Win7 /64bit - Plötzlicher Trojaner und Verschlüsselungsfenster?

MrXxx · 01.10.2015, 14:51

Hi,
Ich hab mir wohl was eingefangen...Genau warum, weiß ich nicht.
Gestern habe ich die Adobe Cloud abboniert und das runtergeladen und eine Testversion von Camtasia.
Heute bekomme ich einen Screenshot von wegen Dateiverschlüsselung sichern? Dabei habe ich nie etwas verschlüsselt und Kaspersky findet nen Trojaner...

Ich lade mal die Log Datein von Kasp hoch und den Screenshot von dem Verschlüsselungsfenster:

Code:

ATTFilter

01.10.2015 15.31.09	Gefundenes Objekt (Datei) wurde gelöscht.	C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cache\f_001721//packed	Datei: C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cache\f_001721//packed	Objektname: HEUR:Trojan.Script.Iframer	Objekttyp: Trojanisches Programm	Zeitpunkt: 01.10.2015 15:31
01.10.2015 15.31.09	Gefundenes Objekt (Datei) wurde gelöscht.	C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cache\f_001721	Datei: C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cache\f_001721	Objektname: 	Objekttyp: Unbekannte Bedrohung	Zeitpunkt: 01.10.2015 15:31

Code:

ATTFilter

01.10.2015 15.31.09	Gefundenes Objekt (Datei) wurde gelöscht.	C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cache\f_001721//packed	Datei: C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cache\f_001721//packed	Objektname: HEUR:Trojan.Script.Iframer	Objekttyp: Trojanisches Programm	Zeitpunkt: 01.10.2015 15:31
01.10.2015 15.31.09	Gefundenes Objekt (Datei) wurde gelöscht.	C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cache\f_001721	Datei: C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cache\f_001721	Objektname: 	Objekttyp: Unbekannte Bedrohung	Zeitpunkt: 01.10.2015 15:31

Vielleicht kann mir jemand sagen, was los ist - bin massiv überrascht...

cosinus · 01.10.2015, 14:55

Die Meldung besagt, dass du das Zertifikat für die NTFS-Verschlüsselung sichern solltest. Wenn das Zertifikat nämlich abhanden kommt,. zerstört wird etc kommst du nicht mehr an die Daten ran.

Es geht hier um die Verschlüsselung, die das Dateisystem NTFS schon selbst als Bordmittel mitbringt.

Und da wurde keine Trojaner gefunden. Sondern nur ein iframe.

MrXxx · 01.10.2015, 16:32

Vielen Dank für die schnelle Antwort.

Wieso genau taucht denn dieses Fenster auf? Habe noch nie eine Datei verschlüsselt und gerade mal (nach googlen) durch das Ausführen von Cipher nach verschlüsselten Dateien gesucht. Wurde nichts gefunden. Könnte das durch einen Virus beeinflusst sein? Bzw. sollte ich sonst einfach das Fenster wegklicken? Ich kann ja auch kein Zertifikat auf nem USB speichern, da ich überhaupt nicht wüsste, wo sich das befindet (Soll einen Ort angeben...)

Was ist denn ein iframe? Bzw. wie lädt sich sowas auf meinen PC? Habe gestern über eine seriöse Website noch zwei Templates für After Effects gekauft/gedownloaded?

Sicherheitshalber habe ich hier nochmal alle Log-Datein von GMER und co, vielleicht siehst du nochmal drüber und sagst mir, das alles in Ordnung ist...

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 16:19 on 01/10/2015 (*****)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

Code:

ATTFilter

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:30-09-2015
durchgeführt von ***** (Administrator) auf *****-PC (01-10-2015 16:19:40)
Gestartet von C:\Users\*****\Desktop
Geladene Profile: ***** (Verfügbare Profile: *****)
Platform: Windows 7 Professional Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avpui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Dropbox, Inc.) C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe
(Dropbox, Inc.) C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AdobeGCClient.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508104 2015-09-04] (Adobe Systems Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13651672 2013-09-03] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2463552 2014-10-04] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-08-13] (Apple Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291128 2013-03-06] (Intel Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-05-15] (Apple Inc.)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-08-28] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe [2620728 2015-07-22] (Malwarebytes Corporation)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-06-17] (Apple Inc.)
HKLM-x32\...\Run: [Nikon Message Center 2] => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe [570880 2013-12-27] (Nikon Corporation)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2292912 2015-09-17] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [2899136 2015-08-19] (Valve Corporation)
HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6482200 2014-09-26] (Piriform Ltd)
HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\...\Run: [Dropbox Update] => C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-19] (Dropbox, Inc.)
HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [787592 2015-09-21] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [11264 2009-07-14] (Microsoft Corporation)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [174856 2014-09-14] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [156840 2014-09-14] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-09-11] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-09-11] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-09-11] ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  Keine Datei
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll Keine Datei
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll Keine Datei
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll Keine Datei
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll Keine Datei
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-12-12]
ShortcutTarget: Dropbox.lnk -> C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CHR HKLM\SOFTWARE\Policies\Google: Beschränkung <======= ACHTUNG

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{C6CFC2E9-EC6A-45CE-8CAE-0C63A07F1B14}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{E3B9FBD5-3CDD-44DE-B9AD-993EA9D045DC}: [DhcpNameServer] 192.168.178.1

Internet Explorer:
==================
HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Kaspersky Protection plugin -> {C66D064F-82FE-4E1A-B06A-B2490BA48B18} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\x64\IEExt\ie_plugin.dll [2015-07-08] (AO Kaspersky Lab)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Kaspersky Protection plugin -> {C66D064F-82FE-4E1A-B06A-B2490BA48B18} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\IEExt\ie_plugin.dll [2015-07-08] (AO Kaspersky Lab)
Toolbar: HKLM - Kein Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  Keine Datei
Toolbar: HKLM - Kein Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  Keine Datei
Toolbar: HKLM - Kaspersky Protection toolbar - {3507FA00-ADA2-4A02-99B9-51AD26CA9120} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\x64\IEExt\ie_plugin.dll [2015-07-08] (AO Kaspersky Lab)
Toolbar: HKLM-x32 - Kaspersky Protection toolbar - {3507FA00-ADA2-4A02-99B9-51AD26CA9120} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\IEExt\ie_plugin.dll [2015-07-08] (AO Kaspersky Lab)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\pqreaw43.default
FF SelectedSearchEngine: Arccosine
FF Homepage: google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_185.dll [2015-09-23] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2015-09-17] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_185.dll [2015-09-23] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-07-30] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-09-13] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-09-13] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2015-09-17] (Adobe Systems)
FF Extension: WOT - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\pqreaw43.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2015-07-09]
FF Extension: Browser-Security - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\pqreaw43.default\Extensions\firefox@browser-security.de.xpi [2015-06-28]
FF Extension: Adblock Plus - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\pqreaw43.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-10-13]
FF HKLM-x32\...\Firefox\Extensions: [light_plugin_D772DC8D6FAF43A29B25C4EBAA5AD1DE@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\FFExt\light_plugin_firefox
FF Extension: Kaspersky Protection - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\FFExt\light_plugin_firefox [2015-09-05]

Chrome: 
=======
CHR Profile: C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-07-29]
CHR Extension: (Google Docs) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-07-29]
CHR Extension: (Google Drive) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-07-29]
CHR Extension: (YouTube) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-07-29]
CHR Extension: (Google-Suche) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-07-29]
CHR Extension: (Kaspersky Protection) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\eahebamiopdhefndnmappcihfajigkka [2015-09-05]
CHR Extension: (Google Tabellen) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-07-29]
CHR Extension: (Google Text & Tabellen Offline) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-07-29]
CHR Extension: (AdBlock) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-08-08]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-29]
CHR Extension: (Google Mail) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-07-29]
CHR HKLM\...\Chrome\Extension: [eahebamiopdhefndnmappcihfajigkka] - https://chrome.google.com/webstore/detail/eahebamiopdhefndnmappcihfajigkka
CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx <nicht gefunden>
CHR HKLM-x32\...\Chrome\Extension: [eahebamiopdhefndnmappcihfajigkka] - https://chrome.google.com/webstore/detail/eahebamiopdhefndnmappcihfajigkka

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 AdobeActiveFileMonitor10.0; C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe [169624 2011-09-01] (Adobe Systems Incorporated)
R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [669872 2015-09-15] (Adobe Systems Incorporated)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [1846464 2015-09-10] (Adobe Systems, Incorporated)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)
S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
R2 AVP16.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe [194000 2015-09-05] (Kaspersky Lab ZAO)
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) [Datei ist nicht signiert]
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-10-04] (NVIDIA Corporation)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [Datei ist nicht signiert]
R2 MbaeSvc; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [713016 2015-07-22] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [Datei ist nicht signiert]
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272688 2012-06-25] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-10-04] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19440960 2014-10-04] (NVIDIA Corporation)
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [177800 2015-09-21] (Sandboxie Holdings, LLC)
S3 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)
S3 vssbrigde64; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\x64\vssbridge64.exe [144640 2015-07-09] (AO Kaspersky Lab)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3325232 2012-06-25] (Intel® Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [21584 2013-02-19] ()
R0 cm_km; C:\Windows\System32\DRIVERS\cm_km.sys [389816 2015-07-06] (Kaspersky Lab ZAO)
R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [495376 2013-05-30] (Intel Corporation)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R1 ESProtectionDriver; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [63064 2015-07-22] ()
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-01-31] (Intel Corporation)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [478392 2015-06-22] (Kaspersky Lab ZAO)
R0 klbackupdisk; C:\Windows\System32\DRIVERS\klbackupdisk.sys [53432 2015-06-06] (Kaspersky Lab ZAO)
R1 klbackupflt; C:\Windows\System32\DRIVERS\klbackupflt.sys [70000 2015-06-27] (Kaspersky Lab ZAO)
R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [68280 2015-06-06] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [171192 2015-06-30] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [227000 2015-07-04] (AO Kaspersky Lab)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [931000 2015-06-30] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [39096 2015-06-11] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [41144 2015-06-06] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [41648 2015-06-07] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [41352 2015-09-27] (AO Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [65208 2015-06-11] (Kaspersky Lab ZAO)
R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [103096 2015-06-16] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [187056 2015-06-23] (Kaspersky Lab ZAO)
S3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [129224 2013-07-18] (Qualcomm Atheros Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20288 2014-10-04] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-07-03] (Secunia)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-06-22] (Corel Corporation)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [191624 2015-09-21] (Sandboxie Holdings, LLC)
S3 Secdrv; C:\Windows\SysWOW64\drivers\SECDRV.SYS [11616 2000-11-06] () [Datei ist nicht signiert]
S3 tap-tb-0901; C:\Windows\System32\DRIVERS\tap-tb-0901.sys [39168 2014-06-17] (The OpenVPN Project)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
S1 UsbCharger; C:\Windows\System32\DRIVERS\UsbCharger.sys [21072 2013-03-27] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 cpuz136; \??\C:\Users\*****\AppData\Local\Temp\cpuz136\cpuz136_x64.sys [X]
S3 gdrv; \??\C:\Windows\gdrv.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-10-01 16:19 - 2015-10-01 16:20 - 00026621 _____ C:\Users\*****\Desktop\FRST.txt
2015-10-01 16:19 - 2015-10-01 16:19 - 00000470 _____ C:\Users\*****\Desktop\defogger_disable.log
2015-10-01 16:19 - 2015-10-01 16:19 - 00000000 _____ C:\Users\*****\defogger_reenable
2015-10-01 15:57 - 2015-10-01 15:57 - 02192384 _____ (Farbar) C:\Users\*****\Desktop\FRST64.exe
2015-10-01 15:57 - 2015-10-01 15:57 - 00380416 _____ C:\Users\*****\Desktop\Gmer-19357.exe
2015-10-01 15:57 - 2015-10-01 15:57 - 00050477 _____ C:\Users\*****\Desktop\Defogger.exe
2015-10-01 02:55 - 2015-10-01 02:55 - 00000000 ___DX C:\Users\*****\Desktop\Ink&Paper2 folder
2015-10-01 02:55 - 2015-10-01 02:55 - 00000000 ____D C:\Users\*****\Desktop\MusicPremium - Epic Enigmatik Theme
2015-10-01 02:49 - 2015-10-01 02:49 - 00311242 _____ C:\Users\*****\Desktop\kards.html
2015-10-01 02:49 - 2015-10-01 02:49 - 00000000 ____D C:\Users\*****\Desktop\kards_files
2015-10-01 02:06 - 2015-10-01 02:06 - 00019800 _____ C:\Users\*****\Downloads\good_times.zip
2015-10-01 02:04 - 2015-10-01 02:04 - 00020186 _____ C:\Users\*****\Downloads\bebas_neue.zip
2015-10-01 02:03 - 2015-10-01 02:03 - 00211920 _____ C:\Users\*****\Downloads\typography_times.zip
2015-10-01 00:53 - 2015-10-01 00:54 - 39219377 _____ C:\Users\*****\Desktop\Unbenannt-2.psd
2015-09-30 22:00 - 2015-10-01 15:57 - 00000000 ____D C:\Users\*****\AppData\Local\CrashDumps
2015-09-30 19:34 - 2015-10-01 16:10 - 00000000 ____D C:\Users\*****\Desktop\Material für Youtube
2015-09-30 18:55 - 2015-09-30 18:55 - 00000000 ____D C:\Users\Public\Documents\Adobe
2015-09-30 18:49 - 2015-09-30 18:49 - 00001073 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Audition CC 2015.lnk
2015-09-30 18:48 - 2015-09-30 18:48 - 00000000 ____D C:\Program Files (x86)\My Company Name
2015-09-30 18:40 - 2015-09-30 18:40 - 00000984 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Lightroom.lnk
2015-09-30 18:18 - 2015-09-30 18:18 - 00001222 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe After Effects CC 2015.lnk
2015-09-30 18:16 - 2015-09-30 18:16 - 00001328 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Character Animator (Preview).lnk
2015-09-30 17:52 - 2015-09-30 17:52 - 00001030 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CC (64bit).lnk
2015-09-30 17:43 - 2015-09-30 17:43 - 00001118 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Media Encoder CC 2015.lnk
2015-09-30 17:30 - 2015-09-30 17:30 - 00001106 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Premiere Pro CC 2015.lnk
2015-09-30 17:04 - 2015-10-01 03:34 - 00000000 ____D C:\Users\*****\Documents\Adobe
2015-09-30 17:04 - 2015-09-30 17:04 - 00001040 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CC 2015.lnk
2015-09-30 17:00 - 2015-09-30 18:49 - 00000000 ____D C:\Program Files\Adobe
2015-09-30 16:47 - 2015-10-01 14:08 - 00000000 ___RD C:\Users\*****\Creative Cloud Files
2015-09-30 16:39 - 2015-09-30 16:39 - 00001225 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk
2015-09-30 14:46 - 2015-09-30 14:46 - 00000000 ____D C:\Users\*****\Documents\Camtasia Studio
2015-09-30 14:23 - 2015-09-30 14:46 - 00000000 ____D C:\Users\*****\AppData\Roaming\TechSmith
2015-09-30 14:19 - 2015-09-30 20:00 - 00000000 ____D C:\Users\*****\AppData\Local\TechSmith
2015-09-30 14:19 - 2015-09-30 14:22 - 00000000 ____D C:\Users\*****\Documents\Snagit
2015-09-30 14:18 - 2015-10-01 15:45 - 00000000 ____D C:\ProgramData\TechSmith
2015-09-30 13:32 - 2015-09-30 13:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fraps
2015-09-30 13:32 - 2015-09-30 13:32 - 00000000 ____D C:\Fraps
2015-09-30 00:01 - 2015-09-30 00:10 - 08797466 _____ C:\Users\*****\Desktop\Gehirn3.psd
2015-09-29 21:47 - 2015-09-29 21:47 - 00083390 _____ C:\Users\*****\Downloads\S_Auge_1.psd
2015-09-28 16:05 - 2015-09-28 16:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2015-09-27 23:36 - 2015-09-27 23:37 - 00000000 ____D C:\Users\*****\Desktop\Videos BEnne
2015-09-23 16:53 - 2015-09-23 16:53 - 18819272 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2015-09-19 22:22 - 2015-09-19 22:35 - 00000000 ____D C:\Users\*****\Documents\SpellForce
2015-09-19 22:00 - 2015-09-19 22:13 - 00000000 ____D C:\Users\*****\Desktop\Neuer Ordner (3)
2015-09-16 14:47 - 2015-09-21 17:02 - 00000000 ____D C:\Users\*****\Desktop\Hausarbeit Kreativität
2015-09-13 15:17 - 2015-09-13 15:17 - 00000000 ____D C:\Users\*****\AppData\Local\GWX
2015-09-13 01:53 - 2015-09-30 14:43 - 00001676 _____ C:\Windows\Sandboxie.ini
2015-09-13 01:53 - 2015-09-16 01:25 - 00001020 _____ C:\Users\*****\Desktop\Sandboxed Web Browser.lnk
2015-09-13 01:53 - 2015-09-13 01:53 - 00000000 ____D C:\Program Files\Sandboxie
2015-09-13 01:52 - 2015-09-13 01:52 - 06979720 _____ (Sandboxie Holdings, LLC) C:\Users\*****\Desktop\SandboxieInstall.exe
2015-09-12 23:39 - 2015-09-12 23:39 - 00002972 _____ C:\Windows\System32\Tasks\{B25A8B84-1BBD-4577-BB6B-8C7BDCC13539}
2015-09-12 23:39 - 2015-09-12 23:39 - 00002972 _____ C:\Windows\System32\Tasks\{2F9C545E-5DA5-46F0-BC8B-4A4C8ED349D8}
2015-09-11 16:00 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2015-09-11 16:00 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2015-09-11 12:28 - 2015-08-18 03:42 - 00393304 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-09-11 12:28 - 2015-08-18 03:14 - 00344168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-09-11 12:28 - 2015-08-15 08:48 - 25190400 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-09-11 12:28 - 2015-08-15 08:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-09-11 12:28 - 2015-08-15 08:33 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-09-11 12:28 - 2015-08-15 08:18 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-09-11 12:28 - 2015-08-15 08:18 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-09-11 12:28 - 2015-08-15 08:17 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-09-11 12:28 - 2015-08-15 08:17 - 00585216 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-09-11 12:28 - 2015-08-15 08:17 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-09-11 12:28 - 2015-08-15 08:17 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-09-11 12:28 - 2015-08-15 08:10 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-09-11 12:28 - 2015-08-15 08:09 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-09-11 12:28 - 2015-08-15 08:06 - 19856896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-09-11 12:28 - 2015-08-15 08:06 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-09-11 12:28 - 2015-08-15 08:04 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-09-11 12:28 - 2015-08-15 08:04 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-09-11 12:28 - 2015-08-15 08:04 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-09-11 12:28 - 2015-08-15 08:04 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-09-11 12:28 - 2015-08-15 08:00 - 05923328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-09-11 12:28 - 2015-08-15 07:57 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-09-11 12:28 - 2015-08-15 07:53 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-09-11 12:28 - 2015-08-15 07:53 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-09-11 12:28 - 2015-08-15 07:46 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-09-11 12:28 - 2015-08-15 07:42 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-09-11 12:28 - 2015-08-15 07:41 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-09-11 12:28 - 2015-08-15 07:40 - 00504832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-09-11 12:28 - 2015-08-15 07:40 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-09-11 12:28 - 2015-08-15 07:39 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-09-11 12:28 - 2015-08-15 07:39 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-09-11 12:28 - 2015-08-15 07:39 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-09-11 12:28 - 2015-08-15 07:38 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-09-11 12:28 - 2015-08-15 07:35 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-09-11 12:28 - 2015-08-15 07:33 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-09-11 12:28 - 2015-08-15 07:32 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-09-11 12:28 - 2015-08-15 07:30 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-09-11 12:28 - 2015-08-15 07:29 - 00665600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-09-11 12:28 - 2015-08-15 07:29 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-09-11 12:28 - 2015-08-15 07:29 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-09-11 12:28 - 2015-08-15 07:24 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-09-11 12:28 - 2015-08-15 07:23 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-09-11 12:28 - 2015-08-15 07:22 - 02126336 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-09-11 12:28 - 2015-08-15 07:22 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-09-11 12:28 - 2015-08-15 07:21 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-09-11 12:28 - 2015-08-15 07:16 - 14451712 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-09-11 12:28 - 2015-08-15 07:16 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-09-11 12:28 - 2015-08-15 07:14 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-09-11 12:28 - 2015-08-15 07:12 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-09-11 12:28 - 2015-08-15 07:11 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-09-11 12:28 - 2015-08-15 07:10 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-09-11 12:28 - 2015-08-15 07:07 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-09-11 12:28 - 2015-08-15 07:04 - 12857344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-09-11 12:28 - 2015-08-15 07:02 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-09-11 12:28 - 2015-08-15 07:01 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-09-11 12:28 - 2015-08-15 07:01 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-09-11 12:28 - 2015-08-15 06:55 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-09-11 12:28 - 2015-08-15 06:43 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-09-11 12:28 - 2015-08-15 06:43 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-09-11 12:28 - 2015-08-15 06:39 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-09-11 12:28 - 2015-08-15 06:37 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-09-11 12:28 - 2013-11-26 10:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2015-09-11 12:28 - 2013-11-23 00:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2015-09-10 15:58 - 2015-09-10 16:10 - 00000000 ____D C:\Users\*****\Desktop\Die Seiten der Welt1
2015-09-10 15:58 - 2015-09-10 15:59 - 05650560 _____ (Canneverbe Limited ) C:\Users\*****\Desktop\cdbxp_setup_4.5.6.5844.exe
2015-09-10 15:58 - 2015-09-10 15:59 - 00000000 ____D C:\Users\*****\Desktop\Seiten der Welt2
2015-09-10 14:14 - 2015-07-30 20:06 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2015-09-10 14:14 - 2015-07-30 20:06 - 01648128 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-09-10 14:14 - 2015-07-30 20:06 - 01180160 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-09-10 14:14 - 2015-07-30 19:57 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2015-09-10 14:14 - 2015-07-30 19:57 - 01251328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-09-10 14:14 - 2015-02-04 05:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-09-10 14:14 - 2015-02-04 04:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-09-10 14:14 - 2015-02-03 05:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-09-10 14:14 - 2015-02-03 05:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-09-10 13:56 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2015-09-10 13:52 - 2015-09-10 13:52 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2015-09-10 13:52 - 2015-09-10 13:52 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2015-09-10 13:52 - 2015-09-10 13:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2015-09-10 13:52 - 2015-09-10 13:52 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2015-09-10 13:52 - 2015-09-10 13:52 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2015-09-10 13:52 - 2015-09-10 13:52 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2015-09-10 13:52 - 2015-09-10 13:52 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2015-09-10 13:52 - 2015-09-10 13:52 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2015-09-10 13:52 - 2015-09-10 13:52 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2015-09-10 13:52 - 2015-09-10 13:52 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2015-09-10 13:52 - 2015-09-10 13:52 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2015-09-10 13:52 - 2015-09-10 13:52 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2015-09-10 13:52 - 2015-09-10 13:52 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-09-10 13:52 - 2015-09-10 13:52 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2015-09-10 13:52 - 2015-09-10 13:52 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-09-10 13:52 - 2015-09-10 13:52 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2015-09-10 13:49 - 2015-09-10 13:49 - 01682432 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 01238528 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 01158144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 01080832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00648192 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00604160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00522752 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00333312 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00249856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00010752 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00010752 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00009728 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00009728 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00002560 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00002560 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2015-09-09 14:03 - 2015-09-09 23:30 - 00001716 _____ C:\Users\*****\Desktop\SFCFix.txt
2015-09-09 14:03 - 2015-09-09 23:30 - 00000000 ____D C:\SFCFix
2015-09-09 14:02 - 2015-09-09 23:30 - 00000000 ____D C:\Users\*****\AppData\Local\niemiro
2015-09-09 14:02 - 2015-09-09 14:02 - 01319424 _____ (niemiro) C:\Users\*****\Desktop\SFCFix.exe
2015-09-09 12:48 - 2015-08-05 19:56 - 01110016 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2015-09-09 12:48 - 2015-08-05 19:56 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-09-09 12:48 - 2015-08-05 19:56 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-09-09 12:48 - 2015-08-05 19:40 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-09-09 12:47 - 2015-09-02 05:04 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-09-09 12:47 - 2015-09-02 05:04 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-09-09 12:47 - 2015-09-02 05:04 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-09-09 12:47 - 2015-09-02 05:04 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-09-09 12:47 - 2015-09-02 04:48 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-09-09 12:47 - 2015-09-02 04:48 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-09-09 12:47 - 2015-09-02 04:48 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-09-09 12:47 - 2015-09-02 04:47 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-09-09 12:47 - 2015-09-02 03:51 - 03209216 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-09-09 12:47 - 2015-09-02 03:47 - 00372736 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-09-09 12:47 - 2015-09-02 03:33 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-09-09 12:47 - 2015-08-27 20:18 - 02004480 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2015-09-09 12:47 - 2015-08-27 20:18 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-09-09 12:47 - 2015-08-27 20:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2015-09-09 12:47 - 2015-08-27 20:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-09-09 12:47 - 2015-08-27 19:58 - 01391104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2015-09-09 12:47 - 2015-08-27 19:58 - 01241088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-09-09 12:47 - 2015-08-27 19:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2015-09-09 12:47 - 2015-08-27 19:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-09-09 12:47 - 2015-08-26 20:07 - 03165696 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-09-09 12:47 - 2015-08-26 20:07 - 02606080 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-09-09 12:47 - 2015-08-26 20:07 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-09-09 12:47 - 2015-08-26 20:07 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-09-09 12:47 - 2015-08-26 20:07 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-09-09 12:47 - 2015-08-26 20:07 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-09-09 12:47 - 2015-08-26 20:07 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-09-09 12:47 - 2015-08-26 20:06 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-09-09 12:47 - 2015-08-26 20:06 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-09-09 12:47 - 2015-08-26 20:06 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-09-09 12:47 - 2015-08-26 20:06 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-09-09 12:47 - 2015-08-26 19:56 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-09-09 12:47 - 2015-08-26 19:56 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-09-09 12:47 - 2015-08-26 19:56 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-09-09 12:47 - 2015-08-26 19:56 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-09-09 12:47 - 2015-08-26 19:55 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-09-09 12:47 - 2015-08-04 20:03 - 00692672 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-09-09 12:47 - 2015-08-04 20:00 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-09-09 12:47 - 2015-08-04 19:56 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-09-09 12:47 - 2015-08-04 19:56 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-09-09 12:47 - 2015-08-04 19:56 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-09-09 12:47 - 2015-08-04 19:55 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-09-09 12:47 - 2015-08-04 19:55 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-09-09 12:47 - 2015-08-04 19:47 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-09-09 12:47 - 2015-08-04 18:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-09-09 12:47 - 2015-07-23 02:06 - 05568960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-09-09 12:47 - 2015-07-23 02:06 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-09-09 12:47 - 2015-07-23 02:06 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-09-09 12:47 - 2015-07-23 02:03 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-09-09 12:47 - 2015-07-23 02:03 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-09-09 12:47 - 2015-07-23 02:03 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-09-09 12:47 - 2015-07-23 02:03 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-09-09 12:47 - 2015-07-23 02:03 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 01390592 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-09-09 12:47 - 2015-07-23 02:02 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-09-09 12:47 - 2015-07-23 02:02 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-09-09 12:47 - 2015-07-23 02:01 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-09-09 12:47 - 2015-07-23 02:01 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-09-09 12:47 - 2015-07-23 02:01 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-09-09 12:47 - 2015-07-23 01:58 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-09-09 12:47 - 2015-07-23 01:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:51 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-09-09 12:47 - 2015-07-22 19:57 - 03989952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-09-09 12:47 - 2015-07-22 19:57 - 03934656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-09-09 12:47 - 2015-07-22 19:54 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-09-09 12:47 - 2015-07-22 19:52 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-09-09 12:47 - 2015-07-22 19:52 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-09-09 12:47 - 2015-07-22 19:52 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-09-09 12:47 - 2015-07-22 19:52 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-09-09 12:47 - 2015-07-22 19:52 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-09-09 12:47 - 2015-07-22 19:52 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-09-09 12:47 - 2015-07-22 19:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-09-09 12:47 - 2015-07-22 19:47 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-09-09 12:47 - 2015-07-22 19:46 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 18:48 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-09-09 12:47 - 2015-07-22 18:45 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-09-09 12:47 - 2015-07-22 18:44 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-09-09 12:47 - 2015-07-22 18:44 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-09-09 12:47 - 2015-07-22 18:34 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-09-09 12:47 - 2015-07-22 18:34 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-09-09 12:47 - 2015-07-22 18:31 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 18:31 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 18:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 18:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-09-09 12:47 - 2015-07-15 05:17 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-09-09 12:47 - 2015-07-15 04:54 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2015-09-09 12:47 - 2015-07-09 19:58 - 01632256 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-09-09 12:47 - 2015-07-09 19:58 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2015-09-09 12:47 - 2015-07-09 19:42 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-09-09 12:47 - 2015-07-09 19:42 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2015-09-09 12:47 - 2015-06-25 12:06 - 00115136 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-09-09 12:47 - 2015-06-25 12:01 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-09-09 12:47 - 2015-06-25 12:01 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-09-09 12:47 - 2015-06-25 11:44 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-09-08 23:55 - 2015-09-09 00:04 - 00000000 ____D C:\Users\*****\Desktop\Spellforce Ordner
2015-09-08 17:25 - 2015-09-19 22:21 - 00002088 _____ C:\Users\*****\Desktop\SpellForce - Platinum Edition.lnk
2015-09-08 17:25 - 2015-09-08 17:25 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JoWooD
2015-09-08 17:25 - 2015-09-08 17:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JoWooD
2015-09-08 17:20 - 2015-09-08 17:20 - 00000000 ____D C:\Program Files (x86)\JoWooD
2015-09-08 14:20 - 2015-09-08 14:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seagate
2015-09-08 14:20 - 2015-09-08 14:20 - 00000000 ____D C:\Program Files (x86)\Seagate
2015-09-05 13:37 - 2015-09-05 13:37 - 00002450 _____ C:\Users\*****\Desktop\Sicherer Zahlungsverkehr.lnk
2015-09-05 13:36 - 2015-09-05 13:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
2015-09-05 13:35 - 2015-10-01 15:23 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2015-09-05 13:35 - 2015-09-05 13:35 - 00000000 ____D C:\Windows\ELAMBKUP
2015-09-05 13:35 - 2015-09-05 13:35 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2015-09-05 13:35 - 2015-07-04 02:18 - 00227000 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\klhk.sys
2015-09-05 13:35 - 2015-06-30 01:05 - 00931000 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2015-09-05 13:35 - 2015-06-30 01:05 - 00171192 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2015-09-05 13:35 - 2013-05-06 08:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll
2015-09-04 12:37 - 2015-09-04 12:37 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-09-02 17:30 - 2015-09-02 17:30 - 00023583 _____ C:\Users\*****\Desktop\HTML_Nachricht
2015-09-01 17:54 - 2015-09-06 23:45 - 00000000 ____D C:\Users\*****\Desktop\urlaub

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-10-01 16:19 - 2013-11-01 01:42 - 00000000 ____D C:\FRST
2015-10-01 16:19 - 2013-09-07 15:11 - 00000000 ____D C:\Users\*****
2015-10-01 16:14 - 2011-04-12 09:43 - 00700454 _____ C:\Windows\system32\perfh007.dat
2015-10-01 16:14 - 2011-04-12 09:43 - 00150092 _____ C:\Windows\system32\perfc007.dat
2015-10-01 16:14 - 2009-07-14 07:13 - 01624034 _____ C:\Windows\system32\PerfStringBackup.INI
2015-10-01 16:00 - 2015-06-19 19:49 - 00001220 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3887911213-2195480286-3553274884-1000UA.job
2015-10-01 15:53 - 2013-09-07 16:12 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-10-01 15:33 - 2015-06-08 14:46 - 00000000 ____D C:\ProgramData\Malwarebytes Anti-Exploit
2015-10-01 15:29 - 2015-05-27 18:01 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-10-01 15:28 - 2009-07-14 06:45 - 00037280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-10-01 15:28 - 2009-07-14 06:45 - 00037280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-10-01 15:23 - 2015-05-27 18:01 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-10-01 15:23 - 2014-02-09 21:07 - 00000000 ___RD C:\Users\*****\Dropbox
2015-10-01 15:23 - 2014-02-09 20:52 - 00000000 ____D C:\Users\*****\AppData\Roaming\Dropbox
2015-10-01 15:23 - 2014-01-31 22:01 - 00000000 ____D C:\Program Files (x86)\Steam
2015-10-01 15:23 - 2013-09-07 15:11 - 01059619 ____N C:\Windows\WindowsUpdate.log
2015-10-01 14:16 - 2014-10-08 17:38 - 00000000 ____D C:\ProgramData\NVIDIA
2015-10-01 14:16 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-10-01 14:09 - 2009-07-14 05:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2015-10-01 14:08 - 2013-09-07 16:10 - 00000000 ____D C:\Users\*****\AppData\Local\Adobe
2015-10-01 14:07 - 2015-08-19 12:15 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-10-01 14:04 - 2009-07-14 06:45 - 05085232 _____ C:\Windows\system32\FNTCACHE.DAT
2015-10-01 14:03 - 2015-06-03 17:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-10-01 04:17 - 2014-02-20 03:26 - 00000000 ____D C:\Users\*****\AppData\Roaming\vlc
2015-10-01 04:09 - 2013-09-07 16:13 - 00000000 ____D C:\Users\*****\AppData\Roaming\Adobe
2015-10-01 02:54 - 2013-09-07 16:37 - 00000000 ____D C:\Users\*****\AppData\Roaming\Skype
2015-10-01 02:07 - 2013-09-07 15:39 - 00111576 _____ C:\Users\*****\AppData\Local\GDIPFONTCACHEV1.DAT
2015-10-01 00:30 - 2015-05-27 18:02 - 00002175 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-10-01 00:00 - 2015-06-19 19:49 - 00001168 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3887911213-2195480286-3553274884-1000Core.job
2015-09-30 20:24 - 2013-09-07 16:37 - 00000000 ____D C:\ProgramData\Skype
2015-09-30 20:24 - 2009-07-14 05:20 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2015-09-30 20:23 - 2015-08-29 12:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-09-30 19:37 - 2013-09-07 15:58 - 00000000 ____D C:\Windows\Panther
2015-09-30 19:29 - 2014-09-11 19:43 - 00000000 ____D C:\Users\*****\Desktop\Magic Tricks
2015-09-30 19:27 - 2013-11-10 01:36 - 00000000 ____D C:\ProgramData\Package Cache
2015-09-30 18:59 - 2013-09-07 16:43 - 00000000 ____D C:\ProgramData\Adobe
2015-09-30 18:15 - 2013-10-15 16:09 - 00000000 ____D C:\Program Files\Common Files\Adobe
2015-09-30 17:14 - 2013-11-26 22:28 - 00000000 ____D C:\Users\*****\AppData\Roaming\NVIDIA
2015-09-30 17:14 - 2013-10-15 19:16 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2015-09-30 17:12 - 2013-09-07 16:43 - 00000000 ____D C:\Program Files (x86)\Adobe
2015-09-30 15:25 - 2013-11-26 04:19 - 00000000 ____D C:\Users\*****\AppData\Roaming\Audacity
2015-09-30 14:11 - 2014-09-24 11:32 - 00000000 ____D C:\Users\*****\AppData\Local\Battle.net
2015-09-30 13:41 - 2014-09-24 11:32 - 00000000 ____D C:\Program Files (x86)\Battle.net
2015-09-29 21:12 - 2013-09-15 16:14 - 00000000 ____D C:\Program Files (x86)\StarCraft II
2015-09-27 02:00 - 2015-06-08 19:43 - 00041352 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\klpd.sys
2015-09-23 16:53 - 2013-09-07 16:12 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-09-23 16:53 - 2013-09-07 16:11 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-09-23 16:53 - 2013-09-07 16:11 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-09-17 13:53 - 2015-07-10 09:08 - 00000000 ____D C:\Users\*****\Desktop\Powerpoints
2015-09-17 13:51 - 2013-11-01 01:05 - 00000000 ___RD C:\Users\*****\Desktop\Uni
2015-09-16 22:36 - 2013-09-07 15:17 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel PROSet Wireless
2015-09-16 14:48 - 2015-08-15 13:36 - 00000000 ____D C:\Users\*****\Desktop\Zu Hause
2015-09-16 12:24 - 2015-05-27 18:01 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-09-16 12:24 - 2015-05-27 18:01 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-09-14 19:29 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-09-12 18:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-09-12 17:15 - 2015-04-09 00:02 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-09-12 17:15 - 2015-04-09 00:02 - 00000000 ___SD C:\Windows\system32\GWX
2015-09-12 17:15 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-09-10 16:00 - 2014-10-07 18:50 - 00000000 ____D C:\Program Files (x86)\CDBurnerXP
2015-09-10 16:00 - 2013-11-01 00:48 - 00001109 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2015-09-10 15:20 - 2013-09-07 15:11 - 00001413 _____ C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-09-10 15:16 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\zh-HK
2015-09-10 15:16 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\tr-TR
2015-09-10 15:15 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\zh-HK
2015-09-10 15:15 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\tr-TR
2015-09-09 21:14 - 2011-04-12 09:55 - 00000000 ____D C:\Program Files\Windows Journal
2015-09-09 18:19 - 2013-09-07 15:46 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-09-09 18:18 - 2013-09-15 16:42 - 00000000 ____D C:\Windows\system32\MRT
2015-09-08 00:44 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2015-09-05 15:37 - 2015-08-19 13:16 - 00000000 ____D C:\Users\*****\Desktop\Bionik Text
2015-09-05 13:32 - 2013-09-07 16:21 - 00000000 ____D C:\ProgramData\AVAST Software
2015-09-05 13:01 - 2013-10-15 20:17 - 00000000 ____D C:\Users\*****\AppData\Local\Google
2015-09-05 12:56 - 2014-06-27 17:04 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-09-01 22:45 - 2015-08-30 17:07 - 00000000 ____D C:\Users\*****\Desktop\zu Hause upload

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2015-08-19 12:11 - 2015-08-19 12:11 - 0000268 ___RH () C:\Users\*****\AppData\Roaming\Woodwinds
2015-08-19 12:12 - 2015-08-19 12:12 - 0000268 ___RH () C:\Users\*****\AppData\Roaming\Work - Home
2015-08-19 12:11 - 2015-08-19 12:11 - 0000268 ___RH () C:\Users\*****\AppData\Roaming\Workflows
2013-11-27 03:47 - 2013-11-27 04:05 - 0008192 _____ () C:\Users\*****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-01-30 08:08 - 2014-01-30 08:08 - 1065984 _____ () C:\Users\*****\AppData\Local\file__0.localstorage
2015-08-19 12:11 - 2015-08-19 12:11 - 0000268 ___RH () C:\ProgramData\designjet
2015-08-19 12:12 - 2015-08-19 12:12 - 0000268 ___RH () C:\ProgramData\deskjet
2015-08-19 12:11 - 2015-08-19 12:11 - 0000268 ___RH () C:\ProgramData\docInfo
2013-10-19 18:22 - 2013-10-19 18:22 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2015-08-19 12:12 - 2015-08-19 12:12 - 0000020 ____H () C:\ProgramData\PKP_DLes.DAT
2015-08-19 12:11 - 2015-08-19 12:17 - 0000020 ____H () C:\ProgramData\PKP_DLet.DAT
2015-08-19 12:11 - 2015-08-19 12:11 - 0000020 ____H () C:\ProgramData\PKP_DLev.DAT

Dateien, die verschoben oder gelöscht werden sollten:
====================
C:\Users\*****\Activation_enu.exe
C:\Users\*****\idman623build14.exe


Einige Dateien in TEMP:
====================
C:\Users\*****\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp8cuemq.dll


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-09-25 17:13

==================== Ende von FRST.txt ============================

MrXxx · 01.10.2015, 16:33

Code:

ATTFilter

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:30-09-2015
durchgeführt von ***** (2015-10-01 16:20:18)
Gestartet von C:\Users\*****\Desktop
Windows 7 Professional Service Pack 1 (X64) (2013-09-07 13:11:32)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-3887911213-2195480286-3553274884-500 - Administrator - Disabled)
***** (S-1-5-21-3887911213-2195480286-3553274884-1000 - Administrator - Enabled) => C:\Users\*****
Gast (S-1-5-21-3887911213-2195480286-3553274884-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3887911213-2195480286-3553274884-1091 - Limited - Enabled)

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Kaspersky Internet Security (Enabled - Up to date) {B41C7598-35F6-4D89-7D0E-7ADE69B4047B}
AS: Kaspersky Internet Security (Enabled - Up to date) {0F7D947C-13CC-4207-47BE-41AC12334EC6}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {8C27F4BD-7F99-4CD1-5651-D3EB97674300}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

Adobe After Effects CC 2015 (HKLM-x32\...\{147EC100-14BE-45EF-AB42-35BAEE7D02F0}) (Version: 13.5.1 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 18.0.0.180 - Adobe Systems Incorporated)
Adobe Audition CC 2015 (HKLM-x32\...\{839A3566-AED6-4787-A849-5CBE2B1DC6AE}) (Version: 8.0 - Adobe Systems Incorporated)
Adobe Bridge CC (64 Bit) (HKLM-x32\...\{359F8007-6486-429C-A8C5-D67F6897C88C}) (Version: 6.1.1 - Adobe Systems Incorporated)
Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.5.23 - Adobe Systems Incorporated.)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 3.3.0.151 - Adobe Systems Incorporated)
Adobe Flash Player 19 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 19.0.0.185 - Adobe Systems Incorporated)
Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.185 - Adobe Systems Incorporated)
Adobe Lightroom (HKLM-x32\...\{8048A5DF-8A70-5BE1-954B-E0FDE1BD0D0D}) (Version: 6.1.1 - Adobe Systems Incorporated)
Adobe Media Encoder CC 2015 (HKLM-x32\...\{0FAC7130-BEC5-47A5-8813-1D339B8326ED}) (Version: 9.0.2 - Adobe Systems Incorporated)
Adobe Photoshop CC 2015 (HKLM-x32\...\{793C2BF7-A4FE-4608-91C9-9282C5801C21}) (Version: 16.0.1 - Adobe Systems Incorporated)
Adobe Photoshop Elements 10 (HKLM-x32\...\Adobe Photoshop Elements 10) (Version: 10.0 - Adobe Systems Incorporated)
Adobe Premiere Pro CC 2015 (HKLM-x32\...\{38C72D42-0672-43B1-9E05-E7631684F9A1}) (Version: 9.0.2 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.12) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)
Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version:  - Hidden Path Entertainment, Ensemble Studios)
Age of Empires III - The WarChiefs (HKLM-x32\...\InstallShield_{1C08A24C-B168-407E-A826-68FAF5F20710}) (Version: 1.00.0000 - Microsoft Game Studios)
Age of Empires III - The WarChiefs (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden
Age of Mythology: Extended Edition (HKLM-x32\...\Steam App 266840) (Version:  - SkyBox Labs)
Amazon Kindle (HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\...\Amazon Kindle) (Version:  - Amazon)
Apple Application Support (32-Bit) (HKLM-x32\...\{7FE25256-B7C1-480D-B736-10A67A833AEA}) (Version: 3.2 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{B255D495-4734-4E9B-B4F5-96702FD4A7B9}) (Version: 3.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{5D61F006-168C-4B8B-B7FD-F113C10AE0E4}) (Version: 8.2.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
bl (x32 Version: 1.0.0 - Your Company Name) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Brother MFL-Pro Suite MFC-J430W (HKLM-x32\...\{A1B36B88-AF90-43A3-8906-6DBEE89B4FBD}) (Version: 1.1.6.0 - Brother Industries, Ltd.)
Browser-Security (HKLM-x32\...\Browser-Security) (Version: 1.0.5.0 - )
CCleaner (HKLM\...\CCleaner) (Version: 4.18 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.6.5844 - CDBurnerXP)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dropbox (HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\...\Dropbox) (Version: 3.8.8 - Dropbox, Inc.)
Elements 10 Organizer (x32 Version: 10.0 - Ihr Firmenname) Hidden
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Fraps (HKLM-x32\...\Fraps) (Version:  - )
GameRanger (HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\...\GameRanger) (Version:  - GameRanger Technologies)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 46.0.2490.52 - Google Inc.)
Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden
iMazing 1.2.4.0 (HKLM\...\iMazing_is1) (Version: 1.2.4.0 - DigiDNA)
Intel(R) Network Connections 18.5.54.0 (HKLM\...\PROSetDX) (Version: 18.5.54.0 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3412 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{BEE86606-EFB5-4353-9F34-29E0C59CDCFA}) (Version: 15.2.0.0284 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.0.0.100 - Intel Corporation)
Intel® PROSet/Wireless WiFi-Software (HKLM\...\{181BBF43-CA17-4E1A-A78D-81E67A57B8A4}) (Version: 15.02.0000.1258 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
iTunes (HKLM\...\{BFEAB774-C7DC-4032-B05A-DA5F7CB7B365}) (Version: 12.2.2.25 - Apple Inc.)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{77E7AE5C-181C-4CAF-ADBF-946F11C1CE26}) (Version: 16.0.0.614 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 16.0.0.614 - Kaspersky Lab) Hidden
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version:  - )
Malwarebytes Anti-Exploit version 1.07.1.1015 (HKLM\...\Malwarebytes Anti-Exploit_is1) (Version: 1.07.1.1015 - Malwarebytes)
Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
MetaTrader 4 Admiral Markets AS (HKLM-x32\...\MetaTrader 4 Admiral Markets AS) (Version: 4.00 - MetaQuotes Software Corp.)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Age of Empires II (HKLM-x32\...\Age of Empires 2.0) (Version:  - )
Microsoft Age of Empires II: The Conquerors Expansion (HKLM-x32\...\Age of Empires II: The Conquerors Expansion 1.0) (Version:  - )
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{D285FC5F-3021-32E9-9C59-24CA325BDC5C}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nikon Message Center 2 (HKLM-x32\...\{B014EE44-9197-4513-9613-71E6EB1B514E}) (Version: 2.1.1 - Nikon)
Nikon Movie Editor (HKLM-x32\...\{5CAD3393-EEC0-44CE-9F93-BCAA365B77FB}) (Version: 2.9.2 - Nikon)
NVIDIA 3D Vision Controller-Treiber 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 344.11 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 344.11 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.3 - NVIDIA Corporation)
NVIDIA Grafiktreiber 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.11 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.32.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.32.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
ODT Viewer version 1.0 (HKLM-x32\...\{CAA1B43B-7CDA-4D58-B9A3-1050C358CB2D}_is1) (Version: 1.0 - odtviewer.com)
ON_OFF Charge 2 B13.0403.1 (HKLM-x32\...\InstallShield_{6B4ED6F7-BB88-4945-B0C6-01410E1BAC3A}) (Version: 1.00.0000 - GIGABYTE)
ON_OFF Charge 2 B13.0403.1 (x32 Version: 1.00.0000 - GIGABYTE) Hidden
ON_OFF Charge B13.0403.1 (HKLM-x32\...\{3DECD372-76A1-4483-BF10-B547790A3261}) (Version: 1.00.0001 - GIGABYTE)
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
Paint XP version 1.1 (HKLM-x32\...\{2367FAB6-055A-4923-835F-F57F7BBBA363}_is1) (Version: 1.1 - MSPAINTXP.COM)
ph (x32 Version: 1.0.0 - Your Company Name) Hidden
Picture Control Utility 2 (HKLM\...\{D4893C47-704F-4B84-8486-9DE4974ACA6F}) (Version: 2.0.2 - Nikon)
PSE10 STI Installer (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
Qualcomm Atheros Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.21 - Qualcomm Atheros Inc.)
QuickTime 7 (HKLM-x32\...\{627FFC10-CE0A-497F-BA2B-208CAC638010}) (Version: 7.77.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7037 - Realtek Semiconductor Corp.)
Saal Design Software (HKLM-x32\...\SaalDesignSoftware) (Version: 3.9 - Saal Digital Fotoservice GmbH)
Saal Design Software (x32 Version: 3.9 - Saal Digital Fotoservice GmbH) Hidden
Sandboxie 5.04 (64-bit) (HKLM\...\Sandboxie) (Version: 5.04 - Sandboxie Holdings, LLC)
SeaTools for Windows 1.4.0.2 (HKLM-x32\...\SeaTools for Windows) (Version: 1.4.0.2 - Seagate Technology)
Secunia PSI (3.0.0.7011) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.7011 - Secunia)
SHIELD Streaming (Version: 3.1.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.13.56 - NVIDIA Corporation) Hidden
Skype™ 7.11 (HKLM-x32\...\{6A0549A9-1B96-498C-ACBC-3943001FEB19}) (Version: 7.11.102 - Skype Technologies S.A.)
SpellForce (HKLM-x32\...\SpellForce) (Version: SpellForce v1.52 - JoWooD Productions Software AG)
StarCraft II (HKLM-x32\...\StarCraft II) (Version:  - Blizzard Entertainment)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.38846 - TeamViewer)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden
ViewNX 2 (HKLM\...\{635BE602-BB9C-4C59-8CC5-93F9366E8A21}) (Version: 2.10.3 - Nikon)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Media Encoder 9 Series x64 Edition (HKLM\...\Windows Media Encoder 9) (Version:  - )
WinRAR 5.21 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH)
WinTelnet & FTP Pro 2.5 for Windows 95 & NT! (HKLM-x32\...\WinTelnet & FTP Pro 2.5 for Windows 95 & NT!) (Version:  - )

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll => Keine Datei

==================== Wiederherstellungspunkte =========================

03-09-2015 15:41:26 Geplanter Prüfpunkt
03-09-2015 17:57:53 Windows Update
04-09-2015 01:34:37 Windows Update
05-09-2015 03:00:10 Windows Update
05-09-2015 03:30:34 Windows Update
05-09-2015 13:30:13 avast! antivirus system restore point
06-09-2015 03:00:12 Windows Update
06-09-2015 03:47:55 Windows Update
06-09-2015 13:04:54 Windows Update
07-09-2015 01:46:29 Windows Update
08-09-2015 03:00:11 Windows Update
08-09-2015 03:13:03 Windows Update
08-09-2015 13:19:52 Windows-Sicherung
08-09-2015 14:20:34 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
09-09-2015 03:00:12 Windows Update
09-09-2015 12:40:18 Windows Update
09-09-2015 18:06:34 Windows Update
09-09-2015 21:58:17 Windows Update
10-09-2015 13:45:42 Windows Update
10-09-2015 18:33:45 Windows Update
11-09-2015 01:54:54 Windows Update
11-09-2015 16:00:16 Windows Update
13-09-2015 16:00:57 Windows-Sicherung
15-09-2015 16:32:43 Windows Update
23-09-2015 13:38:58 Windows Update
29-09-2015 15:10:05 Windows Update
30-09-2015 14:18:07 Snagit 12
30-09-2015 14:39:54 Camtasia Studio 8 wird installiert
30-09-2015 14:58:15 Installed Jing
30-09-2015 15:26:16 Removed Jing
30-09-2015 15:27:15 Camtasia Studio 8 wird entfernt
30-09-2015 16:37:28 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501
30-09-2015 16:37:44 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
30-09-2015 16:38:12 Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501
30-09-2015 17:01:25 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030
30-09-2015 17:01:49 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030
30-09-2015 17:02:23 Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501
30-09-2015 17:02:52 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501
30-09-2015 19:21:21 Snagit 12
30-09-2015 19:57:45 Camtasia Studio 8 wird installiert
01-10-2015 15:41:06 Camtasia Studio 8 wird entfernt

==================== Hosts Inhalt: ==========================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2009-07-14 04:34 - 2015-09-30 19:54 - 00000260 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
127.0.0.1    activation.cloud.techsmith.com
127.0.0.1    oscount.techsmith.com
127.0.0.1    updater.techsmith.com
127.0.0.1    camtasiatudi.techsmith.com
127.0.0.1    tsccloud.cloudapp.net
127.0.0.1    assets.cloud.techsmith.com


==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {0A353796-DBE5-4C0C-9B75-2D00F7DA0010} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-3887911213-2195480286-3553274884-1000Core => C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-19] (Dropbox, Inc.)
Task: {2BE4A7A0-1B91-4F0A-9BB2-3200BA596C04} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {324919A9-5E73-4EC7-BBED-FD116D2D2FD0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-05-27] (Google Inc.)
Task: {377E924D-5D56-4F63-B629-839CA7608225} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {4DA1AC0A-5224-44EE-B392-1AB3365D0760} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-05-27] (Google Inc.)
Task: {7E468E54-35CF-49F6-89F8-BDE988FDE0AB} - System32\Tasks\{B25A8B84-1BBD-4577-BB6B-8C7BDCC13539} => C:\Program Files (x86)\JoWooD\SpellForce\SpellForce.exe [2005-06-07] ()
Task: {964C09AE-F58A-4E3E-BD5D-B5283650C59B} - System32\Tasks\{2F9C545E-5DA5-46F0-BC8B-4A4C8ED349D8} => C:\Program Files (x86)\JoWooD\SpellForce\SpellForce.exe [2005-06-07] ()
Task: {A3F51735-24AF-49E3-BF5E-6BCF9361DD69} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiser
Task: {A7F577E9-B502-47B6-B7BD-E30198545396} - System32\Tasks\AdobeAAMUpdater-1.0-*****-PC-***** => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2015-09-04] (Adobe Systems Incorporated)
Task: {C1AD5DA8-19D9-4ED3-9C01-8F36A74C7C9E} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-09-26] (Piriform Ltd)
Task: {D5649897-4820-4FD9-8526-C9F5DC25A22D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-09-23] (Adobe Systems Incorporated)
Task: {F85449EC-4854-4AF6-8AF3-DDDB814FA12D} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-3887911213-2195480286-3553274884-1000UA => C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-19] (Dropbox, Inc.)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3887911213-2195480286-3553274884-1000Core.job => C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3887911213-2195480286-3553274884-1000UA.job => C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2014-10-08 17:37 - 2014-09-13 23:53 - 00116880 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-05-15 16:26 - 2015-05-15 16:26 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-05-15 16:26 - 2015-05-15 16:26 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-09-11 19:02 - 2015-09-11 19:02 - 00803488 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
2010-07-15 06:44 - 2010-07-15 06:44 - 00020032 _____ () C:\Program Files\Unlocker\UnlockerCOM.dll
2014-01-25 03:22 - 2014-01-25 03:22 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-09-25 20:44 - 2014-09-25 20:44 - 00053248 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2015-10-01 00:30 - 2015-09-30 14:06 - 01908040 _____ () C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.52\libglesv2.dll
2015-10-01 00:30 - 2015-09-30 14:06 - 00093512 _____ () C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.52\libegl.dll
2015-07-08 23:18 - 2015-07-08 23:18 - 00794920 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\kpcengine.2.3.dll
2014-01-10 16:33 - 2015-07-03 18:12 - 00778240 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2015-01-21 17:44 - 2015-07-03 18:12 - 04962816 _____ () C:\Program Files (x86)\Steam\v8.dll
2015-01-21 17:44 - 2015-07-03 18:12 - 01556992 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2015-01-21 17:44 - 2015-07-03 18:12 - 01187840 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2014-05-22 23:23 - 2015-08-19 22:39 - 02413248 _____ () C:\Program Files (x86)\Steam\video.dll
2014-09-07 18:26 - 2014-12-01 23:31 - 02396672 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2014-09-07 18:26 - 2014-12-01 23:31 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2014-09-07 18:26 - 2014-12-01 23:31 - 00479744 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2014-09-07 18:26 - 2014-12-01 23:31 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2014-09-07 18:26 - 2014-12-01 23:31 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2014-01-27 12:02 - 2015-08-19 22:39 - 00704192 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2015-07-22 00:05 - 2015-07-27 03:13 - 00171008 _____ () C:\Program Files (x86)\Steam\bin\openvr_api.dll
2015-10-01 15:23 - 2015-10-01 15:23 - 00071168 _____ () c:\users\*****\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp8cuemq.dll
2015-03-04 23:45 - 2015-08-05 07:26 - 00012800 _____ () C:\Users\*****\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll
2015-03-04 23:45 - 2015-08-05 07:26 - 00779776 _____ () C:\Users\*****\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-07-31 11:05 - 2015-08-05 07:26 - 00056320 _____ () C:\Users\*****\AppData\Roaming\Dropbox\bin\QtQuick\Layouts\qquicklayoutsplugin.dll
2015-03-04 23:45 - 2015-08-05 07:26 - 00012288 _____ () C:\Users\*****\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll
2014-10-01 18:36 - 2009-02-27 16:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2014-01-10 16:33 - 2015-07-03 18:12 - 39553928 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)

AlternateDataStreams: C:\ProgramData\TEMP:5C321E34

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\*****\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

MSCONFIG\startupreg: Google Update => "C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: GrooveMonitor => "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
MSCONFIG\startupreg: ISUSPM Startup => C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
MSCONFIG\startupreg: ISUSScheduler => "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{EF75A5ED-C6CE-4E62-9DD9-930C2D2092EF}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{60A1D3E6-D15B-4B05-A3F7-644BD93290B4}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1675\Agent.exe
FirewallRules: [{D370DA75-CA12-4314-A8F8-BB8BC849A974}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1675\Agent.exe
FirewallRules: [{486FE09B-66B2-4B5B-A64C-FE59C479E737}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2045\Agent.exe
FirewallRules: [{0AA9FD60-C021-496A-8C9A-54D3BA648143}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2045\Agent.exe
FirewallRules: [{11EF2C32-0FA4-45D1-BC51-862440DB7F73}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II.exe
FirewallRules: [{D8468CD5-B10C-42E7-895B-F906DAFA82E8}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II.exe
FirewallRules: [{1B92F5CA-5A6B-4519-AED6-01F3853AA534}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II Public Test.exe
FirewallRules: [{E4DA306C-7F49-4FA9-9AF8-9191B46E2E0E}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II Public Test.exe
FirewallRules: [TCP Query User{439914F9-21EA-4136-BA35-1E4AB21B24B1}C:\program files (x86)\starcraft ii\versions\base26490\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base26490\sc2.exe
FirewallRules: [UDP Query User{E3241DAB-58A3-424A-89A8-53D502CD6771}C:\program files (x86)\starcraft ii\versions\base26490\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base26490\sc2.exe
FirewallRules: [{2E43EE8E-E942-43E3-A740-3436F1DC6720}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires II\age2_x1\age2_x2.exe
FirewallRules: [{2F95D7AC-4EA7-4593-85FE-E8E02DC1D0AD}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires II\age2_x1\age2_x2.exe
FirewallRules: [TCP Query User{F0F67C14-B2AB-47DD-A63E-26BD95D2A150}C:\users\*****\appdata\roaming\gameranger\gameranger\gameranger.exe] => (Allow) C:\users\*****\appdata\roaming\gameranger\gameranger\gameranger.exe
FirewallRules: [UDP Query User{2139204F-45DE-4B05-9660-84FBA6B203F7}C:\users\*****\appdata\roaming\gameranger\gameranger\gameranger.exe] => (Allow) C:\users\*****\appdata\roaming\gameranger\gameranger\gameranger.exe
FirewallRules: [{AFEBFC20-BB84-4AEB-93AD-44109B587F6F}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3.exe
FirewallRules: [{9EDA41C2-EDC2-4BC7-8B1C-BE9AF6CAAF6E}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3.exe
FirewallRules: [{B34A0387-77CA-4E86-A324-634BDE24F2CC}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3x.exe
FirewallRules: [{EC8D4FC3-1CB3-4C81-BBF1-BDDC6B9FA5CA}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3x.exe
FirewallRules: [{35F0EEB1-E6FA-4B98-AE1E-846876FACC95}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3y.exe
FirewallRules: [{A547251F-D499-45CE-99F4-EA8B3707595B}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3y.exe
FirewallRules: [{C413EE3F-B0E6-47C8-8BDC-AFE591D3578C}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2328\Agent.exe
FirewallRules: [{5A91CF27-C64E-419F-8568-5F9696C1EFD3}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2328\Agent.exe
FirewallRules: [{2F5E16C4-6192-49A5-9B4E-BF49A821A31D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exe
FirewallRules: [{0DB5BA90-0A30-40D3-BC6B-23BF14D8B8DA}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exe
FirewallRules: [{A10C6BAC-94EE-480D-893B-B7FF77BD01DF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Age2HD\Launcher.exe
FirewallRules: [{1A7DA604-83C6-4B35-A6D0-A6849074E7F6}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Age2HD\Launcher.exe
FirewallRules: [TCP Query User{7567DB64-287B-4D19-9DB5-8BCBFE27806F}C:\program files (x86)\voobly\voobly.exe] => (Allow) C:\program files (x86)\voobly\voobly.exe
FirewallRules: [UDP Query User{F8D81767-39F1-4C8A-8498-0047BE8EA852}C:\program files (x86)\voobly\voobly.exe] => (Allow) C:\program files (x86)\voobly\voobly.exe
FirewallRules: [TCP Query User{7B2EE519-A8BB-4814-9D0C-500DEFC7042A}C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe] => (Allow) C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe
FirewallRules: [UDP Query User{8BE88C92-BAA6-42A0-BBCF-2EAD03337555}C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe] => (Allow) C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe
FirewallRules: [{CF6411CE-1309-44E1-9870-B52728343068}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{EF86CA9F-EC69-4B89-B4EF-ABCF52457E4D}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{B4F8A91F-38CC-4D13-B8A8-73ECEEB73C90}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{FFAB3750-7D8E-4679-A3B4-394764FD1696}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{277A2BA7-2D1D-49A1-91A5-BD0D7DA815E7}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{7C5A9997-8B90-4CFA-9F9C-19E42448C7D6}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [TCP Query User{5EED7F17-2093-4698-9E3B-A026DD58C24C}C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe
FirewallRules: [UDP Query User{B18686B0-3007-4ACD-9E89-0579BDD1EA74}C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe
FirewallRules: [{47CFD57B-07EE-4EDD-88C1-C8A89B536332}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{E8D5198E-5278-455F-B609-531473E07F41}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{A6934835-54C3-42D5-BFD8-46737DF1843E}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires II\age2_x1\age2_x2.exe
FirewallRules: [{973C13EE-F3CF-4180-A1DA-D107A8BA116D}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires II\age2_x1\age2_x2.exe
FirewallRules: [{6DE2073B-414F-4558-922C-9887604C99C2}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{ADBD2A82-891D-4487-88C8-AEBC44C6BD82}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{DB86E199-E63B-4F55-B994-0238710F0852}] => (Allow) C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{48866709-0683-48CA-9DCC-5EA07E00A4EA}] => (Allow) C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{0A94CB91-5E19-4D2C-9BDB-0A25F3BD8C71}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2689\Agent.exe
FirewallRules: [{78BE73D1-C57F-4C29-8D4F-1EB1441E40D0}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2689\Agent.exe
FirewallRules: [{79B9467A-43DB-46EC-8A62-B201EA89DABE}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2717\Agent.exe
FirewallRules: [{BCE6E3A1-C8FE-428F-A810-F1B685A5BC11}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2717\Agent.exe
FirewallRules: [{8DF4C616-0107-4BFF-ABA5-64E3B8FED48A}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2816\Agent.exe
FirewallRules: [{AEA5E48C-8180-4B6C-B2CA-7A8A312EA08B}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2816\Agent.exe
FirewallRules: [TCP Query User{62D8C5F8-A5B2-4778-B60E-9713F555B0FA}C:\users\*****\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\*****\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{E199CB01-521D-4262-B32E-D1E467572966}C:\users\*****\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\*****\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{600FD0AC-CADD-4398-AFDD-6E021A4BAC21}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe
FirewallRules: [{AA834CFB-D47C-4D13-8A0F-2475016ABB43}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe
FirewallRules: [{A9F84DFA-5B09-46E9-A482-E18A5B83302E}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3023\Agent.exe
FirewallRules: [{9A383178-2DDB-45F1-9ED0-C49A29DA106F}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3023\Agent.exe
FirewallRules: [{F04C1600-E2B9-4794-BF7D-1B7CE3A6B238}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3147\Agent.exe
FirewallRules: [{5BDBF00B-8A89-4DC3-8095-7F6D1D4309AD}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3147\Agent.exe
FirewallRules: [{87508363-FD5D-40E9-B52D-DF58FBBAB09A}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3182\Agent.exe
FirewallRules: [{D4ED5C2F-EBB3-4BE2-9381-4CF2AEB36C80}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3182\Agent.exe
FirewallRules: [{E355BC6E-A601-4229-9917-182708C55BB8}] => (Allow) C:\Windows\SysWOW64\dplaysvr.exe
FirewallRules: [{91252FE3-D1F1-49B8-845D-72F472B5251D}] => (Allow) C:\Windows\SysWOW64\dplaysvr.exe
FirewallRules: [{79FAD884-86A7-4AB6-8AFF-FDD578E43C46}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires II\age2_x1\age2_x2.exe
FirewallRules: [{1C8B1B71-0325-4FC8-9623-599EC82DBB4E}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires II\age2_x1\age2_x2.exe
FirewallRules: [{BB7BE806-FC79-4C06-9F10-AF345F032CF2}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3235\Agent.exe
FirewallRules: [{BF9F3950-0B35-4BB4-92E9-D7354B2C3E2D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3235\Agent.exe
FirewallRules: [{3B0765B6-9B1D-4884-AE3F-D0F00A627ED4}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{8DF4DBD0-BB9D-45D0-BD5A-12F1AABE58DC}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{4169278E-EEA7-491D-8B36-BD9F0A558115}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3286\Agent.exe
FirewallRules: [{2CA484EF-E564-4D5D-8CE9-6C2DDCF7B8AC}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3286\Agent.exe
FirewallRules: [{F7229EB7-D401-462F-9FD1-0029E7AF03C5}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Age of Mythology\Launcher.exe
FirewallRules: [{41CD60DE-BFCB-46D5-B70C-CF9CBE34C85F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Age of Mythology\Launcher.exe
FirewallRules: [{470ACAF7-B706-4139-B550-C7D45899BEB2}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3372\Agent.exe
FirewallRules: [{10422840-0606-4E4C-B300-95A0AAC3D940}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3372\Agent.exe
FirewallRules: [{48E3AAF8-DD49-4AB6-A344-7E09034F4A7C}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{7C326F86-EE42-410E-8508-251F4AA7E084}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [TCP Query User{34D89C74-FD4B-4D79-ACD3-243A253B3503}C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe
FirewallRules: [UDP Query User{0B3896A4-F01B-4476-B1BB-83925CF39C00}C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe
FirewallRules: [{2DBC602E-46C0-4AB7-9C8C-3524DB83617C}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3454\Agent.exe
FirewallRules: [{4F9AF48A-0272-4980-B818-C5264720E8B0}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3454\Agent.exe
FirewallRules: [{29541B14-6720-4EEE-A455-F9A0B6662102}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3507\Agent.exe
FirewallRules: [{D9012977-FAA1-4B6E-A1A9-59922D8162BA}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3507\Agent.exe
FirewallRules: [{3433B42C-9F7A-48AE-907D-AC52EF07F1B3}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3526\Agent.exe
FirewallRules: [{8472A4EF-3539-4A86-9560-209542103DED}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3526\Agent.exe
FirewallRules: [{1373B22A-CE78-413D-BFF8-78F5744F123E}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3688\Agent.exe
FirewallRules: [{1DB89ED0-BC50-49FE-8AED-6802242A31C3}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3688\Agent.exe
FirewallRules: [{5025388E-D7FC-431E-9ADF-3B4ABCF80213}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe
FirewallRules: [{363BB1CB-7264-4598-AD6C-E6DABF094681}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe
FirewallRules: [{7393B37A-6E1F-4BBD-88CE-001D47D0DF83}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{D922D230-E77E-4758-91D4-2FD8B590350F}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{23A489D7-FE85-4492-AC42-A23F4D472CB0}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{E016B5F9-854C-42C2-88F5-3DC240D69C14}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [TCP Query User{08DA00E0-8530-4A2A-B423-9CEB0F9CD8E7}C:\users\*****\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\*****\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{B17310AC-77A6-40ED-A414-09A75C9E77F5}C:\users\*****\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\*****\appdata\roaming\spotify\spotify.exe
FirewallRules: [{72B51C08-A77A-47AC-BED6-1538514973C5}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{919814BB-FB39-4425-97F0-37038F410701}] => (Allow) LPort=2869
FirewallRules: [{7B94D2E6-5CEE-415A-8A7B-E1549AEC089A}] => (Allow) LPort=1900
FirewallRules: [{0817E6FB-AA30-48EB-AF08-1ECCA6B780E9}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{104914B2-E960-4E74-B49F-7F605D237A7A}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{0E80F4E6-B57E-4E3F-AD99-959442401E44}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{8CE001CE-9B8F-4644-BEC2-25563D215212}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{AA693CC1-C3FF-42C9-9F67-C4C51E4D8E40}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{9021429B-7AAF-4970-94BF-5781A5A6A504}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{29A15643-8EC6-46DF-8838-816CD91B94BB}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Fehlerhafte Geräte im Gerätemanager =============

Name: Microsoft-Adapter für Miniports virtueller WiFis
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Microsoft Virtual WiFi Miniport Adapter #2
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Qualcomm Atheros AR8161/8165 PCI-E Gigabit Ethernet Controller (NDIS 6.20)
Description: Qualcomm Atheros AR8161/8165 PCI-E Gigabit Ethernet Controller (NDIS 6.20)
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Qualcomm Atheros
Service: L1C
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (10/01/2015 03:23:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Creative Cloud.exe, Version: 3.3.0.151, Zeitstempel: 0x55fab2fa
Name des fehlerhaften Moduls: ContainerUI.dll, Version: 3.3.0.151, Zeitstempel: 0x55fab383
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00016870
ID des fehlerhaften Prozesses: 0x1924
Startzeit der fehlerhaften Anwendung: 0xCreative Cloud.exe0
Pfad der fehlerhaften Anwendung: Creative Cloud.exe1
Pfad des fehlerhaften Moduls: Creative Cloud.exe2
Berichtskennung: Creative Cloud.exe3

Error: (10/01/2015 02:16:47 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/01/2015 02:05:25 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/30/2015 10:00:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Creative Cloud.exe, Version: 3.3.0.151, Zeitstempel: 0x55fab2fa
Name des fehlerhaften Moduls: ContainerUI.dll, Version: 3.3.0.151, Zeitstempel: 0x55fab383
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00016870
ID des fehlerhaften Prozesses: 0xfb4
Startzeit der fehlerhaften Anwendung: 0xCreative Cloud.exe0
Pfad der fehlerhaften Anwendung: Creative Cloud.exe1
Pfad des fehlerhaften Moduls: Creative Cloud.exe2
Berichtskennung: Creative Cloud.exe3

Error: (09/30/2015 08:22:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Creative Cloud.exe, Version: 3.3.0.151, Zeitstempel: 0x55fab2fa
Name des fehlerhaften Moduls: ContainerUI.dll, Version: 3.3.0.151, Zeitstempel: 0x55fab383
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00016870
ID des fehlerhaften Prozesses: 0x1780
Startzeit der fehlerhaften Anwendung: 0xCreative Cloud.exe0
Pfad der fehlerhaften Anwendung: Creative Cloud.exe1
Pfad des fehlerhaften Moduls: Creative Cloud.exe2
Berichtskennung: Creative Cloud.exe3

Error: (09/30/2015 07:34:05 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm WINWORD.EXE, Version 12.0.6727.5000 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 2a4

Startzeit: 01d0fba5fead2f17

Endzeit: 4

Anwendungspfad: C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE

Berichts-ID: 699aec43-6799-11e5-91bc-6817296ab930

Error: (09/30/2015 12:55:06 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/30/2015 12:35:08 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm PhotoshopElementsEditor.exe, Version 10.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 21ec

Startzeit: 01d0fb06b5e22675

Endzeit: 10

Anwendungspfad: C:\Program Files (x86)\Adobe\Photoshop Elements 10\PhotoshopElementsEditor.exe

Berichts-ID:

Error: (09/29/2015 11:51:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: PhotoshopElementsEditor.exe, Version: 10.0.0.0, Zeitstempel: 0x4e5e8736
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18939, Zeitstempel: 0x55afd843
Ausnahmecode: 0xc0000374
Fehleroffset: 0x000ced0b
ID des fehlerhaften Prozesses: 0x1be4
Startzeit der fehlerhaften Anwendung: 0xPhotoshopElementsEditor.exe0
Pfad der fehlerhaften Anwendung: PhotoshopElementsEditor.exe1
Pfad des fehlerhaften Moduls: PhotoshopElementsEditor.exe2
Berichtskennung: PhotoshopElementsEditor.exe3

Error: (09/29/2015 10:37:01 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm SC2.exe, Version 2.1.12.36657 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 203c

Startzeit: 01d0faeab5c596b7

Endzeit: 166

Anwendungspfad: C:\Program Files (x86)\StarCraft II\Versions\Base32283\SC2.exe

Berichts-ID:


Systemfehler:
=============
Error: (10/01/2015 04:18:10 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR3 gefunden.

Error: (10/01/2015 04:18:10 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR3 gefunden.

Error: (10/01/2015 04:18:09 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR3 gefunden.

Error: (10/01/2015 04:18:09 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR3 gefunden.

Error: (10/01/2015 04:18:08 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR3 gefunden.

Error: (10/01/2015 02:16:48 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
UsbCharger

Error: (10/01/2015 02:05:18 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
UsbCharger

Error: (09/30/2015 12:55:03 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
UsbCharger

Error: (09/29/2015 09:10:18 PM) (Source: Schannel) (EventID: 4119) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 20.

Error: (09/29/2015 03:05:46 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
UsbCharger


==================== Speicherinformationen =========================== 

Prozessor: Intel(R) Core(TM) i5-4670K CPU @ 3.40GHz
Prozentuale Nutzung des RAM: 23%
Installierter physikalischer RAM: 16264.88 MB
Verfügbarer physikalischer RAM: 12381.93 MB
Summe virtueller Speicher: 32527.95 MB
Verfügbarer virtueller Speicher: 28591.66 MB

==================== Laufwerke ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:593.91 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: F140D2C6)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

==================== Ende von Addition.txt ============================

MrXxx · 01.10.2015, 16:33

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-10-01 17:00:36
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 TOSHIBA_DT01ACA100 rev.MS2OA750 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\*****\AppData\Local\Temp\kxldqpow.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2324] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey                                                0000000077a4fae8 5 bytes JMP 00000001724028d0
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2324] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                         0000000077a50078 5 bytes JMP 0000000172402890
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                        0000000075cc1401 2 bytes JMP 7565b20b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                          0000000075cc1419 2 bytes JMP 7565b336 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                        0000000075cc1431 2 bytes JMP 756d8f39 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                        0000000075cc144a 2 bytes CALL 75634885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                                                * 9
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                           0000000075cc14dd 2 bytes JMP 756d8832 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                    0000000075cc14f5 2 bytes JMP 756d8a08 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                           0000000075cc150d 2 bytes JMP 756d8728 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                    0000000075cc1525 2 bytes JMP 756d8af2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                          0000000075cc153d 2 bytes JMP 7564fc98 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                               0000000075cc1555 2 bytes JMP 756568df C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                        0000000075cc156d 2 bytes JMP 756d8ff1 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                          0000000075cc1585 2 bytes JMP 756d8b52 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                             0000000075cc159d 2 bytes JMP 756d86ec C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                          0000000075cc15b5 2 bytes JMP 7564fd31 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                        0000000075cc15cd 2 bytes JMP 7565b2cc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                    0000000075cc16b2 2 bytes JMP 756d8eb4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                    0000000075cc16bd 2 bytes JMP 756d8681 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17                                                0000000075cc1401 2 bytes JMP 7565b20b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17                                                  0000000075cc1419 2 bytes JMP 7565b336 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17                                                0000000075cc1431 2 bytes JMP 756d8f39 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42                                                0000000075cc144a 2 bytes CALL 75634885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                                                * 9
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17                                                   0000000075cc14dd 2 bytes JMP 756d8832 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17                                            0000000075cc14f5 2 bytes JMP 756d8a08 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17                                                   0000000075cc150d 2 bytes JMP 756d8728 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17                                            0000000075cc1525 2 bytes JMP 756d8af2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17                                                  0000000075cc153d 2 bytes JMP 7564fc98 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17                                                       0000000075cc1555 2 bytes JMP 756568df C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17                                                0000000075cc156d 2 bytes JMP 756d8ff1 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17                                                  0000000075cc1585 2 bytes JMP 756d8b52 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17                                                     0000000075cc159d 2 bytes JMP 756d86ec C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17                                                  0000000075cc15b5 2 bytes JMP 7564fd31 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17                                                0000000075cc15cd 2 bytes JMP 7565b2cc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20                                            0000000075cc16b2 2 bytes JMP 756d8eb4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31                                            0000000075cc16bd 2 bytes JMP 756d8681 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                           0000000075cc1401 2 bytes JMP 7565b20b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                             0000000075cc1419 2 bytes JMP 7565b336 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                           0000000075cc1431 2 bytes JMP 756d8f39 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                           0000000075cc144a 2 bytes CALL 75634885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                                                * 9
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                              0000000075cc14dd 2 bytes JMP 756d8832 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                       0000000075cc14f5 2 bytes JMP 756d8a08 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                              0000000075cc150d 2 bytes JMP 756d8728 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                       0000000075cc1525 2 bytes JMP 756d8af2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                             0000000075cc153d 2 bytes JMP 7564fc98 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                  0000000075cc1555 2 bytes JMP 756568df C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                           0000000075cc156d 2 bytes JMP 756d8ff1 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                             0000000075cc1585 2 bytes JMP 756d8b52 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                0000000075cc159d 2 bytes JMP 756d86ec C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                             0000000075cc15b5 2 bytes JMP 7564fd31 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                           0000000075cc15cd 2 bytes JMP 7565b2cc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                       0000000075cc16b2 2 bytes JMP 756d8eb4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                       0000000075cc16bd 2 bytes JMP 756d8681 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                 00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                 0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                         00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                        0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                           0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                               0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                             0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                 0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                             00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                     000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                   000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                         000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                       000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                           000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                           000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                         000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                         000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                       00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                       00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                    00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                 00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                 00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                           00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                  0000000075cc1401 2 bytes JMP 7565b20b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                    0000000075cc1419 2 bytes JMP 7565b336 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                  0000000075cc1431 2 bytes JMP 756d8f39 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                  0000000075cc144a 2 bytes CALL 75634885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                                                * 9
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                     0000000075cc14dd 2 bytes JMP 756d8832 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                              0000000075cc14f5 2 bytes JMP 756d8a08 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                     0000000075cc150d 2 bytes JMP 756d8728 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                              0000000075cc1525 2 bytes JMP 756d8af2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                    0000000075cc153d 2 bytes JMP 7564fc98 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                         0000000075cc1555 2 bytes JMP 756568df C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                  0000000075cc156d 2 bytes JMP 756d8ff1 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                    0000000075cc1585 2 bytes JMP 756d8b52 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                       0000000075cc159d 2 bytes JMP 756d86ec C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                    0000000075cc15b5 2 bytes JMP 7564fd31 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                  0000000075cc15cd 2 bytes JMP 7565b2cc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                              0000000075cc16b2 2 bytes JMP 756d8eb4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                              0000000075cc16bd 2 bytes JMP 756d8681 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                              00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                                              0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                      00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                                                     0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                        0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                            0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                                                          0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                                              0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                          00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                  000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                      000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                    000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                        000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                        000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                      000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                      000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                    00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                    00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                 00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                              00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                              00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                        00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17                                                                               0000000075cc1401 2 bytes JMP 7565b20b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17                                                                                 0000000075cc1419 2 bytes JMP 7565b336 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17                                                                               0000000075cc1431 2 bytes JMP 756d8f39 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42                                                                               0000000075cc144a 2 bytes CALL 75634885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                                                * 9
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17                                                                                  0000000075cc14dd 2 bytes JMP 756d8832 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17                                                                           0000000075cc14f5 2 bytes JMP 756d8a08 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17                                                                                  0000000075cc150d 2 bytes JMP 756d8728 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17                                                                           0000000075cc1525 2 bytes JMP 756d8af2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17                                                                                 0000000075cc153d 2 bytes JMP 7564fc98 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17                                                                                      0000000075cc1555 2 bytes JMP 756568df C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17                                                                               0000000075cc156d 2 bytes JMP 756d8ff1 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17                                                                                 0000000075cc1585 2 bytes JMP 756d8b52 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17                                                                                    0000000075cc159d 2 bytes JMP 756d86ec C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17                                                                                 0000000075cc15b5 2 bytes JMP 7564fd31 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17                                                                               0000000075cc15cd 2 bytes JMP 7565b2cc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20                                                                           0000000075cc16b2 2 bytes JMP 756d8eb4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31                                                                           0000000075cc16bd 2 bytes JMP 756d8681 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                        00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                        0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                               0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                  0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                      0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                                    0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                        0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                    00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                            000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                          000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                              000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                  000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                  000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                              00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                              00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                           00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                        00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                        00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                  00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                         0000000075cc1401 2 bytes JMP 7565b20b C:\Windows\syswow64\kernel32.dll
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                           0000000075cc1419 2 bytes JMP 7565b336 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                         0000000075cc1431 2 bytes JMP 756d8f39 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                         0000000075cc144a 2 bytes CALL 75634885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                                                * 9
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                            0000000075cc14dd 2 bytes JMP 756d8832 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                     0000000075cc14f5 2 bytes JMP 756d8a08 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                            0000000075cc150d 2 bytes JMP 756d8728 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                     0000000075cc1525 2 bytes JMP 756d8af2 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                           0000000075cc153d 2 bytes JMP 7564fc98 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                0000000075cc1555 2 bytes JMP 756568df C:\Windows\syswow64\kernel32.dll
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                         0000000075cc156d 2 bytes JMP 756d8ff1 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                           0000000075cc1585 2 bytes JMP 756d8b52 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                              0000000075cc159d 2 bytes JMP 756d86ec C:\Windows\syswow64\kernel32.dll
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                           0000000075cc15b5 2 bytes JMP 7564fd31 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                         0000000075cc15cd 2 bytes JMP 7565b2cc C:\Windows\syswow64\kernel32.dll
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                     0000000075cc16b2 2 bytes JMP 756d8eb4 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                     0000000075cc16bd 2 bytes JMP 756d8681 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159            00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500            0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                    00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                   0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373      0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                          0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                        0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680            0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16        00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread              000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                    000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                  000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                      000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                      000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                    000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                    000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312  00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471  00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611               00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23            00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23            00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23      00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                                0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                        00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                                       0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                          0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                              0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                                            0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                                0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                            00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                    000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text  C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                  000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text  C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                        000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text  C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                      000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text  C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                          000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text  C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                          000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text  C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                        000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text  C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                        000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text  C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                      00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                      00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                   00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                          00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                                0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                        00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                                       0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                          0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                              0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                                            0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                                0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                            00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                    000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text  C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                  000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text  C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                        000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text  C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                      000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text  C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                          000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text  C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                          000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text  C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                        000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text  C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                        000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text  C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                      00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                      00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                   00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                          00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                           00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                           0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                   00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                                  0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                     0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                         0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                                       0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                           0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                       00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                               000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                             000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                   000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                 000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                     000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                     000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                   000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                   000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                 00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                 00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                              00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                           00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                           00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                     00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                         00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                                         0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                 00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                                                0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                   0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                       0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                                                     0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                                         0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                     00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                             000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text  C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                           000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text  C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                 000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text  C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                               000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text  C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                   000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text  C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                   000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text  C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                 000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text  C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                 000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text  C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                               00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                               00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                            00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                         00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                         00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                   00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                 00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                                 0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                         00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                                        0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                           0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                               0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                                             0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                                 0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                             00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                     000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text  C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                   000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text  C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                         000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text  C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                       000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text  C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                           000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text  C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                           000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text  C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                         000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text  C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                         000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text  C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                       00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                       00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                    00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                 00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                 00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                           00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                 00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                                 0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                         00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                                        0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                           0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                               0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                                             0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                                 0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                             00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                     000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                   000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                         000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                       000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                           000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                           000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                         000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                         000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                       00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                       00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                    00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                 00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                 00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                           00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                  0000000075cc1401 2 bytes JMP 7565b20b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                    0000000075cc1419 2 bytes JMP 7565b336 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                  0000000075cc1431 2 bytes JMP 756d8f39 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                  0000000075cc144a 2 bytes CALL 75634885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                                                * 9
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                     0000000075cc14dd 2 bytes JMP 756d8832 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                              0000000075cc14f5 2 bytes JMP 756d8a08 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                     0000000075cc150d 2 bytes JMP 756d8728 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                              0000000075cc1525 2 bytes JMP 756d8af2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                    0000000075cc153d 2 bytes JMP 7564fc98 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                         0000000075cc1555 2 bytes JMP 756568df C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                  0000000075cc156d 2 bytes JMP 756d8ff1 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                    0000000075cc1585 2 bytes JMP 756d8b52 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                       0000000075cc159d 2 bytes JMP 756d86ec C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                    0000000075cc15b5 2 bytes JMP 7564fd31 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                  0000000075cc15cd 2 bytes JMP 7565b2cc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                              0000000075cc16b2 2 bytes JMP 756d8eb4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                              0000000075cc16bd 2 bytes JMP 756d8681 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                          00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                          0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                  00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                                 0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                    0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                        0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                                      0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                          0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                      00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                              000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                            000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                  000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                    000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                    000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                  000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                  000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                             00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                          00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                          00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                    00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17                                                           0000000075cc1401 2 bytes JMP 7565b20b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17                                                             0000000075cc1419 2 bytes JMP 7565b336 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17                                                           0000000075cc1431 2 bytes JMP 756d8f39 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42                                                           0000000075cc144a 2 bytes CALL 75634885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                                                * 9
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17                                                              0000000075cc14dd 2 bytes JMP 756d8832 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17                                                       0000000075cc14f5 2 bytes JMP 756d8a08 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17                                                              0000000075cc150d 2 bytes JMP 756d8728 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17                                                       0000000075cc1525 2 bytes JMP 756d8af2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17                                                             0000000075cc153d 2 bytes JMP 7564fc98 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17                                                                  0000000075cc1555 2 bytes JMP 756568df C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17                                                           0000000075cc156d 2 bytes JMP 756d8ff1 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17                                                             0000000075cc1585 2 bytes JMP 756d8b52 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17                                                                0000000075cc159d 2 bytes JMP 756d86ec C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17                                                             0000000075cc15b5 2 bytes JMP 7564fd31 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17                                                           0000000075cc15cd 2 bytes JMP 7565b2cc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20                                                       0000000075cc16b2 2 bytes JMP 756d8eb4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31                                                       0000000075cc16bd 2 bytes JMP 756d8681 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                                                0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                        00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                                                       0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                          0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                              0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                                                            0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                                                0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                            00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                    000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text  C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                  000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text  C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                        000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text  C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                      000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text  C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                          000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text  C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                          000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text  C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                        000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text  C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                        000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text  C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                      00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                      00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                   00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                          00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

---- Registry - GMER 2.1 ----

Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\606c667c0adc                                                                                                        
Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\68172963c29c                                                                                                        
Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\6817296ab930                                                                                                        
Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\606c667c0adc (not active ControlSet)                                                                                    
Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\68172963c29c (not active ControlSet)                                                                                    
Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\6817296ab930 (not active ControlSet)                                                                                    

---- EOF - GMER 2.1 ----

cosinus · 01.10.2015, 21:25

Zitat:

Zitat von MrXxx

Wieso genau taucht denn dieses Fenster auf?

Irgendwo in deinem Filesystem sind per NTFS-Verschlüsselung verschlüsselte Objekte. Du solltest dich bei Windows für diesen Hinweis bedanken denn es sind so richtig viele auf die Fresse geflogen, die ihre zweite Partition per NTFS-Verschlüsselung verschlüsselten und ohne daran zu denken einfach mal das System neuaufgesetzt haben...ja was soll auch passieren wenn man nur C formatiert....ja dicker Irrtum!! Die Daten auf der zweiten Partition waren weg, weil mit dem Format C auch das Zertifikat zur Entschlüsselung wegformatiert wurde

Zitat:

Zitat von MrXxx

Habe noch nie eine Datei verschlüsselt und gerade mal (nach googlen) durch das Ausführen von Cipher nach verschlüsselten Dateien gesucht. Wurde nichts gefunden.

Per Bitlocker verschlüsselte Objekte könnens aber auch nicht sein, denn das gibt es zwar bei Windows 7 aber nur bei Ultimate und Enterprise.
Ein Schädling macht sowas nicht. Und ein Verschlüsselungstrojaner erst recht nicht. Die haben ihre eigenen Verschlüsselungsmethoden und sind ja nicht auf derarttige Bordmittel angewiesen.

Zitat:

Zitat von MrXxx

Was ist denn ein iframe? Bzw. wie lädt sich sowas auf meinen PC? Habe gestern über eine seriöse Website noch zwei Templates für After Effects gekauft/gedownloaded?

Siehe => iframe

Zitat:

127.0.0.1 localhost
127.0.0.1 activation.cloud.techsmith.com
127.0.0.1 oscount.techsmith.com
127.0.0.1 updater.techsmith.com
127.0.0.1 camtasiatudi.techsmith.com
127.0.0.1 tsccloud.cloudapp.net
127.0.0.1 assets.cloud.techsmith.com

Gecrackte Software ist echt unschön

Lesestoff:
Illegale Software: Cracks, Keygens und Co

Bitte lesen => http://www.trojaner-board.de/95393-c...-software.html

Es geht weiter wenn du alles Illegale entfernt hast.

Bei wiederholten Crack/Keygen Verstößen behalte ich es mir vor, den Support einzustellen, d.h. Hilfe nur noch bei der Datensicherung und Neuinstallation des Betriebssystems.

MrXxx · 01.10.2015, 22:34

Danke erstmal,
Oh ich seh schon, dann wird das Camtasia sein...Ich hab gestern die Testversion runtergeladen und nen technikversierter Kumpel meinte, er habe noch ne Vollversion und hat da was umgestellt (Nicht in meiner Anwesenheit).

Hab Camtasia aber schon heute gelöscht, weil es mir nicht gefällt. Wie genau lösche ich jezt diese Liste? Kann daher auch der Virus kommen? Ah echt...son Mist, ich dachte er hätte seine Version da installiert...

Und wie finde ich diese verschlüsselten Objekte?
Bzw. wie kann ich die Zertifikate speichern, weiß ja gar nicht wo die sind?

Kann das durch die Adobe Cloud kommen? Dass Adobe irgendwas verschlüsselt - interne Programmdateien?

cosinus · 01.10.2015, 22:46

Warum liest und befolgst du nicht einfach die Meldung von Window??? Da ist doch wirklich alles erklärt wie du das Zertifikat zu sichern hast für den Fall der Fälle.

Wenn das mit dem Zertifikat genau nach der Installation der gecrackten Software auftauchte, hast du die wahrscheinlichste Ursache gefunden.

MrXxx · 01.10.2015, 22:58

"Warum liest und befolgst du nicht einfach die Meldung von Window??? Da ist doch wirklich alles erklärt wie du das Zertifikat zu sichern hast für den Fall der Fälle."

Tut mir Leid, aber ich bin was solche Themen angeht nicht so erfahren wie manch einer hier. Habe ein bisschen gegoogelt und hat sich wohl erledigt. Die Templates, die ich gestern gekauft habe, sind verschlüsselt gegen unbefugtes Weiterverkaufen. Macht ja auch Sinn. Wie deren Zertifikate jetzt sichere, keine Ahnung, aber immerhin kein Virus.

Und dieses iFrame (ganz verstanden was das ist, habe ich auch nach den Webergebnissen nicht) ist wahr. eine Addon das gegen das Schnüffeln von Facebook auf Websites sucht - Chrome Addon war das.

Darf ich trotzdem nochmal fragen, wie ich denn diese Liste jetzt lösche. Möchte ungern sowas auf meinem PC haben. Kumpel ist für die nächsten Wochen wieder in seiner Heimatstadt und übers Telefon ist das wahr. schwer zu erklären.

cosinus · 01.10.2015, 23:18

Naja, da du nen Crack drauf hättest sollten wir eh erstmal tiefer buddeln:

Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte

Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

Starte bitte die mbar.exe.
Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
Klicke auf den CleanUp Button und erlaube den Neustart.
Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut.
Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

MrXxx · 02.10.2015, 00:15

Hab meinen Kumpel über Skype erreicht, er hat die Liste über Teamviewer wieder resettet

Beim Starten des Programms wurde mir ein Fenster wegen eines "möglichen Rootkits" angezeigt mit den Antwortmöglichkeiten JA oder NEIN. Habe mich gegen eine Entfernung entschieden und scannen lassen. War schätze ich falscher Alarm, hatte ich auch schon mal auf meinem Laptop mit dem gleichen Programm (war frisch aufgesetzt.).

Code:

ATTFilter

Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org

Database version:
  main:    v2015.10.01.07
  rootkit: v2015.09.22.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.18015
***** :: *****-PC [administrator]

02.10.2015 00:27:02
mbar-log-2015-10-02 (00-27-02).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 397737
Time elapsed: 25 minute(s), 14 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

cosinus · 02.10.2015, 09:44

Adware/Junkware/Toolbars entfernen

Alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!
Virenscanner jetzt vor dem Einsatz dieser Tools bitte komplett deaktivieren!

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

MrXxx · 03.10.2015, 00:42

Hallo Cosinus,
hier die Logs.
Ich habe noch eine Frage zu diesem iFrame: Ist das nun ein Virus, der sich per HTML Link eingeschleust hat oder einfach nur ein verräterisches Internetprotokoll. Ich habe es nicht wirklich verstanden. Laut Wikipedia ist das ja nur ein HTML Element - wieso wird sowas als Trojaner angezeigt bzw. anscheinend gibt es auch Trojaner, die nach iFrame benannt worden sind (sagt zumindest google...).

Code:

ATTFilter

# AdwCleaner v5.009 - Bericht erstellt am 03/10/2015 um 01:05:22
# Aktualisiert am 27/09/2015 von Xplode
# Datenbank : 2015-09-30.1 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x64)
# Benutzername : ***** - *****-PC
# Gestartet von : C:\Users\*****\Desktop\AdwCleaner_5.009.exe
# Option : Löschen
# Unterstützung : hxxp://toolslib.net/forum

***** [ Dienste ] *****


***** [ Ordner ] *****

[-] Ordner Gelöscht : C:\Users\*****\AppData\Roaming\Browser-Security

***** [ Dateien ] *****

[-] Datei Gelöscht : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\pqreaw43.default\Extensions\firefox@browser-security.de.xpi

***** [ Verknüpfungen ] *****


***** [ Geplante Tasks ] *****

[-] Task Gelöscht : Adobe Flash Player Updater

***** [ Registrierungsdatenbank ] *****

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Browser-Security

***** [ Internetbrowser ] *****


*************************

:: Proxy Einstellungen zurückgesetzt
:: Winsock Einstellungen zurückgesetzt
:: Chrome Richtlinien gelöscht

########## EOF - C:\AdwCleaner\AdwCleaner[C4].txt - [1103 Bytes] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.6.4 (09.28.2015:1)
OS: Windows 7 Professional x64
Ran by ***** on 03.10.2015 at  1:22:29,81
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer



~~~ Files



~~~ Folders



~~~ Chrome


[C:\Users\*****\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\*****\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\*****\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\*****\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.10.2015 at  1:27:41,85
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Code:

ATTFilter

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:30-09-2015
durchgeführt von ***** (Administrator) auf *****-PC (03-10-2015 01:38:00)
Gestartet von C:\Users\*****\Desktop
Geladene Profile: ***** (Verfügbare Profile: *****)
Platform: Windows 7 Professional Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avpui.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508104 2015-09-04] (Adobe Systems Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13651672 2013-09-03] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2463552 2014-10-04] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-08-13] (Apple Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291128 2013-03-06] (Intel Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-05-15] (Apple Inc.)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-08-28] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe [2620728 2015-07-22] (Malwarebytes Corporation)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-06-17] (Apple Inc.)
HKLM-x32\...\Run: [Nikon Message Center 2] => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe [570880 2013-12-27] (Nikon Corporation)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2292912 2015-09-17] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [2899136 2015-08-19] (Valve Corporation)
HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6482200 2014-09-26] (Piriform Ltd)
HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\...\Run: [Dropbox Update] => C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-19] (Dropbox, Inc.)
HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [787592 2015-09-21] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [11264 2009-07-14] (Microsoft Corporation)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [174856 2014-09-14] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [156840 2014-09-14] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-09-11] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-09-11] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-09-11] ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  Keine Datei
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll Keine Datei
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll Keine Datei
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll Keine Datei
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll Keine Datei
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-10-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-10-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-10-02] (Dropbox, Inc.)
Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-12-12]
ShortcutTarget: Dropbox.lnk -> C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{C6CFC2E9-EC6A-45CE-8CAE-0C63A07F1B14}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{E3B9FBD5-3CDD-44DE-B9AD-993EA9D045DC}: [DhcpNameServer] 192.168.178.1

Internet Explorer:
==================
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Kaspersky Protection plugin -> {C66D064F-82FE-4E1A-B06A-B2490BA48B18} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\x64\IEExt\ie_plugin.dll [2015-07-08] (AO Kaspersky Lab)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Kaspersky Protection plugin -> {C66D064F-82FE-4E1A-B06A-B2490BA48B18} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\IEExt\ie_plugin.dll [2015-07-08] (AO Kaspersky Lab)
Toolbar: HKLM - Kein Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  Keine Datei
Toolbar: HKLM - Kein Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  Keine Datei
Toolbar: HKLM - Kaspersky Protection toolbar - {3507FA00-ADA2-4A02-99B9-51AD26CA9120} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\x64\IEExt\ie_plugin.dll [2015-07-08] (AO Kaspersky Lab)
Toolbar: HKLM-x32 - Kaspersky Protection toolbar - {3507FA00-ADA2-4A02-99B9-51AD26CA9120} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\IEExt\ie_plugin.dll [2015-07-08] (AO Kaspersky Lab)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\pqreaw43.default
FF SelectedSearchEngine: Arccosine
FF Homepage: google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_185.dll [2015-09-23] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2015-09-17] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_185.dll [2015-09-23] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-07-30] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-09-13] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-09-13] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2015-09-17] (Adobe Systems)
FF Extension: WOT - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\pqreaw43.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2015-07-09]
FF Extension: Adblock Plus - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\pqreaw43.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-10-13]
FF HKLM-x32\...\Firefox\Extensions: [light_plugin_D772DC8D6FAF43A29B25C4EBAA5AD1DE@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\FFExt\light_plugin_firefox
FF Extension: Kaspersky Protection - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\FFExt\light_plugin_firefox [2015-09-05]
FF Extension: Kein Name - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\pqreaw43.default\extensions\firefox@browser-security.de.xpi [nicht gefunden]

Chrome: 
=======
CHR Profile: C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-07-29]
CHR Extension: (Google Docs) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-07-29]
CHR Extension: (Google Drive) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-07-29]
CHR Extension: (YouTube) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-07-29]
CHR Extension: (Google-Suche) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-07-29]
CHR Extension: (Kaspersky Protection) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\eahebamiopdhefndnmappcihfajigkka [2015-09-05]
CHR Extension: (Google Tabellen) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-07-29]
CHR Extension: (Google Text & Tabellen Offline) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-07-29]
CHR Extension: (AdBlock) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-08-08]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-29]
CHR Extension: (Google Mail) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-07-29]
CHR HKLM\...\Chrome\Extension: [eahebamiopdhefndnmappcihfajigkka] - https://chrome.google.com/webstore/detail/eahebamiopdhefndnmappcihfajigkka
CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx <nicht gefunden>
CHR HKLM-x32\...\Chrome\Extension: [eahebamiopdhefndnmappcihfajigkka] - https://chrome.google.com/webstore/detail/eahebamiopdhefndnmappcihfajigkka

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S2 AdobeActiveFileMonitor10.0; C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe [169624 2011-09-01] (Adobe Systems Incorporated)
S2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [669872 2015-09-15] (Adobe Systems Incorporated)
S2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2015936 2015-09-29] (Adobe Systems, Incorporated)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)
S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
R2 AVP16.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe [194000 2015-09-05] (Kaspersky Lab ZAO)
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) [Datei ist nicht signiert]
S2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-10-04] (NVIDIA Corporation)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [Datei ist nicht signiert]
S2 MbaeSvc; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [713016 2015-07-22] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
S2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [Datei ist nicht signiert]
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272688 2012-06-25] ()
S2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-10-04] (NVIDIA Corporation)
S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19440960 2014-10-04] (NVIDIA Corporation)
S2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [177800 2015-09-21] (Sandboxie Holdings, LLC)
S3 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)
S2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)
S3 vssbrigde64; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\x64\vssbridge64.exe [144640 2015-07-09] (AO Kaspersky Lab)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3325232 2012-06-25] (Intel® Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [21584 2013-02-19] ()
R0 cm_km; C:\Windows\System32\DRIVERS\cm_km.sys [389816 2015-07-06] (Kaspersky Lab ZAO)
R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [495376 2013-05-30] (Intel Corporation)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R1 ESProtectionDriver; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [63064 2015-07-22] ()
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-01-31] (Intel Corporation)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [478392 2015-06-22] (Kaspersky Lab ZAO)
R0 klbackupdisk; C:\Windows\System32\DRIVERS\klbackupdisk.sys [53432 2015-06-06] (Kaspersky Lab ZAO)
R1 klbackupflt; C:\Windows\System32\DRIVERS\klbackupflt.sys [70000 2015-06-27] (Kaspersky Lab ZAO)
R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [68280 2015-06-06] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [171192 2015-06-30] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [227000 2015-07-04] (AO Kaspersky Lab)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [931000 2015-06-30] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [39096 2015-06-11] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [41144 2015-06-06] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [41648 2015-06-07] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [41352 2015-09-27] (AO Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [65208 2015-06-11] (Kaspersky Lab ZAO)
R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [103096 2015-06-16] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [187056 2015-06-23] (Kaspersky Lab ZAO)
S3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [129224 2013-07-18] (Qualcomm Atheros Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20288 2014-10-04] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-07-03] (Secunia)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-06-22] (Corel Corporation)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [191624 2015-09-21] (Sandboxie Holdings, LLC)
S3 Secdrv; C:\Windows\SysWOW64\drivers\SECDRV.SYS [11616 2000-11-06] () [Datei ist nicht signiert]
S3 tap-tb-0901; C:\Windows\System32\DRIVERS\tap-tb-0901.sys [39168 2014-06-17] (The OpenVPN Project)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
S1 UsbCharger; C:\Windows\System32\DRIVERS\UsbCharger.sys [21072 2013-03-27] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 cpuz136; \??\C:\Users\*****\AppData\Local\Temp\cpuz136\cpuz136_x64.sys [X]
S3 gdrv; \??\C:\Windows\gdrv.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-10-03 01:27 - 2015-10-03 01:27 - 00001162 _____ C:\Users\*****\Desktop\JRT.txt
2015-10-03 01:21 - 2015-10-03 01:21 - 00001182 _____ C:\Users\*****\Desktop\AdwCleaner[C4].txt
2015-10-03 01:10 - 2015-10-03 01:10 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-10-03 00:47 - 2015-10-03 00:47 - 01798976 _____ (Malwarebytes) C:\Users\*****\Desktop\JRT.exe
2015-10-03 00:46 - 2015-10-03 00:46 - 01670656 _____ C:\Users\*****\Desktop\AdwCleaner_5.009.exe
2015-10-02 14:45 - 2015-10-03 01:07 - 00000504 _____ C:\Windows\setupact.log
2015-10-02 14:45 - 2015-10-02 14:45 - 00000000 _____ C:\Windows\setuperr.log
2015-10-02 00:30 - 2015-10-02 00:30 - 00002122 _____ C:\Users\*****\Desktop\Rkill.txt
2015-10-02 00:29 - 2015-10-02 00:29 - 02019656 _____ (Bleeping Computer, LLC) C:\Users\*****\Desktop\rkill.exe
2015-10-02 00:24 - 2015-10-02 00:52 - 00000000 ____D C:\Users\*****\Desktop\mbar
2015-10-02 00:24 - 2015-10-02 00:24 - 16563352 _____ (Malwarebytes Corp.) C:\Users\*****\Desktop\mbar-1.09.3.1001.exe
2015-10-02 00:20 - 2015-10-02 00:20 - 264267494 _____ C:\Users\*****\Desktop\IMG_1056.psd
2015-10-01 16:19 - 2015-10-03 01:38 - 00022485 _____ C:\Users\*****\Desktop\FRST.txt
2015-10-01 16:19 - 2015-10-01 16:19 - 00000000 _____ C:\Users\*****\defogger_reenable
2015-10-01 15:57 - 2015-10-01 15:57 - 02192384 _____ (Farbar) C:\Users\*****\Desktop\FRST64.exe
2015-10-01 15:57 - 2015-10-01 15:57 - 00380416 _____ C:\Users\*****\Desktop\Gmer-19357.exe
2015-10-01 15:57 - 2015-10-01 15:57 - 00050477 _____ C:\Users\*****\Desktop\Defogger.exe
2015-10-01 02:55 - 2015-10-02 03:23 - 00000000 ___DX C:\Users\*****\Desktop\Ink&Paper2 folder
2015-10-01 02:55 - 2015-10-01 02:55 - 00000000 ____D C:\Users\*****\Desktop\MusicPremium - Epic Enigmatik Theme
2015-10-01 02:49 - 2015-10-01 02:49 - 00311242 _____ C:\Users\*****\Desktop\kards.html
2015-10-01 02:49 - 2015-10-01 02:49 - 00000000 ____D C:\Users\*****\Desktop\kards_files
2015-10-01 02:06 - 2015-10-01 02:06 - 00019800 _____ C:\Users\*****\Downloads\good_times.zip
2015-10-01 02:04 - 2015-10-01 02:04 - 00020186 _____ C:\Users\*****\Downloads\bebas_neue.zip
2015-10-01 02:03 - 2015-10-01 02:03 - 00211920 _____ C:\Users\*****\Downloads\typography_times.zip
2015-10-01 00:53 - 2015-10-01 00:54 - 39219377 _____ C:\Users\*****\Desktop\Unbenannt-2.psd
2015-09-30 22:00 - 2015-10-01 15:57 - 00000000 ____D C:\Users\*****\AppData\Local\CrashDumps
2015-09-30 19:34 - 2015-10-01 16:10 - 00000000 ____D C:\Users\*****\Desktop\Material für Youtube
2015-09-30 18:55 - 2015-09-30 18:55 - 00000000 ____D C:\Users\Public\Documents\Adobe
2015-09-30 18:49 - 2015-09-30 18:49 - 00001073 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Audition CC 2015.lnk
2015-09-30 18:48 - 2015-09-30 18:48 - 00000000 ____D C:\Program Files (x86)\My Company Name
2015-09-30 18:40 - 2015-09-30 18:40 - 00000984 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Lightroom.lnk
2015-09-30 18:18 - 2015-09-30 18:18 - 00001222 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe After Effects CC 2015.lnk
2015-09-30 18:16 - 2015-09-30 18:16 - 00001328 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Character Animator (Preview).lnk
2015-09-30 17:52 - 2015-09-30 17:52 - 00001030 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CC (64bit).lnk
2015-09-30 17:43 - 2015-09-30 17:43 - 00001118 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Media Encoder CC 2015.lnk
2015-09-30 17:30 - 2015-09-30 17:30 - 00001106 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Premiere Pro CC 2015.lnk
2015-09-30 17:04 - 2015-10-01 03:34 - 00000000 ____D C:\Users\*****\Documents\Adobe
2015-09-30 17:04 - 2015-09-30 17:04 - 00001040 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CC 2015.lnk
2015-09-30 17:00 - 2015-09-30 18:49 - 00000000 ____D C:\Program Files\Adobe
2015-09-30 16:47 - 2015-10-03 01:09 - 00000000 ___RD C:\Users\*****\Creative Cloud Files
2015-09-30 16:39 - 2015-09-30 16:39 - 00001225 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk
2015-09-30 14:46 - 2015-09-30 14:46 - 00000000 ____D C:\Users\*****\Documents\Camtasia Studio
2015-09-30 14:23 - 2015-09-30 14:46 - 00000000 ____D C:\Users\*****\AppData\Roaming\TechSmith
2015-09-30 14:19 - 2015-09-30 20:00 - 00000000 ____D C:\Users\*****\AppData\Local\TechSmith
2015-09-30 14:19 - 2015-09-30 14:22 - 00000000 ____D C:\Users\*****\Documents\Snagit
2015-09-30 14:18 - 2015-10-01 15:45 - 00000000 ____D C:\ProgramData\TechSmith
2015-09-30 13:32 - 2015-09-30 13:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fraps
2015-09-30 13:32 - 2015-09-30 13:32 - 00000000 ____D C:\Fraps
2015-09-30 00:01 - 2015-09-30 00:10 - 08797466 _____ C:\Users\*****\Desktop\Gehirn3.psd
2015-09-29 21:47 - 2015-09-29 21:47 - 00083390 _____ C:\Users\*****\Downloads\S_Auge_1.psd
2015-09-28 16:05 - 2015-09-28 16:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2015-09-27 23:36 - 2015-09-27 23:37 - 00000000 ____D C:\Users\*****\Desktop\Videos BEnne
2015-09-23 16:53 - 2015-09-23 16:53 - 18819272 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2015-09-19 22:22 - 2015-09-19 22:35 - 00000000 ____D C:\Users\*****\Documents\SpellForce
2015-09-19 22:00 - 2015-09-19 22:13 - 00000000 ____D C:\Users\*****\Desktop\Neuer Ordner (3)
2015-09-16 14:47 - 2015-09-21 17:02 - 00000000 ____D C:\Users\*****\Desktop\Hausarbeit Kreativität
2015-09-13 15:17 - 2015-09-13 15:17 - 00000000 ____D C:\Users\*****\AppData\Local\GWX
2015-09-13 01:53 - 2015-09-30 14:43 - 00001676 _____ C:\Windows\Sandboxie.ini
2015-09-13 01:53 - 2015-09-16 01:25 - 00001020 _____ C:\Users\*****\Desktop\Sandboxed Web Browser.lnk
2015-09-13 01:53 - 2015-09-13 01:53 - 00000000 ____D C:\Program Files\Sandboxie
2015-09-13 01:52 - 2015-09-13 01:52 - 06979720 _____ (Sandboxie Holdings, LLC) C:\Users\*****\Desktop\SandboxieInstall.exe
2015-09-12 23:39 - 2015-09-12 23:39 - 00002972 _____ C:\Windows\System32\Tasks\{B25A8B84-1BBD-4577-BB6B-8C7BDCC13539}
2015-09-12 23:39 - 2015-09-12 23:39 - 00002972 _____ C:\Windows\System32\Tasks\{2F9C545E-5DA5-46F0-BC8B-4A4C8ED349D8}
2015-09-11 16:00 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2015-09-11 16:00 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2015-09-11 12:28 - 2015-08-18 03:42 - 00393304 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-09-11 12:28 - 2015-08-18 03:14 - 00344168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-09-11 12:28 - 2015-08-15 08:48 - 25190400 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-09-11 12:28 - 2015-08-15 08:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-09-11 12:28 - 2015-08-15 08:33 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-09-11 12:28 - 2015-08-15 08:18 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-09-11 12:28 - 2015-08-15 08:18 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-09-11 12:28 - 2015-08-15 08:17 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-09-11 12:28 - 2015-08-15 08:17 - 00585216 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-09-11 12:28 - 2015-08-15 08:17 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-09-11 12:28 - 2015-08-15 08:17 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-09-11 12:28 - 2015-08-15 08:10 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-09-11 12:28 - 2015-08-15 08:09 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-09-11 12:28 - 2015-08-15 08:06 - 19856896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-09-11 12:28 - 2015-08-15 08:06 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-09-11 12:28 - 2015-08-15 08:04 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-09-11 12:28 - 2015-08-15 08:04 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-09-11 12:28 - 2015-08-15 08:04 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-09-11 12:28 - 2015-08-15 08:04 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-09-11 12:28 - 2015-08-15 08:00 - 05923328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-09-11 12:28 - 2015-08-15 07:57 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-09-11 12:28 - 2015-08-15 07:53 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-09-11 12:28 - 2015-08-15 07:53 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-09-11 12:28 - 2015-08-15 07:46 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-09-11 12:28 - 2015-08-15 07:42 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-09-11 12:28 - 2015-08-15 07:41 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-09-11 12:28 - 2015-08-15 07:40 - 00504832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-09-11 12:28 - 2015-08-15 07:40 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-09-11 12:28 - 2015-08-15 07:39 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-09-11 12:28 - 2015-08-15 07:39 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-09-11 12:28 - 2015-08-15 07:39 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-09-11 12:28 - 2015-08-15 07:38 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-09-11 12:28 - 2015-08-15 07:35 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-09-11 12:28 - 2015-08-15 07:33 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-09-11 12:28 - 2015-08-15 07:32 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-09-11 12:28 - 2015-08-15 07:30 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-09-11 12:28 - 2015-08-15 07:29 - 00665600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-09-11 12:28 - 2015-08-15 07:29 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-09-11 12:28 - 2015-08-15 07:29 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-09-11 12:28 - 2015-08-15 07:24 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-09-11 12:28 - 2015-08-15 07:23 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-09-11 12:28 - 2015-08-15 07:22 - 02126336 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-09-11 12:28 - 2015-08-15 07:22 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-09-11 12:28 - 2015-08-15 07:21 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-09-11 12:28 - 2015-08-15 07:16 - 14451712 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-09-11 12:28 - 2015-08-15 07:16 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-09-11 12:28 - 2015-08-15 07:14 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-09-11 12:28 - 2015-08-15 07:12 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-09-11 12:28 - 2015-08-15 07:11 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-09-11 12:28 - 2015-08-15 07:10 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-09-11 12:28 - 2015-08-15 07:07 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-09-11 12:28 - 2015-08-15 07:04 - 12857344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-09-11 12:28 - 2015-08-15 07:02 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-09-11 12:28 - 2015-08-15 07:01 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-09-11 12:28 - 2015-08-15 07:01 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-09-11 12:28 - 2015-08-15 06:55 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-09-11 12:28 - 2015-08-15 06:43 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-09-11 12:28 - 2015-08-15 06:43 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-09-11 12:28 - 2015-08-15 06:39 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-09-11 12:28 - 2015-08-15 06:37 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-09-11 12:28 - 2013-11-26 10:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2015-09-11 12:28 - 2013-11-23 00:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2015-09-10 15:58 - 2015-09-10 16:10 - 00000000 ____D C:\Users\*****\Desktop\Die Seiten der Welt1
2015-09-10 15:58 - 2015-09-10 15:59 - 05650560 _____ (Canneverbe Limited ) C:\Users\*****\Desktop\cdbxp_setup_4.5.6.5844.exe
2015-09-10 15:58 - 2015-09-10 15:59 - 00000000 ____D C:\Users\*****\Desktop\Seiten der Welt2
2015-09-10 14:14 - 2015-07-30 20:06 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2015-09-10 14:14 - 2015-07-30 20:06 - 01648128 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-09-10 14:14 - 2015-07-30 20:06 - 01180160 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-09-10 14:14 - 2015-07-30 19:57 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2015-09-10 14:14 - 2015-07-30 19:57 - 01251328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-09-10 14:14 - 2015-02-04 05:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-09-10 14:14 - 2015-02-04 04:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-09-10 14:14 - 2015-02-03 05:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-09-10 14:14 - 2015-02-03 05:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-09-10 13:56 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2015-09-10 13:52 - 2015-09-10 13:52 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2015-09-10 13:52 - 2015-09-10 13:52 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2015-09-10 13:52 - 2015-09-10 13:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2015-09-10 13:52 - 2015-09-10 13:52 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2015-09-10 13:52 - 2015-09-10 13:52 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2015-09-10 13:52 - 2015-09-10 13:52 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2015-09-10 13:52 - 2015-09-10 13:52 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2015-09-10 13:52 - 2015-09-10 13:52 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2015-09-10 13:52 - 2015-09-10 13:52 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2015-09-10 13:52 - 2015-09-10 13:52 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2015-09-10 13:52 - 2015-09-10 13:52 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2015-09-10 13:52 - 2015-09-10 13:52 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2015-09-10 13:52 - 2015-09-10 13:52 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2015-09-10 13:52 - 2015-09-10 13:52 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-09-10 13:52 - 2015-09-10 13:52 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2015-09-10 13:52 - 2015-09-10 13:52 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-09-10 13:52 - 2015-09-10 13:52 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2015-09-10 13:49 - 2015-09-10 13:49 - 01682432 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 01238528 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 01158144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 01080832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00648192 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00604160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00522752 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00333312 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00249856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00010752 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00010752 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00009728 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00009728 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00002560 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2015-09-10 13:49 - 2015-09-10 13:49 - 00002560 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2015-09-09 14:03 - 2015-09-09 23:30 - 00001716 _____ C:\Users\*****\Desktop\SFCFix.txt
2015-09-09 14:03 - 2015-09-09 23:30 - 00000000 ____D C:\SFCFix
2015-09-09 14:02 - 2015-09-09 23:30 - 00000000 ____D C:\Users\*****\AppData\Local\niemiro
2015-09-09 14:02 - 2015-09-09 14:02 - 01319424 _____ (niemiro) C:\Users\*****\Desktop\SFCFix.exe
2015-09-09 12:48 - 2015-08-05 19:56 - 01110016 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2015-09-09 12:48 - 2015-08-05 19:56 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-09-09 12:48 - 2015-08-05 19:56 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-09-09 12:48 - 2015-08-05 19:40 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-09-09 12:47 - 2015-09-02 05:04 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-09-09 12:47 - 2015-09-02 05:04 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-09-09 12:47 - 2015-09-02 05:04 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-09-09 12:47 - 2015-09-02 05:04 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-09-09 12:47 - 2015-09-02 04:48 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-09-09 12:47 - 2015-09-02 04:48 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-09-09 12:47 - 2015-09-02 04:48 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-09-09 12:47 - 2015-09-02 04:47 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-09-09 12:47 - 2015-09-02 03:51 - 03209216 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-09-09 12:47 - 2015-09-02 03:47 - 00372736 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-09-09 12:47 - 2015-09-02 03:33 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-09-09 12:47 - 2015-08-27 20:18 - 02004480 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2015-09-09 12:47 - 2015-08-27 20:18 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-09-09 12:47 - 2015-08-27 20:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2015-09-09 12:47 - 2015-08-27 20:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-09-09 12:47 - 2015-08-27 19:58 - 01391104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2015-09-09 12:47 - 2015-08-27 19:58 - 01241088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-09-09 12:47 - 2015-08-27 19:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2015-09-09 12:47 - 2015-08-27 19:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-09-09 12:47 - 2015-08-26 20:07 - 03165696 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-09-09 12:47 - 2015-08-26 20:07 - 02606080 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-09-09 12:47 - 2015-08-26 20:07 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-09-09 12:47 - 2015-08-26 20:07 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-09-09 12:47 - 2015-08-26 20:07 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-09-09 12:47 - 2015-08-26 20:07 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-09-09 12:47 - 2015-08-26 20:07 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-09-09 12:47 - 2015-08-26 20:06 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-09-09 12:47 - 2015-08-26 20:06 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-09-09 12:47 - 2015-08-26 20:06 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-09-09 12:47 - 2015-08-26 20:06 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-09-09 12:47 - 2015-08-26 19:56 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-09-09 12:47 - 2015-08-26 19:56 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-09-09 12:47 - 2015-08-26 19:56 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-09-09 12:47 - 2015-08-26 19:56 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-09-09 12:47 - 2015-08-26 19:55 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-09-09 12:47 - 2015-08-04 20:03 - 00692672 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-09-09 12:47 - 2015-08-04 20:00 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-09-09 12:47 - 2015-08-04 19:56 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-09-09 12:47 - 2015-08-04 19:56 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-09-09 12:47 - 2015-08-04 19:56 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-09-09 12:47 - 2015-08-04 19:55 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-09-09 12:47 - 2015-08-04 19:55 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-09-09 12:47 - 2015-08-04 19:47 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-09-09 12:47 - 2015-08-04 18:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-09-09 12:47 - 2015-07-23 02:06 - 05568960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-09-09 12:47 - 2015-07-23 02:06 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-09-09 12:47 - 2015-07-23 02:06 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-09-09 12:47 - 2015-07-23 02:03 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-09-09 12:47 - 2015-07-23 02:03 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-09-09 12:47 - 2015-07-23 02:03 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-09-09 12:47 - 2015-07-23 02:03 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-09-09 12:47 - 2015-07-23 02:03 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 01390592 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-09-09 12:47 - 2015-07-23 02:02 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-09-09 12:47 - 2015-07-23 02:02 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-09-09 12:47 - 2015-07-23 02:02 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-09-09 12:47 - 2015-07-23 02:01 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-09-09 12:47 - 2015-07-23 02:01 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-09-09 12:47 - 2015-07-23 02:01 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-09-09 12:47 - 2015-07-23 01:58 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-09-09 12:47 - 2015-07-23 01:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-09-09 12:47 - 2015-07-23 01:51 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-09-09 12:47 - 2015-07-22 19:57 - 03989952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-09-09 12:47 - 2015-07-22 19:57 - 03934656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-09-09 12:47 - 2015-07-22 19:54 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-09-09 12:47 - 2015-07-22 19:53 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-09-09 12:47 - 2015-07-22 19:52 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-09-09 12:47 - 2015-07-22 19:52 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-09-09 12:47 - 2015-07-22 19:52 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-09-09 12:47 - 2015-07-22 19:52 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-09-09 12:47 - 2015-07-22 19:52 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-09-09 12:47 - 2015-07-22 19:52 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-09-09 12:47 - 2015-07-22 19:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-09-09 12:47 - 2015-07-22 19:47 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-09-09 12:47 - 2015-07-22 19:46 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 18:48 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-09-09 12:47 - 2015-07-22 18:45 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-09-09 12:47 - 2015-07-22 18:44 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-09-09 12:47 - 2015-07-22 18:44 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-09-09 12:47 - 2015-07-22 18:34 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-09-09 12:47 - 2015-07-22 18:34 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-09-09 12:47 - 2015-07-22 18:31 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 18:31 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 18:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-09-09 12:47 - 2015-07-22 18:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-09-09 12:47 - 2015-07-15 05:17 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-09-09 12:47 - 2015-07-15 04:54 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2015-09-09 12:47 - 2015-07-09 19:58 - 01632256 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-09-09 12:47 - 2015-07-09 19:58 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2015-09-09 12:47 - 2015-07-09 19:42 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-09-09 12:47 - 2015-07-09 19:42 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2015-09-09 12:47 - 2015-06-25 12:06 - 00115136 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-09-09 12:47 - 2015-06-25 12:01 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-09-09 12:47 - 2015-06-25 12:01 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-09-09 12:47 - 2015-06-25 11:44 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-09-08 23:55 - 2015-09-09 00:04 - 00000000 ____D C:\Users\*****\Desktop\Spellforce Ordner
2015-09-08 17:25 - 2015-09-19 22:21 - 00002088 _____ C:\Users\*****\Desktop\SpellForce - Platinum Edition.lnk
2015-09-08 17:25 - 2015-09-08 17:25 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JoWooD
2015-09-08 17:25 - 2015-09-08 17:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JoWooD
2015-09-08 17:20 - 2015-09-08 17:20 - 00000000 ____D C:\Program Files (x86)\JoWooD
2015-09-08 14:20 - 2015-09-08 14:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seagate
2015-09-08 14:20 - 2015-09-08 14:20 - 00000000 ____D C:\Program Files (x86)\Seagate
2015-09-05 13:37 - 2015-09-05 13:37 - 00002450 _____ C:\Users\*****\Desktop\Sicherer Zahlungsverkehr.lnk
2015-09-05 13:36 - 2015-09-05 13:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
2015-09-05 13:35 - 2015-10-03 01:07 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2015-09-05 13:35 - 2015-09-05 13:35 - 00000000 ____D C:\Windows\ELAMBKUP
2015-09-05 13:35 - 2015-09-05 13:35 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2015-09-05 13:35 - 2015-07-04 02:18 - 00227000 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\klhk.sys
2015-09-05 13:35 - 2015-06-30 01:05 - 00931000 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2015-09-05 13:35 - 2015-06-30 01:05 - 00171192 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2015-09-05 13:35 - 2013-05-06 08:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-10-03 01:38 - 2013-11-01 01:42 - 00000000 ____D C:\FRST
2015-10-03 01:29 - 2015-05-27 18:01 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-10-03 01:15 - 2009-07-14 06:45 - 00037280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-10-03 01:15 - 2009-07-14 06:45 - 00037280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-10-03 01:11 - 2014-02-09 21:07 - 00000000 ___RD C:\Users\*****\Dropbox
2015-10-03 01:11 - 2014-02-09 20:52 - 00000000 ____D C:\Users\*****\AppData\Roaming\Dropbox
2015-10-03 01:10 - 2013-09-07 15:11 - 01142631 _____ C:\Windows\WindowsUpdate.log
2015-10-03 01:09 - 2013-09-07 16:10 - 00000000 ____D C:\Users\*****\AppData\Local\Adobe
2015-10-03 01:08 - 2015-08-19 12:15 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-10-03 01:07 - 2015-05-27 18:01 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-10-03 01:07 - 2014-01-31 22:01 - 00000000 ____D C:\Program Files (x86)\Steam
2015-10-03 01:06 - 2014-10-08 17:38 - 00000000 ____D C:\ProgramData\NVIDIA
2015-10-03 01:06 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-10-03 01:05 - 2014-10-26 19:24 - 00000000 ____D C:\AdwCleaner
2015-10-03 01:00 - 2015-06-19 19:49 - 00001220 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3887911213-2195480286-3553274884-1000UA.job
2015-10-02 03:23 - 2014-02-20 03:26 - 00000000 ____D C:\Users\*****\AppData\Roaming\vlc
2015-10-02 03:14 - 2013-09-07 16:37 - 00000000 ____D C:\Users\*****\AppData\Roaming\Skype
2015-10-02 00:52 - 2015-06-07 03:29 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-10-02 00:26 - 2014-06-27 17:04 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-10-02 00:25 - 2014-06-27 17:04 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-10-02 00:00 - 2015-06-19 19:49 - 00001168 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3887911213-2195480286-3553274884-1000Core.job
2015-10-01 23:51 - 2011-04-12 09:43 - 00700454 _____ C:\Windows\system32\perfh007.dat
2015-10-01 23:51 - 2011-04-12 09:43 - 00150092 _____ C:\Windows\system32\perfc007.dat
2015-10-01 23:51 - 2009-07-14 07:13 - 01624034 _____ C:\Windows\system32\PerfStringBackup.INI
2015-10-01 16:19 - 2013-09-07 15:11 - 00000000 ____D C:\Users\*****
2015-10-01 15:33 - 2015-06-08 14:46 - 00000000 ____D C:\ProgramData\Malwarebytes Anti-Exploit
2015-10-01 14:04 - 2009-07-14 06:45 - 05085232 _____ C:\Windows\system32\FNTCACHE.DAT
2015-10-01 14:03 - 2015-06-03 17:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-10-01 04:09 - 2013-09-07 16:13 - 00000000 ____D C:\Users\*****\AppData\Roaming\Adobe
2015-10-01 02:07 - 2013-09-07 15:39 - 00111576 _____ C:\Users\*****\AppData\Local\GDIPFONTCACHEV1.DAT
2015-10-01 00:30 - 2015-05-27 18:02 - 00002175 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-09-30 20:24 - 2013-09-07 16:37 - 00000000 ____D C:\ProgramData\Skype
2015-09-30 20:24 - 2009-07-14 05:20 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2015-09-30 20:23 - 2015-08-29 12:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-09-30 19:37 - 2013-09-07 15:58 - 00000000 ____D C:\Windows\Panther
2015-09-30 19:29 - 2014-09-11 19:43 - 00000000 ____D C:\Users\*****\Desktop\Magic Tricks
2015-09-30 19:27 - 2013-11-10 01:36 - 00000000 ____D C:\ProgramData\Package Cache
2015-09-30 18:59 - 2013-09-07 16:43 - 00000000 ____D C:\ProgramData\Adobe
2015-09-30 18:15 - 2013-10-15 16:09 - 00000000 ____D C:\Program Files\Common Files\Adobe
2015-09-30 17:14 - 2013-11-26 22:28 - 00000000 ____D C:\Users\*****\AppData\Roaming\NVIDIA
2015-09-30 17:14 - 2013-10-15 19:16 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2015-09-30 17:12 - 2013-09-07 16:43 - 00000000 ____D C:\Program Files (x86)\Adobe
2015-09-30 15:25 - 2013-11-26 04:19 - 00000000 ____D C:\Users\*****\AppData\Roaming\Audacity
2015-09-30 14:11 - 2014-09-24 11:32 - 00000000 ____D C:\Users\*****\AppData\Local\Battle.net
2015-09-30 13:41 - 2014-09-24 11:32 - 00000000 ____D C:\Program Files (x86)\Battle.net
2015-09-29 21:12 - 2013-09-15 16:14 - 00000000 ____D C:\Program Files (x86)\StarCraft II
2015-09-27 02:00 - 2015-06-08 19:43 - 00041352 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\klpd.sys
2015-09-23 16:53 - 2013-09-07 16:11 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-09-23 16:53 - 2013-09-07 16:11 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-09-17 13:53 - 2015-07-10 09:08 - 00000000 ____D C:\Users\*****\Desktop\Powerpoints
2015-09-17 13:51 - 2013-11-01 01:05 - 00000000 ___RD C:\Users\*****\Desktop\Uni
2015-09-16 22:36 - 2013-09-07 15:17 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel PROSet Wireless
2015-09-16 14:48 - 2015-08-15 13:36 - 00000000 ____D C:\Users\*****\Desktop\Zu Hause
2015-09-16 12:24 - 2015-05-27 18:01 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-09-16 12:24 - 2015-05-27 18:01 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-09-14 19:29 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-09-12 18:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-09-12 17:15 - 2015-04-09 00:02 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-09-12 17:15 - 2015-04-09 00:02 - 00000000 ___SD C:\Windows\system32\GWX
2015-09-12 17:15 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-09-10 16:00 - 2014-10-07 18:50 - 00000000 ____D C:\Program Files (x86)\CDBurnerXP
2015-09-10 16:00 - 2013-11-01 00:48 - 00001109 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2015-09-10 15:20 - 2013-09-07 15:11 - 00001413 _____ C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-09-10 15:16 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\zh-HK
2015-09-10 15:16 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\tr-TR
2015-09-10 15:15 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\zh-HK
2015-09-10 15:15 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\tr-TR
2015-09-09 21:14 - 2011-04-12 09:55 - 00000000 ____D C:\Program Files\Windows Journal
2015-09-09 18:19 - 2013-09-07 15:46 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-09-09 18:18 - 2013-09-15 16:42 - 00000000 ____D C:\Windows\system32\MRT
2015-09-08 00:44 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2015-09-06 23:45 - 2015-09-01 17:54 - 00000000 ____D C:\Users\*****\Desktop\urlaub
2015-09-05 15:37 - 2015-08-19 13:16 - 00000000 ____D C:\Users\*****\Desktop\Bionik Text
2015-09-05 13:32 - 2013-09-07 16:21 - 00000000 ____D C:\ProgramData\AVAST Software
2015-09-05 13:01 - 2013-10-15 20:17 - 00000000 ____D C:\Users\*****\AppData\Local\Google

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2015-08-19 12:11 - 2015-08-19 12:11 - 0000268 ___RH () C:\Users\*****\AppData\Roaming\Woodwinds
2015-08-19 12:12 - 2015-08-19 12:12 - 0000268 ___RH () C:\Users\*****\AppData\Roaming\Work - Home
2015-08-19 12:11 - 2015-08-19 12:11 - 0000268 ___RH () C:\Users\*****\AppData\Roaming\Workflows
2013-11-27 03:47 - 2013-11-27 04:05 - 0008192 _____ () C:\Users\*****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-01-30 08:08 - 2014-01-30 08:08 - 1065984 _____ () C:\Users\*****\AppData\Local\file__0.localstorage
2015-08-19 12:11 - 2015-08-19 12:11 - 0000268 ___RH () C:\ProgramData\designjet
2015-08-19 12:12 - 2015-08-19 12:12 - 0000268 ___RH () C:\ProgramData\deskjet
2015-08-19 12:11 - 2015-08-19 12:11 - 0000268 ___RH () C:\ProgramData\docInfo
2013-10-19 18:22 - 2013-10-19 18:22 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2015-08-19 12:12 - 2015-08-19 12:12 - 0000020 ____H () C:\ProgramData\PKP_DLes.DAT
2015-08-19 12:11 - 2015-08-19 12:17 - 0000020 ____H () C:\ProgramData\PKP_DLet.DAT
2015-08-19 12:11 - 2015-08-19 12:11 - 0000020 ____H () C:\ProgramData\PKP_DLev.DAT

Dateien, die verschoben oder gelöscht werden sollten:
====================
C:\Users\*****\Activation_enu.exe
C:\Users\*****\idman623build14.exe


Einige Dateien in TEMP:
====================
C:\Users\*****\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpgeia3v.dll
C:\Users\*****\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-10-01 16:43

==================== Ende von FRST.txt ============================

cosinus · 03.10.2015, 12:44

Das steht doch nirgends, dass ein iFrame gleich automatische ein Virus ist. Wieso kommst du dadrauf, nur weil in diesem Fall dein Virenscanner da das Ding angemeckert hat? Es ist irgendwie immer wieder erstuanlich wenn Ergebnisse oder Meldungen von VIrenscannern eine so hohe Bedeutung beigemssen wird, dass andere Erklärungen/Definitionen kaum noch beachtet werden.

Ein iframe ist grob gesagt nix weiter als eine Webinhalt einer anderen Website eingebettet in einer Website. Eben per iframe. Da ist nix automatisch ein Virus. Sonst wäre jeder Webinhalt automatisch ein Virus.

Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Untersuchen klicken.

MrXxx · 07.10.2015, 10:50

Hier die Logs,
bin leider immer nur wechselnd an diesem PC...
und vielen Dank für die Erklärung des iFrames - hatte auf einer Website was von wegen Trojaner gehört, der sich als iFrame tarnt.

Addition

Code:

ATTFilter

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:04-10-2015
durchgeführt von ***** (2015-10-07 11:44:56)
Gestartet von C:\Users\*****\Desktop
Windows 7 Professional Service Pack 1 (X64) (2013-09-07 13:11:32)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-3887911213-2195480286-3553274884-500 - Administrator - Disabled)
***** (S-1-5-21-3887911213-2195480286-3553274884-1000 - Administrator - Enabled) => C:\Users\*****
Gast (S-1-5-21-3887911213-2195480286-3553274884-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3887911213-2195480286-3553274884-1091 - Limited - Enabled)

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Kaspersky Internet Security (Enabled - Up to date) {B41C7598-35F6-4D89-7D0E-7ADE69B4047B}
AS: Kaspersky Internet Security (Enabled - Up to date) {0F7D947C-13CC-4207-47BE-41AC12334EC6}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {8C27F4BD-7F99-4CD1-5651-D3EB97674300}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

Adobe After Effects CC 2015 (HKLM-x32\...\{147EC100-14BE-45EF-AB42-35BAEE7D02F0}) (Version: 13.5.1 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 18.0.0.180 - Adobe Systems Incorporated)
Adobe Audition CC 2015 (HKLM-x32\...\{839A3566-AED6-4787-A849-5CBE2B1DC6AE}) (Version: 8.0 - Adobe Systems Incorporated)
Adobe Bridge CC (64 Bit) (HKLM-x32\...\{359F8007-6486-429C-A8C5-D67F6897C88C}) (Version: 6.1.1 - Adobe Systems Incorporated)
Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.5.23 - Adobe Systems Incorporated.)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 3.3.0.151 - Adobe Systems Incorporated)
Adobe Flash Player 19 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 19.0.0.185 - Adobe Systems Incorporated)
Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.185 - Adobe Systems Incorporated)
Adobe Lightroom (HKLM-x32\...\{8048A5DF-8A70-5BE1-954B-E0FDE1BD0D0D}) (Version: 6.1.1 - Adobe Systems Incorporated)
Adobe Media Encoder CC 2015 (HKLM-x32\...\{0FAC7130-BEC5-47A5-8813-1D339B8326ED}) (Version: 9.0.2 - Adobe Systems Incorporated)
Adobe Photoshop CC 2015 (HKLM-x32\...\{793C2BF7-A4FE-4608-91C9-9282C5801C21}) (Version: 16.0.1 - Adobe Systems Incorporated)
Adobe Photoshop Elements 10 (HKLM-x32\...\Adobe Photoshop Elements 10) (Version: 10.0 - Adobe Systems Incorporated)
Adobe Premiere Pro CC 2015 (HKLM-x32\...\{38C72D42-0672-43B1-9E05-E7631684F9A1}) (Version: 9.0.2 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.12) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)
Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version:  - Hidden Path Entertainment, Ensemble Studios)
Age of Empires III - The WarChiefs (HKLM-x32\...\InstallShield_{1C08A24C-B168-407E-A826-68FAF5F20710}) (Version: 1.00.0000 - Microsoft Game Studios)
Age of Empires III - The WarChiefs (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden
Age of Mythology: Extended Edition (HKLM-x32\...\Steam App 266840) (Version:  - SkyBox Labs)
Amazon Kindle (HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\...\Amazon Kindle) (Version:  - Amazon)
Apple Application Support (32-Bit) (HKLM-x32\...\{7FE25256-B7C1-480D-B736-10A67A833AEA}) (Version: 3.2 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{B255D495-4734-4E9B-B4F5-96702FD4A7B9}) (Version: 3.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{5D61F006-168C-4B8B-B7FD-F113C10AE0E4}) (Version: 8.2.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
bl (x32 Version: 1.0.0 - Your Company Name) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Brother MFL-Pro Suite MFC-J430W (HKLM-x32\...\{A1B36B88-AF90-43A3-8906-6DBEE89B4FBD}) (Version: 1.1.6.0 - Brother Industries, Ltd.)
CCleaner (HKLM\...\CCleaner) (Version: 4.18 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.6.5844 - CDBurnerXP)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dropbox (HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\...\Dropbox) (Version: 3.10.7 - Dropbox, Inc.)
Elements 10 Organizer (x32 Version: 10.0 - Ihr Firmenname) Hidden
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Fraps (HKLM-x32\...\Fraps) (Version:  - )
GameRanger (HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\...\GameRanger) (Version:  - GameRanger Technologies)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 46.0.2490.52 - Google Inc.)
Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden
iMazing 1.2.4.0 (HKLM\...\iMazing_is1) (Version: 1.2.4.0 - DigiDNA)
Intel(R) Network Connections 18.5.54.0 (HKLM\...\PROSetDX) (Version: 18.5.54.0 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3412 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{BEE86606-EFB5-4353-9F34-29E0C59CDCFA}) (Version: 15.2.0.0284 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{3015F546-6C3E-4E6A-B564-BCDF88C0BA2A}) (Version: 2.1.1.0153 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.0.0.100 - Intel Corporation)
Intel® PROSet/Wireless WiFi-Software (HKLM\...\{181BBF43-CA17-4E1A-A78D-81E67A57B8A4}) (Version: 15.02.0000.1258 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
iTunes (HKLM\...\{BFEAB774-C7DC-4032-B05A-DA5F7CB7B365}) (Version: 12.2.2.25 - Apple Inc.)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{77E7AE5C-181C-4CAF-ADBF-946F11C1CE26}) (Version: 16.0.0.614 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 16.0.0.614 - Kaspersky Lab) Hidden
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version:  - )
Malwarebytes Anti-Exploit version 1.07.1.1015 (HKLM\...\Malwarebytes Anti-Exploit_is1) (Version: 1.07.1.1015 - Malwarebytes)
Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
MetaTrader 4 Admiral Markets AS (HKLM-x32\...\MetaTrader 4 Admiral Markets AS) (Version: 4.00 - MetaQuotes Software Corp.)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Age of Empires II (HKLM-x32\...\Age of Empires 2.0) (Version:  - )
Microsoft Age of Empires II: The Conquerors Expansion (HKLM-x32\...\Age of Empires II: The Conquerors Expansion 1.0) (Version:  - )
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{D285FC5F-3021-32E9-9C59-24CA325BDC5C}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nikon Message Center 2 (HKLM-x32\...\{B014EE44-9197-4513-9613-71E6EB1B514E}) (Version: 2.1.1 - Nikon)
Nikon Movie Editor (HKLM-x32\...\{5CAD3393-EEC0-44CE-9F93-BCAA365B77FB}) (Version: 2.9.2 - Nikon)
NVIDIA 3D Vision Controller-Treiber 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 344.11 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 344.11 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.3 - NVIDIA Corporation)
NVIDIA Grafiktreiber 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.11 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.32.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.32.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
ODT Viewer version 1.0 (HKLM-x32\...\{CAA1B43B-7CDA-4D58-B9A3-1050C358CB2D}_is1) (Version: 1.0 - odtviewer.com)
ON_OFF Charge 2 B13.0403.1 (HKLM-x32\...\InstallShield_{6B4ED6F7-BB88-4945-B0C6-01410E1BAC3A}) (Version: 1.00.0000 - GIGABYTE)
ON_OFF Charge 2 B13.0403.1 (x32 Version: 1.00.0000 - GIGABYTE) Hidden
ON_OFF Charge B13.0403.1 (HKLM-x32\...\{3DECD372-76A1-4483-BF10-B547790A3261}) (Version: 1.00.0001 - GIGABYTE)
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
Paint XP version 1.1 (HKLM-x32\...\{2367FAB6-055A-4923-835F-F57F7BBBA363}_is1) (Version: 1.1 - MSPAINTXP.COM)
ph (x32 Version: 1.0.0 - Your Company Name) Hidden
Picture Control Utility 2 (HKLM\...\{D4893C47-704F-4B84-8486-9DE4974ACA6F}) (Version: 2.0.2 - Nikon)
PSE10 STI Installer (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
Qualcomm Atheros Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.21 - Qualcomm Atheros Inc.)
QuickTime 7 (HKLM-x32\...\{627FFC10-CE0A-497F-BA2B-208CAC638010}) (Version: 7.77.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7037 - Realtek Semiconductor Corp.)
Saal Design Software (HKLM-x32\...\SaalDesignSoftware) (Version: 3.9 - Saal Digital Fotoservice GmbH)
Saal Design Software (x32 Version: 3.9 - Saal Digital Fotoservice GmbH) Hidden
Sandboxie 5.04 (64-bit) (HKLM\...\Sandboxie) (Version: 5.04 - Sandboxie Holdings, LLC)
SeaTools for Windows 1.4.0.2 (HKLM-x32\...\SeaTools for Windows) (Version: 1.4.0.2 - Seagate Technology)
Secunia PSI (3.0.0.7011) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.7011 - Secunia)
SHIELD Streaming (Version: 3.1.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.13.56 - NVIDIA Corporation) Hidden
Skype™ 7.11 (HKLM-x32\...\{6A0549A9-1B96-498C-ACBC-3943001FEB19}) (Version: 7.11.102 - Skype Technologies S.A.)
SpellForce (HKLM-x32\...\SpellForce) (Version: SpellForce v1.52 - JoWooD Productions Software AG)
Spotify (HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\...\Spotify) (Version: 1.0.14.124.g4dfabc51 - Spotify AB)
StarCraft II (HKLM-x32\...\StarCraft II) (Version:  - Blizzard Entertainment)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.38846 - TeamViewer)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden
ViewNX 2 (HKLM\...\{635BE602-BB9C-4C59-8CC5-93F9366E8A21}) (Version: 2.10.3 - Nikon)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Media Encoder 9 Series x64 Edition (HKLM\...\Windows Media Encoder 9) (Version:  - )
WinRAR 5.21 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH)
WinTelnet & FTP Pro 2.5 for Windows 95 & NT! (HKLM-x32\...\WinTelnet & FTP Pro 2.5 for Windows 95 & NT!) (Version:  - )

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-3887911213-2195480286-3553274884-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\*****\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll => Keine Datei

==================== Wiederherstellungspunkte =========================

03-09-2015 15:41:26 Geplanter Prüfpunkt
03-09-2015 17:57:53 Windows Update
04-09-2015 01:34:37 Windows Update
05-09-2015 03:00:10 Windows Update
05-09-2015 03:30:34 Windows Update
05-09-2015 13:30:13 avast! antivirus system restore point
06-09-2015 03:00:12 Windows Update
06-09-2015 03:47:55 Windows Update
06-09-2015 13:04:54 Windows Update
07-09-2015 01:46:29 Windows Update
08-09-2015 03:00:11 Windows Update
08-09-2015 03:13:03 Windows Update
08-09-2015 13:19:52 Windows-Sicherung
08-09-2015 14:20:34 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
09-09-2015 03:00:12 Windows Update
09-09-2015 12:40:18 Windows Update
09-09-2015 18:06:34 Windows Update
09-09-2015 21:58:17 Windows Update
10-09-2015 13:45:42 Windows Update
10-09-2015 18:33:45 Windows Update
11-09-2015 01:54:54 Windows Update
11-09-2015 16:00:16 Windows Update
13-09-2015 16:00:57 Windows-Sicherung
15-09-2015 16:32:43 Windows Update
23-09-2015 13:38:58 Windows Update
29-09-2015 15:10:05 Windows Update
30-09-2015 14:18:07 Snagit 12
30-09-2015 14:39:54 Camtasia Studio 8 wird installiert
30-09-2015 14:58:15 Installed Jing
30-09-2015 15:26:16 Removed Jing
30-09-2015 15:27:15 Camtasia Studio 8 wird entfernt
30-09-2015 16:37:28 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501
30-09-2015 16:37:44 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
30-09-2015 16:38:12 Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501
30-09-2015 17:01:25 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030
30-09-2015 17:01:49 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030
30-09-2015 17:02:23 Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501
30-09-2015 17:02:52 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501
30-09-2015 19:21:21 Snagit 12
30-09-2015 19:57:45 Camtasia Studio 8 wird installiert
01-10-2015 15:41:06 Camtasia Studio 8 wird entfernt
03-10-2015 01:22:44 JRT Pre-Junkware Removal
03-10-2015 20:27:03 Installed Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology
03-10-2015 20:43:18 Windows Update
07-10-2015 11:42:58 Windows Update

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2009-07-14 04:34 - 2015-10-01 23:37 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {0A353796-DBE5-4C0C-9B75-2D00F7DA0010} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-3887911213-2195480286-3553274884-1000Core => C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-19] (Dropbox, Inc.)
Task: {2BE4A7A0-1B91-4F0A-9BB2-3200BA596C04} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {324919A9-5E73-4EC7-BBED-FD116D2D2FD0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-05-27] (Google Inc.)
Task: {377E924D-5D56-4F63-B629-839CA7608225} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {4DA1AC0A-5224-44EE-B392-1AB3365D0760} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-05-27] (Google Inc.)
Task: {7E468E54-35CF-49F6-89F8-BDE988FDE0AB} - System32\Tasks\{B25A8B84-1BBD-4577-BB6B-8C7BDCC13539} => C:\Program Files (x86)\JoWooD\SpellForce\SpellForce.exe [2005-06-07] ()
Task: {964C09AE-F58A-4E3E-BD5D-B5283650C59B} - System32\Tasks\{2F9C545E-5DA5-46F0-BC8B-4A4C8ED349D8} => C:\Program Files (x86)\JoWooD\SpellForce\SpellForce.exe [2005-06-07] ()
Task: {A3F51735-24AF-49E3-BF5E-6BCF9361DD69} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiser
Task: {A7F577E9-B502-47B6-B7BD-E30198545396} - System32\Tasks\AdobeAAMUpdater-1.0-*****-PC-***** => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2015-09-04] (Adobe Systems Incorporated)
Task: {C1AD5DA8-19D9-4ED3-9C01-8F36A74C7C9E} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-09-26] (Piriform Ltd)
Task: {F85449EC-4854-4AF6-8AF3-DDDB814FA12D} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-3887911213-2195480286-3553274884-1000UA => C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-19] (Dropbox, Inc.)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3887911213-2195480286-3553274884-1000Core.job => C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3887911213-2195480286-3553274884-1000UA.job => C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2014-10-08 17:37 - 2014-09-13 23:53 - 00116880 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-09-11 19:02 - 2015-09-11 19:02 - 00803488 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
2010-07-15 06:44 - 2010-07-15 06:44 - 00020032 _____ () C:\Program Files\Unlocker\UnlockerCOM.dll
2015-05-15 16:26 - 2015-05-15 16:26 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-05-15 16:26 - 2015-05-15 16:26 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-01-25 03:22 - 2014-01-25 03:22 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-09-25 20:44 - 2014-09-25 20:44 - 00053248 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2015-09-11 19:01 - 2015-09-11 19:01 - 31958688 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
2015-07-08 23:18 - 2015-07-08 23:18 - 00794920 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\kpcengine.2.3.dll
2014-01-10 16:33 - 2015-07-03 18:12 - 00778240 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2015-01-21 17:44 - 2015-07-03 18:12 - 04962816 _____ () C:\Program Files (x86)\Steam\v8.dll
2015-01-21 17:44 - 2015-07-03 18:12 - 01556992 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2015-01-21 17:44 - 2015-07-03 18:12 - 01187840 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2014-05-22 23:23 - 2015-08-19 22:39 - 02413248 _____ () C:\Program Files (x86)\Steam\video.dll
2014-09-07 18:26 - 2014-12-01 23:31 - 02396672 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2014-09-07 18:26 - 2014-12-01 23:31 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2014-09-07 18:26 - 2014-12-01 23:31 - 00479744 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2014-09-07 18:26 - 2014-12-01 23:31 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2014-09-07 18:26 - 2014-12-01 23:31 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2014-01-27 12:02 - 2015-08-19 22:39 - 00704192 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2015-07-22 00:05 - 2015-07-27 03:13 - 00171008 _____ () C:\Program Files (x86)\Steam\bin\openvr_api.dll
2015-10-03 19:44 - 2015-10-03 19:44 - 45067320 _____ () C:\Users\*****\AppData\Roaming\Spotify\libcef.dll
2015-10-07 11:36 - 2015-10-07 11:36 - 00071168 _____ () c:\users\*****\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpova2yt.dll
2015-03-04 23:45 - 2015-09-24 01:07 - 00012800 _____ () C:\Users\*****\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll
2015-03-04 23:45 - 2015-09-24 01:07 - 00779776 _____ () C:\Users\*****\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-07-31 11:05 - 2015-09-24 01:07 - 00056320 _____ () C:\Users\*****\AppData\Roaming\Dropbox\bin\QtQuick\Layouts\qquicklayoutsplugin.dll
2015-03-04 23:45 - 2015-09-24 01:07 - 00012288 _____ () C:\Users\*****\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll
2014-10-01 18:36 - 2009-02-27 16:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2015-09-15 08:08 - 2015-09-15 08:08 - 40523440 _____ () C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\CEF\libcef.dll
2014-01-10 16:33 - 2015-07-03 18:12 - 39553928 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2015-09-15 08:08 - 2015-09-15 08:08 - 01365680 _____ () C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\CEF\libglesv2.dll
2015-09-15 08:08 - 2015-09-15 08:08 - 00219312 _____ () C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\CEF\libegl.dll
2015-10-03 19:44 - 2015-10-03 19:44 - 01649208 _____ () C:\Users\*****\AppData\Roaming\Spotify\libglesv2.dll
2015-10-03 19:44 - 2015-10-03 19:44 - 00080952 _____ () C:\Users\*****\AppData\Roaming\Spotify\libegl.dll
2015-09-11 16:39 - 2015-09-11 16:39 - 00124416 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\fs-ext\build\Release\fs-ext.node
2015-09-11 16:39 - 2015-09-11 16:39 - 00121856 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\node-imslib\node_modules\ref\build\Release\binding.node
2015-09-11 16:39 - 2015-09-11 16:39 - 00122880 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\node-imslib\node_modules\ffi\build\Release\ffi_bindings.node
2015-09-11 16:39 - 2015-09-11 16:39 - 00188416 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\node-vulcanjs\build\Release\VulcanJS.node
2015-09-11 16:39 - 2015-09-11 16:39 - 00085504 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\ws\build\Release\bufferutil.node
2015-09-11 16:39 - 2015-09-11 16:39 - 00086016 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\ws\build\Release\validation.node
2015-09-11 16:39 - 2015-09-11 16:39 - 00081408 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\idle-gc\build\Release\idle-gc.node

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)

AlternateDataStreams: C:\ProgramData\TEMP:5C321E34

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-3887911213-2195480286-3553274884-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\*****\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

MSCONFIG\startupreg: Google Update => "C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: GrooveMonitor => "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
MSCONFIG\startupreg: ISUSPM Startup => C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
MSCONFIG\startupreg: ISUSScheduler => "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{EF75A5ED-C6CE-4E62-9DD9-930C2D2092EF}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{60A1D3E6-D15B-4B05-A3F7-644BD93290B4}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1675\Agent.exe
FirewallRules: [{D370DA75-CA12-4314-A8F8-BB8BC849A974}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1675\Agent.exe
FirewallRules: [{486FE09B-66B2-4B5B-A64C-FE59C479E737}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2045\Agent.exe
FirewallRules: [{0AA9FD60-C021-496A-8C9A-54D3BA648143}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2045\Agent.exe
FirewallRules: [{11EF2C32-0FA4-45D1-BC51-862440DB7F73}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II.exe
FirewallRules: [{D8468CD5-B10C-42E7-895B-F906DAFA82E8}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II.exe
FirewallRules: [{1B92F5CA-5A6B-4519-AED6-01F3853AA534}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II Public Test.exe
FirewallRules: [{E4DA306C-7F49-4FA9-9AF8-9191B46E2E0E}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II Public Test.exe
FirewallRules: [TCP Query User{439914F9-21EA-4136-BA35-1E4AB21B24B1}C:\program files (x86)\starcraft ii\versions\base26490\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base26490\sc2.exe
FirewallRules: [UDP Query User{E3241DAB-58A3-424A-89A8-53D502CD6771}C:\program files (x86)\starcraft ii\versions\base26490\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base26490\sc2.exe
FirewallRules: [{2E43EE8E-E942-43E3-A740-3436F1DC6720}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires II\age2_x1\age2_x2.exe
FirewallRules: [{2F95D7AC-4EA7-4593-85FE-E8E02DC1D0AD}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires II\age2_x1\age2_x2.exe
FirewallRules: [TCP Query User{F0F67C14-B2AB-47DD-A63E-26BD95D2A150}C:\users\*****\appdata\roaming\gameranger\gameranger\gameranger.exe] => (Allow) C:\users\*****\appdata\roaming\gameranger\gameranger\gameranger.exe
FirewallRules: [UDP Query User{2139204F-45DE-4B05-9660-84FBA6B203F7}C:\users\*****\appdata\roaming\gameranger\gameranger\gameranger.exe] => (Allow) C:\users\*****\appdata\roaming\gameranger\gameranger\gameranger.exe
FirewallRules: [{AFEBFC20-BB84-4AEB-93AD-44109B587F6F}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3.exe
FirewallRules: [{9EDA41C2-EDC2-4BC7-8B1C-BE9AF6CAAF6E}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3.exe
FirewallRules: [{B34A0387-77CA-4E86-A324-634BDE24F2CC}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3x.exe
FirewallRules: [{EC8D4FC3-1CB3-4C81-BBF1-BDDC6B9FA5CA}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3x.exe
FirewallRules: [{35F0EEB1-E6FA-4B98-AE1E-846876FACC95}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3y.exe
FirewallRules: [{A547251F-D499-45CE-99F4-EA8B3707595B}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3y.exe
FirewallRules: [{C413EE3F-B0E6-47C8-8BDC-AFE591D3578C}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2328\Agent.exe
FirewallRules: [{5A91CF27-C64E-419F-8568-5F9696C1EFD3}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2328\Agent.exe
FirewallRules: [{2F5E16C4-6192-49A5-9B4E-BF49A821A31D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exe
FirewallRules: [{0DB5BA90-0A30-40D3-BC6B-23BF14D8B8DA}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exe
FirewallRules: [{A10C6BAC-94EE-480D-893B-B7FF77BD01DF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Age2HD\Launcher.exe
FirewallRules: [{1A7DA604-83C6-4B35-A6D0-A6849074E7F6}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Age2HD\Launcher.exe
FirewallRules: [TCP Query User{7567DB64-287B-4D19-9DB5-8BCBFE27806F}C:\program files (x86)\voobly\voobly.exe] => (Allow) C:\program files (x86)\voobly\voobly.exe
FirewallRules: [UDP Query User{F8D81767-39F1-4C8A-8498-0047BE8EA852}C:\program files (x86)\voobly\voobly.exe] => (Allow) C:\program files (x86)\voobly\voobly.exe
FirewallRules: [TCP Query User{7B2EE519-A8BB-4814-9D0C-500DEFC7042A}C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe] => (Allow) C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe
FirewallRules: [UDP Query User{8BE88C92-BAA6-42A0-BBCF-2EAD03337555}C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe] => (Allow) C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe
FirewallRules: [{CF6411CE-1309-44E1-9870-B52728343068}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{EF86CA9F-EC69-4B89-B4EF-ABCF52457E4D}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{B4F8A91F-38CC-4D13-B8A8-73ECEEB73C90}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{FFAB3750-7D8E-4679-A3B4-394764FD1696}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{277A2BA7-2D1D-49A1-91A5-BD0D7DA815E7}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{7C5A9997-8B90-4CFA-9F9C-19E42448C7D6}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [TCP Query User{5EED7F17-2093-4698-9E3B-A026DD58C24C}C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe
FirewallRules: [UDP Query User{B18686B0-3007-4ACD-9E89-0579BDD1EA74}C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe
FirewallRules: [{47CFD57B-07EE-4EDD-88C1-C8A89B536332}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{E8D5198E-5278-455F-B609-531473E07F41}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{A6934835-54C3-42D5-BFD8-46737DF1843E}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires II\age2_x1\age2_x2.exe
FirewallRules: [{973C13EE-F3CF-4180-A1DA-D107A8BA116D}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires II\age2_x1\age2_x2.exe
FirewallRules: [{6DE2073B-414F-4558-922C-9887604C99C2}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{ADBD2A82-891D-4487-88C8-AEBC44C6BD82}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{DB86E199-E63B-4F55-B994-0238710F0852}] => (Allow) C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{48866709-0683-48CA-9DCC-5EA07E00A4EA}] => (Allow) C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{0A94CB91-5E19-4D2C-9BDB-0A25F3BD8C71}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2689\Agent.exe
FirewallRules: [{78BE73D1-C57F-4C29-8D4F-1EB1441E40D0}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2689\Agent.exe
FirewallRules: [{79B9467A-43DB-46EC-8A62-B201EA89DABE}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2717\Agent.exe
FirewallRules: [{BCE6E3A1-C8FE-428F-A810-F1B685A5BC11}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2717\Agent.exe
FirewallRules: [{8DF4C616-0107-4BFF-ABA5-64E3B8FED48A}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2816\Agent.exe
FirewallRules: [{AEA5E48C-8180-4B6C-B2CA-7A8A312EA08B}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2816\Agent.exe
FirewallRules: [TCP Query User{62D8C5F8-A5B2-4778-B60E-9713F555B0FA}C:\users\*****\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\*****\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{E199CB01-521D-4262-B32E-D1E467572966}C:\users\*****\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\*****\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{600FD0AC-CADD-4398-AFDD-6E021A4BAC21}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe
FirewallRules: [{AA834CFB-D47C-4D13-8A0F-2475016ABB43}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe
FirewallRules: [{A9F84DFA-5B09-46E9-A482-E18A5B83302E}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3023\Agent.exe
FirewallRules: [{9A383178-2DDB-45F1-9ED0-C49A29DA106F}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3023\Agent.exe
FirewallRules: [{F04C1600-E2B9-4794-BF7D-1B7CE3A6B238}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3147\Agent.exe
FirewallRules: [{5BDBF00B-8A89-4DC3-8095-7F6D1D4309AD}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3147\Agent.exe
FirewallRules: [{87508363-FD5D-40E9-B52D-DF58FBBAB09A}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3182\Agent.exe
FirewallRules: [{D4ED5C2F-EBB3-4BE2-9381-4CF2AEB36C80}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3182\Agent.exe
FirewallRules: [{E355BC6E-A601-4229-9917-182708C55BB8}] => (Allow) C:\Windows\SysWOW64\dplaysvr.exe
FirewallRules: [{91252FE3-D1F1-49B8-845D-72F472B5251D}] => (Allow) C:\Windows\SysWOW64\dplaysvr.exe
FirewallRules: [{79FAD884-86A7-4AB6-8AFF-FDD578E43C46}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires II\age2_x1\age2_x2.exe
FirewallRules: [{1C8B1B71-0325-4FC8-9623-599EC82DBB4E}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires II\age2_x1\age2_x2.exe
FirewallRules: [{BB7BE806-FC79-4C06-9F10-AF345F032CF2}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3235\Agent.exe
FirewallRules: [{BF9F3950-0B35-4BB4-92E9-D7354B2C3E2D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3235\Agent.exe
FirewallRules: [{3B0765B6-9B1D-4884-AE3F-D0F00A627ED4}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{8DF4DBD0-BB9D-45D0-BD5A-12F1AABE58DC}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{4169278E-EEA7-491D-8B36-BD9F0A558115}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3286\Agent.exe
FirewallRules: [{2CA484EF-E564-4D5D-8CE9-6C2DDCF7B8AC}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3286\Agent.exe
FirewallRules: [{F7229EB7-D401-462F-9FD1-0029E7AF03C5}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Age of Mythology\Launcher.exe
FirewallRules: [{41CD60DE-BFCB-46D5-B70C-CF9CBE34C85F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Age of Mythology\Launcher.exe
FirewallRules: [{470ACAF7-B706-4139-B550-C7D45899BEB2}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3372\Agent.exe
FirewallRules: [{10422840-0606-4E4C-B300-95A0AAC3D940}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3372\Agent.exe
FirewallRules: [{48E3AAF8-DD49-4AB6-A344-7E09034F4A7C}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{7C326F86-EE42-410E-8508-251F4AA7E084}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [TCP Query User{34D89C74-FD4B-4D79-ACD3-243A253B3503}C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe
FirewallRules: [UDP Query User{0B3896A4-F01B-4476-B1BB-83925CF39C00}C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe
FirewallRules: [{2DBC602E-46C0-4AB7-9C8C-3524DB83617C}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3454\Agent.exe
FirewallRules: [{4F9AF48A-0272-4980-B818-C5264720E8B0}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3454\Agent.exe
FirewallRules: [{29541B14-6720-4EEE-A455-F9A0B6662102}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3507\Agent.exe
FirewallRules: [{D9012977-FAA1-4B6E-A1A9-59922D8162BA}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3507\Agent.exe
FirewallRules: [{3433B42C-9F7A-48AE-907D-AC52EF07F1B3}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3526\Agent.exe
FirewallRules: [{8472A4EF-3539-4A86-9560-209542103DED}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3526\Agent.exe
FirewallRules: [{1373B22A-CE78-413D-BFF8-78F5744F123E}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3688\Agent.exe
FirewallRules: [{1DB89ED0-BC50-49FE-8AED-6802242A31C3}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3688\Agent.exe
FirewallRules: [{5025388E-D7FC-431E-9ADF-3B4ABCF80213}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe
FirewallRules: [{363BB1CB-7264-4598-AD6C-E6DABF094681}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe
FirewallRules: [{7393B37A-6E1F-4BBD-88CE-001D47D0DF83}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{D922D230-E77E-4758-91D4-2FD8B590350F}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{23A489D7-FE85-4492-AC42-A23F4D472CB0}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{E016B5F9-854C-42C2-88F5-3DC240D69C14}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [TCP Query User{08DA00E0-8530-4A2A-B423-9CEB0F9CD8E7}C:\users\*****\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\*****\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{B17310AC-77A6-40ED-A414-09A75C9E77F5}C:\users\*****\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\*****\appdata\roaming\spotify\spotify.exe
FirewallRules: [{72B51C08-A77A-47AC-BED6-1538514973C5}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{919814BB-FB39-4425-97F0-37038F410701}] => (Allow) LPort=2869
FirewallRules: [{7B94D2E6-5CEE-415A-8A7B-E1549AEC089A}] => (Allow) LPort=1900
FirewallRules: [{0817E6FB-AA30-48EB-AF08-1ECCA6B780E9}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{104914B2-E960-4E74-B49F-7F605D237A7A}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{0E80F4E6-B57E-4E3F-AD99-959442401E44}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{8CE001CE-9B8F-4644-BEC2-25563D215212}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{AA693CC1-C3FF-42C9-9F67-C4C51E4D8E40}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{9021429B-7AAF-4970-94BF-5781A5A6A504}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{29A15643-8EC6-46DF-8838-816CD91B94BB}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Fehlerhafte Geräte im Gerätemanager =============

Name: Microsoft Virtual WiFi Miniport Adapter #2
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Qualcomm Atheros AR8161/8165 PCI-E Gigabit Ethernet Controller (NDIS 6.20)
Description: Qualcomm Atheros AR8161/8165 PCI-E Gigabit Ethernet Controller (NDIS 6.20)
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Qualcomm Atheros
Service: L1C
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Microsoft-Adapter für Miniports virtueller WiFis
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (10/07/2015 11:36:57 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ZeroConfigService.exe, Version: 15.2.0.3, Zeitstempel: 0x4fe8ea02
Name des fehlerhaften Moduls: MurocApi.dll, Version: 15.2.0.1, Zeitstempel: 0x4fe8e921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000002089b
ID des fehlerhaften Prozesses: 0x1354
Startzeit der fehlerhaften Anwendung: 0xZeroConfigService.exe0
Pfad der fehlerhaften Anwendung: ZeroConfigService.exe1
Pfad des fehlerhaften Moduls: ZeroConfigService.exe2
Berichtskennung: ZeroConfigService.exe3

Error: (10/07/2015 11:36:13 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/03/2015 05:32:52 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/03/2015 01:07:33 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/03/2015 12:42:04 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/02/2015 02:46:47 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/01/2015 03:23:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Creative Cloud.exe, Version: 3.3.0.151, Zeitstempel: 0x55fab2fa
Name des fehlerhaften Moduls: ContainerUI.dll, Version: 3.3.0.151, Zeitstempel: 0x55fab383
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00016870
ID des fehlerhaften Prozesses: 0x1924
Startzeit der fehlerhaften Anwendung: 0xCreative Cloud.exe0
Pfad der fehlerhaften Anwendung: Creative Cloud.exe1
Pfad des fehlerhaften Moduls: Creative Cloud.exe2
Berichtskennung: Creative Cloud.exe3

Error: (10/01/2015 02:16:47 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/01/2015 02:05:25 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/30/2015 10:00:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Creative Cloud.exe, Version: 3.3.0.151, Zeitstempel: 0x55fab2fa
Name des fehlerhaften Moduls: ContainerUI.dll, Version: 3.3.0.151, Zeitstempel: 0x55fab383
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00016870
ID des fehlerhaften Prozesses: 0xfb4
Startzeit der fehlerhaften Anwendung: 0xCreative Cloud.exe0
Pfad der fehlerhaften Anwendung: Creative Cloud.exe1
Pfad des fehlerhaften Moduls: Creative Cloud.exe2
Berichtskennung: Creative Cloud.exe3


Systemfehler:
=============
Error: (10/07/2015 11:37:33 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (10/07/2015 11:36:10 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
UsbCharger

Error: (10/03/2015 05:32:46 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
UsbCharger

Error: (10/03/2015 01:51:53 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.

Modulpfad: C:\Windows\System32\IWMSSvc.dll

Error: (10/03/2015 01:51:53 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.

Modulpfad: C:\Windows\System32\IWMSSvc.dll

Error: (10/03/2015 01:51:50 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.

Modulpfad: C:\Windows\System32\IWMSSvc.dll

Error: (10/03/2015 01:23:23 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Intel(R) Centrino(R) Wireless Bluetooth(R) + High Speed Security Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (10/03/2015 01:23:23 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Intel® Centrino® Wireless Bluetooth® + High Speed Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (10/03/2015 01:23:22 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Steam Client Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (10/03/2015 01:23:22 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.


==================== Speicherinformationen =========================== 

Prozessor: Intel(R) Core(TM) i5-4670K CPU @ 3.40GHz
Prozentuale Nutzung des RAM: 26%
Installierter physikalischer RAM: 16264.88 MB
Verfügbarer physikalischer RAM: 11959.79 MB
Summe virtueller Speicher: 32527.95 MB
Verfügbarer virtueller Speicher: 27887.75 MB

==================== Laufwerke ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:541.39 GB) NTFS
Drive e: (EOS_DIGITAL) (Removable) (Total:29.49 GB) (Free:3.92 GB) FAT32

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: F140D2C6)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 29.5 GB) (Disk ID: 00000000)

Partition: GPT.

==================== Ende von Addition.txt ============================