dbd561e43ef2a12bd8c43c], 

PUP.Optional.ReMarkit.PrxySvrRST, C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.re-markit00.re-markit.co_0.localstorage, In Quarantäne, [329980fa4645eb4bffb1e9b862a107f9], 

PUP.Optional.ReMarkit.PrxySvrRST, C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.re-markit00.re-markit.co_0.localstorage-journal, In Quarantäne, [8c3f324814776acce4cceab7aa5922de], 

PUP.Optional.FasterSearch, C:\Windows\System32\Tasks\uhy3013, In Quarantäne, [6a611f5b216a7eb8ea0266681ee52ed2], 

PUP.Optional.GlobalUpdate, C:\Users\Admin\AppData\Local\Temp\comh.360610\globalupdateHelper.msi, In Quarantäne, [d6f59ae04b40290d72edadb4aa5806fa], 

PUP.Optional.GlobalUpdate, C:\Users\Admin\AppData\Local\Temp\comh.442473\globalupdateHelper.msi, In Quarantäne, [913a4e2c7813c76f17481b46748e2fd1], 
 

Physische Sektoren: 0

(keine bösartigen Elemente erkannt)
 
 

(end)

Die Logdatei vom JRT:

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Malwarebytes

Version: 7.6.4 (09.28.2015:1)

OS: Windows 10 Pro x64

Ran by Admin on 06.11.2015 at 12:44:10,93

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Tasks
 
 
 

~~~ Registry Values
 

Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_A5B343D047FD8BD2F268B0EA0F8DBD7C
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 
 
 

~~~ Folders
 

Successfully deleted: [Folder] C:\users\Public\Documents\guid
 
 
 

~~~ Chrome
 
 

[C:\Users\Admin\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset
 

[C:\Users\Admin\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:
 

[C:\Users\Admin\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset
 

[C:\Users\Admin\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:

[]
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 06.11.2015 at 12:46:27,95

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

und die beiden Logdateien vom FRST:

FRST:

Code:

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:05-11-2015

durchgeführt von Admin (Administrator) auf PC (06-11-2015 12:50:47)

Gestartet von C:\Users\Admin\Desktop

Geladene Profile: Admin (Verfügbare Profile: Admin)

Platform: Windows 10 Pro (X64) Sprache: Deutsch (Deutschland)

Internet Explorer Version 11 (Standard-Browser: Edge)

Start-Modus: Normal

Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Prozesse (Nicht auf der Ausnahmeliste) =================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
 

(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe

(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe

(Microsoft Corporation) C:\Windows\System32\browser_broker.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
 
 

==================== Registry (Nicht auf der Ausnahmeliste) ===========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13636824 2013-07-26] (Realtek Semiconductor)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)

HKLM\...\Run: [XFast LAN] => C:\Program Files\ASRock\XFast LAN\cFosSpeed.exe [2009952 2013-05-31] (cFos Software GmbH)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169744 2015-09-12] (Apple Inc.)

HKLM-x32\...\Run: [XFastUSB] => C:\Program Files (x86)\XFastUSB\XFastUsb.exe [6311104 2014-12-15] (FNet Co., Ltd.)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-21] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [RoccatKonePure] => C:\Program Files (x86)\ROCCAT\Kone Pure Mouse\KonePureMonitor.EXE [561152 2014-01-20] (ROCCAT GmbH)

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.)

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Spotify Web Helper] => C:\Users\Admin\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2021944 2015-06-17] (Spotify Ltd)

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Spotify] => C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe [7323192 2015-06-17] (Spotify Ltd)

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8551848 2015-10-19] (Piriform Ltd)

HKU\S-1-5-18\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [43816 2015-04-26] (Apple Inc.)

Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2015-11-06]

ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation)
 

==================== Internet (Nicht auf der Ausnahmeliste) ====================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
 

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

Tcpip\..\Interfaces\{947ba08f-6d7e-4686-b9ff-2806db41b1ff}: [DhcpNameServer] 192.168.0.1
 

Internet Explorer:

==================

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com

BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-09-29] (Microsoft Corporation)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-25] (Google Inc.)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-15] (Microsoft Corporation)

BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-09-29] (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-21] (Oracle Corporation)

BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-25] (Google Inc.)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-15] (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-21] (Oracle Corporation)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-25] (Google Inc.)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-25] (Google Inc.)

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-10-14] (Microsoft Corporation)
 

FireFox:

========

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-09-04] ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-03] (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-03] (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-21] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-21] (Oracle Corporation)

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-03-31] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-19] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-19] (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-09-27] (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-03-31] (Microsoft Corporation)
 

Chrome: 

=======

CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-05]

CHR Extension: (Google Drive) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-23]

CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24]

CHR Extension: (Google-Suche) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-28]

CHR Extension: (LoungeDestroyer) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghahcnmfjfckcedfajbhekgknjdplfcl [2015-10-07]

CHR Extension: (Google Text & Tabellen Offline) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-03]

CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-25]

CHR Extension: (Google Mail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-29]
 

==================== Dienste (Nicht auf der Ausnahmeliste) ========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-09-02] (Apple Inc.)

S2 ASRockIOMon; C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe [454656 2013-05-28] () [Datei ist nicht signiert]

S2 cFosSpeedS; C:\Program Files\ASRock\XFast LAN\spd.exe [652640 2013-05-31] (cFos Software GmbH)

S3 Futuremark SystemInfo Service; C:\Program Files (x86)\Futuremark\SystemInfo\FMSISvc.exe [614624 2014-12-10] (Futuremark)

R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)

R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [Datei ist nicht signiert]

S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)

S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-03] (Intel Corporation)

S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-03] (Intel Corporation)

S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes)

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)

S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [966336 2014-10-10] (@ByELDI) [Datei ist nicht signiert]

R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation)
 

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.)

S3 AsrDrv101; C:\Windows\SysWOW64\Drivers\AsrDrv101.sys [22280 2014-12-16] (ASRock Incorporation)

R0 AsrRamDisk; C:\Windows\System32\drivers\AsrRamDisk.sys [40200 2013-05-09] (ASRock Inc.)

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [102912 2015-07-15] (Advanced Micro Devices)

S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)

S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)

R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [16648 2014-12-15] (FNet Co., Ltd.)

R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)

R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2015-11-06] (Malwarebytes)

R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)

R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-03] (Intel Corporation)

R3 sthid; C:\Windows\System32\drivers\sthid.sys [21216 2014-08-06] (Splashtop Inc.)

S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] ()

S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-07-10] (Microsoft Corporation)

R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [291680 2015-07-10] (Microsoft Corporation)

R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation)

S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]
 

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
 

==================== Ein Monat: Erstellte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2015-11-06 12:50 - 2015-11-06 12:50 - 00000000 ____D C:\Users\Admin\Desktop\FRST-OlderVersion

2015-11-06 12:46 - 2015-11-06 12:46 - 00001283 _____ C:\Users\Admin\Desktop\JRT.txt

2015-11-06 12:43 - 2015-11-06 12:43 - 01798976 _____ (Malwarebytes) C:\Users\Admin\Desktop\JRT.exe

2015-11-06 12:43 - 2015-11-06 12:43 - 00010166 _____ C:\Users\Admin\Desktop\mbam.txt

2015-11-06 12:38 - 2015-11-06 12:38 - 00016148 _____ C:\WINDOWS\system32\PC_Admin_HistoryPrediction.bin

2015-11-06 12:12 - 2015-11-06 12:39 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2015-11-06 12:11 - 2015-11-06 12:37 - 00001169 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-11-06 12:11 - 2015-11-06 12:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-11-06 12:11 - 2015-11-06 12:11 - 00000000 ____D C:\ProgramData\Malwarebytes

2015-11-06 12:11 - 2015-11-06 12:11 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-11-06 12:11 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2015-11-06 12:11 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys

2015-11-06 12:11 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys

2015-11-06 12:10 - 2015-11-06 12:11 - 22908888 _____ (Malwarebytes ) C:\Users\Admin\Downloads\mbam-setup-2.2.0.1024.exe

2015-11-06 12:09 - 2015-11-06 12:09 - 00002073 _____ C:\Users\Admin\Desktop\AdwCleaner[C3].txt

2015-11-06 12:08 - 2015-11-06 12:38 - 00014854 _____ C:\WINDOWS\PFRO.log

2015-11-06 12:05 - 2015-11-06 12:05 - 01713664 _____ C:\Users\Admin\Downloads\AdwCleaner_5.018.exe

2015-11-05 14:32 - 2015-11-06 12:51 - 00014435 _____ C:\Users\Admin\Desktop\FRST.txt

2015-11-05 14:31 - 2015-11-05 14:31 - 04404952 _____ (Kaspersky Lab ZAO) C:\Users\Admin\Desktop\tdsskiller.exe

2015-11-05 14:30 - 2015-11-06 12:50 - 02198528 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe

2015-11-05 14:30 - 2015-11-06 12:50 - 00000000 ____D C:\FRST

2015-11-05 14:13 - 2015-11-05 14:13 - 04944608 _____ (Advanced Micro Devices, Inc.) C:\Users\Admin\Downloads\autodetectutility.exe

2015-11-05 14:00 - 2015-11-05 14:00 - 00000000 ___HD C:\OneDriveTemp

2015-11-05 12:12 - 2015-11-05 12:12 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (3).exe

2015-11-04 17:15 - 2015-11-04 17:15 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (2).exe

2015-11-04 17:08 - 2015-11-06 12:07 - 00000000 ____D C:\AdwCleaner

2015-11-04 17:08 - 2015-11-04 17:08 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (1).exe

2015-11-04 16:49 - 2015-11-06 12:38 - 00000275 _____ C:\WINDOWS\WindowsUpdate.log

2015-11-04 16:49 - 2015-11-04 16:49 - 00000000 ____D C:\$SysReset

2015-11-04 16:34 - 2015-11-06 12:37 - 00000901 _____ C:\Users\Public\Desktop\CCleaner.lnk

2015-11-04 16:34 - 2015-11-04 16:34 - 00002844 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC

2015-11-04 16:34 - 2015-11-04 16:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

2015-11-04 16:34 - 2015-11-04 16:34 - 00000000 ____D C:\Program Files\CCleaner

2015-11-04 16:33 - 2015-11-04 16:34 - 05524624 _____ (Piriform Ltd) C:\Users\Admin\Downloads\ccsetup511_slim.exe

2015-11-04 16:14 - 2015-11-04 16:23 - 00000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job

2015-11-04 16:13 - 2015-11-04 16:13 - 00000000 ____D C:\WINDOWS\pss

2015-11-04 16:07 - 2015-11-04 16:07 - 00003380 _____ C:\WINDOWS\System32\Tasks\{6761BBC9-893A-456B-822C-C0DF98AE0062}

2015-11-04 15:21 - 2015-11-06 12:39 - 00001004 _____ C:\WINDOWS\Tasks\28Arly8BQ3IUn.job

2015-11-04 15:21 - 2015-11-04 15:21 - 00004136 _____ C:\WINDOWS\System32\Tasks\28Arly8BQ3IUn

2015-11-04 15:19 - 2015-11-06 12:39 - 00001014 _____ C:\WINDOWS\Tasks\bSUwmicbiyVJJ5rnrs.job

2015-11-04 15:19 - 2015-11-04 15:19 - 00004156 _____ C:\WINDOWS\System32\Tasks\bSUwmicbiyVJJ5rnrs

2015-11-04 15:17 - 2015-11-04 16:00 - 00000004 _____ C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7

2015-11-04 15:17 - 2013-08-22 14:25 - 00000824 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak

2015-11-04 15:16 - 2015-11-04 15:16 - 00000000 ____D C:\Users\Public\Documents\Baidu

2015-11-04 15:15 - 2015-11-04 15:39 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Opera Software

2015-11-04 15:15 - 2015-11-04 15:39 - 00000000 ____D C:\Users\Admin\AppData\Local\Opera Software

2015-11-04 15:12 - 2015-11-04 15:39 - 00000000 ____D C:\Program Files (x86)\Opera

2015-10-30 17:15 - 2015-10-30 17:15 - 00000000 ____D C:\ProgramData\ROCCAT

2015-10-30 17:15 - 2015-10-30 17:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ROCCAT

2015-10-30 17:14 - 2015-10-30 17:14 - 24907859 _____ C:\Users\Admin\Downloads\ROCCAT_Kone_Pure_DRV1.14_FW1.21.zip

2015-10-30 17:14 - 2015-10-30 17:14 - 00000000 ____D C:\Program Files (x86)\ROCCAT

2015-10-30 17:14 - 2014-01-20 10:53 - 73113600 _____ (ROCCAT GmbH) C:\Users\Admin\Desktop\KonePureOption.exe

2015-10-30 17:13 - 2015-10-28 00:38 - 21871616 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll

2015-10-30 17:13 - 2015-10-28 00:16 - 18801664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll

2015-10-30 17:13 - 2015-10-21 13:45 - 00541024 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcupdate_GenuineIntel.dll

2015-10-30 17:13 - 2015-10-21 13:44 - 00459104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys

2015-10-30 17:13 - 2015-10-21 13:43 - 01392480 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll

2015-10-30 17:13 - 2015-10-21 13:39 - 03621248 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2015-10-30 17:13 - 2015-10-21 13:00 - 24595968 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2015-10-30 17:13 - 2015-10-21 13:00 - 03248128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll

2015-10-30 17:13 - 2015-10-21 12:59 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll

2015-10-30 17:13 - 2015-10-21 12:57 - 02418688 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll

2015-10-30 17:13 - 2015-10-21 12:52 - 02987520 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll

2015-10-30 17:13 - 2015-10-21 12:50 - 00333312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll

2015-10-30 17:13 - 2015-10-21 12:48 - 01068032 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll

2015-10-30 17:13 - 2015-10-21 12:47 - 00453120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Usb.dll

2015-10-30 17:13 - 2015-10-21 12:46 - 02179584 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll

2015-10-30 17:13 - 2015-10-21 12:46 - 01602560 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2015-10-30 17:13 - 2015-10-21 12:44 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll

2015-10-30 17:13 - 2015-10-21 12:44 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe

2015-10-30 17:13 - 2015-10-21 12:43 - 02675200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll

2015-10-30 17:13 - 2015-10-21 12:42 - 00627712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll

2015-10-30 17:13 - 2015-10-21 12:41 - 01795072 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll

2015-10-30 17:13 - 2015-10-21 12:40 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll

2015-10-30 17:13 - 2015-10-21 12:38 - 00502272 _____ (Microsoft Corporation) C:\WINDOWS\system32\dlnashext.dll

2015-10-30 17:13 - 2015-10-21 06:53 - 00961376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll

2015-10-30 17:13 - 2015-10-21 06:49 - 02878512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2015-10-30 17:13 - 2015-10-21 06:13 - 19326464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2015-10-30 17:13 - 2015-10-21 06:11 - 02647040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll

2015-10-30 17:13 - 2015-10-21 06:08 - 01918976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll

2015-10-30 17:13 - 2015-10-21 06:05 - 02639872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll

2015-10-30 17:13 - 2015-10-21 06:03 - 01380864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2015-10-30 17:13 - 2015-10-21 06:03 - 00311296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Usb.dll

2015-10-30 17:13 - 2015-10-21 05:58 - 02049536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepository.dll

2015-10-30 17:13 - 2015-10-21 05:58 - 00464896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll

2015-10-30 17:13 - 2015-10-21 05:55 - 00441344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dlnashext.dll

2015-10-26 19:45 - 2015-10-26 19:45 - 00014336 _____ C:\Users\Admin\Downloads\wenn-2.xls

2015-10-26 19:38 - 2015-10-26 19:38 - 03135063 _____ C:\Users\Admin\Downloads\Pruefung_1_Jugendarbeitsschutzgesetz_.zip

2015-10-17 13:48 - 2015-10-10 08:12 - 00078528 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll

2015-10-17 13:48 - 2015-10-06 04:03 - 16708608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll

2015-10-17 13:48 - 2015-10-06 03:46 - 13027840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll

2015-10-17 13:48 - 2015-10-01 05:01 - 01294352 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi

2015-10-17 13:48 - 2015-10-01 05:01 - 01123400 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe

2015-10-17 13:48 - 2015-10-01 05:01 - 01018568 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi

2015-10-17 13:48 - 2015-10-01 05:01 - 00858408 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe

2015-10-17 13:48 - 2015-10-01 05:00 - 08020320 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2015-10-17 13:48 - 2015-10-01 04:03 - 00757760 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll

2015-10-17 13:48 - 2015-09-25 05:01 - 02573768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll

2015-10-17 13:48 - 2015-09-25 05:01 - 00498016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys

2015-10-17 13:48 - 2015-09-25 04:56 - 22322624 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2015-10-17 13:48 - 2015-09-25 04:52 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi

2015-10-17 13:48 - 2015-09-25 04:33 - 01997336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll

2015-10-17 13:48 - 2015-09-25 04:26 - 20858360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2015-10-17 13:48 - 2015-09-25 04:11 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataAccountApis.dll

2015-10-17 13:48 - 2015-09-25 04:11 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneCallHistoryApis.dll

2015-10-17 13:48 - 2015-09-25 04:09 - 12504064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2015-10-17 13:48 - 2015-09-25 04:07 - 01276416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll

2015-10-17 13:48 - 2015-09-25 04:04 - 00826880 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll

2015-10-17 13:48 - 2015-09-25 04:04 - 00771072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll

2015-10-17 13:48 - 2015-09-25 04:03 - 00796160 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll

2015-10-17 13:48 - 2015-09-25 04:03 - 00576000 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll

2015-10-17 13:48 - 2015-09-25 04:02 - 07523840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll

2015-10-17 13:48 - 2015-09-25 04:02 - 00949248 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll

2015-10-17 13:48 - 2015-09-25 04:02 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll

2015-10-17 13:48 - 2015-09-25 04:01 - 04792320 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2015-10-17 13:48 - 2015-09-25 04:01 - 03586560 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys

2015-10-17 13:48 - 2015-09-25 04:00 - 01423872 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll

2015-10-17 13:48 - 2015-09-25 04:00 - 01382400 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys

2015-10-17 13:48 - 2015-09-25 04:00 - 00856576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContactApis.dll

2015-10-17 13:48 - 2015-09-25 04:00 - 00752640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChatApis.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 01205248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\EmailApis.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 00685568 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppointmentApis.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\MessagingDataModel2.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 00288256 _____ (Microsoft Corporation) C:\WINDOWS\system32\PimIndexMaintenance.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\CallHistoryClient.dll

2015-10-17 13:48 - 2015-09-25 03:58 - 01871360 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll

2015-10-17 13:48 - 2015-09-25 03:47 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll

2015-10-17 13:48 - 2015-09-25 03:47 - 00172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhoneCallHistoryApis.dll

2015-10-17 13:48 - 2015-09-25 03:38 - 03580416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2015-10-17 13:48 - 2015-09-25 03:38 - 00650240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll

2015-10-17 13:48 - 2015-09-25 03:38 - 00574464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll

2015-10-17 13:48 - 2015-09-25 03:38 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll

2015-10-17 13:48 - 2015-09-25 03:37 - 00766976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll

2015-10-17 13:48 - 2015-09-25 03:37 - 00613376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll

2015-10-17 13:48 - 2015-09-25 03:37 - 00480256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll

2015-10-17 13:48 - 2015-09-25 03:36 - 11262976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2015-10-17 13:48 - 2015-09-25 03:36 - 05454848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll

2015-10-17 13:48 - 2015-09-25 03:34 - 00928256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll

2015-10-17 13:48 - 2015-09-25 03:34 - 00625152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContactApis.dll

2015-10-17 13:48 - 2015-09-25 03:34 - 00579584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentApis.dll

2015-10-17 13:48 - 2015-09-25 03:34 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ChatApis.dll

2015-10-17 13:48 - 2015-09-25 03:34 - 00525312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EmailApis.dll

2015-10-17 13:48 - 2015-09-25 03:33 - 00131072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CallHistoryClient.dll

2015-10-17 13:48 - 2015-09-25 03:32 - 01594368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll

2015-10-17 13:48 - 2015-09-25 03:32 - 00466432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MessagingDataModel2.dll

2015-10-17 13:39 - 2015-11-04 16:28 - 00000000 ____D C:\Users\Admin\Desktop\Felgen

2015-10-17 13:36 - 2015-11-06 12:37 - 00001816 _____ C:\Users\Public\Desktop\iTunes.lnk

2015-10-17 13:36 - 2015-10-17 13:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2015-10-17 13:35 - 2015-11-06 12:37 - 00002523 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk

2015-10-17 13:35 - 2015-10-17 13:36 - 00000000 ____D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7

2015-10-17 13:35 - 2015-10-17 13:36 - 00000000 ____D C:\Program Files\iTunes

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\WINDOWS\System32\Tasks\Apple

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files\iPod

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files\Bonjour

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\iTunes

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\Bonjour

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\Apple Software Update

2015-10-17 13:30 - 2015-10-17 13:34 - 152447768 _____ (Apple Inc.) C:\Users\Admin\Downloads\iTunes6464Setup (1).exe

2015-10-12 18:13 - 2015-10-12 18:15 - 167601944 _____ (Apple Inc.) C:\Users\Admin\Downloads\iTunes6464Setup.exe

2015-10-12 17:20 - 2015-10-12 17:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud

2015-10-12 17:09 - 2015-10-12 17:19 - 71807792 _____ (Apple Inc.) C:\Users\Admin\Downloads\iCloudSetup.exe

2015-10-12 17:03 - 2015-10-12 17:24 - 1971067436 _____ C:\Users\Admin\Downloads\iPhone7,2_8.4.1_12H321_Restore.ipsw

2015-10-09 15:13 - 2015-10-09 15:13 - 00000000 ____D C:\Users\Admin\AppData\LocalLow\Hyper Hippo Productions Ltd_

2015-10-09 15:12 - 2015-10-09 15:12 - 00000222 _____ C:\Users\Admin\Desktop\AdVenture Capitalist.url

2015-10-08 16:47 - 2015-10-08 16:47 - 00000000 ____D C:\ProgramData\ATI

2015-10-07 18:54 - 2015-10-07 18:54 - 00062253 _____ C:\WINDOWS\SysWOW64\CCCInstall_201510071954276182.log

2015-10-07 18:54 - 2015-10-07 18:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center

2015-10-07 18:54 - 2015-10-07 18:54 - 00000000 ____D C:\Program Files\ATI Technologies

2015-10-07 18:53 - 2015-10-07 18:54 - 00000000 ____D C:\Program Files (x86)\ATI Technologies

2015-10-07 18:53 - 2015-10-07 18:53 - 00052907 _____ C:\WINDOWS\SysWOW64\CCCInstall_201510071953453509.log

2015-10-07 18:52 - 2015-10-07 18:52 - 47794160 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\amdocl64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 39721456 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\amdocl.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 30776304 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atio6axx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 27544560 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\amdocl12cl64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 25320432 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atioglxx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 22327280 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\amdocl12cl.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 15725552 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticaldd64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 14310896 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticaldd.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 09355016 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdxc64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 08009360 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiumdva.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 07683096 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdxc32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 07482560 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiumdag.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 06686192 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdmantle64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 05216240 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdmantle32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 03471376 _____ C:\WINDOWS\SysWOW64\atiumdva.cap

2015-10-07 18:52 - 2015-10-07 18:52 - 03437632 _____ C:\WINDOWS\system32\atiumd6a.cap

2015-10-07 18:52 - 2015-10-07 18:52 - 01196032 _____ C:\WINDOWS\system32\amdocl_as64.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 01070592 _____ C:\WINDOWS\system32\amdocl_ld64.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 01004032 _____ C:\WINDOWS\SysWOW64\amdocl_as32.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00935408 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atiadlxy.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00935408 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atiadlxx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00833800 _____ C:\WINDOWS\system32\amdicdxx.dat

2015-10-07 18:52 - 2015-10-07 18:52 - 00807424 _____ C:\WINDOWS\SysWOW64\amdocl_ld32.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00662392 _____ C:\WINDOWS\SysWOW64\atiapfxx.blb

2015-10-07 18:52 - 2015-10-07 18:52 - 00662392 _____ C:\WINDOWS\system32\atiapfxx.blb

2015-10-07 18:52 - 2015-10-07 18:52 - 00631280 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\amdlvr64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00524272 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\amdlvr32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00471320 _____ C:\WINDOWS\system32\amdmiracast.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00375792 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atiapfxx.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00341488 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\ATIODE.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00243696 _____ C:\WINDOWS\system32\clinfo.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00213488 _____ C:\WINDOWS\system32\amdgfxinfo64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00199664 _____ (AMD) C:\WINDOWS\system32\atitmm64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00198640 _____ C:\WINDOWS\SysWOW64\amdgfxinfo32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00177344 _____ C:\WINDOWS\system32\ativce03.dat

2015-10-07 18:52 - 2015-10-07 18:52 - 00175648 _____ C:\WINDOWS\system32\amde31a.dat

2015-10-07 18:52 - 2015-10-07 18:52 - 00168944 _____ C:\WINDOWS\system32\atieah64.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00165360 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atig6txx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00152560 _____ C:\WINDOWS\SysWOW64\atieah32.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00151936 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\amdhcp64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00150512 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atigktxx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00143344 _____ C:\WINDOWS\system32\amdhdl64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00138384 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\amdhcp32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00136176 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\mantle64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00132080 _____ C:\WINDOWS\SysWOW64\amdhdl32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00122352 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\mantle32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00117608 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdave64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00112368 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiu9pag.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00111600 _____ C:\WINDOWS\system32\hsa-thunk64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00111088 _____ C:\WINDOWS\SysWOW64\hsa-thunk.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00110320 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdave32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00103408 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\mantleaxl64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00100816 _____ C:\WINDOWS\system32\ativce02.dat

2015-10-07 18:52 - 2015-10-07 18:52 - 00097776 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atisamu64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00096752 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\mantleaxl32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00089584 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atisamu32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00088000 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atimpc64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00088000 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdpcom64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00083952 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atig6pxx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00081168 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atimpc32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00081160 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdpcom32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00078320 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiglpxx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00078320 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiglpxx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00073712 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00071152 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticalrt64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00068080 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00064496 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticalcl64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00060912 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticalrt.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00059888 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\ATIODCLI.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00059376 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdmmcl6.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00057840 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticalcl.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00052208 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\ati2erec.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00048112 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdmmcl.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00047664 _____ C:\WINDOWS\system32\kapp_ci.sbin

2015-10-07 18:52 - 2015-10-07 18:52 - 00043536 _____ C:\WINDOWS\system32\kapp_si.sbin

2015-10-07 18:52 - 2015-10-07 18:52 - 00038384 _____ (AMD) C:\WINDOWS\system32\atimuixx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00012784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\detoured.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00012784 _____ (Microsoft Corporation) C:\WINDOWS\system32\detoured.dll
 

==================== Ein Monat: Geänderte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2015-11-06 12:43 - 2015-08-05 21:51 - 01793546 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2015-11-06 12:43 - 2015-07-10 17:34 - 00772138 _____ C:\WINDOWS\system32\perfh007.dat

2015-11-06 12:43 - 2015-07-10 17:34 - 00154500 _____ C:\WINDOWS\system32\perfc007.dat

2015-11-06 12:39 - 2014-12-15 23:33 - 00001120 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2015-11-06 12:38 - 2015-07-10 13:21 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2015-11-06 12:37 - 2015-09-08 18:22 - 00000971 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk

2015-11-06 12:37 - 2015-08-05 22:01 - 00002358 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

2015-11-06 12:37 - 2015-08-05 21:45 - 00001540 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

2015-11-06 12:37 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\sru

2015-11-06 12:37 - 2015-07-10 10:05 - 00262144 ___SH C:\WINDOWS\system32\config\BBI

2015-11-06 12:37 - 2015-05-24 23:54 - 00000925 _____ C:\Users\Public\Desktop\VLC media player.lnk

2015-11-06 12:37 - 2015-01-06 20:22 - 00001017 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2015-11-06 12:37 - 2014-12-31 19:28 - 00000973 _____ C:\Users\Public\Desktop\Steam.lnk

2015-11-06 12:37 - 2014-12-31 18:33 - 00001813 _____ C:\Users\Admin\Desktop\Spotify.lnk

2015-11-06 12:37 - 2014-12-31 18:33 - 00001799 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk

2015-11-06 12:37 - 2014-12-18 21:21 - 00002445 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2015-11-06 12:37 - 2014-12-15 23:33 - 00001321 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2015-11-06 12:23 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\AppReadiness

2015-11-06 12:19 - 2014-12-15 23:33 - 00001124 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2015-11-06 11:03 - 2014-12-31 19:28 - 00000000 ____D C:\Program Files (x86)\Steam

2015-11-05 20:20 - 2015-08-05 21:41 - 00000000 ____D C:\Users\Admin

2015-11-05 18:47 - 2015-01-06 20:23 - 00000000 ____D C:\Users\Admin\AppData\Roaming\TS3Client

2015-11-05 17:46 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\rescache

2015-11-05 14:57 - 2014-12-30 15:46 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-11-05 14:56 - 2014-12-30 19:00 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013

2015-11-05 14:05 - 2015-08-05 22:01 - 00000000 ___RD C:\Users\Admin\OneDrive

2015-11-04 17:09 - 2015-08-05 21:41 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-11-04 17:09 - 2014-12-15 23:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2015-11-04 16:42 - 2015-08-05 22:33 - 00000000 ___DC C:\WINDOWS\Panther

2015-11-04 16:42 - 2014-12-30 23:19 - 00000000 ____D C:\Users\Admin\AppData\Local\CrashDumps

2015-11-04 16:09 - 2014-12-18 21:20 - 00000000 ____D C:\Program Files (x86)\Adobe

2015-11-04 16:08 - 2014-12-15 22:53 - 00000000 ____D C:\Program Files\KMSpico

2015-11-04 15:46 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy

2015-11-04 15:39 - 2015-01-21 20:03 - 00000000 __SHD C:\Users\Admin\AppData\Local\EmieUserList

2015-11-04 15:39 - 2015-01-21 20:03 - 00000000 __SHD C:\Users\Admin\AppData\Local\EmieSiteList

2015-11-04 15:26 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\appraiser

2015-11-02 14:26 - 2015-07-10 11:55 - 00000000 ____D C:\WINDOWS\CbsTemp

2015-11-01 00:33 - 2015-01-05 18:20 - 00003972 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task

2015-10-30 17:14 - 2014-12-15 23:42 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2015-10-27 19:48 - 2014-12-31 18:33 - 00000000 ____D C:\Users\Admin\AppData\Local\Spotify

2015-10-27 19:48 - 2014-12-31 18:32 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Spotify

2015-10-26 20:55 - 2015-04-12 21:14 - 00000000 ____D C:\Users\Admin\Desktop\Mailin

2015-10-26 20:15 - 2013-08-22 14:25 - 00000167 _____ C:\WINDOWS\win.ini

2015-10-26 19:47 - 2014-12-15 22:56 - 00000000 ____D C:\Users\Admin\AppData\Local\Packages

2015-10-17 13:35 - 2015-04-10 06:25 - 00000000 ____D C:\Program Files\Common Files\Apple

2015-10-17 13:34 - 2015-04-10 06:25 - 00000000 ____D C:\ProgramData\Apple

2015-10-16 04:10 - 2015-07-10 12:06 - 00810488 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2015-10-16 04:10 - 2015-07-10 12:06 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2015-10-12 18:13 - 2015-09-08 19:52 - 00000000 ____D C:\WINDOWS\system32\appmgmt

2015-10-12 18:11 - 2014-12-30 17:39 - 00000000 ____D C:\Users\Admin\AppData\Local\Akamai

2015-10-12 17:47 - 2015-07-10 13:20 - 00348328 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2015-10-12 17:45 - 2015-07-10 17:44 - 00000000 ____D C:\Program Files\Windows Journal

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___SD C:\WINDOWS\system32\F12

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___RD C:\WINDOWS\PurchaseDialog

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\Provisioning

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\L2Schemas

2015-10-09 15:12 - 2015-01-06 13:55 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2015-10-07 18:53 - 2015-07-30 15:44 - 00000000 ____D C:\Program Files (x86)\AMD

2015-10-07 18:53 - 2014-12-15 22:57 - 00000000 ____D C:\AMD

2015-10-07 18:52 - 2015-07-16 01:12 - 00162240 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiuxp64.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 12088008 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atidxx64.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 10211016 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atidxx32.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 08982440 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiumd6a.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 08864928 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiumd64.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 01479808 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\aticfx64.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 01223552 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\aticfx32.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 00143056 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiuxpag.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 00130072 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiu9p64.dll

2015-10-07 18:52 - 2015-07-16 01:06 - 21648880 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\atikmdag.sys

2015-10-07 18:52 - 2015-07-16 00:17 - 00683504 _____ (AMD) C:\WINDOWS\system32\atieclxx.exe

2015-10-07 18:52 - 2015-07-16 00:17 - 00451056 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atidemgy.dll

2015-10-07 18:52 - 2015-07-16 00:17 - 00255472 _____ (AMD) C:\WINDOWS\system32\atiesrxx.exe

2015-10-07 18:52 - 2015-07-16 00:13 - 01256432 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atiadlxx.dll

2015-10-07 18:52 - 2015-07-16 00:13 - 00674288 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\atikmpag.sys

2015-10-07 18:52 - 2015-07-16 00:12 - 00874480 _____ (AMD) C:\WINDOWS\system32\coinst_15.20.dll
 

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
 

2015-04-19 13:20 - 2015-04-19 13:20 - 0005872 _____ () C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn

2015-04-19 13:20 - 2015-04-19 13:20 - 0005872 _____ () C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs

2015-09-08 19:37 - 2015-09-08 19:37 - 0003225 _____ () C:\Users\Admin\AppData\Local\recently-used.xbel
 

Einige Dateien in TEMP:

====================

C:\Users\Admin\AppData\Local\Temp\8548.exe

C:\Users\Admin\AppData\Local\Temp\avgD177.exe

C:\Users\Admin\AppData\Local\Temp\InstallHelper.exe

C:\Users\Admin\AppData\Local\Temp\Opera_NI_stable.exe

C:\Users\Admin\AppData\Local\Temp\sqlite3.dll

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe

C:\Users\Admin\AppData\Local\Temp\UninstallModule.exe

C:\Users\Admin\AppData\Local\Temp\VLX_Player.exe
 
 

==================== Bamital & volsnap =================
 

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
 

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert

C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert

C:\WINDOWS\explorer.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert

C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert

C:\WINDOWS\system32\services.exe => Datei ist digital signiert

C:\WINDOWS\system32\User32.dll => Datei ist digital signiert

C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert

C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert

C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert

C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert

C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert

C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
 
 

LastRegBack: 2015-11-02 14:19
 

==================== Ende von FRST.txt ============================

Addition:

Code:

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:05-11-2015

durchgeführt von Admin (2015-11-06 12:51:40)

Gestartet von C:\Users\Admin\Desktop

Windows 10 Pro (X64) (2015-08-05 20:58:30)

Start-Modus: Normal

==========================================================
 
 

==================== Konten: =============================
 

Admin (S-1-5-21-3896126499-3315573620-1378135710-1001 - Administrator - Enabled) => C:\Users\Admin

Administrator (S-1-5-21-3896126499-3315573620-1378135710-500 - Administrator - Disabled)

DefaultAccount (S-1-5-21-3896126499-3315573620-1378135710-503 - Limited - Disabled)

Gast (S-1-5-21-3896126499-3315573620-1378135710-501 - Limited - Disabled)
 

==================== Sicherheits-Center ========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
 

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installierte Programme ======================
 

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
 

3DMark (HKLM-x32\...\{7330098c-3669-4f39-9e82-4221d489db39}) (Version: 1.4.828.0 - Futuremark)

3DMark (Version: 1.4.828.0 - Futuremark) Hidden

Adobe Reader XI (11.0.13) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.13 - Adobe Systems Incorporated)

AdVenture Capitalist (HKLM-x32\...\Steam App 346900) (Version:  - Hyper Hippo Games)

Akamai NetSession Interface (HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Akamai) (Version:  - Akamai Technologies, Inc)

AMD Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)

AMD Catalyst Install Manager (HKLM\...\{572C982F-95F5-0562-AE8F-8A9D7D024A88}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)

APP Shop v1.0.13 (HKLM-x32\...\{90242E9B-BC60-46E3-8EE7-8E953F702280}_is1) (Version: 1.0.13 - ASRock Inc.)

Apple Application Support (32-Bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)

Apple Application Support (64-Bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{FD244E19-6EFE-4A2D-948A-0D45D4C168BE}) (Version: 9.0.0.26 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)

ASRock App Charger v1.0.6 (HKLM\...\ASRock App Charger_is1) (Version: 1.0.6 - ASRock Inc.)

ASRock Restart to UEFI v1.0.3 (HKLM-x32\...\ASRock Restart to UEFI_is1) (Version:  - )

ASRock XFast RAM v3.0.2 (HKLM\...\ASRock XFast RAM_is1) (Version:  - ASRock Inc.)

A-Tuning v2.0.51.1 (HKLM-x32\...\A-Tuning_is1) (Version: 2.0.51.1 - )

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

CCleaner (HKLM\...\CCleaner) (Version: 5.11 - Piriform)

Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)

Futuremark SystemInfo (HKLM-x32\...\{2FE4C157-30AD-47F3-9D93-D9A2AFF25D3F}) (Version: 4.33.485.0 - Futuremark)

GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 46.0.2490.80 - Google Inc.)

Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6904.2028 - Google Inc.)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden

iCloud (HKLM\...\{709A2D23-C25E-47B5-9268-CB6FEE648504}) (Version: 4.1.1.53 - Apple Inc.)

Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation)

Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{0EC7F9CC-4741-45AE-9F55-6E9343F726F5}) (Version: 1.1.0.36960 - Intel Corporation)

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)

Intel(R) Network Connections 18.5.54.0 (HKLM\...\PROSetDX) (Version: 18.5.54.0 - Intel)

Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation)

iTunes (HKLM\...\{CEC7613B-E286-4A31-BEE3-3F7798488D9F}) (Version: 12.1.3.6 - Apple Inc.)

Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)

KMSpico (HKLM\...\{8B29D47F-92E2-4C20-9EE0-F710991F5D7C}_is1) (Version:  - )

Malwarebytes Anti-Malware Version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)

Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)

MyDriveConnect 4.0.2.2123 (HKLM-x32\...\MyDriveConnect) (Version: 4.0.2.2123 - TomTom)

Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.)

ROCCAT Kone Pure Mouse Driver (HKLM-x32\...\{4905245D-56E7-4176-BE68-962728B803D6}) (Version:  - Roccat GmbH)

Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)

Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version:  - Microsoft) Hidden

Splashtop Software Updater (HKLM-x32\...\Splashtop Software Updater) (Version: 1.5.6.15 - Splashtop Inc.)

Splashtop Streamer (HKLM-x32\...\{B7C5EA94-B96A-41F5-BE95-25D78B486678}) (Version: 2.6.2.4 - Splashtop Inc.)

Spotify (HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Spotify) (Version: 1.0.6.80.g2a801a53 - Spotify AB)

Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)

TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)

Update for Skype for Business 2015 (KB2889853) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{CBCC2FD8-7DFE-4752-95B5-2E447C226F45}) (Version:  - Microsoft)

Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version:  - Microsoft)

Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version:  - Microsoft)

Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version:  - Microsoft)

VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden

Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)

VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN)

WinRAR 5.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)

XFast LAN v9.05 (HKLM\...\XFast LAN) (Version: 9.05 - cFos Software GmbH, Bonn)

XFastUSB (HKLM-x32\...\XFastUSB) (Version: 3.02.38 - ASRock Inc.)
 

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

CustomCLSID: HKU\S-1-5-21-3896126499-3315573620-1378135710-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Admin\AppData\Local\Microsoft\OneDrive\17.3.6201.1019\FileCoAuth.exe (Microsoft Corporation)
 

==================== Wiederherstellungspunkte =========================
 

17-10-2015 13:21:53 Removed iTunes

26-10-2015 19:59:23 Windows Update

02-11-2015 14:19:58 Windows Update

04-11-2015 15:33:50 Wiederherstellungsvorgang

06-11-2015 12:44:13 JRT Pre-Junkware Removal
 

==================== Hosts Inhalt: ===============================
 

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
 

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
 
 

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

Task: {0641E672-CA84-4606-B6D2-9F2BABE58BF5} - System32\Tasks\28Arly8BQ3IUn => C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe <==== ACHTUNG

Task: {07181339-8E57-4CB5-BBFE-76170783B9DB} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG

Task: {12FB6D15-B5C0-4B66-BF0C-21D82690E855} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)

Task: {1780DAB3-4584-4FBD-92C9-8857F3886BA3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)

Task: {18B3B3A2-AFFF-476E-BA62-AB75BE1E7871} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG

Task: {314E7782-948E-4C4F-B24E-BC0CC4B34F09} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG

Task: {35EB728D-F128-4075-B375-D45BF71FE8B2} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\BrowserChoice\browserchoice.exe

Task: {3A4FD38E-5C92-414E-9586-8C3CAA34B95C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)

Task: {3E9757E4-DB07-4418-A44D-2721FDE15694} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG

Task: {4D0FE605-48D7-41B3-AD75-AD266C4238D5} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG

Task: {5769C702-F476-4F1D-8161-7F0B757132B2} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation)

Task: {6B883A1A-4B18-410C-B686-CE03876036BA} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG

Task: {706560C9-EAA0-41D3-833A-15525024E0B5} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-26] (Apple Inc.)

Task: {80A4DADB-BA50-49B2-AA96-134B855D9DA2} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)

Task: {829CE483-8082-49CD-A513-92A43A02E5FB} - System32\Tasks\{6761BBC9-893A-456B-822C-C0DF98AE0062} => pcalua.exe -a "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\Installer\setup.exe" -c --uninstall --system-level

Task: {91B7D1C5-C4A2-47A1-8301-8BB576FF708E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)

Task: {A0AE8DD5-A88B-4716-868D-7DE54D6A193B} - \AutoKMS -> Keine Datei <==== ACHTUNG

Task: {ABDBD144-AC98-4BFB-A605-068E267D2877} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation)

Task: {AF2AD4F7-61F8-4A4D-80A1-EC7534DACF61} - System32\Tasks\bSUwmicbiyVJJ5rnrs => C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe <==== ACHTUNG

Task: {B5D52175-0BF8-41EC-8DE9-7EA06BDD727D} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG

Task: {C094DE92-8467-4C1A-BDA4-A77A51B90A69} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG

Task: {CBA55D8E-91C9-42CD-83D1-CCEA95CCAD58} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG

Task: {D9512478-B671-48F5-AB7D-4DFDF9C1B3D9} - \AutoPico Daily Restart -> Keine Datei <==== ACHTUNG

Task: {DA46E218-00C4-4B54-B5E0-5243E443B1D5} - \uhy3013 -> Keine Datei <==== ACHTUNG

Task: {ECA37C1B-4E7F-4781-B87B-E8B93639BBCB} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG

Task: {F2497E2D-9818-4923-A176-F89FB32151E5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-10-19] (Piriform Ltd)

Task: {F5E604C0-8A2B-485C-9605-9EC1FD317421} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG

Task: {F69C0FCA-220E-4675-A1E1-DD67E0976A15} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
 

Task: C:\WINDOWS\Tasks\28Arly8BQ3IUn.job => C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe <==== ACHTUNG

Task: C:\WINDOWS\Tasks\bSUwmicbiyVJJ5rnrs.job => C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe <==== ACHTUNG

Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
 

2015-07-10 12:00 - 2015-07-10 12:00 - 00028160 _____ () C:\WINDOWS\SYSTEM32\efsext.dll

2015-08-05 22:30 - 2015-08-05 22:30 - 00032768 _____ () C:\WINDOWS\SYSTEM32\licensemanagerapi.dll

2015-08-23 21:30 - 2015-08-11 10:14 - 00404480 _____ () C:\WINDOWS\System32\diagtrack_wininternal.dll

2015-10-01 09:14 - 2015-09-17 07:48 - 02494712 _____ () C:\WINDOWS\system32\CoreUIComponents.dll

2015-10-01 09:14 - 2015-09-17 07:48 - 02494712 _____ () C:\WINDOWS\System32\CoreUIComponents.dll

2015-10-19 21:00 - 2015-10-19 21:00 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll

2015-10-01 09:14 - 2015-09-17 06:48 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll

2015-10-01 09:14 - 2015-09-17 06:44 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll

2015-10-01 09:14 - 2015-09-17 06:42 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll

2015-10-01 09:14 - 2015-09-17 06:49 - 00884736 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll

2015-10-01 09:14 - 2015-09-17 06:42 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll

2015-10-01 09:14 - 2015-09-17 06:43 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll

2015-03-20 17:12 - 2015-03-20 17:12 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

2015-03-20 17:12 - 2015-03-20 17:12 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

2015-10-01 09:14 - 2015-09-17 06:43 - 00928768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RulesBackgroundTasks.dll

2014-12-15 23:45 - 2013-09-03 16:52 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
 

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
 
 

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
 
 

==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
 
 

==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
 
 

==================== Andere Bereiche ============================
 

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
 

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppBackground\{8f613224-081d-4870-95b1-d3401a9c063b}.jpg

DNS Servers: 192.168.0.1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall ist aktiviert.
 

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
 

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
 

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Akamai NetSession Interface"

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Spotify"

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Spotify Web Helper"
 

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139

FirewallRules: [{AA2759FA-EDA9-49D9-8F1E-31DBB008545D}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

FirewallRules: [{21668B50-B857-45A9-B645-E11ECDD0BA49}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

FirewallRules: [{6CB59014-5555-42F1-8B13-C849BCCFE2D5}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe

FirewallRules: [{A3131C8E-696E-4F51-ACFD-B2AB59280978}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe

FirewallRules: [{FEE6B3AF-FAFD-4C1B-B25C-3D7B4B195124}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{B443DA33-A6A7-4033-956B-A93AC3CBC433}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{E6CBFDB1-E319-4DB8-AFE5-A4934C2C92BB}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{6A8E79CC-2575-4BAE-8F1C-D7A7E2F46E1E}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{8E7D9FDF-1879-4244-A2C6-EBC14CC669E7}] => (Allow) %USERPROFILE%\jagexcache\jagexlauncher\bin\JagexLauncher.exe

FirewallRules: [{35A1C72A-BDD3-483A-89A4-27F37D6F2DF0}] => (Allow) %USERPROFILE%\jagexcache\jagexlauncher\bin\JagexLauncher.exe

FirewallRules: [{B6240254-8695-4136-8688-496A32476A12}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe

FirewallRules: [{E7AD38FE-F37D-44CA-9649-1701BCC99048}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe

FirewallRules: [{B0CB35E9-5E30-4F33-B965-F50096A6FF89}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{D97329F3-5344-4F9A-ABBF-5E569CF1D363}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{CAEEFC92-F0A2-4DE5-A2E7-FFCAFF3B70D4}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{DA773FEA-CDF4-4FFB-818E-B255D4ABA4EF}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{22A49953-B3ED-4BC6-8832-A1E30DE6E35D}] => (Block) C:\users\admin\appdata\roaming\spotify\spotify.exe

FirewallRules: [{C130419E-ACEF-4A16-B5CD-F7064DA07399}] => (Block) C:\users\admin\appdata\roaming\spotify\spotify.exe

FirewallRules: [UDP Query User{8F3963CA-4443-496D-B9E4-2A16E020A73E}C:\users\admin\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\admin\appdata\roaming\spotify\spotify.exe

FirewallRules: [TCP Query User{C9892719-B171-4AE8-B087-57F263271C60}C:\users\admin\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\admin\appdata\roaming\spotify\spotify.exe

FirewallRules: [{52E0F1D2-FD56-4E24-A22C-DE206D1494F7}] => (Allow) C:\Windows\AutoKMS\AutoKMS.exe

FirewallRules: [{7039608C-3BAF-4175-B1D5-9DB53104CE60}] => (Allow) C:\Windows\AutoKMS\AutoKMS.exe

FirewallRules: [{A6677B6E-9570-4D98-87FE-84B9780B452C}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe

FirewallRules: [{CD221F27-BA09-4A4E-BC94-50541EBCB868}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe

FirewallRules: [{85BC76F4-96B4-4164-A507-B85036C799E4}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe

FirewallRules: [{05E12DE1-3BF9-4600-BD77-0809E7D8C280}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe

FirewallRules: [UDP Query User{6B3064D8-144A-4C73-834F-582573F693E1}C:\users\admin\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\admin\appdata\local\akamai\netsession_win.exe

FirewallRules: [TCP Query User{4F97824E-B35A-4B0C-97A6-D3BAFD6E693B}C:\users\admin\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\admin\appdata\local\akamai\netsession_win.exe

FirewallRules: [{ACFE8A12-C5A4-41FC-90A6-7D110C49FAEE}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

FirewallRules: [{55CAAA0F-FBB7-462F-8A31-FCCBE685917A}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

FirewallRules: [{046FF7F9-A214-4106-ADBB-6B8AD4D530E1}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe

FirewallRules: [{B26C67AD-595F-4798-8BA9-48A408D1A66A}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe

FirewallRules: [{0812631C-DFED-4D26-BAD8-38EC0D43A5F9}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe

FirewallRules: [{DD625CA9-74CC-4EF5-8787-672253D8102B}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe

FirewallRules: [{92F406C8-75D5-4ABC-B10E-2BCB8528AAD5}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe

FirewallRules: [{2E1B87E5-B37C-4C66-97F9-A7331EB138D4}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe

FirewallRules: [{20E5CF9D-CD2B-48EC-8529-99B170102939}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\AdVenture Capitalist\adventure-capitalist.exe

FirewallRules: [{C1EF0CA2-2081-43FE-8B04-16DE223F8C15}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\AdVenture Capitalist\adventure-capitalist.exe

FirewallRules: [{C20F43D5-69D4-45A1-AD1B-C744E89D4511}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{7E097365-0904-432E-929B-8F1CD4D41E51}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{1E925C46-62CE-4FA6-82B0-ABDF754998C5}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{F8DCB71C-268A-4DB2-8339-FDB932450A7D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{DD491145-F36D-48BC-A4CF-458D412FE1DE}] => (Allow) C:\Program Files\iTunes\iTunes.exe

FirewallRules: [{9E2BD5A0-E113-4596-8766-27355FE2915D}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

FirewallRules: [{E745B22D-7912-4168-B501-8A08C1F3C580}] => (Allow) C:\Program Files (x86)\Max Driver Updater\maxdu.exe

FirewallRules: [{93C38DE8-53A2-4A89-9205-B0807ACAA3F2}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe

FirewallRules: [{279EF737-27B1-40C7-99AC-8EAD354171BD}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe

FirewallRules: [{7886F932-3D5E-474B-9059-A0E18BD488B9}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\DataProxy.exe
 

==================== Fehlerhafte Geräte im Gerätemanager =============
 
 

==================== Fehlereinträge in der Ereignisanzeige: =========================
 

Applikationsfehler:

==================

Error: (11/06/2015 12:45:08 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: MicrosoftEdge.exe, Version: 11.0.10240.16566, Zeitstempel: 0x56277dbe

Name des fehlerhaften Moduls: CoreUIComponents.dll, Version: 0.0.0.0, Zeitstempel: 0x55fa4b76

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000000000060f73

ID des fehlerhaften Prozesses: 0x7e8

Startzeit der fehlerhaften Anwendung: 0xMicrosoftEdge.exe0

Pfad der fehlerhaften Anwendung: MicrosoftEdge.exe1

Pfad des fehlerhaften Moduls: MicrosoftEdge.exe2

Berichtskennung: MicrosoftEdge.exe3

Vollständiger Name des fehlerhaften Pakets: MicrosoftEdge.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: MicrosoftEdge.exe5
 

Error: (11/06/2015 12:44:23 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
 

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
 

System Error:

Zugriff verweigert

.
 

Error: (11/05/2015 08:20:37 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC)

Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 

Error: (11/05/2015 01:57:18 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC)

Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2147024865. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 

Error: (11/05/2015 01:57:18 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC)

Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2147024865. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 

Error: (11/05/2015 01:57:18 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC)

Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 

Error: (11/04/2015 05:09:31 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: MicrosoftEdge.exe, Version: 11.0.10240.16566, Zeitstempel: 0x56277dbe

Name des fehlerhaften Moduls: CoreUIComponents.dll, Version: 0.0.0.0, Zeitstempel: 0x55fa4b76

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000000000060f73

ID des fehlerhaften Prozesses: 0x1f70

Startzeit der fehlerhaften Anwendung: 0xMicrosoftEdge.exe0

Pfad der fehlerhaften Anwendung: MicrosoftEdge.exe1

Pfad des fehlerhaften Moduls: MicrosoftEdge.exe2

Berichtskennung: MicrosoftEdge.exe3

Vollständiger Name des fehlerhaften Pakets: MicrosoftEdge.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: MicrosoftEdge.exe5
 

Error: (11/04/2015 04:53:58 PM) (Source: System Restore) (EventID: 8210) (User: )

Description: Unbekannter Fehler bei der Systemwiederherstellung: (Windows Update). Zusätzliche Informationen: 0x80070571.
 

Error: (11/04/2015 04:23:32 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC)

Description: Bei der Aktivierung der App „Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe:MicrosoftEdge.AppX9zvsr9qeth9e9a03yr0g7rpdrcrwgn5r.mca“ ist folgender Fehler aufgetreten: -2144927149. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 

Error: (11/04/2015 04:14:43 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC)

Description: Bei der Aktivierung der App „Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe:MicrosoftEdge.AppX9zvsr9qeth9e9a03yr0g7rpdrcrwgn5r.mca“ ist folgender Fehler aufgetreten: -2144927149. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 
 

Systemfehler:

=============

Error: (11/06/2015 12:45:08 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Intel(R) Dynamic Application Loader Host Interface Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (11/06/2015 12:45:08 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Intel(R) ME Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (11/06/2015 12:45:08 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "iPod-Dienst" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (11/06/2015 12:45:07 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "cFosSpeed System Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (11/06/2015 12:45:07 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Intel(R) Capability Licensing Service Interface" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (11/06/2015 12:45:06 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Dienst "Bonjour"" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (11/06/2015 12:45:06 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Service KMSELDI" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (11/06/2015 12:44:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (11/06/2015 12:44:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "MBAMScheduler" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (11/06/2015 12:44:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Intel(R) PROSet Monitoring Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 
 

CodeIntegrity:

===================================

  Date: 2015-11-06 12:29:17.082

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-11-05 12:39:36.174

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-10-26 20:03:56.406

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-09-28 17:52:15.924

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-09-24 22:29:45.054

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-09-15 19:40:31.474

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-08-29 12:12:37.860

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-08-05 23:10:52.350

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 
 

==================== Speicherinformationen =========================== 
 

Prozessor: Intel(R) Pentium(R) CPU G3420 @ 3.20GHz

Prozentuale Nutzung des RAM: 23%

Installierter physikalischer RAM: 8111.13 MB

Verfügbarer physikalischer RAM: 6176.89 MB

Summe virtueller Speicher: 9391.13 MB

Verfügbarer virtueller Speicher: 7412.32 MB
 

==================== Laufwerke ================================
 

Drive c: () (Fixed) (Total:243.36 GB) (Free:163.71 GB) NTFS

Drive d: (Volume) (Fixed) (Total:687.37 GB) (Free:687.19 GB) NTFS
 

==================== MBR & Partitionstabelle ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: C390FBE7)

Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=243.4 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=450 MB) - (Type=27)

Partition 4: (Not Active) - (Size=687.4 GB) - (Type=07 NTFS)
 

==================== Ende von Addition.txt ============================

Martiba

06.11.2015 12:55

und die beiden Logdateien vom FRST:

FRST:

Code:

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:05-11-2015

durchgeführt von Admin (Administrator) auf PC (06-11-2015 12:50:47)

Gestartet von C:\Users\Admin\Desktop

Geladene Profile: Admin (Verfügbare Profile: Admin)

Platform: Windows 10 Pro (X64) Sprache: Deutsch (Deutschland)

Internet Explorer Version 11 (Standard-Browser: Edge)

Start-Modus: Normal

Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Prozesse (Nicht auf der Ausnahmeliste) =================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
 

(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe

(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe

(Microsoft Corporation) C:\Windows\System32\browser_broker.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
 
 

==================== Registry (Nicht auf der Ausnahmeliste) ===========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13636824 2013-07-26] (Realtek Semiconductor)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)

HKLM\...\Run: [XFast LAN] => C:\Program Files\ASRock\XFast LAN\cFosSpeed.exe [2009952 2013-05-31] (cFos Software GmbH)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169744 2015-09-12] (Apple Inc.)

HKLM-x32\...\Run: [XFastUSB] => C:\Program Files (x86)\XFastUSB\XFastUsb.exe [6311104 2014-12-15] (FNet Co., Ltd.)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-21] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [RoccatKonePure] => C:\Program Files (x86)\ROCCAT\Kone Pure Mouse\KonePureMonitor.EXE [561152 2014-01-20] (ROCCAT GmbH)

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.)

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Spotify Web Helper] => C:\Users\Admin\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2021944 2015-06-17] (Spotify Ltd)

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Spotify] => C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe [7323192 2015-06-17] (Spotify Ltd)

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8551848 2015-10-19] (Piriform Ltd)

HKU\S-1-5-18\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [43816 2015-04-26] (Apple Inc.)

Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2015-11-06]

ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation)
 

==================== Internet (Nicht auf der Ausnahmeliste) ====================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
 

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

Tcpip\..\Interfaces\{947ba08f-6d7e-4686-b9ff-2806db41b1ff}: [DhcpNameServer] 192.168.0.1
 

Internet Explorer:

==================

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com

BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-09-29] (Microsoft Corporation)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-25] (Google Inc.)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-15] (Microsoft Corporation)

BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-09-29] (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-21] (Oracle Corporation)

BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-25] (Google Inc.)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-15] (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-21] (Oracle Corporation)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-25] (Google Inc.)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-25] (Google Inc.)

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-10-14] (Microsoft Corporation)
 

FireFox:

========

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-09-04] ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-03] (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-03] (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-21] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-21] (Oracle Corporation)

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-03-31] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-19] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-19] (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-09-27] (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-03-31] (Microsoft Corporation)
 

Chrome: 

=======

CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-05]

CHR Extension: (Google Drive) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-23]

CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24]

CHR Extension: (Google-Suche) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-28]

CHR Extension: (LoungeDestroyer) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghahcnmfjfckcedfajbhekgknjdplfcl [2015-10-07]

CHR Extension: (Google Text & Tabellen Offline) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-03]

CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-25]

CHR Extension: (Google Mail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-29]
 

==================== Dienste (Nicht auf der Ausnahmeliste) ========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-09-02] (Apple Inc.)

S2 ASRockIOMon; C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe [454656 2013-05-28] () [Datei ist nicht signiert]

S2 cFosSpeedS; C:\Program Files\ASRock\XFast LAN\spd.exe [652640 2013-05-31] (cFos Software GmbH)

S3 Futuremark SystemInfo Service; C:\Program Files (x86)\Futuremark\SystemInfo\FMSISvc.exe [614624 2014-12-10] (Futuremark)

R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)

R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [Datei ist nicht signiert]

S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)

S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-03] (Intel Corporation)

S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-03] (Intel Corporation)

S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes)

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)

S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [966336 2014-10-10] (@ByELDI) [Datei ist nicht signiert]

R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation)
 

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.)

S3 AsrDrv101; C:\Windows\SysWOW64\Drivers\AsrDrv101.sys [22280 2014-12-16] (ASRock Incorporation)

R0 AsrRamDisk; C:\Windows\System32\drivers\AsrRamDisk.sys [40200 2013-05-09] (ASRock Inc.)

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [102912 2015-07-15] (Advanced Micro Devices)

S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)

S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)

R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [16648 2014-12-15] (FNet Co., Ltd.)

R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)

R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2015-11-06] (Malwarebytes)

R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)

R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-03] (Intel Corporation)

R3 sthid; C:\Windows\System32\drivers\sthid.sys [21216 2014-08-06] (Splashtop Inc.)

S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] ()

S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-07-10] (Microsoft Corporation)

R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [291680 2015-07-10] (Microsoft Corporation)

R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation)

S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]
 

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
 

==================== Ein Monat: Erstellte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2015-11-06 12:50 - 2015-11-06 12:50 - 00000000 ____D C:\Users\Admin\Desktop\FRST-OlderVersion

2015-11-06 12:46 - 2015-11-06 12:46 - 00001283 _____ C:\Users\Admin\Desktop\JRT.txt

2015-11-06 12:43 - 2015-11-06 12:43 - 01798976 _____ (Malwarebytes) C:\Users\Admin\Desktop\JRT.exe

2015-11-06 12:43 - 2015-11-06 12:43 - 00010166 _____ C:\Users\Admin\Desktop\mbam.txt

2015-11-06 12:38 - 2015-11-06 12:38 - 00016148 _____ C:\WINDOWS\system32\PC_Admin_HistoryPrediction.bin

2015-11-06 12:12 - 2015-11-06 12:39 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2015-11-06 12:11 - 2015-11-06 12:37 - 00001169 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-11-06 12:11 - 2015-11-06 12:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-11-06 12:11 - 2015-11-06 12:11 - 00000000 ____D C:\ProgramData\Malwarebytes

2015-11-06 12:11 - 2015-11-06 12:11 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-11-06 12:11 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2015-11-06 12:11 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys

2015-11-06 12:11 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys

2015-11-06 12:10 - 2015-11-06 12:11 - 22908888 _____ (Malwarebytes ) C:\Users\Admin\Downloads\mbam-setup-2.2.0.1024.exe

2015-11-06 12:09 - 2015-11-06 12:09 - 00002073 _____ C:\Users\Admin\Desktop\AdwCleaner[C3].txt

2015-11-06 12:08 - 2015-11-06 12:38 - 00014854 _____ C:\WINDOWS\PFRO.log

2015-11-06 12:05 - 2015-11-06 12:05 - 01713664 _____ C:\Users\Admin\Downloads\AdwCleaner_5.018.exe

2015-11-05 14:32 - 2015-11-06 12:51 - 00014435 _____ C:\Users\Admin\Desktop\FRST.txt

2015-11-05 14:31 - 2015-11-05 14:31 - 04404952 _____ (Kaspersky Lab ZAO) C:\Users\Admin\Desktop\tdsskiller.exe

2015-11-05 14:30 - 2015-11-06 12:50 - 02198528 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe

2015-11-05 14:30 - 2015-11-06 12:50 - 00000000 ____D C:\FRST

2015-11-05 14:13 - 2015-11-05 14:13 - 04944608 _____ (Advanced Micro Devices, Inc.) C:\Users\Admin\Downloads\autodetectutility.exe

2015-11-05 14:00 - 2015-11-05 14:00 - 00000000 ___HD C:\OneDriveTemp

2015-11-05 12:12 - 2015-11-05 12:12 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (3).exe

2015-11-04 17:15 - 2015-11-04 17:15 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (2).exe

2015-11-04 17:08 - 2015-11-06 12:07 - 00000000 ____D C:\AdwCleaner

2015-11-04 17:08 - 2015-11-04 17:08 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (1).exe

2015-11-04 16:49 - 2015-11-06 12:38 - 00000275 _____ C:\WINDOWS\WindowsUpdate.log

2015-11-04 16:49 - 2015-11-04 16:49 - 00000000 ____D C:\$SysReset

2015-11-04 16:34 - 2015-11-06 12:37 - 00000901 _____ C:\Users\Public\Desktop\CCleaner.lnk

2015-11-04 16:34 - 2015-11-04 16:34 - 00002844 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC

2015-11-04 16:34 - 2015-11-04 16:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

2015-11-04 16:34 - 2015-11-04 16:34 - 00000000 ____D C:\Program Files\CCleaner

2015-11-04 16:33 - 2015-11-04 16:34 - 05524624 _____ (Piriform Ltd) C:\Users\Admin\Downloads\ccsetup511_slim.exe

2015-11-04 16:14 - 2015-11-04 16:23 - 00000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job

2015-11-04 16:13 - 2015-11-04 16:13 - 00000000 ____D C:\WINDOWS\pss

2015-11-04 16:07 - 2015-11-04 16:07 - 00003380 _____ C:\WINDOWS\System32\Tasks\{6761BBC9-893A-456B-822C-C0DF98AE0062}

2015-11-04 15:21 - 2015-11-06 12:39 - 00001004 _____ C:\WINDOWS\Tasks\28Arly8BQ3IUn.job

2015-11-04 15:21 - 2015-11-04 15:21 - 00004136 _____ C:\WINDOWS\System32\Tasks\28Arly8BQ3IUn

2015-11-04 15:19 - 2015-11-06 12:39 - 00001014 _____ C:\WINDOWS\Tasks\bSUwmicbiyVJJ5rnrs.job

2015-11-04 15:19 - 2015-11-04 15:19 - 00004156 _____ C:\WINDOWS\System32\Tasks\bSUwmicbiyVJJ5rnrs

2015-11-04 15:17 - 2015-11-04 16:00 - 00000004 _____ C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7

2015-11-04 15:17 - 2013-08-22 14:25 - 00000824 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak

2015-11-04 15:16 - 2015-11-04 15:16 - 00000000 ____D C:\Users\Public\Documents\Baidu

2015-11-04 15:15 - 2015-11-04 15:39 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Opera Software

2015-11-04 15:15 - 2015-11-04 15:39 - 00000000 ____D C:\Users\Admin\AppData\Local\Opera Software

2015-11-04 15:12 - 2015-11-04 15:39 - 00000000 ____D C:\Program Files (x86)\Opera

2015-10-30 17:15 - 2015-10-30 17:15 - 00000000 ____D C:\ProgramData\ROCCAT

2015-10-30 17:15 - 2015-10-30 17:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ROCCAT

2015-10-30 17:14 - 2015-10-30 17:14 - 24907859 _____ C:\Users\Admin\Downloads\ROCCAT_Kone_Pure_DRV1.14_FW1.21.zip

2015-10-30 17:14 - 2015-10-30 17:14 - 00000000 ____D C:\Program Files (x86)\ROCCAT

2015-10-30 17:14 - 2014-01-20 10:53 - 73113600 _____ (ROCCAT GmbH) C:\Users\Admin\Desktop\KonePureOption.exe

2015-10-30 17:13 - 2015-10-28 00:38 - 21871616 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll

2015-10-30 17:13 - 2015-10-28 00:16 - 18801664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll

2015-10-30 17:13 - 2015-10-21 13:45 - 00541024 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcupdate_GenuineIntel.dll

2015-10-30 17:13 - 2015-10-21 13:44 - 00459104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys

2015-10-30 17:13 - 2015-10-21 13:43 - 01392480 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll

2015-10-30 17:13 - 2015-10-21 13:39 - 03621248 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2015-10-30 17:13 - 2015-10-21 13:00 - 24595968 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2015-10-30 17:13 - 2015-10-21 13:00 - 03248128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll

2015-10-30 17:13 - 2015-10-21 12:59 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll

2015-10-30 17:13 - 2015-10-21 12:57 - 02418688 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll

2015-10-30 17:13 - 2015-10-21 12:52 - 02987520 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll

2015-10-30 17:13 - 2015-10-21 12:50 - 00333312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll

2015-10-30 17:13 - 2015-10-21 12:48 - 01068032 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll

2015-10-30 17:13 - 2015-10-21 12:47 - 00453120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Usb.dll

2015-10-30 17:13 - 2015-10-21 12:46 - 02179584 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll

2015-10-30 17:13 - 2015-10-21 12:46 - 01602560 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2015-10-30 17:13 - 2015-10-21 12:44 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll

2015-10-30 17:13 - 2015-10-21 12:44 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe

2015-10-30 17:13 - 2015-10-21 12:43 - 02675200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll

2015-10-30 17:13 - 2015-10-21 12:42 - 00627712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll

2015-10-30 17:13 - 2015-10-21 12:41 - 01795072 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll

2015-10-30 17:13 - 2015-10-21 12:40 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll

2015-10-30 17:13 - 2015-10-21 12:38 - 00502272 _____ (Microsoft Corporation) C:\WINDOWS\system32\dlnashext.dll

2015-10-30 17:13 - 2015-10-21 06:53 - 00961376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll

2015-10-30 17:13 - 2015-10-21 06:49 - 02878512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2015-10-30 17:13 - 2015-10-21 06:13 - 19326464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2015-10-30 17:13 - 2015-10-21 06:11 - 02647040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll

2015-10-30 17:13 - 2015-10-21 06:08 - 01918976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll

2015-10-30 17:13 - 2015-10-21 06:05 - 02639872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll

2015-10-30 17:13 - 2015-10-21 06:03 - 01380864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2015-10-30 17:13 - 2015-10-21 06:03 - 00311296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Usb.dll

2015-10-30 17:13 - 2015-10-21 05:58 - 02049536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepository.dll

2015-10-30 17:13 - 2015-10-21 05:58 - 00464896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll

2015-10-30 17:13 - 2015-10-21 05:55 - 00441344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dlnashext.dll

2015-10-26 19:45 - 2015-10-26 19:45 - 00014336 _____ C:\Users\Admin\Downloads\wenn-2.xls

2015-10-26 19:38 - 2015-10-26 19:38 - 03135063 _____ C:\Users\Admin\Downloads\Pruefung_1_Jugendarbeitsschutzgesetz_.zip

2015-10-17 13:48 - 2015-10-10 08:12 - 00078528 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll

2015-10-17 13:48 - 2015-10-06 04:03 - 16708608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll

2015-10-17 13:48 - 2015-10-06 03:46 - 13027840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll

2015-10-17 13:48 - 2015-10-01 05:01 - 01294352 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi

2015-10-17 13:48 - 2015-10-01 05:01 - 01123400 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe

2015-10-17 13:48 - 2015-10-01 05:01 - 01018568 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi

2015-10-17 13:48 - 2015-10-01 05:01 - 00858408 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe

2015-10-17 13:48 - 2015-10-01 05:00 - 08020320 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2015-10-17 13:48 - 2015-10-01 04:03 - 00757760 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll

2015-10-17 13:48 - 2015-09-25 05:01 - 02573768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll

2015-10-17 13:48 - 2015-09-25 05:01 - 00498016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys

2015-10-17 13:48 - 2015-09-25 04:56 - 22322624 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2015-10-17 13:48 - 2015-09-25 04:52 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi

2015-10-17 13:48 - 2015-09-25 04:33 - 01997336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll

2015-10-17 13:48 - 2015-09-25 04:26 - 20858360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2015-10-17 13:48 - 2015-09-25 04:11 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataAccountApis.dll

2015-10-17 13:48 - 2015-09-25 04:11 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneCallHistoryApis.dll

2015-10-17 13:48 - 2015-09-25 04:09 - 12504064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2015-10-17 13:48 - 2015-09-25 04:07 - 01276416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll

2015-10-17 13:48 - 2015-09-25 04:04 - 00826880 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll

2015-10-17 13:48 - 2015-09-25 04:04 - 00771072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll

2015-10-17 13:48 - 2015-09-25 04:03 - 00796160 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll

2015-10-17 13:48 - 2015-09-25 04:03 - 00576000 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll

2015-10-17 13:48 - 2015-09-25 04:02 - 07523840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll

2015-10-17 13:48 - 2015-09-25 04:02 - 00949248 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll

2015-10-17 13:48 - 2015-09-25 04:02 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll

2015-10-17 13:48 - 2015-09-25 04:01 - 04792320 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2015-10-17 13:48 - 2015-09-25 04:01 - 03586560 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys

2015-10-17 13:48 - 2015-09-25 04:00 - 01423872 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll

2015-10-17 13:48 - 2015-09-25 04:00 - 01382400 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys

2015-10-17 13:48 - 2015-09-25 04:00 - 00856576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContactApis.dll

2015-10-17 13:48 - 2015-09-25 04:00 - 00752640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChatApis.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 01205248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\EmailApis.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 00685568 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppointmentApis.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\MessagingDataModel2.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 00288256 _____ (Microsoft Corporation) C:\WINDOWS\system32\PimIndexMaintenance.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\CallHistoryClient.dll

2015-10-17 13:48 - 2015-09-25 03:58 - 01871360 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll

2015-10-17 13:48 - 2015-09-25 03:47 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll

2015-10-17 13:48 - 2015-09-25 03:47 - 00172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhoneCallHistoryApis.dll

2015-10-17 13:48 - 2015-09-25 03:38 - 03580416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2015-10-17 13:48 - 2015-09-25 03:38 - 00650240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll

2015-10-17 13:48 - 2015-09-25 03:38 - 00574464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll

2015-10-17 13:48 - 2015-09-25 03:38 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll

2015-10-17 13:48 - 2015-09-25 03:37 - 00766976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll

2015-10-17 13:48 - 2015-09-25 03:37 - 00613376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll

2015-10-17 13:48 - 2015-09-25 03:37 - 00480256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll

2015-10-17 13:48 - 2015-09-25 03:36 - 11262976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2015-10-17 13:48 - 2015-09-25 03:36 - 05454848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll

2015-10-17 13:48 - 2015-09-25 03:34 - 00928256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll

2015-10-17 13:48 - 2015-09-25 03:34 - 00625152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContactApis.dll

2015-10-17 13:48 - 2015-09-25 03:34 - 00579584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentApis.dll

2015-10-17 13:48 - 2015-09-25 03:34 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ChatApis.dll

2015-10-17 13:48 - 2015-09-25 03:34 - 00525312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EmailApis.dll

2015-10-17 13:48 - 2015-09-25 03:33 - 00131072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CallHistoryClient.dll

2015-10-17 13:48 - 2015-09-25 03:32 - 01594368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll

2015-10-17 13:48 - 2015-09-25 03:32 - 00466432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MessagingDataModel2.dll

2015-10-17 13:39 - 2015-11-04 16:28 - 00000000 ____D C:\Users\Admin\Desktop\Felgen

2015-10-17 13:36 - 2015-11-06 12:37 - 00001816 _____ C:\Users\Public\Desktop\iTunes.lnk

2015-10-17 13:36 - 2015-10-17 13:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2015-10-17 13:35 - 2015-11-06 12:37 - 00002523 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk

2015-10-17 13:35 - 2015-10-17 13:36 - 00000000 ____D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7

2015-10-17 13:35 - 2015-10-17 13:36 - 00000000 ____D C:\Program Files\iTunes

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\WINDOWS\System32\Tasks\Apple

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files\iPod

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files\Bonjour

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\iTunes

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\Bonjour

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\Apple Software Update

2015-10-17 13:30 - 2015-10-17 13:34 - 152447768 _____ (Apple Inc.) C:\Users\Admin\Downloads\iTunes6464Setup (1).exe

2015-10-12 18:13 - 2015-10-12 18:15 - 167601944 _____ (Apple Inc.) C:\Users\Admin\Downloads\iTunes6464Setup.exe

2015-10-12 17:20 - 2015-10-12 17:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud

2015-10-12 17:09 - 2015-10-12 17:19 - 71807792 _____ (Apple Inc.) C:\Users\Admin\Downloads\iCloudSetup.exe

2015-10-12 17:03 - 2015-10-12 17:24 - 1971067436 _____ C:\Users\Admin\Downloads\iPhone7,2_8.4.1_12H321_Restore.ipsw

2015-10-09 15:13 - 2015-10-09 15:13 - 00000000 ____D C:\Users\Admin\AppData\LocalLow\Hyper Hippo Productions Ltd_

2015-10-09 15:12 - 2015-10-09 15:12 - 00000222 _____ C:\Users\Admin\Desktop\AdVenture Capitalist.url

2015-10-08 16:47 - 2015-10-08 16:47 - 00000000 ____D C:\ProgramData\ATI

2015-10-07 18:54 - 2015-10-07 18:54 - 00062253 _____ C:\WINDOWS\SysWOW64\CCCInstall_201510071954276182.log

2015-10-07 18:54 - 2015-10-07 18:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center

2015-10-07 18:54 - 2015-10-07 18:54 - 00000000 ____D C:\Program Files\ATI Technologies

2015-10-07 18:53 - 2015-10-07 18:54 - 00000000 ____D C:\Program Files (x86)\ATI Technologies

2015-10-07 18:53 - 2015-10-07 18:53 - 00052907 _____ C:\WINDOWS\SysWOW64\CCCInstall_201510071953453509.log

2015-10-07 18:52 - 2015-10-07 18:52 - 47794160 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\amdocl64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 39721456 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\amdocl.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 30776304 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atio6axx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 27544560 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\amdocl12cl64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 25320432 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atioglxx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 22327280 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\amdocl12cl.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 15725552 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticaldd64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 14310896 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticaldd.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 09355016 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdxc64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 08009360 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiumdva.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 07683096 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdxc32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 07482560 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiumdag.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 06686192 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdmantle64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 05216240 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdmantle32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 03471376 _____ C:\WINDOWS\SysWOW64\atiumdva.cap

2015-10-07 18:52 - 2015-10-07 18:52 - 03437632 _____ C:\WINDOWS\system32\atiumd6a.cap

2015-10-07 18:52 - 2015-10-07 18:52 - 01196032 _____ C:\WINDOWS\system32\amdocl_as64.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 01070592 _____ C:\WINDOWS\system32\amdocl_ld64.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 01004032 _____ C:\WINDOWS\SysWOW64\amdocl_as32.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00935408 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atiadlxy.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00935408 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atiadlxx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00833800 _____ C:\WINDOWS\system32\amdicdxx.dat

2015-10-07 18:52 - 2015-10-07 18:52 - 00807424 _____ C:\WINDOWS\SysWOW64\amdocl_ld32.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00662392 _____ C:\WINDOWS\SysWOW64\atiapfxx.blb

2015-10-07 18:52 - 2015-10-07 18:52 - 00662392 _____ C:\WINDOWS\system32\atiapfxx.blb

2015-10-07 18:52 - 2015-10-07 18:52 - 00631280 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\amdlvr64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00524272 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\amdlvr32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00471320 _____ C:\WINDOWS\system32\amdmiracast.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00375792 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atiapfxx.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00341488 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\ATIODE.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00243696 _____ C:\WINDOWS\system32\clinfo.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00213488 _____ C:\WINDOWS\system32\amdgfxinfo64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00199664 _____ (AMD) C:\WINDOWS\system32\atitmm64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00198640 _____ C:\WINDOWS\SysWOW64\amdgfxinfo32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00177344 _____ C:\WINDOWS\system32\ativce03.dat

2015-10-07 18:52 - 2015-10-07 18:52 - 00175648 _____ C:\WINDOWS\system32\amde31a.dat

2015-10-07 18:52 - 2015-10-07 18:52 - 00168944 _____ C:\WINDOWS\system32\atieah64.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00165360 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atig6txx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00152560 _____ C:\WINDOWS\SysWOW64\atieah32.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00151936 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\amdhcp64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00150512 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atigktxx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00143344 _____ C:\WINDOWS\system32\amdhdl64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00138384 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\amdhcp32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00136176 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\mantle64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00132080 _____ C:\WINDOWS\SysWOW64\amdhdl32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00122352 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\mantle32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00117608 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdave64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00112368 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiu9pag.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00111600 _____ C:\WINDOWS\system32\hsa-thunk64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00111088 _____ C:\WINDOWS\SysWOW64\hsa-thunk.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00110320 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdave32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00103408 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\mantleaxl64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00100816 _____ C:\WINDOWS\system32\ativce02.dat

2015-10-07 18:52 - 2015-10-07 18:52 - 00097776 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atisamu64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00096752 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\mantleaxl32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00089584 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atisamu32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00088000 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atimpc64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00088000 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdpcom64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00083952 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atig6pxx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00081168 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atimpc32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00081160 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdpcom32.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00078320 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiglpxx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00078320 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiglpxx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00073712 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00071152 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticalrt64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00068080 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00064496 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticalcl64.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00060912 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticalrt.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00059888 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\ATIODCLI.exe

2015-10-07 18:52 - 2015-10-07 18:52 - 00059376 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdmmcl6.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00057840 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticalcl.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00052208 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\ati2erec.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00048112 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdmmcl.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00047664 _____ C:\WINDOWS\system32\kapp_ci.sbin

2015-10-07 18:52 - 2015-10-07 18:52 - 00043536 _____ C:\WINDOWS\system32\kapp_si.sbin

2015-10-07 18:52 - 2015-10-07 18:52 - 00038384 _____ (AMD) C:\WINDOWS\system32\atimuixx.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00012784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\detoured.dll

2015-10-07 18:52 - 2015-10-07 18:52 - 00012784 _____ (Microsoft Corporation) C:\WINDOWS\system32\detoured.dll
 

==================== Ein Monat: Geänderte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2015-11-06 12:43 - 2015-08-05 21:51 - 01793546 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2015-11-06 12:43 - 2015-07-10 17:34 - 00772138 _____ C:\WINDOWS\system32\perfh007.dat

2015-11-06 12:43 - 2015-07-10 17:34 - 00154500 _____ C:\WINDOWS\system32\perfc007.dat

2015-11-06 12:39 - 2014-12-15 23:33 - 00001120 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2015-11-06 12:38 - 2015-07-10 13:21 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2015-11-06 12:37 - 2015-09-08 18:22 - 00000971 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk

2015-11-06 12:37 - 2015-08-05 22:01 - 00002358 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

2015-11-06 12:37 - 2015-08-05 21:45 - 00001540 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

2015-11-06 12:37 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\sru

2015-11-06 12:37 - 2015-07-10 10:05 - 00262144 ___SH C:\WINDOWS\system32\config\BBI

2015-11-06 12:37 - 2015-05-24 23:54 - 00000925 _____ C:\Users\Public\Desktop\VLC media player.lnk

2015-11-06 12:37 - 2015-01-06 20:22 - 00001017 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2015-11-06 12:37 - 2014-12-31 19:28 - 00000973 _____ C:\Users\Public\Desktop\Steam.lnk

2015-11-06 12:37 - 2014-12-31 18:33 - 00001813 _____ C:\Users\Admin\Desktop\Spotify.lnk

2015-11-06 12:37 - 2014-12-31 18:33 - 00001799 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk

2015-11-06 12:37 - 2014-12-18 21:21 - 00002445 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2015-11-06 12:37 - 2014-12-15 23:33 - 00001321 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2015-11-06 12:23 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\AppReadiness

2015-11-06 12:19 - 2014-12-15 23:33 - 00001124 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2015-11-06 11:03 - 2014-12-31 19:28 - 00000000 ____D C:\Program Files (x86)\Steam

2015-11-05 20:20 - 2015-08-05 21:41 - 00000000 ____D C:\Users\Admin

2015-11-05 18:47 - 2015-01-06 20:23 - 00000000 ____D C:\Users\Admin\AppData\Roaming\TS3Client

2015-11-05 17:46 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\rescache

2015-11-05 14:57 - 2014-12-30 15:46 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-11-05 14:56 - 2014-12-30 19:00 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013

2015-11-05 14:05 - 2015-08-05 22:01 - 00000000 ___RD C:\Users\Admin\OneDrive

2015-11-04 17:09 - 2015-08-05 21:41 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-11-04 17:09 - 2014-12-15 23:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2015-11-04 16:42 - 2015-08-05 22:33 - 00000000 ___DC C:\WINDOWS\Panther

2015-11-04 16:42 - 2014-12-30 23:19 - 00000000 ____D C:\Users\Admin\AppData\Local\CrashDumps

2015-11-04 16:09 - 2014-12-18 21:20 - 00000000 ____D C:\Program Files (x86)\Adobe

2015-11-04 16:08 - 2014-12-15 22:53 - 00000000 ____D C:\Program Files\KMSpico

2015-11-04 15:46 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy

2015-11-04 15:39 - 2015-01-21 20:03 - 00000000 __SHD C:\Users\Admin\AppData\Local\EmieUserList

2015-11-04 15:39 - 2015-01-21 20:03 - 00000000 __SHD C:\Users\Admin\AppData\Local\EmieSiteList

2015-11-04 15:26 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\appraiser

2015-11-02 14:26 - 2015-07-10 11:55 - 00000000 ____D C:\WINDOWS\CbsTemp

2015-11-01 00:33 - 2015-01-05 18:20 - 00003972 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task

2015-10-30 17:14 - 2014-12-15 23:42 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2015-10-27 19:48 - 2014-12-31 18:33 - 00000000 ____D C:\Users\Admin\AppData\Local\Spotify

2015-10-27 19:48 - 2014-12-31 18:32 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Spotify

2015-10-26 20:55 - 2015-04-12 21:14 - 00000000 ____D C:\Users\Admin\Desktop\Mailin

2015-10-26 20:15 - 2013-08-22 14:25 - 00000167 _____ C:\WINDOWS\win.ini

2015-10-26 19:47 - 2014-12-15 22:56 - 00000000 ____D C:\Users\Admin\AppData\Local\Packages

2015-10-17 13:35 - 2015-04-10 06:25 - 00000000 ____D C:\Program Files\Common Files\Apple

2015-10-17 13:34 - 2015-04-10 06:25 - 00000000 ____D C:\ProgramData\Apple

2015-10-16 04:10 - 2015-07-10 12:06 - 00810488 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2015-10-16 04:10 - 2015-07-10 12:06 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2015-10-12 18:13 - 2015-09-08 19:52 - 00000000 ____D C:\WINDOWS\system32\appmgmt

2015-10-12 18:11 - 2014-12-30 17:39 - 00000000 ____D C:\Users\Admin\AppData\Local\Akamai

2015-10-12 17:47 - 2015-07-10 13:20 - 00348328 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2015-10-12 17:45 - 2015-07-10 17:44 - 00000000 ____D C:\Program Files\Windows Journal

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___SD C:\WINDOWS\system32\F12

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___RD C:\WINDOWS\PurchaseDialog

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\Provisioning

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\L2Schemas

2015-10-09 15:12 - 2015-01-06 13:55 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2015-10-07 18:53 - 2015-07-30 15:44 - 00000000 ____D C:\Program Files (x86)\AMD

2015-10-07 18:53 - 2014-12-15 22:57 - 00000000 ____D C:\AMD

2015-10-07 18:52 - 2015-07-16 01:12 - 00162240 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiuxp64.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 12088008 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atidxx64.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 10211016 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atidxx32.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 08982440 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiumd6a.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 08864928 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiumd64.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 01479808 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\aticfx64.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 01223552 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\aticfx32.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 00143056 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiuxpag.dll

2015-10-07 18:52 - 2015-07-16 01:11 - 00130072 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiu9p64.dll

2015-10-07 18:52 - 2015-07-16 01:06 - 21648880 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\atikmdag.sys

2015-10-07 18:52 - 2015-07-16 00:17 - 00683504 _____ (AMD) C:\WINDOWS\system32\atieclxx.exe

2015-10-07 18:52 - 2015-07-16 00:17 - 00451056 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atidemgy.dll

2015-10-07 18:52 - 2015-07-16 00:17 - 00255472 _____ (AMD) C:\WINDOWS\system32\atiesrxx.exe

2015-10-07 18:52 - 2015-07-16 00:13 - 01256432 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atiadlxx.dll

2015-10-07 18:52 - 2015-07-16 00:13 - 00674288 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\atikmpag.sys

2015-10-07 18:52 - 2015-07-16 00:12 - 00874480 _____ (AMD) C:\WINDOWS\system32\coinst_15.20.dll
 

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
 

2015-04-19 13:20 - 2015-04-19 13:20 - 0005872 _____ () C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn

2015-04-19 13:20 - 2015-04-19 13:20 - 0005872 _____ () C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs

2015-09-08 19:37 - 2015-09-08 19:37 - 0003225 _____ () C:\Users\Admin\AppData\Local\recently-used.xbel
 

Einige Dateien in TEMP:

====================

C:\Users\Admin\AppData\Local\Temp\8548.exe

C:\Users\Admin\AppData\Local\Temp\avgD177.exe

C:\Users\Admin\AppData\Local\Temp\InstallHelper.exe

C:\Users\Admin\AppData\Local\Temp\Opera_NI_stable.exe

C:\Users\Admin\AppData\Local\Temp\sqlite3.dll

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe

C:\Users\Admin\AppData\Local\Temp\UninstallModule.exe

C:\Users\Admin\AppData\Local\Temp\VLX_Player.exe
 
 

==================== Bamital & volsnap =================
 

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
 

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert

C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert

C:\WINDOWS\explorer.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert

C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert

C:\WINDOWS\system32\services.exe => Datei ist digital signiert

C:\WINDOWS\system32\User32.dll => Datei ist digital signiert

C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert

C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert

C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert

C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert

C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert

C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
 
 

LastRegBack: 2015-11-02 14:19
 

==================== Ende von FRST.txt ============================

Addition:

Code:

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:05-11-2015

durchgeführt von Admin (2015-11-06 12:51:40)

Gestartet von C:\Users\Admin\Desktop

Windows 10 Pro (X64) (2015-08-05 20:58:30)

Start-Modus: Normal

==========================================================
 
 

==================== Konten: =============================
 

Admin (S-1-5-21-3896126499-3315573620-1378135710-1001 - Administrator - Enabled) => C:\Users\Admin

Administrator (S-1-5-21-3896126499-3315573620-1378135710-500 - Administrator - Disabled)

DefaultAccount (S-1-5-21-3896126499-3315573620-1378135710-503 - Limited - Disabled)

Gast (S-1-5-21-3896126499-3315573620-1378135710-501 - Limited - Disabled)
 

==================== Sicherheits-Center ========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
 

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installierte Programme ======================
 

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
 

3DMark (HKLM-x32\...\{7330098c-3669-4f39-9e82-4221d489db39}) (Version: 1.4.828.0 - Futuremark)

3DMark (Version: 1.4.828.0 - Futuremark) Hidden

Adobe Reader XI (11.0.13) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.13 - Adobe Systems Incorporated)

AdVenture Capitalist (HKLM-x32\...\Steam App 346900) (Version:  - Hyper Hippo Games)

Akamai NetSession Interface (HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Akamai) (Version:  - Akamai Technologies, Inc)

AMD Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)

AMD Catalyst Install Manager (HKLM\...\{572C982F-95F5-0562-AE8F-8A9D7D024A88}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)

APP Shop v1.0.13 (HKLM-x32\...\{90242E9B-BC60-46E3-8EE7-8E953F702280}_is1) (Version: 1.0.13 - ASRock Inc.)

Apple Application Support (32-Bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)

Apple Application Support (64-Bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{FD244E19-6EFE-4A2D-948A-0D45D4C168BE}) (Version: 9.0.0.26 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)

ASRock App Charger v1.0.6 (HKLM\...\ASRock App Charger_is1) (Version: 1.0.6 - ASRock Inc.)

ASRock Restart to UEFI v1.0.3 (HKLM-x32\...\ASRock Restart to UEFI_is1) (Version:  - )

ASRock XFast RAM v3.0.2 (HKLM\...\ASRock XFast RAM_is1) (Version:  - ASRock Inc.)

A-Tuning v2.0.51.1 (HKLM-x32\...\A-Tuning_is1) (Version: 2.0.51.1 - )

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

CCleaner (HKLM\...\CCleaner) (Version: 5.11 - Piriform)

Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)

Futuremark SystemInfo (HKLM-x32\...\{2FE4C157-30AD-47F3-9D93-D9A2AFF25D3F}) (Version: 4.33.485.0 - Futuremark)

GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 46.0.2490.80 - Google Inc.)

Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6904.2028 - Google Inc.)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden

iCloud (HKLM\...\{709A2D23-C25E-47B5-9268-CB6FEE648504}) (Version: 4.1.1.53 - Apple Inc.)

Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation)

Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{0EC7F9CC-4741-45AE-9F55-6E9343F726F5}) (Version: 1.1.0.36960 - Intel Corporation)

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)

Intel(R) Network Connections 18.5.54.0 (HKLM\...\PROSetDX) (Version: 18.5.54.0 - Intel)

Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation)

iTunes (HKLM\...\{CEC7613B-E286-4A31-BEE3-3F7798488D9F}) (Version: 12.1.3.6 - Apple Inc.)

Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)

KMSpico (HKLM\...\{8B29D47F-92E2-4C20-9EE0-F710991F5D7C}_is1) (Version:  - )

Malwarebytes Anti-Malware Version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)

Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)

MyDriveConnect 4.0.2.2123 (HKLM-x32\...\MyDriveConnect) (Version: 4.0.2.2123 - TomTom)

Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.)

ROCCAT Kone Pure Mouse Driver (HKLM-x32\...\{4905245D-56E7-4176-BE68-962728B803D6}) (Version:  - Roccat GmbH)

Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)

Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version:  - Microsoft) Hidden

Splashtop Software Updater (HKLM-x32\...\Splashtop Software Updater) (Version: 1.5.6.15 - Splashtop Inc.)

Splashtop Streamer (HKLM-x32\...\{B7C5EA94-B96A-41F5-BE95-25D78B486678}) (Version: 2.6.2.4 - Splashtop Inc.)

Spotify (HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Spotify) (Version: 1.0.6.80.g2a801a53 - Spotify AB)

Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)

TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)

Update for Skype for Business 2015 (KB2889853) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{CBCC2FD8-7DFE-4752-95B5-2E447C226F45}) (Version:  - Microsoft)

Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version:  - Microsoft)

Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version:  - Microsoft)

Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version:  - Microsoft)

VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden

Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)

VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN)

WinRAR 5.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)

XFast LAN v9.05 (HKLM\...\XFast LAN) (Version: 9.05 - cFos Software GmbH, Bonn)

XFastUSB (HKLM-x32\...\XFastUSB) (Version: 3.02.38 - ASRock Inc.)
 

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

CustomCLSID: HKU\S-1-5-21-3896126499-3315573620-1378135710-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Admin\AppData\Local\Microsoft\OneDrive\17.3.6201.1019\FileCoAuth.exe (Microsoft Corporation)
 

==================== Wiederherstellungspunkte =========================
 

17-10-2015 13:21:53 Removed iTunes

26-10-2015 19:59:23 Windows Update

02-11-2015 14:19:58 Windows Update

04-11-2015 15:33:50 Wiederherstellungsvorgang

06-11-2015 12:44:13 JRT Pre-Junkware Removal
 

==================== Hosts Inhalt: ===============================
 

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
 

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
 
 

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

Task: {0641E672-CA84-4606-B6D2-9F2BABE58BF5} - System32\Tasks\28Arly8BQ3IUn => C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe <==== ACHTUNG

Task: {07181339-8E57-4CB5-BBFE-76170783B9DB} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG

Task: {12FB6D15-B5C0-4B66-BF0C-21D82690E855} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)

Task: {1780DAB3-4584-4FBD-92C9-8857F3886BA3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)

Task: {18B3B3A2-AFFF-476E-BA62-AB75BE1E7871} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG

Task: {314E7782-948E-4C4F-B24E-BC0CC4B34F09} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG

Task: {35EB728D-F128-4075-B375-D45BF71FE8B2} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\BrowserChoice\browserchoice.exe

Task: {3A4FD38E-5C92-414E-9586-8C3CAA34B95C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)

Task: {3E9757E4-DB07-4418-A44D-2721FDE15694} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG

Task: {4D0FE605-48D7-41B3-AD75-AD266C4238D5} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG

Task: {5769C702-F476-4F1D-8161-7F0B757132B2} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation)

Task: {6B883A1A-4B18-410C-B686-CE03876036BA} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG

Task: {706560C9-EAA0-41D3-833A-15525024E0B5} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-26] (Apple Inc.)

Task: {80A4DADB-BA50-49B2-AA96-134B855D9DA2} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)

Task: {829CE483-8082-49CD-A513-92A43A02E5FB} - System32\Tasks\{6761BBC9-893A-456B-822C-C0DF98AE0062} => pcalua.exe -a "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\Installer\setup.exe" -c --uninstall --system-level

Task: {91B7D1C5-C4A2-47A1-8301-8BB576FF708E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)

Task: {A0AE8DD5-A88B-4716-868D-7DE54D6A193B} - \AutoKMS -> Keine Datei <==== ACHTUNG

Task: {ABDBD144-AC98-4BFB-A605-068E267D2877} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation)

Task: {AF2AD4F7-61F8-4A4D-80A1-EC7534DACF61} - System32\Tasks\bSUwmicbiyVJJ5rnrs => C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe <==== ACHTUNG

Task: {B5D52175-0BF8-41EC-8DE9-7EA06BDD727D} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG

Task: {C094DE92-8467-4C1A-BDA4-A77A51B90A69} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG

Task: {CBA55D8E-91C9-42CD-83D1-CCEA95CCAD58} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG

Task: {D9512478-B671-48F5-AB7D-4DFDF9C1B3D9} - \AutoPico Daily Restart -> Keine Datei <==== ACHTUNG

Task: {DA46E218-00C4-4B54-B5E0-5243E443B1D5} - \uhy3013 -> Keine Datei <==== ACHTUNG

Task: {ECA37C1B-4E7F-4781-B87B-E8B93639BBCB} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG

Task: {F2497E2D-9818-4923-A176-F89FB32151E5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-10-19] (Piriform Ltd)

Task: {F5E604C0-8A2B-485C-9605-9EC1FD317421} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG

Task: {F69C0FCA-220E-4675-A1E1-DD67E0976A15} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
 

Task: C:\WINDOWS\Tasks\28Arly8BQ3IUn.job => C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe <==== ACHTUNG

Task: C:\WINDOWS\Tasks\bSUwmicbiyVJJ5rnrs.job => C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe <==== ACHTUNG

Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
 

2015-07-10 12:00 - 2015-07-10 12:00 - 00028160 _____ () C:\WINDOWS\SYSTEM32\efsext.dll

2015-08-05 22:30 - 2015-08-05 22:30 - 00032768 _____ () C:\WINDOWS\SYSTEM32\licensemanagerapi.dll

2015-08-23 21:30 - 2015-08-11 10:14 - 00404480 _____ () C:\WINDOWS\System32\diagtrack_wininternal.dll

2015-10-01 09:14 - 2015-09-17 07:48 - 02494712 _____ () C:\WINDOWS\system32\CoreUIComponents.dll

2015-10-01 09:14 - 2015-09-17 07:48 - 02494712 _____ () C:\WINDOWS\System32\CoreUIComponents.dll

2015-10-19 21:00 - 2015-10-19 21:00 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll

2015-10-01 09:14 - 2015-09-17 06:48 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll

2015-10-01 09:14 - 2015-09-17 06:44 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll

2015-10-01 09:14 - 2015-09-17 06:42 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll

2015-10-01 09:14 - 2015-09-17 06:49 - 00884736 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll

2015-10-01 09:14 - 2015-09-17 06:42 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll

2015-10-01 09:14 - 2015-09-17 06:43 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll

2015-03-20 17:12 - 2015-03-20 17:12 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

2015-03-20 17:12 - 2015-03-20 17:12 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

2015-10-01 09:14 - 2015-09-17 06:43 - 00928768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RulesBackgroundTasks.dll

2014-12-15 23:45 - 2013-09-03 16:52 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
 

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
 
 

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
 
 

==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
 
 

==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
 
 

==================== Andere Bereiche ============================
 

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
 

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppBackground\{8f613224-081d-4870-95b1-d3401a9c063b}.jpg

DNS Servers: 192.168.0.1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall ist aktiviert.
 

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
 

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
 

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Akamai NetSession Interface"

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Spotify"

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Spotify Web Helper"
 

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139

FirewallRules: [{AA2759FA-EDA9-49D9-8F1E-31DBB008545D}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

FirewallRules: [{21668B50-B857-45A9-B645-E11ECDD0BA49}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

FirewallRules: [{6CB59014-5555-42F1-8B13-C849BCCFE2D5}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe

FirewallRules: [{A3131C8E-696E-4F51-ACFD-B2AB59280978}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe

FirewallRules: [{FEE6B3AF-FAFD-4C1B-B25C-3D7B4B195124}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{B443DA33-A6A7-4033-956B-A93AC3CBC433}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{E6CBFDB1-E319-4DB8-AFE5-A4934C2C92BB}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{6A8E79CC-2575-4BAE-8F1C-D7A7E2F46E1E}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{8E7D9FDF-1879-4244-A2C6-EBC14CC669E7}] => (Allow) %USERPROFILE%\jagexcache\jagexlauncher\bin\JagexLauncher.exe

FirewallRules: [{35A1C72A-BDD3-483A-89A4-27F37D6F2DF0}] => (Allow) %USERPROFILE%\jagexcache\jagexlauncher\bin\JagexLauncher.exe

FirewallRules: [{B6240254-8695-4136-8688-496A32476A12}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe

FirewallRules: [{E7AD38FE-F37D-44CA-9649-1701BCC99048}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe

FirewallRules: [{B0CB35E9-5E30-4F33-B965-F50096A6FF89}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{D97329F3-5344-4F9A-ABBF-5E569CF1D363}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{CAEEFC92-F0A2-4DE5-A2E7-FFCAFF3B70D4}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{DA773FEA-CDF4-4FFB-818E-B255D4ABA4EF}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{22A49953-B3ED-4BC6-8832-A1E30DE6E35D}] => (Block) C:\users\admin\appdata\roaming\spotify\spotify.exe

FirewallRules: [{C130419E-ACEF-4A16-B5CD-F7064DA07399}] => (Block) C:\users\admin\appdata\roaming\spotify\spotify.exe

FirewallRules: [UDP Query User{8F3963CA-4443-496D-B9E4-2A16E020A73E}C:\users\admin\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\admin\appdata\roaming\spotify\spotify.exe

FirewallRules: [TCP Query User{C9892719-B171-4AE8-B087-57F263271C60}C:\users\admin\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\admin\appdata\roaming\spotify\spotify.exe

FirewallRules: [{52E0F1D2-FD56-4E24-A22C-DE206D1494F7}] => (Allow) C:\Windows\AutoKMS\AutoKMS.exe

FirewallRules: [{7039608C-3BAF-4175-B1D5-9DB53104CE60}] => (Allow) C:\Windows\AutoKMS\AutoKMS.exe

FirewallRules: [{A6677B6E-9570-4D98-87FE-84B9780B452C}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe

FirewallRules: [{CD221F27-BA09-4A4E-BC94-50541EBCB868}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe

FirewallRules: [{85BC76F4-96B4-4164-A507-B85036C799E4}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe

FirewallRules: [{05E12DE1-3BF9-4600-BD77-0809E7D8C280}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe

FirewallRules: [UDP Query User{6B3064D8-144A-4C73-834F-582573F693E1}C:\users\admin\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\admin\appdata\local\akamai\netsession_win.exe

FirewallRules: [TCP Query User{4F97824E-B35A-4B0C-97A6-D3BAFD6E693B}C:\users\admin\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\admin\appdata\local\akamai\netsession_win.exe

FirewallRules: [{ACFE8A12-C5A4-41FC-90A6-7D110C49FAEE}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

FirewallRules: [{55CAAA0F-FBB7-462F-8A31-FCCBE685917A}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

FirewallRules: [{046FF7F9-A214-4106-ADBB-6B8AD4D530E1}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe

FirewallRules: [{B26C67AD-595F-4798-8BA9-48A408D1A66A}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe

FirewallRules: [{0812631C-DFED-4D26-BAD8-38EC0D43A5F9}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe

FirewallRules: [{DD625CA9-74CC-4EF5-8787-672253D8102B}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe

FirewallRules: [{92F406C8-75D5-4ABC-B10E-2BCB8528AAD5}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe

FirewallRules: [{2E1B87E5-B37C-4C66-97F9-A7331EB138D4}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe

FirewallRules: [{20E5CF9D-CD2B-48EC-8529-99B170102939}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\AdVenture Capitalist\adventure-capitalist.exe

FirewallRules: [{C1EF0CA2-2081-43FE-8B04-16DE223F8C15}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\AdVenture Capitalist\adventure-capitalist.exe

FirewallRules: [{C20F43D5-69D4-45A1-AD1B-C744E89D4511}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{7E097365-0904-432E-929B-8F1CD4D41E51}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{1E925C46-62CE-4FA6-82B0-ABDF754998C5}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{F8DCB71C-268A-4DB2-8339-FDB932450A7D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{DD491145-F36D-48BC-A4CF-458D412FE1DE}] => (Allow) C:\Program Files\iTunes\iTunes.exe

FirewallRules: [{9E2BD5A0-E113-4596-8766-27355FE2915D}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

FirewallRules: [{E745B22D-7912-4168-B501-8A08C1F3C580}] => (Allow) C:\Program Files (x86)\Max Driver Updater\maxdu.exe

FirewallRules: [{93C38DE8-53A2-4A89-9205-B0807ACAA3F2}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe

FirewallRules: [{279EF737-27B1-40C7-99AC-8EAD354171BD}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe

FirewallRules: [{7886F932-3D5E-474B-9059-A0E18BD488B9}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\DataProxy.exe
 

==================== Fehlerhafte Geräte im Gerätemanager =============
 
 

==================== Fehlereinträge in der Ereignisanzeige: =========================
 

Applikationsfehler:

==================

Error: (11/06/2015 12:45:08 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: MicrosoftEdge.exe, Version: 11.0.10240.16566, Zeitstempel: 0x56277dbe

Name des fehlerhaften Moduls: CoreUIComponents.dll, Version: 0.0.0.0, Zeitstempel: 0x55fa4b76

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000000000060f73

ID des fehlerhaften Prozesses: 0x7e8

Startzeit der fehlerhaften Anwendung: 0xMicrosoftEdge.exe0

Pfad der fehlerhaften Anwendung: MicrosoftEdge.exe1

Pfad des fehlerhaften Moduls: MicrosoftEdge.exe2

Berichtskennung: MicrosoftEdge.exe3

Vollständiger Name des fehlerhaften Pakets: MicrosoftEdge.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: MicrosoftEdge.exe5
 

Error: (11/06/2015 12:44:23 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
 

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
 

System Error:

Zugriff verweigert

.
 

Error: (11/05/2015 08:20:37 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC)

Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 

Error: (11/05/2015 01:57:18 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC)

Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2147024865. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 

Error: (11/05/2015 01:57:18 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC)

Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2147024865. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 

Error: (11/05/2015 01:57:18 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC)

Description: Bei der Aktivierung der App „Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 

Error: (11/04/2015 05:09:31 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: MicrosoftEdge.exe, Version: 11.0.10240.16566, Zeitstempel: 0x56277dbe

Name des fehlerhaften Moduls: CoreUIComponents.dll, Version: 0.0.0.0, Zeitstempel: 0x55fa4b76

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000000000060f73

ID des fehlerhaften Prozesses: 0x1f70

Startzeit der fehlerhaften Anwendung: 0xMicrosoftEdge.exe0

Pfad der fehlerhaften Anwendung: MicrosoftEdge.exe1

Pfad des fehlerhaften Moduls: MicrosoftEdge.exe2

Berichtskennung: MicrosoftEdge.exe3

Vollständiger Name des fehlerhaften Pakets: MicrosoftEdge.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: MicrosoftEdge.exe5
 

Error: (11/04/2015 04:53:58 PM) (Source: System Restore) (EventID: 8210) (User: )

Description: Unbekannter Fehler bei der Systemwiederherstellung: (Windows Update). Zusätzliche Informationen: 0x80070571.
 

Error: (11/04/2015 04:23:32 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC)

Description: Bei der Aktivierung der App „Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe:MicrosoftEdge.AppX9zvsr9qeth9e9a03yr0g7rpdrcrwgn5r.mca“ ist folgender Fehler aufgetreten: -2144927149. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 

Error: (11/04/2015 04:14:43 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PC)

Description: Bei der Aktivierung der App „Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe:MicrosoftEdge.AppX9zvsr9qeth9e9a03yr0g7rpdrcrwgn5r.mca“ ist folgender Fehler aufgetreten: -2144927149. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
 
 

Systemfehler:

=============

Error: (11/06/2015 12:45:08 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Intel(R) Dynamic Application Loader Host Interface Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (11/06/2015 12:45:08 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Intel(R) ME Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (11/06/2015 12:45:08 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "iPod-Dienst" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (11/06/2015 12:45:07 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "cFosSpeed System Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (11/06/2015 12:45:07 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Intel(R) Capability Licensing Service Interface" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (11/06/2015 12:45:06 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Dienst "Bonjour"" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (11/06/2015 12:45:06 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Service KMSELDI" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (11/06/2015 12:44:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (11/06/2015 12:44:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "MBAMScheduler" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (11/06/2015 12:44:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Intel(R) PROSet Monitoring Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 
 

CodeIntegrity:

===================================

  Date: 2015-11-06 12:29:17.082

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-11-05 12:39:36.174

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-10-26 20:03:56.406

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-09-28 17:52:15.924

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-09-24 22:29:45.054

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-09-15 19:40:31.474

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-08-29 12:12:37.860

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-08-05 23:10:52.350

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 
 

==================== Speicherinformationen =========================== 
 

Prozessor: Intel(R) Pentium(R) CPU G3420 @ 3.20GHz

Prozentuale Nutzung des RAM: 23%

Installierter physikalischer RAM: 8111.13 MB

Verfügbarer physikalischer RAM: 6176.89 MB

Summe virtueller Speicher: 9391.13 MB

Verfügbarer virtueller Speicher: 7412.32 MB
 

==================== Laufwerke ================================
 

Drive c: () (Fixed) (Total:243.36 GB) (Free:163.71 GB) NTFS

Drive d: (Volume) (Fixed) (Total:687.37 GB) (Free:687.19 GB) NTFS
 

==================== MBR & Partitionstabelle ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: C390FBE7)

Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=243.4 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=450 MB) - (Type=27)

Partition 4: (Not Active) - (Size=687.4 GB) - (Type=07 NTFS)
 

==================== Ende von Addition.txt ============================

Vielen Dank!

Mfg,
Martin

M-K-D-B

06.11.2015 13:06

Servus,

bevor wir weitermachen, bitte nochmal kurz FRST so ausführen:

Starte FRST erneut. Kopiere den Inhalt der folgenden Code-Box oben in die Zeile:

Code:

CinemaPlus;MyBrowser;mbot_de;re-markit;
Drücke auf Registry-Suche.
FRST beginnt mit dem Suchlauf. Dies kann einige Zeit dauern.
Am Ende erstellt FRST eine Textdatei Search.txt.
Poste mir deren Inhalt mit deiner nächsten Antwort.

Martiba

06.11.2015 13:11

Hallo nochmal,

anbei die Search.txt

Code:

Farbar Recovery Scan Tool (x64) Version:05-11-2015

durchgeführt von Admin (2015-11-06 13:10:53)

Gestartet von C:\Users\Admin\Desktop

Start-Modus: Normal
 

================== Registry-Suche: "CinemaPlus;MyBrowser;mbot_de;re-markit" ===========
 
 

===================== Suchergebnis für "CinemaPlus" ==========
 

[HKEY_USERS\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store]

"C:\Program Files (x86)\CinemaPlus_1.3dV04.11\Uninstall.exe"="0x534143500100000000000000070000002800000050CE0100AD160200030000000000000000000306000100000261329FFFBAD0010000000000000000020000002800000000000000000000000000000000000000000000000000000068BF0000000000000100000001000000"
 

===================== Suchergebnis für "MyBrowser" ==========
 

[HKEY_USERS\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store]

"C:\Program Files (x86)\MyBrowser\MyBrowser\Application\39.5.2171.95\Installer\setup.exe"="0x534143500100000000000000070000002800000000D20D0000000000030000000000000000000306000100000261329FFFBAD0010000000000000000010000000400000001000000050000001000000000000000000000000000000000000000020000002800000000000000000000000082820000000000008080000000000042240000000000000A0000000A000000"
 
 

===================== Suchergebnis für "mbot_de" ==========
 

[HKEY_USERS\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\UFH\SHC]

"0"="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MYBESTOFFERSTODAY\MyBestOffersToday.lnk

C:\Program Files (x86)\mbot_de_014010136\mybestofferstoday_widget.exe

"
 

====== Ende von Suche ======

M-K-D-B

06.11.2015 13:21

Wir entfernen noch die letzten Reste und kontrollieren anschließend nochmal alles, damit dein Rechner auch sauber ist.
Hinweis: Der Suchlauf mit ESET kann länger dauern.

Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

start

CloseProcesses:

C:\Users\Public\Documents\Baidu

C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn

C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs

Task: C:\WINDOWS\Tasks\28Arly8BQ3IUn.job => C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe <==== ACHTUNG

Task: C:\WINDOWS\Tasks\bSUwmicbiyVJJ5rnrs.job => C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe <==== ACHTUNG

Task: {0641E672-CA84-4606-B6D2-9F2BABE58BF5} - System32\Tasks\28Arly8BQ3IUn => C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe <==== ACHTUNG

C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe

Task: {AF2AD4F7-61F8-4A4D-80A1-EC7534DACF61} - System32\Tasks\bSUwmicbiyVJJ5rnrs => C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe <==== ACHTUNG

C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe

Task: {07181339-8E57-4CB5-BBFE-76170783B9DB} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG

Task: {18B3B3A2-AFFF-476E-BA62-AB75BE1E7871} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG

Task: {314E7782-948E-4C4F-B24E-BC0CC4B34F09} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG

Task: {3E9757E4-DB07-4418-A44D-2721FDE15694} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG

Task: {4D0FE605-48D7-41B3-AD75-AD266C4238D5} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG

Task: {6B883A1A-4B18-410C-B686-CE03876036BA} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG

Task: {829CE483-8082-49CD-A513-92A43A02E5FB} - System32\Tasks\{6761BBC9-893A-456B-822C-C0DF98AE0062} => pcalua.exe -a "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\Installer\setup.exe" -c --uninstall --system-level

Task: {A0AE8DD5-A88B-4716-868D-7DE54D6A193B} - \AutoKMS -> Keine Datei <==== ACHTUNG

Task: {B5D52175-0BF8-41EC-8DE9-7EA06BDD727D} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG

Task: {C094DE92-8467-4C1A-BDA4-A77A51B90A69} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG

Task: {CBA55D8E-91C9-42CD-83D1-CCEA95CCAD58} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG

Task: {D9512478-B671-48F5-AB7D-4DFDF9C1B3D9} - \AutoPico Daily Restart -> Keine Datei <==== ACHTUNG

Task: {DA46E218-00C4-4B54-B5E0-5243E443B1D5} - \uhy3013 -> Keine Datei <==== ACHTUNG

Task: {ECA37C1B-4E7F-4781-B87B-E8B93639BBCB} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG

FirewallRules: [{52E0F1D2-FD56-4E24-A22C-DE206D1494F7}] => (Allow) C:\Windows\AutoKMS\AutoKMS.exe

FirewallRules: [{7039608C-3BAF-4175-B1D5-9DB53104CE60}] => (Allow) C:\Windows\AutoKMS\AutoKMS.exe

FirewallRules: [{E745B22D-7912-4168-B501-8A08C1F3C580}] => (Allow) C:\Program Files (x86)\Max Driver Updater\maxdu.exe 

RemoveProxy:

EmptyTemp:

end

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2
Downloade dir die passende Version von HitmanPro auf deinen Desktop: HitmanPro - 32 Bit | HitmanPro - 64 Bit.

Starte die HitmanPro.exe
Klicke auf
Entferne den Haken bei
Klicke auf
und
Akzeptiere die Lizenzbedingungen und klicke auf
Klicke auf

und auf
Wenn der Scan beendet wurde, nichts löschen lassen etc. sondern wähle unten links auf der Button-Leiste
und speichere die Logdatei auf Deinem Desktop.
Schließe HitmanPro und poste mir das Log.

Schritt 3

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 4

Deaktiviere dein Anti-Viren-Programm.
Gehe zum Ordner C:\FRST\Quarantine.
Rechtsklicke auf den Ordner Quarantine und wähle > Senden an > Zip-komprimierter Ordner.
Es wird eine zip-Datei mit dem Namen Quarantine.zip im Ordner FRST erstellt.
Lade die Quarantine.zip im Upload-Channel hoch.
Klicke dazu auf Durchsuchen, navigiere zu der zip-Datei ( C:\FRST\Quarantine.zip ) und klicke auf Öffnen.
Klicke abschließend auf Hochladen.
Vielen Dank für deine Hilfe.
Aktiviere dein Anti-Viren-Programm wieder.

Bitte poste mit deiner nächsten Antwort

die Logdatei des FRST-Fix,
die Logdatei von HitmanPro,
die Logdatei von ESET,
eine Rückmeldung bezüglich des Uploads.

Martiba

06.11.2015 21:45

Hallo,

anbei die Logdatei des FRST-Fix:

Code:

Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version:05-11-2015

durchgeführt von Admin (2015-11-06 19:56:27) Run:1

Gestartet von C:\Users\Admin\Desktop

Geladene Profile: Admin (Verfügbare Profile: Admin)

Start-Modus: Normal

==============================================
 

fixlist Inhalt:

*****************

start

CloseProcesses:

C:\Users\Public\Documents\Baidu

C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn

C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs

Task: C:\WINDOWS\Tasks\28Arly8BQ3IUn.job => C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe <==== ACHTUNG

Task: C:\WINDOWS\Tasks\bSUwmicbiyVJJ5rnrs.job => C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe <==== ACHTUNG

Task: {0641E672-CA84-4606-B6D2-9F2BABE58BF5} - System32\Tasks\28Arly8BQ3IUn => C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe <==== ACHTUNG

C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe

Task: {AF2AD4F7-61F8-4A4D-80A1-EC7534DACF61} - System32\Tasks\bSUwmicbiyVJJ5rnrs => C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe <==== ACHTUNG

C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe

Task: {07181339-8E57-4CB5-BBFE-76170783B9DB} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG

Task: {18B3B3A2-AFFF-476E-BA62-AB75BE1E7871} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG

Task: {314E7782-948E-4C4F-B24E-BC0CC4B34F09} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG

Task: {3E9757E4-DB07-4418-A44D-2721FDE15694} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG

Task: {4D0FE605-48D7-41B3-AD75-AD266C4238D5} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG

Task: {6B883A1A-4B18-410C-B686-CE03876036BA} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG

Task: {829CE483-8082-49CD-A513-92A43A02E5FB} - System32\Tasks\{6761BBC9-893A-456B-822C-C0DF98AE0062} => pcalua.exe -a "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\Installer\setup.exe" -c --uninstall --system-level

Task: {A0AE8DD5-A88B-4716-868D-7DE54D6A193B} - \AutoKMS -> Keine Datei <==== ACHTUNG

Task: {B5D52175-0BF8-41EC-8DE9-7EA06BDD727D} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG

Task: {C094DE92-8467-4C1A-BDA4-A77A51B90A69} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG

Task: {CBA55D8E-91C9-42CD-83D1-CCEA95CCAD58} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG

Task: {D9512478-B671-48F5-AB7D-4DFDF9C1B3D9} - \AutoPico Daily Restart -> Keine Datei <==== ACHTUNG

Task: {DA46E218-00C4-4B54-B5E0-5243E443B1D5} - \uhy3013 -> Keine Datei <==== ACHTUNG

Task: {ECA37C1B-4E7F-4781-B87B-E8B93639BBCB} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG

FirewallRules: [{52E0F1D2-FD56-4E24-A22C-DE206D1494F7}] => (Allow) C:\Windows\AutoKMS\AutoKMS.exe

FirewallRules: [{7039608C-3BAF-4175-B1D5-9DB53104CE60}] => (Allow) C:\Windows\AutoKMS\AutoKMS.exe

FirewallRules: [{E745B22D-7912-4168-B501-8A08C1F3C580}] => (Allow) C:\Program Files (x86)\Max Driver Updater\maxdu.exe 

RemoveProxy:

EmptyTemp:

end

         

*****************
 

Prozess erfolgreich geschlossen.

C:\Users\Public\Documents\Baidu => erfolgreich verschoben

C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn => erfolgreich verschoben

C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs => erfolgreich verschoben

C:\WINDOWS\Tasks\28Arly8BQ3IUn.job => erfolgreich verschoben

C:\WINDOWS\Tasks\bSUwmicbiyVJJ5rnrs.job => erfolgreich verschoben

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{0641E672-CA84-4606-B6D2-9F2BABE58BF5}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0641E672-CA84-4606-B6D2-9F2BABE58BF5}" => Schlüssel erfolgreich entfernt

C:\WINDOWS\System32\Tasks\28Arly8BQ3IUn => erfolgreich verschoben

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\28Arly8BQ3IUn" => Schlüssel erfolgreich entfernt

"C:\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.exe" => nicht gefunden.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{AF2AD4F7-61F8-4A4D-80A1-EC7534DACF61}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AF2AD4F7-61F8-4A4D-80A1-EC7534DACF61}" => Schlüssel erfolgreich entfernt

C:\WINDOWS\System32\Tasks\bSUwmicbiyVJJ5rnrs => erfolgreich verschoben

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\bSUwmicbiyVJJ5rnrs" => Schlüssel erfolgreich entfernt

"C:\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.exe" => nicht gefunden.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{07181339-8E57-4CB5-BBFE-76170783B9DB}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{07181339-8E57-4CB5-BBFE-76170783B9DB}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{18B3B3A2-AFFF-476E-BA62-AB75BE1E7871}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{18B3B3A2-AFFF-476E-BA62-AB75BE1E7871}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{314E7782-948E-4C4F-B24E-BC0CC4B34F09}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{314E7782-948E-4C4F-B24E-BC0CC4B34F09}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3E9757E4-DB07-4418-A44D-2721FDE15694}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3E9757E4-DB07-4418-A44D-2721FDE15694}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4D0FE605-48D7-41B3-AD75-AD266C4238D5}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4D0FE605-48D7-41B3-AD75-AD266C4238D5}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6B883A1A-4B18-410C-B686-CE03876036BA}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6B883A1A-4B18-410C-B686-CE03876036BA}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{829CE483-8082-49CD-A513-92A43A02E5FB}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{829CE483-8082-49CD-A513-92A43A02E5FB}" => Schlüssel erfolgreich entfernt

C:\WINDOWS\System32\Tasks\{6761BBC9-893A-456B-822C-C0DF98AE0062} => erfolgreich verschoben

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{6761BBC9-893A-456B-822C-C0DF98AE0062}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{A0AE8DD5-A88B-4716-868D-7DE54D6A193B}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A0AE8DD5-A88B-4716-868D-7DE54D6A193B}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoKMS" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{B5D52175-0BF8-41EC-8DE9-7EA06BDD727D}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B5D52175-0BF8-41EC-8DE9-7EA06BDD727D}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C094DE92-8467-4C1A-BDA4-A77A51B90A69}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C094DE92-8467-4C1A-BDA4-A77A51B90A69}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CBA55D8E-91C9-42CD-83D1-CCEA95CCAD58}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CBA55D8E-91C9-42CD-83D1-CCEA95CCAD58}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D9512478-B671-48F5-AB7D-4DFDF9C1B3D9}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D9512478-B671-48F5-AB7D-4DFDF9C1B3D9}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoPico Daily Restart" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{DA46E218-00C4-4B54-B5E0-5243E443B1D5}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DA46E218-00C4-4B54-B5E0-5243E443B1D5}" => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\uhy3013 => Schlüssel nicht gefunden. 

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{ECA37C1B-4E7F-4781-B87B-E8B93639BBCB}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ECA37C1B-4E7F-4781-B87B-E8B93639BBCB}" => Schlüssel erfolgreich entfernt

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d" => Schlüssel erfolgreich entfernt

HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{52E0F1D2-FD56-4E24-A22C-DE206D1494F7} => Wert erfolgreich entfernt

HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{7039608C-3BAF-4175-B1D5-9DB53104CE60} => Wert erfolgreich entfernt

HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{E745B22D-7912-4168-B501-8A08C1F3C580} => Wert erfolgreich entfernt
 

========= RemoveProxy: =========
 

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt
 
 

========= Ende von RemoveProxy: =========
 

EmptyTemp: => 248.3 MB temporäre Dateien entfernt.
 
 

Das System musste neu gestartet werden.
 

==== Ende von Fixlog 19:56:36 ====

Die Logdatei von HitmanPro:

Code:

HitmanPro 3.7.10.251

www.hitmanpro.com
 

   Computer name . . . . : PC

   Windows . . . . . . . : 10.0.0.10240.X64/2

   User name . . . . . . : PC\Admin

   UAC . . . . . . . . . : Enabled

   License . . . . . . . : Free
 

   Scan date . . . . . . : 2015-11-06 20:04:21

   Scan mode . . . . . . : Normal

   Scan duration . . . . : 6m 6s

   Disk access mode  . . : Direct disk access (SRB)

   Cloud . . . . . . . . : Internet

   Reboot  . . . . . . . : No
 

   Threats . . . . . . . : 1

   Traces  . . . . . . . : 46
 

   Objects scanned . . . : 1.631.223

   Files scanned . . . . : 37.539

   Remnants scanned  . . : 377.131 files / 1.216.553 keys
 

Malware _____________________________________________________________________
 

   C:\Program Files\KMSpico\Service_KMS.exe

      Size . . . . . . . : 966.336 bytes

      Age  . . . . . . . : 325.9 days (2014-12-15 22:53:52)

      Entropy  . . . . . : 6.0

      SHA-256  . . . . . : D446B1B31B823875E0536CA8A2F784093B0DA77A875FB0F2D5EABB6DE711CFFC

      Needs elevation  . : Yes

      Product  . . . . . : Service_KMS

      Publisher  . . . . : @ByELDI

      Description  . . . : Service_KMS

      Version  . . . . . : 14.0.0.4

      RSA Key Size . . . : 1024

      Service  . . . . . : Service KMSELDI

      LanguageID . . . . : 0

      Authenticode . . . : Valid

      Running processes  : 2636

    > Kaspersky  . . . . : not-a-virus:RiskTool.Win32.ProcPatcher.aat

      Fuzzy  . . . . . . : 90.0

      Startup

         HKLM\SYSTEM\CurrentControlSet\Services\Service KMSELDI\
 
 

Suspicious files ____________________________________________________________
 

   C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GDVZFDQ2\FRST64[1].exe

      Size . . . . . . . : 2.198.528 bytes

      Age  . . . . . . . : 0.3 days (2015-11-06 12:50:38)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : D33E591C587FD3A772D55ED7718564DA16237D74FE6C5D108EA6611BDAA35A6F

      Needs elevation  . : Yes

      Fuzzy  . . . . . . : 24.0

         Program has no publisher information but prompts the user for permission elevation.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Time indicates that the file appeared recently on this computer.

      Forensic Cluster

         -0.2s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GDVZFDQ2\82[1].htm

         -0.2s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\LOQSOK05.txt

         -0.2s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\88Y1LCKB.txt

          0.0s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GDVZFDQ2\FRST64[1].exe

          0.0s C:\Users\Admin\Desktop\FRST64.exe

          0.8s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\87\922F1042B8692EF7.dat

          0.8s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\68\7E43BDF9BABC8E74.dat

          3.5s C:\Users\Admin\Desktop\FRST-OlderVersion\

          4.5s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\48\E744E92281773330.dat

          4.6s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\08\39D499AEF98EE6B0.dat
 

   C:\Users\Admin\Desktop\FRST-OlderVersion\FRST64.exe

      Size . . . . . . . : 2.198.016 bytes

      Age  . . . . . . . : 1.2 days (2015-11-05 14:30:03)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : 39FEF3436440B2FC7A998855C3C33446EA14A440EE9A07E1AB2140C46EEAF52E

      Needs elevation  . : Yes

      Fuzzy  . . . . . . : 24.0

         Program has no publisher information but prompts the user for permission elevation.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Time indicates that the file appeared recently on this computer.

      Forensic Cluster

          0.0s C:\Users\Admin\Desktop\FRST-OlderVersion\FRST64.exe

          3.6s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\73\4D667FACA8CA3F25.dat

          3.6s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\4\73\

          3.6s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\4\73\4D667FACA8CA3F25.dat

          6.0s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{4F7513BE-038F-445E-9417-D09C682D7AE6}

         29.1s C:\Windows\Prefetch\FRST64.EXE-3667DBA6.pf

         30.6s C:\FRST\Hives\

         30.6s C:\FRST\Logs\

         30.6s C:\FRST\

         30.6s C:\FRST\Quarantine\

         30.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{D780FC8B-7A6B-4BB9-9743-B34143F3BE53}

         30.9s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\3EED5C5703A7C712951A04592694CEA2

         31.7s C:\FRST\Hives\ERDNT.INF

         31.7s C:\FRST\Hives\ERDNT.CON

         31.7s C:\FRST\Hives\SAM

         31.7s C:\FRST\Hives\DEFAULT

         31.8s C:\FRST\Hives\SECURITY

         31.8s C:\FRST\Hives\SYSTEM

         31.9s C:\FRST\Hives\SOFTWARE

         32.1s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\40\9E4B90858055AAD4.dat

         32.2s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\26\4A6D46E8F573A0F6.dat

         32.4s C:\FRST\Hives\BCD

         32.5s C:\FRST\Hives\Users\

         32.5s C:\FRST\Hives\Users\00000001\

         32.5s C:\FRST\Hives\Users\00000001\NTUSER.DAT

         32.5s C:\FRST\Hives\Users\00000002\

         32.5s C:\FRST\Hives\Users\00000002\UsrClass.dat

         32.7s C:\FRST\Hives\ERDNT.EXE

         32.7s C:\FRST\Hives\ERDNTWIN.LOC

         32.7s C:\FRST\Hives\ERDNTDOS.LOC

         32.8s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\2\73\4D667FACA8CA3F25.dat

         45.8s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\76\776308D43420DF74.dat
 

   C:\Users\Admin\Desktop\FRST64.exe

      Size . . . . . . . : 2.198.528 bytes

      Age  . . . . . . . : 0.3 days (2015-11-06 12:50:38)

      Entropy  . . . . . : 7.6

      SHA-256  . . . . . : D33E591C587FD3A772D55ED7718564DA16237D74FE6C5D108EA6611BDAA35A6F

      Needs elevation  . : Yes

      Fuzzy  . . . . . . : 24.0

         Program has no publisher information but prompts the user for permission elevation.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Time indicates that the file appeared recently on this computer.

      Forensic Cluster

         -0.2s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GDVZFDQ2\82[1].htm

         -0.2s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\LOQSOK05.txt

         -0.2s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\88Y1LCKB.txt

         -0.0s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GDVZFDQ2\FRST64[1].exe

          0.0s C:\Users\Admin\Desktop\FRST64.exe

          0.8s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\87\922F1042B8692EF7.dat

          0.8s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\68\7E43BDF9BABC8E74.dat

          3.5s C:\Users\Admin\Desktop\FRST-OlderVersion\

          4.5s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\48\E744E92281773330.dat

          4.5s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\08\39D499AEF98EE6B0.dat
 
 

Potential Unwanted Programs _________________________________________________
 

   HKLM\SOFTWARE\Classes\AppID\{9F2949D6-977B-4B61-B513-0C2EE52C2B4F}\ (Acengine)

   HKLM\SOFTWARE\Classes\Interface\{00E3D575-A24C-4BBC-A708-BCDB8BBCA6C7}\ (Acengine)

   HKLM\SOFTWARE\Classes\Interface\{024BF4C8-B53D-45B9-957F-D3BA9655FF39}\ (Acengine)

   HKLM\SOFTWARE\Classes\Interface\{074DCA49-F6A1-417F-B79E-D5E3ADC30330}\ (Acengine)

   HKLM\SOFTWARE\Classes\Interface\{3323765B-5B83-4406-841E-473DBA4B8F29}\ (Acengine)

   HKLM\SOFTWARE\Classes\Interface\{389562C4-59D9-40C4-966E-28DA91725FFE}\ (Acengine)

   HKLM\SOFTWARE\Classes\Interface\{3F8D3B31-AEB8-4ED7-8B05-5556068D6B54}\ (Acengine)

   HKLM\SOFTWARE\Classes\Interface\{6ED1EF08-DFF4-4252-8986-691D06C54131}\ (Acengine)

   HKLM\SOFTWARE\Classes\Interface\{83E07061-02D1-41EC-8751-BB176B823C38}\ (Acengine)

   HKLM\SOFTWARE\Classes\Interface\{9F0948E7-227A-4F1B-9849-2D8912F185A7}\ (Acengine)

   HKLM\SOFTWARE\Classes\Interface\{A471A4AA-5C18-429F-81BF-6C760941DB74}\ (Acengine)

   HKLM\SOFTWARE\Classes\Interface\{C0A7C2B3-86D6-42AF-8221-79C9E4AD50BA}\ (Acengine)

   HKLM\SOFTWARE\Classes\Interface\{F2FB003D-07C7-4E4D-80E3-00B49468A6F4}\ (Acengine)

   HKLM\SOFTWARE\Classes\Interface\{F7971E81-FC71-4659-8CCE-C903576E0924}\ (Acengine)

   HKLM\SOFTWARE\Classes\Wow6432Node\AppID\{9F2949D6-977B-4B61-B513-0C2EE52C2B4F}\ (Acengine)

   HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{34EBA76A-E745-4B18-96C9-2B8E2BA8B246}\ (Acengine)

   HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{3A8E009B-E66D-4016-87CF-EC57FA9A4BC1}\ (Acengine)

   HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{4D4D0357-0376-4656-A040-65AC089E84A2}\ (Acengine)

   HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{6D5AF218-5F7E-40E0-B49D-54FFAFE2001A}\ (Acengine)

   HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{89E46EA6-2F87-4D79-8FFA-8B264F93F54A}\ (Acengine)

   HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{9ECCDEFC-1C26-4BB3-B6DF-252672D9FFFA}\ (Acengine)

   HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{F1BC674D-15D8-46C5-AC51-12AB16D67616}\ (Acengine)

   HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{F811C371-1DC7-4E2F-8676-D96B85BE4AF1}\ (Acengine)

   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{00E3D575-A24C-4BBC-A708-BCDB8BBCA6C7}\ (Acengine)

   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{024BF4C8-B53D-45B9-957F-D3BA9655FF39}\ (Acengine)

   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{074DCA49-F6A1-417F-B79E-D5E3ADC30330}\ (Acengine)

   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3323765B-5B83-4406-841E-473DBA4B8F29}\ (Acengine)

   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{389562C4-59D9-40C4-966E-28DA91725FFE}\ (Acengine)

   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3F8D3B31-AEB8-4ED7-8B05-5556068D6B54}\ (Acengine)

   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{6ED1EF08-DFF4-4252-8986-691D06C54131}\ (Acengine)

   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{83E07061-02D1-41EC-8751-BB176B823C38}\ (Acengine)

   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{9F0948E7-227A-4F1B-9849-2D8912F185A7}\ (Acengine)

   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{A471A4AA-5C18-429F-81BF-6C760941DB74}\ (Acengine)

   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{C0A7C2B3-86D6-42AF-8221-79C9E4AD50BA}\ (Acengine)

   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{F2FB003D-07C7-4E4D-80E3-00B49468A6F4}\ (Acengine)

   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{F7971E81-FC71-4659-8CCE-C903576E0924}\ (Acengine)

   HKU\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_\ (Crossrider)

   HKU\S-1-5-18\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_\ (Crossrider)

   HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_\ (Crossrider)

   HKU\S-1-5-21-3896126499-3315573620-1378135710-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_\ (Crossrider)

Die Logdatei von ESET:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# EOSSerial=ab736f9ea0dad34a8f47b055b2cb7a0e

# end=init

# utc_time=2015-11-06 07:13:52

# local_time=2015-11-06 08:13:52 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# osver=6.2.9200 NT 

Update Init

Update Download

Update Finalize

Updated modules version: 26602

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# EOSSerial=ab736f9ea0dad34a8f47b055b2cb7a0e

# end=updated

# utc_time=2015-11-06 07:16:41

# local_time=2015-11-06 08:16:41 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# osver=6.2.9200 NT 

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7777

# api_version=3.1.1

# EOSSerial=ab736f9ea0dad34a8f47b055b2cb7a0e

# engine=26602

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2015-11-06 08:17:30

# local_time=2015-11-06 09:17:30 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1031

# osver=6.2.9200 NT 

# compatibility_mode_1=''

# compatibility_mode=5893 16776573 100 94 4277 10315062 0 0

# scanned=204649

# found=39

# cleaned=0

# scan_time=3648

sh=E8102E3CB1CF555D01878EE3E29ED2CAC0331154 ft=1 fh=10dc493a6f8fa458 vn="Variante von Win32/Adware.ConvertAd.ABZ Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\03000200-1446646633-0500-0006-000700080009\hnsa9095.tmp.vir"

sh=300D82F78DA7ACA73AA37C5D5DC1855192E35A19 ft=1 fh=9f297330aabcb4b9 vn="Variante von Win32/Adware.ConvertAd.ABN Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\03000200-1446646633-0500-0006-000700080009\jnsr7AE8.tmp.vir"

sh=804F9C8AFBF710A910ED124A12D3B07D7D6468CF ft=1 fh=c71c0011fd4c8915 vn="Variante von Win32/Adware.ConvertAd.AAP Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\03000200-1446646633-0500-0006-000700080009\knsl5F8A.tmpfs.vir"

sh=54D65AE0D791D53C0322B3F914F2FAC349AA902A ft=1 fh=8538336621961c1a vn="Win32/Adware.ConvertAd.YY Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\03000200-1446646633-0500-0006-000700080009\Uninstall.exe.vir"

sh=628C4E53E2E36647B7DC7332F3E33665CE70F671 ft=1 fh=47ece30934908b20 vn="Mehrere Bedrohungen" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\03000200-1446646633-0500-0006-000700080009\vnsr460D.tmp.vir"

sh=FAA8FF39AF9C5DEA5654C8AEA04B445F779CE48B ft=1 fh=33339b5767a481f8 vn="Mehrere Bedrohungen" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\03000200-1446649120-0500-0006-000700080009\vnsn83C8.tmp.vir"

sh=32E88B4495F192995B985213AF28D57590C2D6B7 ft=1 fh=2a536d9de585a48e vn="Variante von Win32/Packed.Komodia.E verdÃ¤chtige Datei" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Fast-Search\ACDLL.dll.vir"

sh=76C4E256F7E8CE4E0E7DC4CD4A67D46B85DCF47B ft=1 fh=d3b35132675a3035 vn="Variante von Win64/Packed.Komodia.F verdÃ¤chtige Datei" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Fast-Search\ACDLL64.dll.vir"

sh=7FA9D4E48AB094CE5E45EC1938E5E7F7BF1B518D ft=1 fh=df1053b26fd5d9fd vn="Variante von Win64/Packed.Komodia.D verdÃ¤chtige Datei" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Fast-Search\ACDLL64.exe.vir"

sh=2A0DAD058E3B9918710EC62D8011E19C0DAFF008 ft=1 fh=9c16eb358d0788e0 vn="Variante von Win32/Packed.Komodia.E verdÃ¤chtige Datei" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Fast-Search\acengine.dll.vir"

sh=5F24F2D7F9CAC7C80C88355665F724C3F6071D26 ft=1 fh=cb34dbb550ae82e5 vn="Variante von Win32/Packed.Komodia.E verdÃ¤chtige Datei" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Fast-Search\acengine.exe.vir"

sh=7F52702D031995D0533F88D1B3F3B7768434E1DB ft=1 fh=9f84886b3143c62a vn="Variante von Win64/Packed.Komodia.E verdÃ¤chtige Datei" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Fast-Search\acengine64.dll.vir"

sh=89D8DB09BD7DA621F7599F0B6621A47837EDC674 ft=1 fh=fde5ee7cce37125c vn="Variante von Win32/Packed.Komodia.E verdÃ¤chtige Datei" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Fast-Search\acenginecert.dll.vir"

sh=C58CEEBFFE8182E00403C03ECF6354993DBA85B1 ft=1 fh=90dc33b9248d1c16 vn="Variante von Win32/Packed.Komodia.F verdÃ¤chtige Datei" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Fast-Search\lengine.exe.vir"

sh=54599F13385AA60EC39F85EC276A62A7C750EA56 ft=1 fh=34071684318313e6 vn="Variante von Win64/Packed.Komodia.D verdÃ¤chtige Datei" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Fast-Search\lengine64.exe.vir"

sh=DD4605E26B48B7C231DBEBA5E8FAA91F33D21B2B ft=1 fh=bb1ffd2794ad6ec5 vn="Win32/AlteredSoftware.F evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\globalupdate.exe.vir"

sh=DD4605E26B48B7C231DBEBA5E8FAA91F33D21B2B ft=1 fh=bb1ffd2794ad6ec5 vn="Win32/AlteredSoftware.F evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\globalupdate.exe.vir"

sh=08976B0143D7A77694D2B3014053542C42F4774E ft=1 fh=67450ef68c8fc670 vn="Win32/AlteredSoftware.H evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\globalupdateBroker.exe.vir"

sh=DD4605E26B48B7C231DBEBA5E8FAA91F33D21B2B ft=1 fh=bb1ffd2794ad6ec5 vn="Win32/AlteredSoftware.F evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\globalupdateCrashHandler.exe.vir"

sh=FE3BD67B77BB38A3110091D17DE69012FAAD4FA6 ft=1 fh=67450ef6f68fd149 vn="Win32/AlteredSoftware.H evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\globalupdateOnDemand.exe.vir"

sh=3C0D9D3A966B1954FEAEAD3BE6358A2AB42385C4 ft=1 fh=c71c001178de99b1 vn="Variante von Win32/AlteredSoftware.A evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\goopdate.dll.vir"

sh=5CFD5CECD9E35ED6C11651D499D9E45FA4E3B295 ft=1 fh=e858233d4598588e vn="Variante von Win32/AlteredSoftware.J evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\goopdateres_en.dll.vir"

sh=7B023A2C73FBCB281999C13780C0561E366CE3EF ft=1 fh=c71c00119a74eb7c vn="Variante von Win32/AlteredSoftware.E evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\npglobalupdateUpdate4.dll.vir"

sh=BD08E733D803A193E4FA4118A6D52BCD0FC98F81 ft=1 fh=c71c0011371aa7ff vn="Variante von Win32/AlteredSoftware.G evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\psmachine.dll.vir"

sh=9AE1636DE7E3CB630B3A2C11E41C76BF0B716CCD ft=1 fh=c71c0011864645d3 vn="Variante von Win32/AlteredSoftware.G evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\psuser.dll.vir"

sh=5FFAF9301BF75E359D287D06B9B5380AE41D8920 ft=1 fh=be62b22f47cea8a2 vn="Variante von Win32/Adware.ConvertAd.ACA.gen Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\03000200-1446650279-0500-0006-000700080009\2152.tmp.vir"

sh=5FFAF9301BF75E359D287D06B9B5380AE41D8920 ft=1 fh=be62b22f47cea8a2 vn="Variante von Win32/Adware.ConvertAd.ACA.gen Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\03000200-1446650279-0500-0006-000700080009\522E.tmp.vir"

sh=AAA0879216B13959E04E87EF6FE3C4090DB560BF ft=1 fh=c71c00118e08d5b5 vn="Variante von Win32/Adware.ConvertAd.ABX Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\03000200-1446650279-0500-0006-000700080009\snsnFB85.tmp.vir"

sh=7F52702D031995D0533F88D1B3F3B7768434E1DB ft=1 fh=9f84886b3143c62a vn="Variante von Win64/Packed.Komodia.E verdÃ¤chtige Datei" ac=I fn="C:\AdwCleaner\Quarantine\C\WINDOWS\SysNative\acengine64.dll.vir"

sh=879FAF187CB063AF8FCA4C404E7B549A6D96CF37 ft=1 fh=9193f08fb8b52cac vn="Variante von Win64/NetFilter.A potenziell unsichere Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\WINDOWS\SysNative\drivers\swsedrvr_vw_1_10_0_25.sys.vir"

sh=2A0DAD058E3B9918710EC62D8011E19C0DAFF008 ft=1 fh=9c16eb358d0788e0 vn="Variante von Win32/Packed.Komodia.E verdÃ¤chtige Datei" ac=I fn="C:\AdwCleaner\Quarantine\C\WINDOWS\SysWOW64\acengine.dll.vir"

sh=C28052B54F49AACF8660C7759B076341257F2241 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.I evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Admin\AppData\Roaming\28Arly8BQ3IUn.xBAD"

sh=C28052B54F49AACF8660C7759B076341257F2241 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.I evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Admin\AppData\Roaming\bSUwmicbiyVJJ5rnrs.xBAD"

sh=08715FB4D3045EE5BEC821DB3315FB4ED459DB49 ft=1 fh=cf3a24109b2aac41 vn="Variante von MSIL/HackTool.IdleKMS.E potenziell unsichere Anwendung" ac=I fn="C:\Program Files\KMSpico\KMSELDI.exe"

sh=1DBA0B16BF2570C32B991CC018C112500D7B333C ft=1 fh=a0c3866843c32de8 vn="Variante von MSIL/HackTool.IdleKMS.C potenziell unsichere Anwendung" ac=I fn="C:\Program Files\KMSpico\Service_KMS.exe"

sh=86949D0A4B5EAC5D2D921E673DA3D0016152C5EB ft=1 fh=78e8d192b38125e3 vn="Variante von Win32/InstallCore.ADD evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\Users\Admin\Desktop\Felgen\CCleaner_Setup.exe"

sh=66E99AD765E95D90F7CB30EB9D0323C42DFA81FB ft=1 fh=39e044100eb41b68 vn="Variante von Win32/DownloadSponsor.C evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\Users\Admin\Downloads\VLC media player 64 Bit - CHIP-Installer.exe"

sh=6EF8310627537B1D24409574BC3C398CD97C474C ft=1 fh=8f545065e84edd76 vn="Win64/HackKMS.D potenziell unsichere Anwendung" ac=I fn="C:\Windows\SECOH-QAD.dll"

sh=66C72019EAFA41BBF3E708CC3824C7C4447BDAB6 ft=1 fh=0a46a8abafa4da1b vn="Win64/HackKMS.C potenziell unsichere Anwendung" ac=I fn="C:\Windows\SECOH-QAD.exe"

und der Upload ist auch getätigt:

Datei: Quarantine.zip empfangen
/usr/bin/zip -P infected -j /var/www/vhosts/trojaner-board.de/upload.trojaner-board.de/files/151106-2145_Quarantine.zip.zip /var/www/vhosts/trojaner-board.de/upload.trojaner-board.de/files/Quarantine.zip
Vorgang erfolgreich abgeschlossen.

Vielen Dank !

M-K-D-B

07.11.2015 00:13

Servus,

vielen Dank für den Upload. :)

Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

start

C:\Program Files\KMSpico

C:\Users\Admin\Desktop\Felgen\CCleaner_Setup.exe

C:\Users\Admin\Downloads\*CHIP-Installer.exe

C:\Windows\SECOH-QAD.exe

C:\Windows\SECOH-QAD.dll

DeleteKey: HKLM\SOFTWARE\Classes\AppID\{9F2949D6-977B-4B61-B513-0C2EE52C2B4F}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{00E3D575-A24C-4BBC-A708-BCDB8BBCA6C7}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{024BF4C8-B53D-45B9-957F-D3BA9655FF39}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{074DCA49-F6A1-417F-B79E-D5E3ADC30330}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{3323765B-5B83-4406-841E-473DBA4B8F29}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{389562C4-59D9-40C4-966E-28DA91725FFE}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{3F8D3B31-AEB8-4ED7-8B05-5556068D6B54}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{6ED1EF08-DFF4-4252-8986-691D06C54131}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{83E07061-02D1-41EC-8751-BB176B823C38}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{9F0948E7-227A-4F1B-9849-2D8912F185A7}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{A471A4AA-5C18-429F-81BF-6C760941DB74}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{C0A7C2B3-86D6-42AF-8221-79C9E4AD50BA}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{F2FB003D-07C7-4E4D-80E3-00B49468A6F4}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{F7971E81-FC71-4659-8CCE-C903576E0924}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\AppID\{9F2949D6-977B-4B61-B513-0C2EE52C2B4F}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{34EBA76A-E745-4B18-96C9-2B8E2BA8B246}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{3A8E009B-E66D-4016-87CF-EC57FA9A4BC1}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{4D4D0357-0376-4656-A040-65AC089E84A2}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{6D5AF218-5F7E-40E0-B49D-54FFAFE2001A}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{89E46EA6-2F87-4D79-8FFA-8B264F93F54A}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{9ECCDEFC-1C26-4BB3-B6DF-252672D9FFFA}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{F1BC674D-15D8-46C5-AC51-12AB16D67616}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{F811C371-1DC7-4E2F-8676-D96B85BE4AF1}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{00E3D575-A24C-4BBC-A708-BCDB8BBCA6C7}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{024BF4C8-B53D-45B9-957F-D3BA9655FF39}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{074DCA49-F6A1-417F-B79E-D5E3ADC30330}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3323765B-5B83-4406-841E-473DBA4B8F29}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{389562C4-59D9-40C4-966E-28DA91725FFE}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3F8D3B31-AEB8-4ED7-8B05-5556068D6B54}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{6ED1EF08-DFF4-4252-8986-691D06C54131}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{83E07061-02D1-41EC-8751-BB176B823C38}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{9F0948E7-227A-4F1B-9849-2D8912F185A7}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{A471A4AA-5C18-429F-81BF-6C760941DB74}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{C0A7C2B3-86D6-42AF-8221-79C9E4AD50BA}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{F2FB003D-07C7-4E4D-80E3-00B49468A6F4}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{F7971E81-FC71-4659-8CCE-C903576E0924}

DeleteKey: HKU\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_

DeleteKey: HKU\S-1-5-18\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_

DeleteKey: HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_

DeleteKey: HKU\S-1-5-21-3896126499-3315573620-1378135710-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_

Reboot:

end

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2
Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

Schritt 3
Downloade dir bitte

Farbar Service Scanner

Starte das Tool mit Doppelklick auf die FSS.exe
Gehe sicher, dass folgende Optionen angehakt sind.
- Internet Services
- Windows Firewall
- System Restore
- Security Center/Action Center
- Windows Update
- Windows Defender
- Other Services
Klicke auf Scan.
Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.

Schritt 4

Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Untersuchen.
FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
Poste mir beide Logdateien mit deiner nächsten Antwort.

Wie läuft dein Rechner momentan? Gibt es noch Probleme mit EasyCalender? Wenn ja, in welchem Browser?

Bitte poste mit deiner nächsten Antwort

die Logdatei des FRST-Fix,
die Logdatei desSecurityCheck,
die Logdatei von FSS,
die beiden neuen Logdateien von FRST,
die Beantwortung der gestellten Fragen.

Martiba

07.11.2015 01:31

Guten Abend Matthias!

also erstmal die Antwort auf die Frage: Mein PC an sich lief schon flüssig nachdem ich die seltsamen Programme die sich mit der Freeware runtergeladen hatten wieder Deinstalliert hatte (zumindest die die ich problemlos deinstallieren konnte..). Nur mein Google Chrome Browser hatte Probleme mit dem EasyCalender und, dass dieser auf so gut wie jeder Seite etliche Werbebanner geschaltet hatte, sodass man die Seite nicht mehr erkennen konnte. Nun hab ich eben nochmal getestet und der EasyCalender ist tatsächlich verschwunden und auch die Werbung scheint nicht mehr aufzupoppen, dafür erstmal ein RIESEN Dankeschön!!!

nun noch die Logdateien vom Fixlog:

Code:

Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version:05-11-2015

durchgeführt von Admin (2015-11-07 01:17:52) Run:2

Gestartet von C:\Users\Admin\Desktop

Geladene Profile: Admin (Verfügbare Profile: Admin)

Start-Modus: Normal

==============================================
 

fixlist Inhalt:

*****************

start

C:\Program Files\KMSpico

C:\Users\Admin\Desktop\Felgen\CCleaner_Setup.exe

C:\Users\Admin\Downloads\*CHIP-Installer.exe

C:\Windows\SECOH-QAD.exe

C:\Windows\SECOH-QAD.dll

DeleteKey: HKLM\SOFTWARE\Classes\AppID\{9F2949D6-977B-4B61-B513-0C2EE52C2B4F}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{00E3D575-A24C-4BBC-A708-BCDB8BBCA6C7}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{024BF4C8-B53D-45B9-957F-D3BA9655FF39}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{074DCA49-F6A1-417F-B79E-D5E3ADC30330}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{3323765B-5B83-4406-841E-473DBA4B8F29}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{389562C4-59D9-40C4-966E-28DA91725FFE}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{3F8D3B31-AEB8-4ED7-8B05-5556068D6B54}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{6ED1EF08-DFF4-4252-8986-691D06C54131}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{83E07061-02D1-41EC-8751-BB176B823C38}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{9F0948E7-227A-4F1B-9849-2D8912F185A7}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{A471A4AA-5C18-429F-81BF-6C760941DB74}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{C0A7C2B3-86D6-42AF-8221-79C9E4AD50BA}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{F2FB003D-07C7-4E4D-80E3-00B49468A6F4}

DeleteKey: HKLM\SOFTWARE\Classes\Interface\{F7971E81-FC71-4659-8CCE-C903576E0924}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\AppID\{9F2949D6-977B-4B61-B513-0C2EE52C2B4F}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{34EBA76A-E745-4B18-96C9-2B8E2BA8B246}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{3A8E009B-E66D-4016-87CF-EC57FA9A4BC1}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{4D4D0357-0376-4656-A040-65AC089E84A2}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{6D5AF218-5F7E-40E0-B49D-54FFAFE2001A}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{89E46EA6-2F87-4D79-8FFA-8B264F93F54A}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{9ECCDEFC-1C26-4BB3-B6DF-252672D9FFFA}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{F1BC674D-15D8-46C5-AC51-12AB16D67616}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{F811C371-1DC7-4E2F-8676-D96B85BE4AF1}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{00E3D575-A24C-4BBC-A708-BCDB8BBCA6C7}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{024BF4C8-B53D-45B9-957F-D3BA9655FF39}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{074DCA49-F6A1-417F-B79E-D5E3ADC30330}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3323765B-5B83-4406-841E-473DBA4B8F29}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{389562C4-59D9-40C4-966E-28DA91725FFE}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3F8D3B31-AEB8-4ED7-8B05-5556068D6B54}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{6ED1EF08-DFF4-4252-8986-691D06C54131}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{83E07061-02D1-41EC-8751-BB176B823C38}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{9F0948E7-227A-4F1B-9849-2D8912F185A7}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{A471A4AA-5C18-429F-81BF-6C760941DB74}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{C0A7C2B3-86D6-42AF-8221-79C9E4AD50BA}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{F2FB003D-07C7-4E4D-80E3-00B49468A6F4}

DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{F7971E81-FC71-4659-8CCE-C903576E0924}

DeleteKey: HKU\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_

DeleteKey: HKU\S-1-5-18\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_

DeleteKey: HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_

DeleteKey: HKU\S-1-5-21-3896126499-3315573620-1378135710-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_

Reboot:

end
 

*****************
 

C:\Program Files\KMSpico => erfolgreich verschoben

C:\Users\Admin\Desktop\Felgen\CCleaner_Setup.exe => erfolgreich verschoben
 

=========== "C:\Users\Admin\Downloads\*CHIP-Installer.exe" ==========
 

C:\Users\Admin\Downloads\VLC media player 64 Bit - CHIP-Installer.exe => erfolgreich verschoben
 

========= Ende -> "C:\Users\Admin\Downloads\*CHIP-Installer.exe" ========
 

C:\Windows\SECOH-QAD.exe => erfolgreich verschoben

C:\Windows\SECOH-QAD.dll => erfolgreich verschoben

HKLM\SOFTWARE\Classes\AppID\{9F2949D6-977B-4B61-B513-0C2EE52C2B4F} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Interface\{00E3D575-A24C-4BBC-A708-BCDB8BBCA6C7} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Interface\{00E3D575-A24C-4BBC-A708-BCDB8BBCA6C7} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Interface\{024BF4C8-B53D-45B9-957F-D3BA9655FF39} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Interface\{024BF4C8-B53D-45B9-957F-D3BA9655FF39} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Interface\{074DCA49-F6A1-417F-B79E-D5E3ADC30330} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Interface\{074DCA49-F6A1-417F-B79E-D5E3ADC30330} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Interface\{3323765B-5B83-4406-841E-473DBA4B8F29} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Interface\{3323765B-5B83-4406-841E-473DBA4B8F29} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Interface\{389562C4-59D9-40C4-966E-28DA91725FFE} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Interface\{389562C4-59D9-40C4-966E-28DA91725FFE} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Interface\{3F8D3B31-AEB8-4ED7-8B05-5556068D6B54} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Interface\{3F8D3B31-AEB8-4ED7-8B05-5556068D6B54} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Interface\{6ED1EF08-DFF4-4252-8986-691D06C54131} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Interface\{6ED1EF08-DFF4-4252-8986-691D06C54131} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Interface\{83E07061-02D1-41EC-8751-BB176B823C38} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Interface\{83E07061-02D1-41EC-8751-BB176B823C38} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Interface\{9F0948E7-227A-4F1B-9849-2D8912F185A7} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Interface\{9F0948E7-227A-4F1B-9849-2D8912F185A7} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Interface\{A471A4AA-5C18-429F-81BF-6C760941DB74} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Interface\{A471A4AA-5C18-429F-81BF-6C760941DB74} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Interface\{C0A7C2B3-86D6-42AF-8221-79C9E4AD50BA} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Interface\{C0A7C2B3-86D6-42AF-8221-79C9E4AD50BA} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Interface\{F2FB003D-07C7-4E4D-80E3-00B49468A6F4} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Interface\{F2FB003D-07C7-4E4D-80E3-00B49468A6F4} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Interface\{F7971E81-FC71-4659-8CCE-C903576E0924} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Interface\{F7971E81-FC71-4659-8CCE-C903576E0924} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Wow6432Node\AppID\{9F2949D6-977B-4B61-B513-0C2EE52C2B4F} => Schlüssel nicht gefunden. 

HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{34EBA76A-E745-4B18-96C9-2B8E2BA8B246} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{34EBA76A-E745-4B18-96C9-2B8E2BA8B246} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{3A8E009B-E66D-4016-87CF-EC57FA9A4BC1} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{3A8E009B-E66D-4016-87CF-EC57FA9A4BC1} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{4D4D0357-0376-4656-A040-65AC089E84A2} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{4D4D0357-0376-4656-A040-65AC089E84A2} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{6D5AF218-5F7E-40E0-B49D-54FFAFE2001A} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{6D5AF218-5F7E-40E0-B49D-54FFAFE2001A} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{89E46EA6-2F87-4D79-8FFA-8B264F93F54A} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{89E46EA6-2F87-4D79-8FFA-8B264F93F54A} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{9ECCDEFC-1C26-4BB3-B6DF-252672D9FFFA} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{9ECCDEFC-1C26-4BB3-B6DF-252672D9FFFA} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{F1BC674D-15D8-46C5-AC51-12AB16D67616} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{F1BC674D-15D8-46C5-AC51-12AB16D67616} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{F811C371-1DC7-4E2F-8676-D96B85BE4AF1} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{F811C371-1DC7-4E2F-8676-D96B85BE4AF1} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{00E3D575-A24C-4BBC-A708-BCDB8BBCA6C7} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{00E3D575-A24C-4BBC-A708-BCDB8BBCA6C7} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{024BF4C8-B53D-45B9-957F-D3BA9655FF39} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{024BF4C8-B53D-45B9-957F-D3BA9655FF39} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{074DCA49-F6A1-417F-B79E-D5E3ADC30330} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{074DCA49-F6A1-417F-B79E-D5E3ADC30330} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3323765B-5B83-4406-841E-473DBA4B8F29} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3323765B-5B83-4406-841E-473DBA4B8F29} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{389562C4-59D9-40C4-966E-28DA91725FFE} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{389562C4-59D9-40C4-966E-28DA91725FFE} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3F8D3B31-AEB8-4ED7-8B05-5556068D6B54} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3F8D3B31-AEB8-4ED7-8B05-5556068D6B54} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{6ED1EF08-DFF4-4252-8986-691D06C54131} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{6ED1EF08-DFF4-4252-8986-691D06C54131} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{83E07061-02D1-41EC-8751-BB176B823C38} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{83E07061-02D1-41EC-8751-BB176B823C38} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{9F0948E7-227A-4F1B-9849-2D8912F185A7} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{9F0948E7-227A-4F1B-9849-2D8912F185A7} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{A471A4AA-5C18-429F-81BF-6C760941DB74} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{A471A4AA-5C18-429F-81BF-6C760941DB74} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{C0A7C2B3-86D6-42AF-8221-79C9E4AD50BA} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{C0A7C2B3-86D6-42AF-8221-79C9E4AD50BA} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{F2FB003D-07C7-4E4D-80E3-00B49468A6F4} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{F2FB003D-07C7-4E4D-80E3-00B49468A6F4} => Schlüssel erfolgreich entfernt

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{F7971E81-FC71-4659-8CCE-C903576E0924} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{F7971E81-FC71-4659-8CCE-C903576E0924} => Schlüssel erfolgreich entfernt

HKU\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_ => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKU\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_ => Schlüssel erfolgreich entfernt

HKU\S-1-5-18\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_ => Schlüssel nicht gefunden. 

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_ => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_ => Schlüssel erfolgreich entfernt

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_ => Schlüssel nicht gefunden. 
 
 

Das System musste neu gestartet werden.
 

==== Ende von Fixlog 01:17:54 ====

Die Logdatei des SecurityChecks:

Code:

 Results of screen317's Security Check version 1.009  

   x64 (UAC is enabled)  

 Internet Explorer 11  
 ``````````````Antivirus/Firewall Check:`````````````` 

Windows Defender   

 WMI entry may not exist for antivirus; attempting automatic update. 
 `````````Anti-malware/Other Utilities Check:````````` 

 Java 8 Update 31  

 Java version 32-bit out of Date! 

 Adobe Reader XI  

 Google Chrome (46.0.2490.71) 

 Google Chrome (46.0.2490.80) 
 ````````Process Check: objlist.exe by Laurent````````  

 Windows Defender MSMpEng.exe 

 Malwarebytes Anti-Malware mbamservice.exe  

 Malwarebytes Anti-Malware mbam.exe  

 Malwarebytes Anti-Malware mbamscheduler.exe   
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  % 
 ````````````````````End of Log``````````````````````

Die Logdateien vom FSS:

Code:

Farbar Service Scanner Version: 26-07-2015

Ran by Admin (administrator) on 07-11-2015 at 01:23:11

Running from "C:\Users\Admin\Downloads"

Microsoft Windows 10 Pro  (X64)

Boot Mode: Normal

****************************************************************
 

Internet Services:

============
 

Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Google.com is accessible.

Yahoo.com is accessible.
 
 

Windows Firewall:

=============
 

Firewall Disabled Policy: 

==================
 
 

System Restore:

============
 

System Restore Policy: 

========================
 
 

Action Center:

============
 
 

Windows Update:

============
 

Windows Autoupdate Disabled Policy: 

============================
 
 

Windows Defender:

==============
 

Other Services:

==============
 
 

File Check:

========

C:\Windows\System32\nsisvc.dll => File is digitally signed

C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed

C:\Windows\System32\dhcpcore.dll => File is digitally signed

C:\Windows\System32\drivers\afd.sys => File is digitally signed

C:\Windows\System32\drivers\tdx.sys => File is digitally signed

C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed

C:\Windows\System32\dnsrslvr.dll => File is digitally signed

C:\Windows\System32\mpssvc.dll => File is digitally signed

C:\Windows\System32\bfe.dll => File is digitally signed

C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed

C:\Windows\System32\wscsvc.dll => File is digitally signed

C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed

C:\Windows\System32\wuaueng.dll => File is digitally signed

C:\Windows\System32\qmgr.dll => File is digitally signed

C:\Windows\System32\es.dll => File is digitally signed

C:\Windows\System32\cryptsvc.dll => File is digitally signed

C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed

C:\Program Files\Windows Defender\MsMpEng.exe => File is digitally signed

C:\Windows\System32\ipnathlp.dll => File is digitally signed

C:\Windows\System32\iphlpsvc.dll => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed
 
 

**** End of log ****

Die beiden neuen Logdateien vom FRST

FRST:

Code:

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:05-11-2015

durchgeführt von Admin (Administrator) auf PC (07-11-2015 01:23:55)

Gestartet von C:\Users\Admin\Desktop

Geladene Profile: Admin (Verfügbare Profile: Admin)

Platform: Windows 10 Pro (X64) Sprache: Deutsch (Deutschland)

Internet Explorer Version 11 (Standard-Browser: Edge)

Start-Modus: Normal

Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Prozesse (Nicht auf der Ausnahmeliste) =================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

() C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\spd.exe

(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe

(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe

(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe

(Microsoft Corporation) C:\Windows\System32\browser_broker.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\cfosspeed.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(FNet Co., Ltd.) C:\Program Files (x86)\XFastUSB\XFastUsb.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Kone Pure Mouse\KonePureMonitor.exe

(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\ActionUriServer.exe

(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Nicht auf der Ausnahmeliste) ===========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13636824 2013-07-26] (Realtek Semiconductor)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)

HKLM\...\Run: [XFast LAN] => C:\Program Files\ASRock\XFast LAN\cFosSpeed.exe [2009952 2013-05-31] (cFos Software GmbH)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169744 2015-09-12] (Apple Inc.)

HKLM-x32\...\Run: [XFastUSB] => C:\Program Files (x86)\XFastUSB\XFastUsb.exe [6311104 2014-12-15] (FNet Co., Ltd.)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-21] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [RoccatKonePure] => C:\Program Files (x86)\ROCCAT\Kone Pure Mouse\KonePureMonitor.EXE [561152 2014-01-20] (ROCCAT GmbH)

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Admin\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.)

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Spotify Web Helper] => C:\Users\Admin\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2021944 2015-06-17] (Spotify Ltd)

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [Spotify] => C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe [7323192 2015-06-17] (Spotify Ltd)

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8551848 2015-10-19] (Piriform Ltd)

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Run: [GoogleChromeAutoLaunch_A5B343D047FD8BD2F268B0EA0F8DBD7C] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [811848 2015-10-20] (Google Inc.)

HKU\S-1-5-18\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [43816 2015-04-26] (Apple Inc.)

Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2015-11-06]

ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation)
 

==================== Internet (Nicht auf der Ausnahmeliste) ====================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
 

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

Tcpip\..\Interfaces\{947ba08f-6d7e-4686-b9ff-2806db41b1ff}: [DhcpNameServer] 192.168.0.1
 

Internet Explorer:

==================

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com

BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-09-29] (Microsoft Corporation)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-25] (Google Inc.)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-15] (Microsoft Corporation)

BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-09-29] (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-21] (Oracle Corporation)

BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-25] (Google Inc.)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-15] (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-21] (Oracle Corporation)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-25] (Google Inc.)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-25] (Google Inc.)

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-10-14] (Microsoft Corporation)
 

FireFox:

========

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-09-04] ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-03] (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-03] (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-21] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-21] (Oracle Corporation)

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-03-31] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-19] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-19] (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-09-27] (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-03-31] (Microsoft Corporation)
 

Chrome: 

=======

CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-05]

CHR Extension: (Google Drive) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-23]

CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24]

CHR Extension: (Google-Suche) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-28]

CHR Extension: (LoungeDestroyer) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghahcnmfjfckcedfajbhekgknjdplfcl [2015-10-07]

CHR Extension: (Google Text & Tabellen Offline) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-03]

CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-25]

CHR Extension: (Google Mail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-29]
 

==================== Dienste (Nicht auf der Ausnahmeliste) ========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-09-02] (Apple Inc.)

R2 ASRockIOMon; C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe [454656 2013-05-28] () [Datei ist nicht signiert]

R2 cFosSpeedS; C:\Program Files\ASRock\XFast LAN\spd.exe [652640 2013-05-31] (cFos Software GmbH)

S3 Futuremark SystemInfo Service; C:\Program Files (x86)\Futuremark\SystemInfo\FMSISvc.exe [614624 2014-12-10] (Futuremark)

R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)

R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [Datei ist nicht signiert]

S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-03] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-03] (Intel Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)

R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation)

S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [X]
 

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.)

S3 AsrDrv101; C:\Windows\SysWOW64\Drivers\AsrDrv101.sys [22280 2014-12-16] (ASRock Incorporation)

R0 AsrRamDisk; C:\Windows\System32\drivers\AsrRamDisk.sys [40200 2013-05-09] (ASRock Inc.)

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [102912 2015-07-15] (Advanced Micro Devices)

S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)

S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)

R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [16648 2014-12-15] (FNet Co., Ltd.)

R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)

R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2015-11-07] (Malwarebytes)

R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)

R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-03] (Intel Corporation)

R3 sthid; C:\Windows\System32\drivers\sthid.sys [21216 2014-08-06] (Splashtop Inc.)

S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] ()

S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-07-10] (Microsoft Corporation)

R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [291680 2015-07-10] (Microsoft Corporation)

R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation)

S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]
 

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
 

==================== Ein Monat: Erstellte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2015-11-07 01:23 - 2015-11-07 01:23 - 00002284 _____ C:\WINDOWS\SysWOW64\FSS.txt

2015-11-07 01:23 - 2015-11-07 01:23 - 00002284 _____ C:\Users\Admin\Desktop\FSS.txt

2015-11-07 01:22 - 2015-11-07 01:22 - 00899072 _____ (Farbar) C:\Users\Admin\Downloads\FSS.exe

2015-11-07 01:22 - 2015-11-07 01:22 - 00000936 _____ C:\Users\Admin\Desktop\checkup.txt

2015-11-07 01:20 - 2015-11-07 01:20 - 00852720 _____ C:\Users\Admin\Desktop\SecurityCheck.exe

2015-11-07 01:19 - 2015-11-07 01:19 - 00016148 _____ C:\WINDOWS\system32\PC_Admin_HistoryPrediction.bin

2015-11-06 21:33 - 2015-11-06 21:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

2015-11-06 21:33 - 2015-11-06 21:33 - 00000000 ____D C:\Program Files\7-Zip

2015-11-06 21:32 - 2015-11-06 21:32 - 01513472 _____ C:\Users\Admin\Downloads\7z938-x64.msi

2015-11-06 20:13 - 2015-11-06 20:13 - 02870984 _____ (ESET) C:\Users\Admin\Desktop\esetsmartinstaller_deu.exe

2015-11-06 20:13 - 2015-11-06 20:13 - 00000000 ____D C:\Program Files (x86)\ESET

2015-11-06 20:11 - 2015-11-06 20:11 - 00024646 _____ C:\Users\Admin\Desktop\HitmanPro_20151106_2011.log

2015-11-06 20:02 - 2015-11-06 20:11 - 00000000 ____D C:\ProgramData\HitmanPro

2015-11-06 20:00 - 2015-11-06 20:01 - 11337112 _____ (SurfRight B.V.) C:\Users\Admin\Desktop\HitmanPro_x64.exe

2015-11-06 13:10 - 2015-11-06 13:10 - 00001740 _____ C:\Users\Admin\Desktop\Search.txt

2015-11-06 12:51 - 2015-11-06 12:51 - 00036247 _____ C:\Users\Admin\Desktop\Addition.txt

2015-11-06 12:50 - 2015-11-06 12:50 - 00000000 ____D C:\Users\Admin\Desktop\FRST-OlderVersion

2015-11-06 12:46 - 2015-11-06 12:46 - 00001283 _____ C:\Users\Admin\Desktop\JRT.txt

2015-11-06 12:43 - 2015-11-06 12:43 - 01798976 _____ (Malwarebytes) C:\Users\Admin\Desktop\JRT.exe

2015-11-06 12:43 - 2015-11-06 12:43 - 00010166 _____ C:\Users\Admin\Desktop\mbam.txt

2015-11-06 12:12 - 2015-11-07 01:19 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2015-11-06 12:11 - 2015-11-06 12:37 - 00001169 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-11-06 12:11 - 2015-11-06 12:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-11-06 12:11 - 2015-11-06 12:11 - 00000000 ____D C:\ProgramData\Malwarebytes

2015-11-06 12:11 - 2015-11-06 12:11 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-11-06 12:11 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2015-11-06 12:11 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys

2015-11-06 12:11 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys

2015-11-06 12:10 - 2015-11-06 12:11 - 22908888 _____ (Malwarebytes ) C:\Users\Admin\Downloads\mbam-setup-2.2.0.1024.exe

2015-11-06 12:09 - 2015-11-06 12:09 - 00002073 _____ C:\Users\Admin\Desktop\AdwCleaner[C3].txt

2015-11-06 12:08 - 2015-11-06 19:57 - 00015208 _____ C:\WINDOWS\PFRO.log

2015-11-06 12:05 - 2015-11-06 12:05 - 01713664 _____ C:\Users\Admin\Downloads\AdwCleaner_5.018.exe

2015-11-05 14:32 - 2015-11-07 01:24 - 00016899 _____ C:\Users\Admin\Desktop\FRST.txt

2015-11-05 14:31 - 2015-11-05 14:31 - 04404952 _____ (Kaspersky Lab ZAO) C:\Users\Admin\Desktop\tdsskiller.exe

2015-11-05 14:30 - 2015-11-07 01:23 - 00000000 ____D C:\FRST

2015-11-05 14:30 - 2015-11-06 12:50 - 02198528 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe

2015-11-05 14:13 - 2015-11-05 14:13 - 04944608 _____ (Advanced Micro Devices, Inc.) C:\Users\Admin\Downloads\autodetectutility.exe

2015-11-05 14:00 - 2015-11-05 14:00 - 00000000 ___HD C:\OneDriveTemp

2015-11-05 12:12 - 2015-11-05 12:12 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (3).exe

2015-11-04 17:15 - 2015-11-04 17:15 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (2).exe

2015-11-04 17:08 - 2015-11-06 12:07 - 00000000 ____D C:\AdwCleaner

2015-11-04 17:08 - 2015-11-04 17:08 - 01708032 _____ C:\Users\Admin\Downloads\adwcleaner_5.017 (1).exe

2015-11-04 16:49 - 2015-11-07 01:18 - 00000275 _____ C:\WINDOWS\WindowsUpdate.log

2015-11-04 16:49 - 2015-11-04 16:49 - 00000000 ____D C:\$SysReset

2015-11-04 16:34 - 2015-11-06 12:37 - 00000901 _____ C:\Users\Public\Desktop\CCleaner.lnk

2015-11-04 16:34 - 2015-11-04 16:34 - 00002844 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC

2015-11-04 16:34 - 2015-11-04 16:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

2015-11-04 16:34 - 2015-11-04 16:34 - 00000000 ____D C:\Program Files\CCleaner

2015-11-04 16:33 - 2015-11-04 16:34 - 05524624 _____ (Piriform Ltd) C:\Users\Admin\Downloads\ccsetup511_slim.exe

2015-11-04 16:14 - 2015-11-04 16:23 - 00000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job

2015-11-04 16:13 - 2015-11-04 16:13 - 00000000 ____D C:\WINDOWS\pss

2015-11-04 15:17 - 2015-11-04 16:00 - 00000004 _____ C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7

2015-11-04 15:17 - 2013-08-22 14:25 - 00000824 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak

2015-11-04 15:15 - 2015-11-04 15:39 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Opera Software

2015-11-04 15:15 - 2015-11-04 15:39 - 00000000 ____D C:\Users\Admin\AppData\Local\Opera Software

2015-11-04 15:12 - 2015-11-04 15:39 - 00000000 ____D C:\Program Files (x86)\Opera

2015-10-30 17:15 - 2015-10-30 17:15 - 00000000 ____D C:\ProgramData\ROCCAT

2015-10-30 17:15 - 2015-10-30 17:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ROCCAT

2015-10-30 17:14 - 2015-10-30 17:14 - 24907859 _____ C:\Users\Admin\Downloads\ROCCAT_Kone_Pure_DRV1.14_FW1.21.zip

2015-10-30 17:14 - 2015-10-30 17:14 - 00000000 ____D C:\Program Files (x86)\ROCCAT

2015-10-30 17:14 - 2014-01-20 10:53 - 73113600 _____ (ROCCAT GmbH) C:\Users\Admin\Desktop\KonePureOption.exe

2015-10-30 17:13 - 2015-10-28 00:38 - 21871616 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll

2015-10-30 17:13 - 2015-10-28 00:16 - 18801664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll

2015-10-30 17:13 - 2015-10-21 13:45 - 00541024 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcupdate_GenuineIntel.dll

2015-10-30 17:13 - 2015-10-21 13:44 - 00459104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys

2015-10-30 17:13 - 2015-10-21 13:43 - 01392480 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll

2015-10-30 17:13 - 2015-10-21 13:39 - 03621248 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2015-10-30 17:13 - 2015-10-21 13:00 - 24595968 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2015-10-30 17:13 - 2015-10-21 13:00 - 03248128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll

2015-10-30 17:13 - 2015-10-21 12:59 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll

2015-10-30 17:13 - 2015-10-21 12:57 - 02418688 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll

2015-10-30 17:13 - 2015-10-21 12:52 - 02987520 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll

2015-10-30 17:13 - 2015-10-21 12:50 - 00333312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll

2015-10-30 17:13 - 2015-10-21 12:48 - 01068032 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll

2015-10-30 17:13 - 2015-10-21 12:47 - 00453120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Usb.dll

2015-10-30 17:13 - 2015-10-21 12:46 - 02179584 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll

2015-10-30 17:13 - 2015-10-21 12:46 - 01602560 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2015-10-30 17:13 - 2015-10-21 12:44 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll

2015-10-30 17:13 - 2015-10-21 12:44 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe

2015-10-30 17:13 - 2015-10-21 12:43 - 02675200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll

2015-10-30 17:13 - 2015-10-21 12:42 - 00627712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll

2015-10-30 17:13 - 2015-10-21 12:41 - 01795072 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll

2015-10-30 17:13 - 2015-10-21 12:40 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll

2015-10-30 17:13 - 2015-10-21 12:38 - 00502272 _____ (Microsoft Corporation) C:\WINDOWS\system32\dlnashext.dll

2015-10-30 17:13 - 2015-10-21 06:53 - 00961376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll

2015-10-30 17:13 - 2015-10-21 06:49 - 02878512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2015-10-30 17:13 - 2015-10-21 06:13 - 19326464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2015-10-30 17:13 - 2015-10-21 06:11 - 02647040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll

2015-10-30 17:13 - 2015-10-21 06:08 - 01918976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll

2015-10-30 17:13 - 2015-10-21 06:05 - 02639872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll

2015-10-30 17:13 - 2015-10-21 06:03 - 01380864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2015-10-30 17:13 - 2015-10-21 06:03 - 00311296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Usb.dll

2015-10-30 17:13 - 2015-10-21 05:58 - 02049536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepository.dll

2015-10-30 17:13 - 2015-10-21 05:58 - 00464896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll

2015-10-30 17:13 - 2015-10-21 05:55 - 00441344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dlnashext.dll

2015-10-26 19:45 - 2015-10-26 19:45 - 00014336 _____ C:\Users\Admin\Downloads\wenn-2.xls

2015-10-26 19:38 - 2015-10-26 19:38 - 03135063 _____ C:\Users\Admin\Downloads\Pruefung_1_Jugendarbeitsschutzgesetz_.zip

2015-10-17 13:48 - 2015-10-10 08:12 - 00078528 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll

2015-10-17 13:48 - 2015-10-06 04:03 - 16708608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll

2015-10-17 13:48 - 2015-10-06 03:46 - 13027840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll

2015-10-17 13:48 - 2015-10-01 05:01 - 01294352 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi

2015-10-17 13:48 - 2015-10-01 05:01 - 01123400 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe

2015-10-17 13:48 - 2015-10-01 05:01 - 01018568 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi

2015-10-17 13:48 - 2015-10-01 05:01 - 00858408 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe

2015-10-17 13:48 - 2015-10-01 05:00 - 08020320 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2015-10-17 13:48 - 2015-10-01 04:03 - 00757760 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll

2015-10-17 13:48 - 2015-09-25 05:01 - 02573768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll

2015-10-17 13:48 - 2015-09-25 05:01 - 00498016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys

2015-10-17 13:48 - 2015-09-25 04:56 - 22322624 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2015-10-17 13:48 - 2015-09-25 04:52 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi

2015-10-17 13:48 - 2015-09-25 04:33 - 01997336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll

2015-10-17 13:48 - 2015-09-25 04:26 - 20858360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2015-10-17 13:48 - 2015-09-25 04:11 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataAccountApis.dll

2015-10-17 13:48 - 2015-09-25 04:11 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneCallHistoryApis.dll

2015-10-17 13:48 - 2015-09-25 04:09 - 12504064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2015-10-17 13:48 - 2015-09-25 04:07 - 01276416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll

2015-10-17 13:48 - 2015-09-25 04:04 - 00826880 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll

2015-10-17 13:48 - 2015-09-25 04:04 - 00771072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll

2015-10-17 13:48 - 2015-09-25 04:03 - 00796160 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll

2015-10-17 13:48 - 2015-09-25 04:03 - 00576000 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll

2015-10-17 13:48 - 2015-09-25 04:02 - 07523840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll

2015-10-17 13:48 - 2015-09-25 04:02 - 00949248 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll

2015-10-17 13:48 - 2015-09-25 04:02 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll

2015-10-17 13:48 - 2015-09-25 04:01 - 04792320 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2015-10-17 13:48 - 2015-09-25 04:01 - 03586560 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys

2015-10-17 13:48 - 2015-09-25 04:00 - 01423872 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll

2015-10-17 13:48 - 2015-09-25 04:00 - 01382400 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys

2015-10-17 13:48 - 2015-09-25 04:00 - 00856576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContactApis.dll

2015-10-17 13:48 - 2015-09-25 04:00 - 00752640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChatApis.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 01205248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\EmailApis.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 00685568 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppointmentApis.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\MessagingDataModel2.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 00288256 _____ (Microsoft Corporation) C:\WINDOWS\system32\PimIndexMaintenance.dll

2015-10-17 13:48 - 2015-09-25 03:59 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\CallHistoryClient.dll

2015-10-17 13:48 - 2015-09-25 03:58 - 01871360 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll

2015-10-17 13:48 - 2015-09-25 03:47 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll

2015-10-17 13:48 - 2015-09-25 03:47 - 00172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhoneCallHistoryApis.dll

2015-10-17 13:48 - 2015-09-25 03:38 - 03580416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2015-10-17 13:48 - 2015-09-25 03:38 - 00650240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll

2015-10-17 13:48 - 2015-09-25 03:38 - 00574464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll

2015-10-17 13:48 - 2015-09-25 03:38 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll

2015-10-17 13:48 - 2015-09-25 03:37 - 00766976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll

2015-10-17 13:48 - 2015-09-25 03:37 - 00613376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll

2015-10-17 13:48 - 2015-09-25 03:37 - 00480256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll

2015-10-17 13:48 - 2015-09-25 03:36 - 11262976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2015-10-17 13:48 - 2015-09-25 03:36 - 05454848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll

2015-10-17 13:48 - 2015-09-25 03:34 - 00928256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll

2015-10-17 13:48 - 2015-09-25 03:34 - 00625152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContactApis.dll

2015-10-17 13:48 - 2015-09-25 03:34 - 00579584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentApis.dll

2015-10-17 13:48 - 2015-09-25 03:34 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ChatApis.dll

2015-10-17 13:48 - 2015-09-25 03:34 - 00525312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EmailApis.dll

2015-10-17 13:48 - 2015-09-25 03:33 - 00131072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CallHistoryClient.dll

2015-10-17 13:48 - 2015-09-25 03:32 - 01594368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll

2015-10-17 13:48 - 2015-09-25 03:32 - 00466432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MessagingDataModel2.dll

2015-10-17 13:39 - 2015-11-07 01:17 - 00000000 ____D C:\Users\Admin\Desktop\Felgen

2015-10-17 13:36 - 2015-11-06 12:37 - 00001816 _____ C:\Users\Public\Desktop\iTunes.lnk

2015-10-17 13:36 - 2015-10-17 13:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2015-10-17 13:35 - 2015-11-06 12:37 - 00002523 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk

2015-10-17 13:35 - 2015-10-17 13:36 - 00000000 ____D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7

2015-10-17 13:35 - 2015-10-17 13:36 - 00000000 ____D C:\Program Files\iTunes

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\WINDOWS\System32\Tasks\Apple

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files\iPod

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files\Bonjour

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\iTunes

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\Bonjour

2015-10-17 13:35 - 2015-10-17 13:35 - 00000000 ____D C:\Program Files (x86)\Apple Software Update

2015-10-17 13:30 - 2015-10-17 13:34 - 152447768 _____ (Apple Inc.) C:\Users\Admin\Downloads\iTunes6464Setup (1).exe

2015-10-12 18:13 - 2015-10-12 18:15 - 167601944 _____ (Apple Inc.) C:\Users\Admin\Downloads\iTunes6464Setup.exe

2015-10-12 17:20 - 2015-10-12 17:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud

2015-10-12 17:09 - 2015-10-12 17:19 - 71807792 _____ (Apple Inc.) C:\Users\Admin\Downloads\iCloudSetup.exe

2015-10-12 17:03 - 2015-10-12 17:24 - 1971067436 _____ C:\Users\Admin\Downloads\iPhone7,2_8.4.1_12H321_Restore.ipsw

2015-10-09 15:13 - 2015-10-09 15:13 - 00000000 ____D C:\Users\Admin\AppData\LocalLow\Hyper Hippo Productions Ltd_

2015-10-09 15:12 - 2015-10-09 15:12 - 00000222 _____ C:\Users\Admin\Desktop\AdVenture Capitalist.url

2015-10-08 16:47 - 2015-10-08 16:47 - 00000000 ____D C:\ProgramData\ATI
 

==================== Ein Monat: Geänderte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2015-11-07 01:23 - 2015-08-05 21:51 - 01793546 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2015-11-07 01:23 - 2015-07-10 17:34 - 00772138 _____ C:\WINDOWS\system32\perfh007.dat

2015-11-07 01:23 - 2015-07-10 17:34 - 00154500 _____ C:\WINDOWS\system32\perfc007.dat

2015-11-07 01:20 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\sru

2015-11-07 01:19 - 2014-12-15 23:33 - 00001124 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2015-11-07 01:19 - 2014-12-15 23:33 - 00001120 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2015-11-07 01:18 - 2015-07-10 13:21 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2015-11-07 01:18 - 2015-07-10 10:05 - 00262144 ___SH C:\WINDOWS\system32\config\BBI

2015-11-07 01:18 - 2014-12-31 19:28 - 00000000 ____D C:\Program Files (x86)\Steam

2015-11-06 22:17 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\AppReadiness

2015-11-06 19:54 - 2014-12-15 23:13 - 00000000 ____D C:\WINDOWS\system32\MRT

2015-11-06 19:53 - 2014-12-15 23:13 - 143481208 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2015-11-06 12:37 - 2015-09-08 18:22 - 00000971 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk

2015-11-06 12:37 - 2015-08-05 22:01 - 00002358 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

2015-11-06 12:37 - 2015-08-05 21:45 - 00001540 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

2015-11-06 12:37 - 2015-05-24 23:54 - 00000925 _____ C:\Users\Public\Desktop\VLC media player.lnk

2015-11-06 12:37 - 2015-01-06 20:22 - 00001017 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2015-11-06 12:37 - 2014-12-31 19:28 - 00000973 _____ C:\Users\Public\Desktop\Steam.lnk

2015-11-06 12:37 - 2014-12-31 18:33 - 00001813 _____ C:\Users\Admin\Desktop\Spotify.lnk

2015-11-06 12:37 - 2014-12-31 18:33 - 00001799 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk

2015-11-06 12:37 - 2014-12-18 21:21 - 00002445 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2015-11-06 12:37 - 2014-12-15 23:33 - 00001321 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2015-11-05 20:20 - 2015-08-05 21:41 - 00000000 ____D C:\Users\Admin

2015-11-05 18:47 - 2015-01-06 20:23 - 00000000 ____D C:\Users\Admin\AppData\Roaming\TS3Client

2015-11-05 17:46 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\rescache

2015-11-05 14:57 - 2014-12-30 15:46 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-11-05 14:56 - 2014-12-30 19:00 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013

2015-11-05 14:05 - 2015-08-05 22:01 - 00000000 ___RD C:\Users\Admin\OneDrive

2015-11-04 17:09 - 2015-08-05 21:41 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-11-04 17:09 - 2014-12-15 23:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2015-11-04 16:42 - 2015-08-05 22:33 - 00000000 ___DC C:\WINDOWS\Panther

2015-11-04 16:42 - 2014-12-30 23:19 - 00000000 ____D C:\Users\Admin\AppData\Local\CrashDumps

2015-11-04 16:09 - 2014-12-18 21:20 - 00000000 ____D C:\Program Files (x86)\Adobe

2015-11-04 15:46 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy

2015-11-04 15:39 - 2015-01-21 20:03 - 00000000 __SHD C:\Users\Admin\AppData\Local\EmieUserList

2015-11-04 15:39 - 2015-01-21 20:03 - 00000000 __SHD C:\Users\Admin\AppData\Local\EmieSiteList

2015-11-04 15:26 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\appraiser

2015-11-02 14:26 - 2015-07-10 11:55 - 00000000 ____D C:\WINDOWS\CbsTemp

2015-11-01 00:33 - 2015-01-05 18:20 - 00003972 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task

2015-10-30 17:14 - 2014-12-15 23:42 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2015-10-27 19:48 - 2014-12-31 18:33 - 00000000 ____D C:\Users\Admin\AppData\Local\Spotify

2015-10-27 19:48 - 2014-12-31 18:32 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Spotify

2015-10-26 20:55 - 2015-04-12 21:14 - 00000000 ____D C:\Users\Admin\Desktop\Mailin

2015-10-26 20:15 - 2013-08-22 14:25 - 00000167 _____ C:\WINDOWS\win.ini

2015-10-26 19:47 - 2014-12-15 22:56 - 00000000 ____D C:\Users\Admin\AppData\Local\Packages

2015-10-17 13:35 - 2015-04-10 06:25 - 00000000 ____D C:\Program Files\Common Files\Apple

2015-10-17 13:34 - 2015-04-10 06:25 - 00000000 ____D C:\ProgramData\Apple

2015-10-16 04:10 - 2015-07-10 12:06 - 00810488 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2015-10-16 04:10 - 2015-07-10 12:06 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2015-10-12 18:13 - 2015-09-08 19:52 - 00000000 ____D C:\WINDOWS\system32\appmgmt

2015-10-12 18:11 - 2014-12-30 17:39 - 00000000 ____D C:\Users\Admin\AppData\Local\Akamai

2015-10-12 17:47 - 2015-07-10 13:20 - 00348328 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2015-10-12 17:45 - 2015-07-10 17:44 - 00000000 ____D C:\Program Files\Windows Journal

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___SD C:\WINDOWS\system32\F12

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___RD C:\WINDOWS\PurchaseDialog

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\Provisioning

2015-10-12 17:45 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\L2Schemas

2015-10-09 15:12 - 2015-01-06 13:55 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
 

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
 

2015-09-08 19:37 - 2015-09-08 19:37 - 0003225 _____ () C:\Users\Admin\AppData\Local\recently-used.xbel
 

==================== Bamital & volsnap =================
 

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
 

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert

C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert

C:\WINDOWS\explorer.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert

C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert

C:\WINDOWS\system32\services.exe => Datei ist digital signiert

C:\WINDOWS\system32\User32.dll => Datei ist digital signiert

C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert

C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert

C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert

C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert

C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert

C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
 
 

LastRegBack: 2015-11-02 14:19
 

==================== Ende von FRST.txt ============================

Addition:

Code:

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:05-11-2015

durchgeführt von Admin (2015-11-07 01:24:36)

Gestartet von C:\Users\Admin\Desktop

Windows 10 Pro (X64) (2015-08-05 20:58:30)

Start-Modus: Normal

==========================================================
 
 

==================== Konten: =============================
 

Admin (S-1-5-21-3896126499-3315573620-1378135710-1001 - Administrator - Enabled) => C:\Users\Admin

Administrator (S-1-5-21-3896126499-3315573620-1378135710-500 - Administrator - Disabled)

DefaultAccount (S-1-5-21-3896126499-3315573620-1378135710-503 - Limited - Disabled)

Gast (S-1-5-21-3896126499-3315573620-1378135710-501 - Limited - Disabled)
 

==================== Sicherheits-Center ========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
 

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installierte Programme ======================
 

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
 

3DMark (HKLM-x32\...\{7330098c-3669-4f39-9e82-4221d489db39}) (Version: 1.4.828.0 - Futuremark)

3DMark (Version: 1.4.828.0 - Futuremark) Hidden

7-Zip 9.38 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0938-000001000000}) (Version: 9.38.00.0 - Igor Pavlov)

Adobe Reader XI (11.0.13) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.13 - Adobe Systems Incorporated)

AdVenture Capitalist (HKLM-x32\...\Steam App 346900) (Version:  - Hyper Hippo Games)

Akamai NetSession Interface (HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Akamai) (Version:  - Akamai Technologies, Inc)

AMD Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)

AMD Catalyst Install Manager (HKLM\...\{572C982F-95F5-0562-AE8F-8A9D7D024A88}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)

APP Shop v1.0.13 (HKLM-x32\...\{90242E9B-BC60-46E3-8EE7-8E953F702280}_is1) (Version: 1.0.13 - ASRock Inc.)

Apple Application Support (32-Bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)

Apple Application Support (64-Bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{FD244E19-6EFE-4A2D-948A-0D45D4C168BE}) (Version: 9.0.0.26 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)

ASRock App Charger v1.0.6 (HKLM\...\ASRock App Charger_is1) (Version: 1.0.6 - ASRock Inc.)

ASRock Restart to UEFI v1.0.3 (HKLM-x32\...\ASRock Restart to UEFI_is1) (Version:  - )

ASRock XFast RAM v3.0.2 (HKLM\...\ASRock XFast RAM_is1) (Version:  - ASRock Inc.)

A-Tuning v2.0.51.1 (HKLM-x32\...\A-Tuning_is1) (Version: 2.0.51.1 - )

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

CCleaner (HKLM\...\CCleaner) (Version: 5.11 - Piriform)

Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)

ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )

Futuremark SystemInfo (HKLM-x32\...\{2FE4C157-30AD-47F3-9D93-D9A2AFF25D3F}) (Version: 4.33.485.0 - Futuremark)

GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 46.0.2490.80 - Google Inc.)

Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6904.2028 - Google Inc.)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden

iCloud (HKLM\...\{709A2D23-C25E-47B5-9268-CB6FEE648504}) (Version: 4.1.1.53 - Apple Inc.)

Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation)

Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{0EC7F9CC-4741-45AE-9F55-6E9343F726F5}) (Version: 1.1.0.36960 - Intel Corporation)

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)

Intel(R) Network Connections 18.5.54.0 (HKLM\...\PROSetDX) (Version: 18.5.54.0 - Intel)

Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation)

iTunes (HKLM\...\{CEC7613B-E286-4A31-BEE3-3F7798488D9F}) (Version: 12.1.3.6 - Apple Inc.)

Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)

KMSpico (HKLM\...\{8B29D47F-92E2-4C20-9EE0-F710991F5D7C}_is1) (Version:  - )

Malwarebytes Anti-Malware Version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)

Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)

MyDriveConnect 4.0.2.2123 (HKLM-x32\...\MyDriveConnect) (Version: 4.0.2.2123 - TomTom)

Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.)

ROCCAT Kone Pure Mouse Driver (HKLM-x32\...\{4905245D-56E7-4176-BE68-962728B803D6}) (Version:  - Roccat GmbH)

Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)

Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version:  - Microsoft) Hidden

Splashtop Software Updater (HKLM-x32\...\Splashtop Software Updater) (Version: 1.5.6.15 - Splashtop Inc.)

Splashtop Streamer (HKLM-x32\...\{B7C5EA94-B96A-41F5-BE95-25D78B486678}) (Version: 2.6.2.4 - Splashtop Inc.)

Spotify (HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\Spotify) (Version: 1.0.6.80.g2a801a53 - Spotify AB)

Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)

TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)

Update for Skype for Business 2015 (KB2889853) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{CBCC2FD8-7DFE-4752-95B5-2E447C226F45}) (Version:  - Microsoft)

Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version:  - Microsoft)

Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version:  - Microsoft)

Update for Skype for Business 2015 (KB3085581) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{6BCC80EE-3B68-4110-8D47-23E04FB6D08D}) (Version:  - Microsoft)

VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden

Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)

VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN)

WinRAR 5.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)

XFast LAN v9.05 (HKLM\...\XFast LAN) (Version: 9.05 - cFos Software GmbH, Bonn)

XFastUSB (HKLM-x32\...\XFastUSB) (Version: 3.02.38 - ASRock Inc.)
 

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

CustomCLSID: HKU\S-1-5-21-3896126499-3315573620-1378135710-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Admin\AppData\Local\Microsoft\OneDrive\17.3.6201.1019\FileCoAuth.exe (Microsoft Corporation)
 

==================== Wiederherstellungspunkte =========================
 

17-10-2015 13:21:53 Removed iTunes

26-10-2015 19:59:23 Windows Update

02-11-2015 14:19:58 Windows Update

04-11-2015 15:33:50 Wiederherstellungsvorgang

06-11-2015 12:44:13 JRT Pre-Junkware Removal
 

==================== Hosts Inhalt: ===============================
 

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
 

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
 
 

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

Task: {12FB6D15-B5C0-4B66-BF0C-21D82690E855} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)

Task: {1780DAB3-4584-4FBD-92C9-8857F3886BA3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)

Task: {35EB728D-F128-4075-B375-D45BF71FE8B2} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\BrowserChoice\browserchoice.exe

Task: {3A4FD38E-5C92-414E-9586-8C3CAA34B95C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)

Task: {5769C702-F476-4F1D-8161-7F0B757132B2} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation)

Task: {706560C9-EAA0-41D3-833A-15525024E0B5} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-26] (Apple Inc.)

Task: {80A4DADB-BA50-49B2-AA96-134B855D9DA2} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)

Task: {91B7D1C5-C4A2-47A1-8301-8BB576FF708E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)

Task: {ABDBD144-AC98-4BFB-A605-068E267D2877} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation)

Task: {D90353AE-3ED6-447A-9C2D-5A83962EBBF3} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-11-06] (Microsoft Corporation)

Task: {F2497E2D-9818-4923-A176-F89FB32151E5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-10-19] (Piriform Ltd)

Task: {F5E604C0-8A2B-485C-9605-9EC1FD317421} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG

Task: {F69C0FCA-220E-4675-A1E1-DD67E0976A15} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
 

Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
 

2015-07-10 12:00 - 2015-07-10 12:00 - 00028160 _____ () C:\WINDOWS\SYSTEM32\efsext.dll

2015-08-05 22:30 - 2015-08-05 22:30 - 00032768 _____ () C:\WINDOWS\SYSTEM32\licensemanagerapi.dll

2015-03-20 17:12 - 2015-03-20 17:12 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

2015-03-20 17:12 - 2015-03-20 17:12 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

2014-12-15 23:54 - 2013-05-28 17:58 - 00454656 _____ () C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\IOMonitorSrv.exe

2015-08-23 21:30 - 2015-08-11 10:14 - 00404480 _____ () C:\WINDOWS\System32\diagtrack_wininternal.dll

2015-10-01 09:14 - 2015-09-17 07:48 - 02494712 _____ () C:\WINDOWS\system32\CoreUIComponents.dll

2015-10-01 09:14 - 2015-09-17 06:43 - 02028544 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RulesService.dll

2015-10-01 09:14 - 2015-09-17 06:42 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll

2015-10-01 09:14 - 2015-09-17 06:42 - 00619008 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SignalsManager.dll

2015-10-01 09:14 - 2015-09-17 06:43 - 00928768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RulesBackgroundTasks.dll

2015-10-01 09:14 - 2015-09-17 06:42 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll

2015-10-01 09:14 - 2015-09-17 07:48 - 02494712 _____ () C:\WINDOWS\System32\CoreUIComponents.dll

2015-10-01 09:14 - 2015-09-17 06:48 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll

2015-10-01 09:14 - 2015-09-17 06:44 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll

2015-10-01 09:14 - 2015-09-17 06:49 - 00884736 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll

2015-10-01 09:14 - 2015-09-17 06:43 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll

2015-07-10 12:00 - 2015-07-10 17:43 - 00210432 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.ProxyStub.dll

2015-10-19 21:00 - 2015-10-19 21:00 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll

2015-10-23 15:20 - 2015-10-20 15:08 - 01532744 _____ () C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.80\libglesv2.dll

2015-10-23 15:20 - 2015-10-20 15:08 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.80\libegl.dll

2015-10-30 17:15 - 2012-06-23 14:54 - 00061440 _____ () C:\Program Files (x86)\ROCCAT\Kone Pure Mouse\hiddriver.dll

2014-12-15 23:45 - 2013-09-03 16:52 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
 

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
 
 

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
 
 

==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
 
 

==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
 
 

==================== Andere Bereiche ============================
 

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
 

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppBackground\{8f613224-081d-4870-95b1-d3401a9c063b}.jpg

DNS Servers: 192.168.0.1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall ist aktiviert.
 

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
 

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
 

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Akamai NetSession Interface"

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Spotify"

HKU\S-1-5-21-3896126499-3315573620-1378135710-1001\...\StartupApproved\Run: => "Spotify Web Helper"
 

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139

FirewallRules: [{AA2759FA-EDA9-49D9-8F1E-31DBB008545D}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

FirewallRules: [{21668B50-B857-45A9-B645-E11ECDD0BA49}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

FirewallRules: [{6CB59014-5555-42F1-8B13-C849BCCFE2D5}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe

FirewallRules: [{A3131C8E-696E-4F51-ACFD-B2AB59280978}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe

FirewallRules: [{FEE6B3AF-FAFD-4C1B-B25C-3D7B4B195124}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{B443DA33-A6A7-4033-956B-A93AC3CBC433}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{E6CBFDB1-E319-4DB8-AFE5-A4934C2C92BB}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{6A8E79CC-2575-4BAE-8F1C-D7A7E2F46E1E}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{8E7D9FDF-1879-4244-A2C6-EBC14CC669E7}] => (Allow) %USERPROFILE%\jagexcache\jagexlauncher\bin\JagexLauncher.exe

FirewallRules: [{35A1C72A-BDD3-483A-89A4-27F37D6F2DF0}] => (Allow) %USERPROFILE%\jagexcache\jagexlauncher\bin\JagexLauncher.exe

FirewallRules: [{B6240254-8695-4136-8688-496A32476A12}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe

FirewallRules: [{E7AD38FE-F37D-44CA-9649-1701BCC99048}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe

FirewallRules: [{B0CB35E9-5E30-4F33-B965-F50096A6FF89}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{D97329F3-5344-4F9A-ABBF-5E569CF1D363}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{CAEEFC92-F0A2-4DE5-A2E7-FFCAFF3B70D4}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{DA773FEA-CDF4-4FFB-818E-B255D4ABA4EF}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{22A49953-B3ED-4BC6-8832-A1E30DE6E35D}] => (Block) C:\users\admin\appdata\roaming\spotify\spotify.exe

FirewallRules: [{C130419E-ACEF-4A16-B5CD-F7064DA07399}] => (Block) C:\users\admin\appdata\roaming\spotify\spotify.exe

FirewallRules: [UDP Query User{8F3963CA-4443-496D-B9E4-2A16E020A73E}C:\users\admin\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\admin\appdata\roaming\spotify\spotify.exe

FirewallRules: [TCP Query User{C9892719-B171-4AE8-B087-57F263271C60}C:\users\admin\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\admin\appdata\roaming\spotify\spotify.exe

FirewallRules: [{A6677B6E-9570-4D98-87FE-84B9780B452C}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe

FirewallRules: [{CD221F27-BA09-4A4E-BC94-50541EBCB868}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe

FirewallRules: [{85BC76F4-96B4-4164-A507-B85036C799E4}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe

FirewallRules: [{05E12DE1-3BF9-4600-BD77-0809E7D8C280}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe

FirewallRules: [UDP Query User{6B3064D8-144A-4C73-834F-582573F693E1}C:\users\admin\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\admin\appdata\local\akamai\netsession_win.exe

FirewallRules: [TCP Query User{4F97824E-B35A-4B0C-97A6-D3BAFD6E693B}C:\users\admin\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\admin\appdata\local\akamai\netsession_win.exe

FirewallRules: [{ACFE8A12-C5A4-41FC-90A6-7D110C49FAEE}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

FirewallRules: [{55CAAA0F-FBB7-462F-8A31-FCCBE685917A}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

FirewallRules: [{046FF7F9-A214-4106-ADBB-6B8AD4D530E1}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe

FirewallRules: [{B26C67AD-595F-4798-8BA9-48A408D1A66A}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe

FirewallRules: [{0812631C-DFED-4D26-BAD8-38EC0D43A5F9}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe

FirewallRules: [{DD625CA9-74CC-4EF5-8787-672253D8102B}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe

FirewallRules: [{92F406C8-75D5-4ABC-B10E-2BCB8528AAD5}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe

FirewallRules: [{2E1B87E5-B37C-4C66-97F9-A7331EB138D4}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe

FirewallRules: [{20E5CF9D-CD2B-48EC-8529-99B170102939}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\AdVenture Capitalist\adventure-capitalist.exe

FirewallRules: [{C1EF0CA2-2081-43FE-8B04-16DE223F8C15}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\AdVenture Capitalist\adventure-capitalist.exe

FirewallRules: [{C20F43D5-69D4-45A1-AD1B-C744E89D4511}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{7E097365-0904-432E-929B-8F1CD4D41E51}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{1E925C46-62CE-4FA6-82B0-ABDF754998C5}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{F8DCB71C-268A-4DB2-8339-FDB932450A7D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{DD491145-F36D-48BC-A4CF-458D412FE1DE}] => (Allow) C:\Program Files\iTunes\iTunes.exe

FirewallRules: [{9E2BD5A0-E113-4596-8766-27355FE2915D}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

FirewallRules: [{FA0C4343-8703-4F6C-9DC8-FFFFAB81E76F}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe

FirewallRules: [{ED914587-871F-442A-9BD6-A49AE4D2E7FC}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe

FirewallRules: [{0E13C41E-AF31-49F7-B977-A5BFEB095E9A}] => (Allow) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\DataProxy.exe
 

==================== Fehlerhafte Geräte im Gerätemanager =============
 
 

==================== Fehlereinträge in der Ereignisanzeige: =========================
 

Applikationsfehler:

==================

Error: (11/06/2015 09:42:25 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest.

Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest.
 

Error: (11/06/2015 09:30:57 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest.

Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest.
 

Error: (11/06/2015 08:13:45 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest.

Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest.
 

Error: (11/06/2015 08:13:36 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest.

Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest.
 

Error: (11/06/2015 08:13:35 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest.

Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest.
 

Error: (11/06/2015 08:13:35 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest.

Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest.
 

Error: (11/06/2015 08:13:26 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest.

Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest.
 

Error: (11/06/2015 08:13:23 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43.manifest.

Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849.manifest.
 

Error: (11/06/2015 12:45:08 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: MicrosoftEdge.exe, Version: 11.0.10240.16566, Zeitstempel: 0x56277dbe

Name des fehlerhaften Moduls: CoreUIComponents.dll, Version: 0.0.0.0, Zeitstempel: 0x55fa4b76

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000000000060f73

ID des fehlerhaften Prozesses: 0x7e8

Startzeit der fehlerhaften Anwendung: 0xMicrosoftEdge.exe0

Pfad der fehlerhaften Anwendung: MicrosoftEdge.exe1

Pfad des fehlerhaften Moduls: MicrosoftEdge.exe2

Berichtskennung: MicrosoftEdge.exe3

Vollständiger Name des fehlerhaften Pakets: MicrosoftEdge.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: MicrosoftEdge.exe5
 

Error: (11/06/2015 12:44:23 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
 

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.
 

System Error:

Zugriff verweigert

.
 
 

Systemfehler:

=============

Error: (11/07/2015 01:22:14 AM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)

Description: {784E29F4-5EBE-4279-9948-1E8FE941646D}
 

Error: (11/07/2015 01:18:54 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Service KMSELDI" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (11/07/2015 01:18:01 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Benutzerdatenzugriff_Session1" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (11/07/2015 01:18:01 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Benutzerdatenspeicher _Session1" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (11/07/2015 01:18:01 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Kontaktdaten_Session1" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (11/07/2015 01:18:01 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Synchronisierungshost_Session1" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (11/06/2015 08:16:39 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1275
 

Error: (11/06/2015 08:16:39 PM) (Source: Application Popup) (EventID: 1060) (User: )

Description: \??\C:\Users\Admin\AppData\Local\Temp\ehdrv.sys
 

Error: (11/06/2015 08:16:39 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1275
 

Error: (11/06/2015 08:16:39 PM) (Source: Application Popup) (EventID: 1060) (User: )

Description: \??\C:\Users\Admin\AppData\Local\Temp\ehdrv.sys
 
 

CodeIntegrity:

===================================

  Date: 2015-11-06 21:20:14.093

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-11-06 12:29:17.082

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-11-05 12:39:36.174

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-10-26 20:03:56.406

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-09-28 17:52:15.924

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-09-24 22:29:45.054

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-09-15 19:40:31.474

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-08-29 12:12:37.860

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-08-05 23:10:52.350

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
 
 

==================== Speicherinformationen =========================== 
 

Prozessor: Intel(R) Pentium(R) CPU G3420 @ 3.20GHz

Prozentuale Nutzung des RAM: 27%

Installierter physikalischer RAM: 8111.13 MB

Verfügbarer physikalischer RAM: 5861.58 MB

Summe virtueller Speicher: 9391.13 MB

Verfügbarer virtueller Speicher: 6606.91 MB
 

==================== Laufwerke ================================
 

Drive c: () (Fixed) (Total:243.36 GB) (Free:161.02 GB) NTFS

Drive d: (Volume) (Fixed) (Total:687.37 GB) (Free:687.18 GB) NTFS
 

==================== MBR & Partitionstabelle ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: C390FBE7)

Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=243.4 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=450 MB) - (Type=27)

Partition 4: (Not Active) - (Size=687.4 GB) - (Type=07 NTFS)
 

==================== Ende von Addition.txt ============================

Mit freundlichen Grüßen und Gute Nacht!

Martin

M-K-D-B

07.11.2015 11:17

Zitat:

CHIP-Installer.exe

Bitte keinen Chip-Installer mehr verwenden! Bitte lesen: CHIP-Installer – was ist das?

Reste entfernen
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

start

S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [X]

Task: {F5E604C0-8A2B-485C-9605-9EC1FD317421} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG

Reboot:

end

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Die Fixlog von FRST gleich posten, da diese sonst mit DelFix (siehe weiter unten) automatisch entfernt wird!

Wenn du keine Probleme mehr mit Malware hast, dann sind wir hier fertig. Deine Logdateien sind sauber. :daumenhoc
Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern.

http://deeprybka.trojaner-board.de/b...cleanupneu.png
Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
http://deeprybka.trojaner-board.de/b.../combofix2.pngCombofix deinstallieren

Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
Drücke bitte die http://deeprybka.trojaner-board.de/b...ne/revo/w7.png + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
Klicke auf OK.
Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte http://filepony.de/icon/tiny/delfix.pngDelFix herunter.

Schließe alle offenen Programme.
Starte die delfix.exe mit einem Doppelklick.
Setze vor jede Funktion ein Häkchen.
Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner anschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...:dankeschoen:und/oder das Forum mit einer kleinen Spende http://www.trojaner-board.de/extra/spende.png unterstützen. :applaus:

http://deeprybka.trojaner-board.de/b...ast/schild.png
Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Sofern du noch unentschieden bist, verwende ein einziges der folgenden Antivirusprogramme mit Echtzeitscanner und stets aktueller Signaturendatenbank:

	Emsisoft	MSE
	http://filepony.de/icon/emsisoft_anti_malware.png	http://filepony.de/icon/microsoft_se...essentials.png

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:
http://filepony.de/icon/adblock_firefox.pngAdblock Plus Kann Banner, Pop-ups, Videowerbung, Tracking und Malware-Seiten blockieren.
http://filepony.de/icon/noscript.png NoScript Verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.
http://filepony.de/icon/malwarebytes_anti_exploit.pngMalwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.

Lade Software von einem sauberen Portal wie http://filepony.de/images/microbanner.gif.
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .

Abschließend noch ein paar grundsätzliche Bemerkungen:

Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Lade keine Software von Chip, Softonic oder SourceForge. Die dort angebotene Software wird häufig mit einem sog. "Installer" verteilt, mit dem man sich nur unerwünschte Software oder Adware installiert.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Selbst Microsoft unterstützt sog. Registry-Cleaner nicht. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.

Alle Zeitangaben in WEZ +1. Es ist jetzt 11:05 Uhr.

Seite 1 von 2

100 Beiträge dieses Themas auf einer Seite anzeigen

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131