Dann zeig mal frische FRST Logs. Haken setzen bei addition.txt dann auf Untersuchen klicken

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 08-01-2017
durchgeführt von z1 (Administrator) auf BUERO01 (09-01-2017 15:42:02)
Gestartet von C:\Users\z1\Desktop
Geladene Profile: z1 (Verfügbare Profile: z1)
Platform: Windows 7 Professional Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(CompuGroup Medical Dentalsysteme GmbH) C:\Program Files (x86)\CG\Z1Lokal\exe\Z1ClientUpdate.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(DATEV eG) C:\Program Files (x86)\DATEV\SiPacompact\SiPaHostService.exe
(Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(TeamViewer GmbH) C:\Program Files\ITbrain\AntiMalware\ITbrain_AntiMalware_Service.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 10\ouservice\StarMoneyOnlineUpdate.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(TeamViewer GmbH) C:\Program Files\ITbrain\AntiMalware\AntiMalwareUserControl.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Dominik Reichl) C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(CANON INC.) C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe
() C:\Program Files (x86)\Syncios2\SynciosDeviceService.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(DATEV eG) C:\Program Files (x86)\DATEV\SiPacompact\SiPaHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe
(CompuGroup Medical Dentalsysteme GmbH) C:\Program Files (x86)\CG\Z1Lokal\exe\z1men.exe
(CompuGroup Medical) C:\Program Files (x86)\CG\Z1Lokal\exe\wkflbin\wkflsr32.exe
(CompuGroup Medical) C:\Program Files (x86)\CG\Z1Lokal\exe\wkflbin\wkflbu32.exe
(CompuGroup Medical Software GmbH) \\z1server\Z1\vitax\vita-X.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
(CompuGroup Medical AG) \\10.11.34.10\timer\timer.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13667032 2014-05-16] (Realtek Semiconductor)
HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [767312 2009-09-03] (CANON INC.)
HKLM\...\Run: [Malwarebytes Anti-Ransomware] => C:\Program Files\Malwarebytes\Anti-Ransomware\mbarw.exe [722896 2016-08-26] (Malwarebytes)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2776528 2016-12-14] (Malwarebytes)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [777392 2016-12-15] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [IJNetworkScanUtility] => C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe [140640 2009-09-28] (CANON INC.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2779136 2016-06-11] (Dominik Reichl)
HKLM-x32\...\Run: [Syncios device service] => C:\Program Files (x86)\Syncios2\SynciosDeviceService.exe [861184 2015-08-04] ()
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [25779624 2016-12-21] (Dropbox, Inc.)
HKLM-x32\...\Run: [DVCServ] => C:\Program Files (x86)\DATEV\SipaCompact\SipaHost.exe [575016 2016-03-17] (DATEV eG)
Winlogon\Notify\GoToAssist Express Customer: C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\1092\g2ax_winlogonx64.dll [X]
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\Run: [KeePass Password Safe 2] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2779136 2016-06-11] (Dominik Reichl)
HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\Run: [AudialsNotifier] => C:\Program Files (x86)\Audials\Audials 2016\AudialsNotifier.exe
HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\MountPoints2: {78eb7145-14b5-11e5-858d-dc85deaa056a} - H:\start.exe /auto
HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\ssText3d.scr [333824 2010-11-21] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [67384 2016-10-05] (Apple Inc.)
ShellExecuteHooks: Kein Name - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} -  -> Keine Datei
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-05-22] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-05-22] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-05-22] ()
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt9] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2 (GFS Stub)] -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 3 (GFS Folder)] -> {16F3DD56-1AF5-4347-846D-7C10C4192619} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt10] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt9] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 10.11.34.10
Tcpip\..\Interfaces\{1D46F64B-10AF-4846-A1E2-3328F4D5E3C1}: [DhcpNameServer] 10.11.34.10
Tcpip\..\Interfaces\{5894CFCF-2FDA-4695-A601-6E86B221FF36}: [DhcpNameServer] 192.168.178.2
Tcpip\..\Interfaces\{816BB56E-DB65-4014-9518-6FAA3CDD697B}: [DhcpNameServer] 172.20.10.1

Internet Explorer:
==================
HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131043802421602492&GUID=00000000-0000-0000-0000-000000000000
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
BHO: Kein Name -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> Keine Datei
BHO: Password Depot 7 -> {9F79B165-70F7-4C46-B1A5-8828E2FF21F9} -> C:\Program Files (x86)\AceBIT\Password Depot 7\pdIEAddOn64.dll [2014-01-24] (AceBIT)
BHO: SCardBHOEvent Class -> {AF8CD625-E04A-4A8F-A90A-0C74846C2E30} -> C:\Program Files (x86)\DATEV\SipaCompact\DVCCSAScardBHO64002.dll [2016-03-17] (DATEV eG)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2016-08-27] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\ssv.dll [2016-09-08] (Oracle Corporation)
BHO-x32: Password Depot 7 -> {9F79B165-70F7-4C46-B1A5-8828E2FF21F9} -> C:\Program Files (x86)\AceBIT\Password Depot 7\pdIEAddOn32.dll [2014-01-24] (AceBIT)
BHO-x32: SCardBHOEvent Class -> {AF8CD625-E04A-4A8F-A90A-0C74846C2E30} -> C:\Program Files (x86)\DATEV\SiPacompact\DVCCSAScardBHO002.dll [2016-03-17] (DATEV eG)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2016-11-15] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-09-08] (Oracle Corporation)
Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL Keine Datei
Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL Keine Datei
Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL Keine Datei
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL Keine Datei

FireFox:
========
FF ProfilePath: C:\Users\z1\AppData\Roaming\Mozilla\Firefox\Profiles\tdwfzx6c.default-1483442638781 [2017-01-09]
FF Homepage: Mozilla\Firefox\Profiles\tdwfzx6c.default-1483442638781 -> hxxps://www.google.de/
FF HKLM-x32\...\Firefox\Extensions: [passworddepot@acebit.com] - C:\Program Files (x86)\AceBIT\Password Depot 7\Firefox
FF Extension: (Password Depot Extension) - C:\Program Files (x86)\AceBIT\Password Depot 7\Firefox [2014-12-16] [ist nicht signiert]
FF HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\z1\AppData\Roaming\Mozilla\Firefox\Profiles\9tlmz71o.default\extensions\cliqz@cliqz.com => nicht gefunden
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_24_0_0_186.dll [2016-12-14] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2016-06-08] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_24_0_0_186.dll [2016-12-14] ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL [2010-02-04] (CANON INC.)
FF Plugin-x32: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-09-08] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-09-08] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll [2014-07-16] (Nitro PDF)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2016-06-08] (Adobe Systems)
FF Plugin HKU\S-1-5-21-4170931350-1392568851-4209714175-1000: @citrixonline.com/appdetectorplugin -> C:\Users\z1\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2014-08-11] (Citrix Online)

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [imkcgcjpeajeajpcpbdbgbknfaijnpdc] - C:\Program Files (x86)\AceBIT\Password Depot 7\crx.crx [2014-12-16]
CHR HKLM-x32\...\Chrome\Extension: [ocbnpbkmjpgbdcgiflkgkpnkinifpgpj] - C:\Users\z1\ChromeExtensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj\amazon-icon-2.crx [2014-08-18]

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2016-05-24] (Adobe Systems) [Datei ist nicht signiert]
S4 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [737984 2016-06-03] (Adobe Systems Incorporated)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2218712 2016-12-13] (Adobe Systems, Incorporated)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [871584 2016-12-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [465832 2016-12-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [465832 2016-12-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1047744 2016-12-15] (Avira Operations GmbH & Co. KG)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [249856 2011-11-15] (Brother Industries, Ltd.) [Datei ist nicht signiert]
S4 chip1click; C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe [91136 2016-08-29] (Chip Digital GmbH) [Datei ist nicht signiert]
R2 DATEV Sicherheitspaket-Dienst; C:\Program Files (x86)\DATEV\SiPacompact\SiPaHostService.exe [345128 2016-03-17] (DATEV eG)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-07] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-07] (Dropbox, Inc.)
R2 DbxSvc; C:\Windows\system32\DbxSvc.exe [42096 2016-12-21] (Dropbox, Inc.)
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [2457232 2014-04-11] (Realsil Microelectronics Inc.)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319080 2015-06-04] (Intel Corporation)
R2 ITbrainAntiMalwareService; C:\Program Files\ITbrain\AntiMalware\ITbrain_AntiMalware_Service.exe [4500400 2016-12-01] (TeamViewer GmbH)
S2 MB3Service; C:\Program Files\Malwarebytes\Anti-Ransomware\MB3Service.exe [3291088 2016-08-26] (Malwarebytes)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4317648 2016-12-14] (Malwarebytes)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [50688 2014-04-28] (Hewlett-Packard) [Datei ist nicht signiert]
S4 NitroDriverReadSpool9; C:\Program Files\Nitro\Pro 9\NitroPDFDriverService9x64.exe [230920 2014-07-16] (Nitro PDF Software)
S4 NitroUpdateService; C:\Program Files\Nitro\Pro 9\Nitro_UpdateService.exe [417800 2014-07-16] ()
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [66048 2014-04-28] (Hewlett-Packard) [Datei ist nicht signiert]
R2 StarMoney 10 OnlineUpdate; C:\Program Files (x86)\StarMoney 10\ouservice\StarMoneyOnlineUpdate.exe [701760 2016-11-25] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
S4 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5702416 2015-09-11] (TeamViewer GmbH)
S4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2014-05-16] (Microsoft Corporation)
S3 BsHelpCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [X]
S2 GoToAssist Remote Support Customer; "C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\1092\g2ax_service.exe" "Start=service" [X]
S2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [X]
S2 KMS-R@1n; C:\Windows\KMS-R@1n.exe [X]

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 3wareDrv; C:\Windows\system32\drivers\3wareDrv.sys [125224 2014-05-16] (LSI)
R0 ACPIEXT; C:\Windows\System32\DRIVERS\ext_acpi.sys [20568 2014-04-11] (Mitac)
S3 AMDCIR64; C:\Windows\system32\drivers\AMDCIR64.sys [79488 2014-05-16] (Advanced Micro Devices)
S3 amdide64; C:\Windows\system32\drivers\amdide64.sys [11944 2014-05-16] (Advanced Micro Devices Inc.)
R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36096 2014-05-16] (Advanced Micro Devices, Inc.)
S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31920 2014-04-09] (Wondershare)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [167704 2016-12-15] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [139272 2016-12-15] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-08-08] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-10] (Avira Operations GmbH & Co. KG)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77408 2017-01-09] ()
S3 FUJ02E3; C:\Windows\system32\drivers\FUJ02E3.sys [7296 2014-05-16] (FUJITSU LIMITED)
R3 gzflt; C:\Program Files\ITbrain\AntiMalware\gzflt.sys [155912 2016-11-30] (BitDefender LLC)
S3 IAMTVE; C:\Windows\system32\drivers\IAMTVE.sys [43416 2014-05-16] (Intel Corporation)
S3 IAMTXPE; C:\Windows\system32\drivers\IAMTXPE.sys [51096 2014-05-16] (Intel Corporation)
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [28008 2014-05-16] (Intel Corporation)
S3 IFCoEMP; C:\Windows\system32\drivers\ifM60x64.sys [473968 2014-05-16] (Intel(R) Corporation)
S3 IFCoES; C:\Windows\system32\drivers\IFP60X64.sys [163696 2014-05-16] (Intel(R) Corporation)
S3 IFCoEVB; C:\Windows\system32\drivers\ifP60X64.sys [163696 2014-05-16] (Intel(R) Corporation)
S3 iSSetup; C:\Windows\system32\drivers\iSSetup.sys [219968 2014-05-16] (Intel Corporation)
S3 KOBCCID; C:\Windows\System32\drivers\KOBCCID.sys [116864 2015-09-30] (KOBIL Systems GmbH)
R0 MB3SwissArmy; C:\Windows\System32\drivers\MB3SwissArmy.sys [228800 2016-12-30] (Malwarebytes)
R2 MBAMChameleon; C:\Windows\system32\drivers\MBAMChameleon.sys [176064 2017-01-03] (Malwarebytes)
R3 MBAMFarflt; C:\Windows\system32\drivers\farflt.sys [102856 2017-01-09] (Malwarebytes)
R3 MBAMProtection; C:\Windows\system32\drivers\mbam.sys [43968 2017-01-09] (Malwarebytes)
R0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [250816 2017-01-09] (Malwarebytes)
R3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [81696 2017-01-09] (Malwarebytes)
S3 megasas2; C:\Windows\system32\drivers\megasas2.sys [52464 2014-05-16] (LSI Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [118272 2014-05-16] (Intel Corporation)
S3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2014-05-16] ()
R3 netr28x; C:\Windows\System32\DRIVERS\netr28x.sys [2473616 2014-12-10] (MediaTek Inc.)
S3 O2MDRDR; C:\Windows\system32\drivers\o2mdx64.sys [63264 2014-05-16] (O2Micro )
S3 rccfg; C:\Windows\system32\drivers\rccfg.sys [21680 2014-05-16] (AMD, Inc.)
S3 rcraid; C:\Windows\system32\drivers\rcraid.sys [533680 2014-05-16] (AMD, Inc.)
R3 rtbth; C:\Windows\System32\DRIVERS\rtbth.sys [685152 2012-06-13] (Ralink Technology, Corp.)
R0 rtcrfilt64; C:\Windows\System32\DRIVERS\rtcrfilt64.sys [19600 2014-04-11] (Realtek Semiconductor Corp.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2015-12-18] (Duplex Secure Ltd.)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.)
S3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [452040 2016-11-30] (BitDefender S.R.L.)
S3 usbohci; C:\Windows\system32\drivers\usbohci.sys [25600 2014-05-16] (Microsoft Corporation) [Datei ist nicht signiert]
S3 usbuhci; C:\Windows\system32\drivers\usbuhci.sys [30720 2014-05-16] (Microsoft Corporation) [Datei ist nicht signiert]
S3 BtAudioBusSrv; System32\Drivers\BtAudioBus.sys [X]
S3 BthL2caScoIfSrv; System32\Drivers\BtL2caScoIf.sys [X]
S3 btUrbFilterDrv; System32\Drivers\IvtUrbBtFlt.sys [X]
S3 dbx; system32\DRIVERS\dbx.sys [X]
S3 DIRECTIO; \??\UNC\filer.prod.xnet\lab\8_systemtest\stresspack_pc\PerformanceTest\DirectIo64.sys [X]
S3 NmPar; \SystemRoot\system32\drivers\NmPar.sys [X]
S3 nmserial; \SystemRoot\system32\drivers\nmserial.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-01-09 15:42 - 2017-01-09 15:42 - 00027289 _____ C:\Users\z1\Desktop\FRST.txt
2017-01-09 14:33 - 2017-01-09 14:48 - 00000000 ____D C:\Users\z1\Desktop\office backup
2017-01-09 14:20 - 2017-01-09 14:20 - 03988944 _____ C:\Users\z1\Downloads\adwcleaner_6.042.exe
2017-01-09 11:19 - 2017-01-09 11:19 - 00000000 ____D C:\Users\z1\AppData\Local\WhatsApp
2017-01-09 11:18 - 2017-01-09 11:19 - 101616400 _____ (WhatsApp) C:\Users\z1\Downloads\WhatsAppSetup.exe
2017-01-09 11:17 - 2017-01-09 11:17 - 01496584 _____ C:\Users\z1\Downloads\WhatsApp2732Setup - CHIP-Installer.exe
2017-01-09 09:12 - 2017-01-09 09:12 - 00811234 _____ C:\Users\z1\Desktop\Ereignisse.txt
2017-01-09 09:01 - 2017-01-09 09:01 - 00024964 _____ C:\Users\z1\Desktop\itbrain.txt
2017-01-09 08:58 - 2017-01-09 08:58 - 00006030 _____ C:\Users\z1\Desktop\Malwarebytes23.1..txt
2017-01-09 08:57 - 2017-01-09 08:57 - 00232103 _____ C:\Users\z1\Desktop\Malwarebytes3.1..txt
2017-01-09 08:53 - 2017-01-09 15:42 - 00000000 ____D C:\FRST
2017-01-09 08:48 - 2017-01-09 08:48 - 02419200 _____ (Farbar) C:\Users\z1\Desktop\FRST64.exe
2017-01-07 13:58 - 2017-01-09 15:03 - 00000000 ____D C:\Users\z1\AppData\LocalLow\Mozilla
2017-01-05 10:45 - 2017-01-07 13:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-01-03 12:49 - 2017-01-09 15:01 - 00081696 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2017-01-03 12:49 - 2017-01-09 15:00 - 00043968 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-01-03 12:49 - 2017-01-03 12:49 - 00176064 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys
2017-01-03 12:28 - 2017-01-03 12:38 - 00000000 ____D C:\Users\z1\Doctor Web
2017-01-03 12:24 - 2017-01-03 12:24 - 00000000 ____D C:\Users\z1\Desktop\Alte Firefox-Daten
2017-01-02 18:34 - 2017-01-09 12:54 - 00077408 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-01-02 18:34 - 2017-01-02 23:45 - 00001867 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2016-12-30 16:34 - 2017-01-09 14:59 - 03093887 ____H C:\Users\z1\AppData\Local\IconCache.db
2016-12-28 12:25 - 2016-12-28 12:25 - 00001123 _____ C:\Users\Public\Desktop\Z1-Datensicherung.lnk
2016-12-23 10:30 - 2016-12-23 10:30 - 00001909 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2016-12-23 10:30 - 2016-12-23 10:30 - 00000000 ____D C:\Program Files\HitmanPro
2016-12-23 09:40 - 2016-12-23 09:40 - 00000000 ____D C:\Program Files\ITbrain
2016-12-23 09:40 - 2016-11-30 13:41 - 00452040 _____ (BitDefender S.R.L.) C:\Windows\system32\Drivers\Trufos.sys
2016-12-23 09:39 - 2016-12-23 09:39 - 00000000 ____D C:\Users\z1\AppData\Local\TeamViewer
2016-12-22 10:26 - 2016-12-22 10:26 - 00137713 _____ C:\Users\z1\Desktop\Angebot #989.pdf
2016-12-22 05:01 - 2016-12-22 05:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2016-12-21 19:15 - 2016-12-21 19:15 - 00075888 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-stable.sys
2016-12-21 19:15 - 2016-12-21 19:15 - 00075888 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-dev.sys
2016-12-21 19:15 - 2016-12-21 19:15 - 00075888 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-canary.sys
2016-12-21 19:15 - 2016-12-21 19:15 - 00042096 _____ (Dropbox, Inc.) C:\Windows\system32\DbxSvc.exe
2016-12-20 08:47 - 2016-12-20 08:47 - 00002003 _____ C:\Users\Public\Desktop\Bestellkompass.lnk
2016-12-20 07:56 - 2017-01-03 12:08 - 00001962 _____ C:\Users\Public\Desktop\CGM ORGANIZER (z1server).lnk
2016-12-19 10:55 - 2016-12-19 10:55 - 00001254 _____ C:\Users\z1\Desktop\Z1-Fernwartung.lnk
2016-12-19 10:52 - 2013-07-05 03:53 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdbss.sys
2016-12-19 10:14 - 2016-12-19 10:14 - 00018280 _____ C:\Windows\system32\results.xml
2016-12-19 09:46 - 2016-12-19 09:46 - 00399976 _____ (Intel Corporation) C:\Windows\system32\CustomModeApp.exe
2016-12-19 09:24 - 2016-12-19 09:24 - 00000000 ____D C:\Windows\pss
2016-12-19 07:52 - 2016-12-19 08:57 - 00000000 ___HD C:\Users\Public\Documents\AdobeGC
2016-12-15 10:20 - 2016-12-15 10:20 - 00000000 ____D C:\Users\z1\Desktop\DVT Gerl, Rita
2016-12-14 13:43 - 2016-12-14 13:43 - 00055423 _____ C:\Users\z1\Documents\mayer.,therese.pdf
2016-12-13 23:18 - 2016-11-21 19:16 - 00154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-12-13 23:18 - 2016-11-21 19:16 - 00095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-12-13 23:18 - 2016-11-21 19:12 - 01462272 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00730624 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\hlink.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-12-13 23:18 - 2016-11-20 17:20 - 00666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2016-12-13 23:18 - 2016-11-20 17:20 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2016-12-13 23:18 - 2016-11-20 17:20 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2016-12-13 23:18 - 2016-11-20 17:20 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2016-12-13 23:18 - 2016-11-20 17:20 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hlink.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2016-12-13 23:18 - 2016-11-20 17:04 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2016-12-13 23:18 - 2016-11-20 16:58 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-12-13 23:18 - 2016-11-20 16:57 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-12-13 23:18 - 2016-11-20 16:57 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-12-13 23:18 - 2016-11-20 16:57 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2016-12-13 23:18 - 2016-11-20 16:57 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-12-13 23:18 - 2016-11-20 16:52 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2016-12-13 23:18 - 2016-11-20 15:07 - 00467392 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2016-12-13 23:18 - 2016-11-17 17:41 - 00370920 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2016-12-13 23:18 - 2016-11-15 00:27 - 00394448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-12-13 23:18 - 2016-11-14 23:39 - 00346320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-12-13 23:18 - 2016-11-12 20:48 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-12-13 23:18 - 2016-11-12 20:48 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2016-12-13 23:18 - 2016-11-12 20:28 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-12-13 23:18 - 2016-11-12 20:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-12-13 23:18 - 2016-11-12 20:26 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2016-12-13 23:18 - 2016-11-12 20:25 - 00576000 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-12-13 23:18 - 2016-11-12 20:25 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2016-12-13 23:18 - 2016-11-12 20:21 - 02896384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-12-13 23:18 - 2016-11-12 20:15 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-12-13 23:18 - 2016-11-12 20:14 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-12-13 23:18 - 2016-11-12 20:09 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-12-13 23:18 - 2016-11-12 20:08 - 25759744 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-12-13 23:18 - 2016-11-12 20:08 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-12-13 23:18 - 2016-11-12 20:08 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2016-12-13 23:18 - 2016-11-12 20:07 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-12-13 23:18 - 2016-11-12 20:07 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2016-12-13 23:18 - 2016-11-12 19:56 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2016-12-13 23:18 - 2016-11-12 19:53 - 06049280 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-12-13 23:18 - 2016-11-12 19:52 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-12-13 23:18 - 2016-11-12 19:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2016-12-13 23:18 - 2016-11-12 19:41 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-12-13 23:18 - 2016-11-12 19:40 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2016-12-13 23:18 - 2016-11-12 19:35 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2016-12-13 23:18 - 2016-11-12 19:34 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-12-13 23:18 - 2016-11-12 19:31 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-12-13 23:18 - 2016-11-12 19:30 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2016-12-13 23:18 - 2016-11-12 19:29 - 00498688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-12-13 23:18 - 2016-11-12 19:29 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2016-12-13 23:18 - 2016-11-12 19:29 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2016-12-13 23:18 - 2016-11-12 19:28 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2016-12-13 23:18 - 2016-11-12 19:27 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2016-12-13 23:18 - 2016-11-12 19:20 - 02287616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-12-13 23:18 - 2016-11-12 19:20 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2016-12-13 23:18 - 2016-11-12 19:19 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2016-12-13 23:18 - 2016-11-12 19:17 - 20302848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-12-13 23:18 - 2016-11-12 19:15 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2016-12-13 23:18 - 2016-11-12 19:14 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-12-13 23:18 - 2016-11-12 19:14 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2016-12-13 23:18 - 2016-11-12 19:14 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-12-13 23:18 - 2016-11-12 19:14 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2016-12-13 23:18 - 2016-11-12 19:11 - 00725504 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-12-13 23:18 - 2016-11-12 19:10 - 00806912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-12-13 23:18 - 2016-11-12 19:08 - 02131456 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-12-13 23:18 - 2016-11-12 19:08 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2016-12-13 23:18 - 2016-11-12 19:03 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2016-12-13 23:18 - 2016-11-12 18:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2016-12-13 23:18 - 2016-11-12 18:56 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2016-12-13 23:18 - 2016-11-12 18:52 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2016-12-13 23:18 - 2016-11-12 18:51 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2016-12-13 23:18 - 2016-11-12 18:49 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2016-12-13 23:18 - 2016-11-12 18:47 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2016-12-13 23:18 - 2016-11-12 18:41 - 15257088 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-12-13 23:18 - 2016-11-12 18:40 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2016-12-13 23:18 - 2016-11-12 18:38 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-12-13 23:18 - 2016-11-12 18:37 - 04608000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-12-13 23:18 - 2016-11-12 18:36 - 02055680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-12-13 23:18 - 2016-11-12 18:36 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2016-12-13 23:18 - 2016-11-12 18:35 - 02920960 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-12-13 23:18 - 2016-11-12 18:21 - 13653504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-12-13 23:18 - 2016-11-12 18:20 - 01543680 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-12-13 23:18 - 2016-11-12 18:11 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-12-13 23:18 - 2016-11-12 18:05 - 02444800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-12-13 23:18 - 2016-11-12 18:02 - 01312256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-12-13 23:18 - 2016-11-12 18:02 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-12-13 23:18 - 2016-11-10 17:32 - 01009152 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2016-12-13 23:18 - 2016-11-10 17:19 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2016-12-13 23:18 - 2016-11-09 17:41 - 00114408 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2016-12-13 23:18 - 2016-11-09 17:33 - 03244032 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2016-12-13 23:18 - 2016-11-09 17:33 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2016-12-13 23:18 - 2016-11-09 17:33 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2016-12-13 23:18 - 2016-11-09 17:33 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2016-12-13 23:18 - 2016-11-09 17:33 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2016-12-13 23:18 - 2016-11-09 17:33 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2016-12-13 23:18 - 2016-11-09 17:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2016-12-13 23:18 - 2016-11-09 17:17 - 01806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2016-12-13 23:18 - 2016-11-09 17:17 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2016-12-13 23:18 - 2016-11-09 17:17 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2016-12-13 23:18 - 2016-11-09 17:17 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2016-12-13 23:18 - 2016-11-09 17:02 - 00128512 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2016-12-13 23:18 - 2016-11-09 16:55 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2016-12-13 23:18 - 2016-11-06 17:33 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-12-13 23:18 - 2016-11-06 17:16 - 00312832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2016-12-13 23:18 - 2016-11-06 17:01 - 03219456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-12-13 23:18 - 2016-10-27 16:33 - 00802304 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2016-12-13 23:18 - 2016-10-27 16:20 - 00627712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2016-12-13 23:18 - 2016-10-11 16:40 - 00631176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2016-12-13 23:18 - 2016-10-11 16:37 - 05547752 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-12-13 23:18 - 2016-10-11 16:37 - 00706792 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2016-12-13 23:18 - 2016-10-11 16:34 - 01732864 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-12-13 23:18 - 2016-10-11 16:32 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2016-12-13 23:18 - 2016-10-11 16:32 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2016-12-13 23:18 - 2016-10-11 16:32 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2016-12-13 23:18 - 2016-10-11 16:32 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2016-12-13 23:18 - 2016-10-11 16:32 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\nlsbres.dll
2016-12-13 23:18 - 2016-10-11 16:32 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2016-12-13 23:18 - 2016-10-11 16:32 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2016-12-13 23:18 - 2016-10-11 16:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2016-12-13 23:18 - 2016-10-11 16:32 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:24 - 04000488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2016-12-13 23:18 - 2016-10-11 16:24 - 03944680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2016-12-13 23:18 - 2016-10-11 16:21 - 01314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlsbres.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:03 - 00148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2016-12-13 23:18 - 2016-10-11 16:03 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2016-12-13 23:18 - 2016-10-11 16:03 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2016-12-13 23:18 - 2016-10-11 15:59 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2016-12-13 23:18 - 2016-10-11 15:59 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2016-12-13 23:18 - 2016-10-11 15:55 - 00346112 _____ (Microsoft Corporation) C:\Windows\system32\bcdedit.exe
2016-12-13 23:18 - 2016-10-11 15:55 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2016-12-13 23:18 - 2016-10-11 15:51 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2016-12-13 23:18 - 2016-10-11 15:51 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2016-12-13 23:18 - 2016-10-11 15:51 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2016-12-13 23:18 - 2016-10-11 15:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2016-12-13 23:18 - 2016-10-11 15:50 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 15:50 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 15:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 15:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 14:18 - 00419648 _____ C:\Windows\SysWOW64\locale.nls
2016-12-13 23:18 - 2016-10-11 14:17 - 00419648 _____ C:\Windows\system32\locale.nls
2016-12-13 23:18 - 2016-10-08 14:06 - 00633296 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2016-12-13 23:18 - 2016-10-04 16:31 - 01483264 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2016-12-13 23:18 - 2016-10-04 16:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2016-12-13 23:18 - 2016-10-04 16:31 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2016-12-13 23:18 - 2016-10-04 16:31 - 00141824 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2016-12-13 23:18 - 2016-10-04 16:13 - 01176064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2016-12-13 23:18 - 2016-10-04 16:13 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2016-12-13 23:18 - 2016-10-04 16:13 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2016-12-13 23:18 - 2016-10-04 16:13 - 00106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2016-12-12 10:50 - 2016-12-12 10:50 - 00282319 _____ C:\Users\z1\Documents\IMG_20161212_0002.pdf
2016-12-12 10:14 - 2016-12-12 10:14 - 00274226 _____ C:\Users\z1\Documents\IMG_20161212_0001.pdf

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-01-09 15:41 - 2015-09-16 08:20 - 00001206 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
2017-01-09 15:08 - 2009-07-14 05:45 - 00030192 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-01-09 15:08 - 2009-07-14 05:45 - 00030192 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-01-09 15:05 - 2014-05-16 14:52 - 00704858 _____ C:\Windows\system32\perfh007.dat
2017-01-09 15:05 - 2014-05-16 14:52 - 00151258 _____ C:\Windows\system32\perfc007.dat
2017-01-09 15:05 - 2009-07-14 06:13 - 01629436 _____ C:\Windows\system32\PerfStringBackup.INI
2017-01-09 15:05 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2017-01-09 15:02 - 2014-11-03 18:04 - 00114240 _____ C:\Windows\SysWOW64\GDIPFONTCACHEV1.DAT
2017-01-09 15:01 - 2015-01-13 18:16 - 00000000 ____D C:\Users\z1\AppData\Roaming\Nitro PDF
2017-01-09 15:00 - 2016-11-21 08:14 - 00250816 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-01-09 15:00 - 2016-11-21 08:14 - 00102856 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2017-01-09 15:00 - 2015-09-16 08:32 - 00000000 ___RD C:\Users\z1\Dropbox
2017-01-09 15:00 - 2015-09-16 08:20 - 00001202 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
2017-01-09 15:00 - 2014-11-03 18:06 - 00114240 _____ C:\Windows\system32\GDIPFONTCACHEV1.DAT
2017-01-09 15:00 - 2014-08-07 10:53 - 00000000 __SHD C:\Users\z1\IntelGraphicsProfiles
2017-01-09 15:00 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-01-09 15:00 - 2009-07-14 05:45 - 00446984 _____ C:\Windows\system32\FNTCACHE.DAT
2017-01-09 14:59 - 2015-10-29 08:02 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2017-01-09 14:59 - 2014-12-01 14:30 - 00000000 ____D C:\Users\z1\AppData\Roaming\KeePass
2017-01-09 14:58 - 2015-10-29 11:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2017-01-09 14:58 - 2010-11-21 08:17 - 00000000 ____D C:\Windows\ShellNew
2017-01-09 14:58 - 2009-07-14 03:34 - 00000387 _____ C:\Windows\win.ini
2017-01-09 14:57 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2017-01-09 14:48 - 2016-05-14 10:52 - 00000000 ____D C:\Users\z1\AppData\Roaming\WhatsApp
2017-01-09 14:48 - 2015-02-24 16:41 - 00000000 ____D C:\Users\z1\Documents\Outlook-Dateien
2017-01-09 14:44 - 2014-08-12 15:51 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2017-01-09 14:26 - 2016-07-26 08:54 - 00000000 ____D C:\Users\z1\AppData\Local\5838A438-B957-4AA2-BCE9-678C09561139.aplzod
2017-01-09 14:22 - 2014-10-07 13:36 - 00000000 ____D C:\AdwCleaner
2017-01-09 13:49 - 2014-11-17 15:53 - 00000000 ____D C:\ProgramData\TEMP
2017-01-09 11:19 - 2016-05-14 10:52 - 00002153 _____ C:\Users\z1\Desktop\WhatsApp.lnk
2017-01-09 11:19 - 2016-05-14 10:52 - 00000000 ____D C:\Users\z1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WhatsApp
2017-01-09 11:19 - 2016-05-14 10:52 - 00000000 ____D C:\Users\z1\AppData\Local\SquirrelTemp
2017-01-09 10:51 - 2014-08-11 07:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-01-09 10:50 - 2014-08-06 15:16 - 00000000 ___HD C:\Users\z1
2017-01-09 08:59 - 2015-07-22 11:24 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2017-01-09 08:35 - 2014-11-04 17:50 - 00000000 ____D C:\Users\z1\Documents\Backups
2017-01-05 18:27 - 2015-05-12 09:51 - 00000000 ____D C:\Program Files (x86)\StarMoney 10
2017-01-03 12:53 - 2014-08-18 13:07 - 00000000 ____D C:\Users\z1\AppData\Local\JDownloader v2.0
2017-01-03 12:08 - 2016-09-08 13:21 - 00001337 _____ C:\Users\z1\Desktop\GoToAssist Customer.lnk
2017-01-03 12:08 - 2016-04-25 10:38 - 00001956 _____ C:\Users\Public\Desktop\Dashboard CGM ORGANIZER (z1server).lnk
2017-01-03 12:08 - 2016-04-05 07:32 - 00003306 _____ C:\Users\Public\Desktop\DATEV Unternehmen online.lnk
2017-01-03 12:08 - 2009-07-14 06:01 - 00001218 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
2017-01-03 12:08 - 2009-07-14 05:57 - 00001523 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2017-01-03 12:08 - 2009-07-14 05:57 - 00001292 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
2017-01-03 12:08 - 2009-07-14 05:49 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
2017-01-02 23:45 - 2016-11-21 08:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-01-02 18:34 - 2016-11-21 08:13 - 00000000 ____D C:\Program Files\Malwarebytes
2016-12-30 16:35 - 2016-11-21 08:15 - 00228800 _____ (Malwarebytes) C:\Windows\system32\Drivers\MB3SwissArmy.sys
2016-12-29 13:21 - 2014-08-06 15:16 - 00000000 ___RD C:\Users\z1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
2016-12-28 12:25 - 2015-07-01 12:21 - 00003016 _____ C:\Windows\System32\Tasks\Z1ClientUpdate
2016-12-28 12:25 - 2014-08-08 11:40 - 00001201 _____ C:\Users\Public\Desktop\Z1.lnk
2016-12-28 12:24 - 2014-08-08 11:39 - 00000508 _____ C:\Windows\pbl.ini
2016-12-23 19:56 - 2014-08-06 15:16 - 00000000 ____D C:\Users\z1\AppData\Roaming
2016-12-23 12:21 - 2016-03-02 10:09 - 00016728 _____ C:\Users\z1\Desktop\Rechnungen an EOS.xlsx
2016-12-23 10:55 - 2016-10-12 08:47 - 00000000 ____D C:\Program Files (x86)\Movavi Video Converter 15
2016-12-23 10:30 - 2016-01-20 11:07 - 00000000 ____D C:\ProgramData\HitmanPro
2016-12-23 10:14 - 2015-07-22 11:24 - 00000931 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2016-12-22 11:08 - 2014-08-18 13:03 - 00000000 ____D C:\Users\z1\AppData\Local\CrashDumps
2016-12-22 10:16 - 2016-07-04 10:04 - 00007616 _____ C:\Users\z1\Desktop\Kosten Polo 2016.lnk
2016-12-22 10:16 - 2016-02-02 18:11 - 00014923 _____ C:\Users\z1\Desktop\OP-Protokoll Implantation - Verknüpfung.lnk
2016-12-22 10:16 - 2016-02-02 15:50 - 00002765 _____ C:\Users\z1\Desktop\Temp - Übertragung.lnk
2016-12-22 10:16 - 2016-01-21 09:15 - 00002866 _____ C:\Users\z1\Desktop\Shootcamp - Verknüpfung.lnk
2016-12-22 10:16 - 2016-01-20 13:14 - 00004736 _____ C:\Users\z1\Desktop\Teambesprechung - Verknüpfung.lnk
2016-12-22 10:16 - 2015-12-21 16:40 - 00002292 _____ C:\Users\z1\Desktop\Eigene Videos - Verknüpfung.lnk
2016-12-22 10:16 - 2015-11-26 15:49 - 00004140 _____ C:\Users\z1\Desktop\Polo Club.lnk
2016-12-22 10:16 - 2015-06-02 07:14 - 00004521 _____ C:\Users\z1\Desktop\Gerätebuch - Verknüpfung.lnk
2016-12-22 10:16 - 2015-04-21 12:11 - 00001498 _____ C:\Users\Public\Desktop\CGM PRAXISTIMER.lnk
2016-12-22 10:16 - 2015-02-03 17:40 - 00002832 _____ C:\Users\z1\Desktop\Praxis.lnk
2016-12-22 10:16 - 2014-10-06 13:09 - 00002832 _____ C:\Users\z1\Desktop\Privat.lnk
2016-12-22 05:01 - 2015-09-16 08:20 - 00000000 ____D C:\Program Files (x86)\Dropbox
2016-12-20 12:06 - 2015-03-03 10:09 - 00001096 _____ C:\Users\Public\Desktop\TA.lnk
2016-12-20 08:47 - 2015-01-20 16:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AERA
2016-12-20 08:47 - 2015-01-20 16:05 - 00000000 ____D C:\Program Files (x86)\AERA
2016-12-19 11:13 - 2009-07-14 06:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-12-19 10:03 - 2014-08-19 07:14 - 01831844 _____ C:\Windows\ntbtlog.txt
2016-12-19 09:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\catroot
2016-12-19 09:47 - 2009-07-14 05:54 - 00000404 ___SH C:\Users\Public\Desktop\desktop.ini
2016-12-19 09:47 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\DriverStore
2016-12-19 09:46 - 2014-06-24 19:42 - 00000000 ____D C:\Intel
2016-12-19 09:42 - 2014-08-06 18:29 - 00000000 ____D C:\Windows\Minidump
2016-12-19 09:24 - 2014-08-06 15:16 - 00000000 ___RD C:\Users\z1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2016-12-19 09:24 - 2009-07-14 04:20 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2016-12-19 09:00 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\catroot2
2016-12-19 08:57 - 2014-11-28 11:37 - 00000000 ___RD C:\Users\z1\iCloudDrive
2016-12-19 08:29 - 2016-09-07 10:02 - 00524288 ___SH C:\Windows\system32\config\components{b2086b64-74d9-11e6-b253-dc85deaa056a}.TMContainer00000000000000000001.regtrans-ms
2016-12-19 07:52 - 2014-08-13 10:35 - 00000000 ____D C:\Users\z1\AppData\Local\Adobe
2016-12-15 13:59 - 2014-08-08 13:37 - 00167704 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2016-12-15 13:59 - 2014-08-08 13:37 - 00139272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2016-12-14 13:58 - 2014-08-08 12:34 - 00002242 ____H C:\Users\z1\Documents\Default.rdp
2016-12-14 13:44 - 2014-08-06 15:16 - 00000000 ___RD C:\Users\z1\Documents
2016-12-14 11:45 - 2014-08-12 15:51 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-12-14 11:44 - 2014-08-12 15:51 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-12-14 11:44 - 2014-08-12 15:51 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-12-14 11:44 - 2014-08-12 15:51 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2016-12-14 11:44 - 2014-08-12 15:51 - 00000000 ____D C:\Windows\system32\Macromed
2016-12-14 10:49 - 2015-03-10 17:18 - 00000000 ____D C:\Users\z1\temp
2016-12-14 03:59 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2016-12-14 03:30 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Microsoft.NET
2016-12-14 03:22 - 2009-07-14 03:34 - 00189440 ____H C:\Users\Default\NTUSER.DAT.LOG1
2016-12-14 03:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\en-US
2016-12-14 03:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\de-DE
2016-12-14 03:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\en-US
2016-12-14 03:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\de-DE
2016-12-14 03:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\Boot
2016-12-14 03:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\AppPatch
2016-12-14 03:21 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Internet Explorer
2016-12-14 03:21 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files (x86)\Internet Explorer
2016-12-14 03:05 - 2014-08-06 15:50 - 00000000 ____D C:\Windows\system32\MRT
2016-12-14 03:03 - 2014-08-06 15:50 - 135632432 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-12-14 03:02 - 2014-05-16 15:21 - 01606524 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2016-12-13 15:49 - 2015-03-18 09:50 - 00000000 ____D C:\SYNADOC-CD
2016-12-13 15:47 - 2016-04-06 07:17 - 00001455 _____ C:\Users\z1\Desktop\Synadoc-CD auf Laufwerk Z.lnk
2016-12-12 09:12 - 2014-08-08 12:36 - 00000000 ____D C:\ProgramData\TW

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2015-02-27 10:12 - 2015-02-27 10:12 - 0038475 _____ () C:\Users\z1\AppData\Roaming\Kommagetrennte Werte (DOS).ADR
2015-02-27 10:46 - 2015-02-27 10:46 - 0038465 _____ () C:\Users\z1\AppData\Roaming\Microsoft Excel 97-2003.ADR
2015-02-27 11:20 - 2015-02-27 11:23 - 0038478 _____ () C:\Users\z1\AppData\Roaming\Tabulatorgetrennte Werte (DOS).ADR
2015-02-27 11:07 - 2015-02-27 11:07 - 0038487 _____ () C:\Users\z1\AppData\Roaming\Tabulatorgetrennte Werte (Windows).ADR
2014-11-21 10:21 - 2014-11-21 10:21 - 0111752 _____ () C:\Users\z1\AppData\Local\ars.cache
2015-11-02 11:10 - 2015-11-02 11:10 - 0000423 _____ () C:\Users\z1\AppData\Local\belegtransfer_setup.log
2014-11-21 10:21 - 2014-11-21 10:21 - 0242928 _____ () C:\Users\z1\AppData\Local\census.cache
2014-11-21 09:45 - 2014-11-21 09:45 - 0000036 _____ () C:\Users\z1\AppData\Local\housecall.guid.cache
2015-04-10 08:17 - 2015-04-10 08:17 - 0000017 _____ () C:\Users\z1\AppData\Local\resmon.resmoncfg
2014-06-24 19:43 - 2014-06-24 19:43 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2016-10-12 08:40 - 2016-10-12 08:40 - 0000016 _____ () C:\ProgramData\mntemp
2016-10-12 08:40 - 2016-10-12 08:40 - 0005106 _____ () C:\ProgramData\mudtcpaz.vzs

Einige Dateien in TEMP:
====================
C:\Users\z1\AppData\Local\Temp\avgnt.exe
C:\Users\z1\AppData\Local\Temp\jna2026503319534643980.dll
C:\Users\z1\AppData\Local\Temp\jna2572421679924466072.dll
C:\Users\z1\AppData\Local\Temp\jna7609583068531516420.dll
C:\Users\z1\AppData\Local\Temp\sqlite-3.7.2-sqlitejdbc.dll


==================== Bamital & volsnap ======================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert

LastRegBack: 2017-01-03 00:08

==================== Ende von FRST.txt ============================
         

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 08-01-2017
durchgeführt von z1 (09-01-2017 15:42:20)
Gestartet von C:\Users\z1\Desktop
Windows 7 Professional Service Pack 1 (X64) (2014-08-06 14:16:13)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-4170931350-1392568851-4209714175-500 - Administrator - Disabled)
Gast (S-1-5-21-4170931350-1392568851-4209714175-501 - Limited - Enabled)
z1 (S-1-5-21-4170931350-1392568851-4209714175-1000 - Administrator - Enabled) => C:\Users\z1

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: ITbrain Anti-Malware (Enabled - Up to date) {0DF788D5-9792-056A-E90E-8A863B242341}
AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: ITbrain Anti-Malware (Enabled - Up to date) {B6966931-B1A8-0AE4-D3BE-B1F440A369FC}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

3D-Patientenberater Plus (HKLM-x32\...\3D-Patientenberater Plus) (Version:  - CompuDENT Praxiscomputer)
64 Bit HP CIO Components Installer (Version: 17.2.1 - Hewlett-Packard) Hidden
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.020.20042 - Adobe Systems Incorporated)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 3.7.0.272 - Adobe Systems Incorporated)
Adobe Flash Player 24 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 24.0.0.186 - Adobe Systems Incorporated)
Adobe Flash Player 24 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 24.0.0.186 - Adobe Systems Incorporated)
Adobe Photoshop CS2 (HKLM-x32\...\Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0407-1E257A25E34D}) (Version: 9.0 - Adobe Systems, Inc.)
Adobe Photoshop Lightroom 5 (HKLM-x32\...\{D176CB09-1505-4D2B-838A-4483D7DF23FB}) (Version: 5.0.1 - Adobe)
Adobe Photoshop Lightroom 5.7.1 64-bit (HKLM\...\{BC86B82C-8C0E-4408-9AC1-6B0F2D636963}) (Version: 5.7.1 - Adobe Systems Incorporated)
AERA Bestellkompass (HKLM-x32\...\AERA_Bestellkompass) (Version: 5.5 - AERA)
AERA plus (HKLM-x32\...\AERA_AERA plus) (Version: 1.0.9 - AERA)
Apple Application Support (32-Bit) (HKLM-x32\...\{F2871C89-C8A5-42EE-8D45-0F02506385A6}) (Version: 5.1 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{9BC93467-75D1-4AA4-BD58-D9C51D88DFAB}) (Version: 5.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{55BB2110-FB43-49B3-93F4-945A0CFB0A6C}) (Version: 10.0.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.6.3.0 - Asmedia Technology)
AudibleManager (HKLM-x32\...\AudibleManager) (Version: 1997091889.48.56.2430194 - Audible, Inc.)
Avira Professional Security (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.24.37 - Avira Operations GmbH & Co. KG)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Canon CanoScan LiDE 120 On-screen Manual (HKLM-x32\...\Canon CanoScan LiDE 120 On-screen Manual) (Version: 7.7.1 - Canon Inc.)
Canon IJ Network Scan Utility (HKLM-x32\...\Canon_IJ_Network_Scan_UTILITY) (Version:  - )
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version:  - )
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version: 1.1.11.1 - Canon Inc.)
Canon Kurzwahlprogramm (HKLM-x32\...\Speed Dial Utility) (Version:  - )
Canon MP Navigator EX 3.1 (HKLM-x32\...\MP Navigator EX 3.1) (Version:  - )
Canon MX870 series Benutzerregistrierung (HKLM-x32\...\Canon MX870 series Benutzerregistrierung) (Version:  - )
Canon MX870 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX870_series) (Version:  - )
Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.4.0 - Canon Inc.)
Canon RAW Codec (HKLM-x32\...\Canon RAW Codec) (Version: 1.8.0.68 - Canon Inc.)
Canon Utilities Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version:  - )
Canon Utilities My Printer (HKLM-x32\...\CanonMyPrinter) (Version:  - )
Canon Utilities Solution Menu (HKLM-x32\...\CanonSolutionMenu) (Version:  - )
CanoScan LiDE 120 Scanner Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ2415) (Version: 1.00 - Canon Inc.)
CGM ORGANIZER (HKLM-x32\...\{12F112BB-DFF4-41CB-B8BB-33962DC90843}) (Version: 1.11.226 - CompuGroup Medical Deutschland AG)
CGM PRAXISARCHIV (HKLM-x32\...\{4430C052-AF7C-468C-915D-222E26E2B153}) (Version: 4.12.2100.8815 - CompuGroup Medical Deutschland AG)
CGM PRAXISTIMER 4.12.1607.0 (HKLM-x32\...\PraxisTimer) (Version:  - )
CGM Z1 (HKLM-x32\...\CGM Z1) (Version: 2.56 - )
chip 1-click download service (HKLM-x32\...\{503CA94E-0834-4CEE-AD92-BA17AF4E809A}) (Version: 3.6.9.0 - Chip Digital GmbH)
Citrix Online Launcher (HKLM-x32\...\{678753E6-E526-4AE5-A144-00240772543A}) (Version: 1.0.393 - Citrix)
CodeTwo Sync for iCloud (HKLM-x32\...\{0D8DF5B9-96A7-47B3-9D9C-49F044DB603C}) (Version: 1.3.3.3 - CodeTwo)
CR Driver (remove only) (HKLM-x32\...\Driver CR) (Version: 1.3.39.0 - )
CS 3D Imaging Software (remove only) (HKLM-x32\...\3DViewer) (Version: 3.2.12.0 - )
CS FilmComposer (remove only) (HKLM-x32\...\FilmComposer) (Version: 3.2.9.0 - Carestream Health, Inc.)
CS Volume Converter (remove only) (HKLM-x32\...\VolumeConverter) (Version: 1.0.6.0 - )
DATEV Belegtransfer V.3.32 (HKLM-x32\...\{EC561A24-754E-44F1-B76F-2FDA3DF9E912}) (Version: 2.03 - DATEV eG)
DriverRVG (HKLM-x32\...\{A9273B11-2A0C-4477-926C-54D66291B8B1}) (Version:  - )
Dropbox (HKLM-x32\...\Dropbox) (Version: 16.4.30 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.59.1 - Dropbox, Inc.) Hidden
EclipseDB (HKLM-x32\...\{C3857AE9-B016-404E-9E22-7D87A00625DE}) (Version: 1.0.0.41 - Carestream)
EOS Health Transfer (2.5.0) (HKLM-x32\...\EOS Health Transfer) (Version:  - EOS Health Honorarmanagement AG)
Ez3D Plus (HKLM-x32\...\{036F4752-39E3-4B9C-AD93-2A856A867C1E}) (Version: 1.2.6.2 - E-WOO Technology Co.,LTD)
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.15.281 - SurfRight B.V.)
HL-5470DW (HKLM-x32\...\{7171B206-5C5A-4B7F-B9E1-1F1827FC769F}) (Version: 1.1.7.0 - Brother Industries, Ltd.)
HP Color LaserJet 3600 (02/27/2007 61.063.461.41) (HKLM\...\hpc3600w) (Version: 02/27/2007 61.063.461.41 - HP)
iCloud (HKLM\...\{29AAC3D3-23FC-496D-8266-0E3833686758}) (Version: 6.0.2.10 - Apple Inc.)
Intel Driver Update Utility (HKLM-x32\...\{fe92d390-13ee-4660-a2f8-39a066fdffe0}) (Version: 2.2.0.5 - Intel)
Intel(R) Driver Update Utility 2.2.0.5 (x32 Version: 2.2.0.1 - Intel) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4226 - Intel Corporation)
ITbrain Anti-Malware (HKLM\...\ITbrain Anti-Malware) (Version: 1.0.71681  - TeamViewer)
iTunes (HKLM\...\{2C49F336-2E86-4407-83E2-16AC65598EF4}) (Version: 12.5.3.16 - Apple Inc.)
Java 8 Update 101 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180101F0}) (Version: 8.0.1010.13 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
KOBIL CCID driver x64x86 (x32 Version: 1.013.02121 - KOBIL Systems) Hidden
Kodak Dental Imaging Software Installation (HKLM-x32\...\InstallShield_{03F102FB-18C9-4B2A-B464-55FFD9AB2C2B}) (Version: 6.12.32.0-C - Kodak-Trophy)
Kodak Dental Imaging Software Installation (x32 Version: 6.12.32.0-C - Kodak-Trophy) Hidden
Kodak Dental Software (x32 Version: 6.12.32.0-C - Kodak) Hidden
Kodak Patient File (x32 Version: 6.12.32.0-C - Kodak) Hidden
Leitfaden Praxisbegehung 1.0 (HKLM-x32\...\{34951065-2C8A-42B4-B75A-F110679A48AD}) (Version: 3.22 - Spitta Verlag GmbH & Co. KG)
Malwarebytes Version 3.0.5.1299 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.0.5.1299 - Malwarebytes)
mediserv Abrechnungsmodul 4.8.6 (Build 1056) (HKLM-x32\...\mediserv Abrechnungsmodul) (Version:  - mediserv GmbH)
Microsoft .NET Framework 4.6.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft Camera Codec Pack (HKLM\...\{F7930EE9-0929-439D-A57B-D40C2C69C890}) (Version: 6.3.9723.0 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\OneDriveSetup.exe) (Version: 17.3.5951.0827 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Facebook 32-bit (HKLM-x32\...\{95140000-007C-0409-0000-0000000FF1CE}) (Version: 14.0.6114.5003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Native Client (HKLM\...\{CB95CD7D-FDCC-449A-86AE-67C257745A0B}) (Version: 10.50.1600.1 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client  (HKLM\...\{93945D16-4C3D-433E-B7E4-3D0D86B284C8}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{D285FC5F-3021-32E9-9C59-24CA325BDC5C}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23918 (HKLM-x32\...\{dab68466-3a7d-41a8-a5cf-415e3ff8ef71}) (Version: 14.0.23918.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23918 (HKLM-x32\...\{2e085fd2-a3e4-4b39-8e10-6b8d35f55244}) (Version: 14.0.23918.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Movavi Video Converter 15 (HKLM-x32\...\Movavi Video Converter 15) (Version: 15.2.1 - Movavi)
Mozilla Firefox 50.1.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 50.1.0 (x86 de)) (Version: 50.1.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 50.1.0.6186 - Mozilla)
Mozilla Thunderbird 38.2.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 38.2.0 (x86 de)) (Version: 38.2.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML4.0 component (x32 Version: 1.0.0.0 - Trophy) Hidden
Nitro Pro 9 (HKLM\...\{4A53F617-750C-4322-86FC-02F467B0CA70}) (Version: 9.5.2.29 - Nitro)
Office 16 Click-to-Run Extensibility Component (Version: 16.0.6001.1034 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.6001.1034 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (Version: 16.0.6001.1034 - Microsoft Corporation) Hidden
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
pcvisit Support 15.0 (HKLM-x32\...\pcvisit Support 15.0) (Version: 15.0.11.872 - pcvisit Software AG)
PopScan ReadScanner (HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\PopScan Scanner Reader) (Version: 0.2.4.2 - Sensational AG)
PraxisArchiv (HKLM-x32\...\{8C9F0911-4E29-4C35-BB7F-E5F263E96DCA}) (Version: 4.8.5800.6095 - CompuGroup Medical Deutschland AG)
PrintKey2000 (HKLM-x32\...\PrintKey2000) (Version:  - )
PrograBase X10 (HKLM-x32\...\{ADC71A09-D373-47B9-84A5-C0B6563A1E76}) (Version: 2.10.0 - Ivoclar Vivadent)
Ralink RT2860 Wireless LAN Card (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309B0}) (Version: 1.2.0.40 - Ralink)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.97.1001.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7179 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.2.8400.39032 - Realtek Semiconductor Corp.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version:  - Microsoft)
Sicherheitspaket compact (HKLM-x32\...\{394a49d9-02fa-4439-9433-ce2f135972f3}) (Version: 3.2.100.16077 - DATEV eG)
Sicherheitspaket compact (x32 Version: 3.2.100.16077 - DATEV eG) Hidden
Skype™ 7.3 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.3.101 - Skype Technologies S.A.)
SmartTools Publishing • Word Falz & Lochmarken-Assistent (HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\SmartToolsWordFalz & Lochmarken-Assistent) (Version: 8.00 - SmartTools Publishing)
Spitta Abrechnungsportal Schnittstelle (HKLM-x32\...\spittaaportzm) (Version:  - )
Spitta-Aufklärungssystem (HKLM-x32\...\{402F6E21-EEC4-4D45-8FB5-4A6AF6998744}) (Version: 3.1 - Spitta Verlag GmbH & Co. KG)
StarMoney (x32 Version: 4.0.4.16 - StarFinanz) Hidden
StarMoney (x32 Version: 4.0.6.107 - StarFinanz) Hidden
StarMoney (x32 Version: 5.0.0.226 - StarFinanz) Hidden
StarMoney 10  (HKLM-x32\...\{8A9B4DDC-91F1-4670-B301-8B6C2B4D2FA6}) (Version: 10 - Star Finanz GmbH)
StarMoney 9.0  (HKLM-x32\...\{4D7B9450-BA40-4856-8932-F6765A1AFF5C}) (Version: 9.0 - Star Finanz GmbH)
StarMoney 9.0  (HKLM-x32\...\{548C3C0B-CAF5-4088-A8EB-39D7A1BB95E3}) (Version: 9.0 - Star Finanz GmbH)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.47484 - TeamViewer)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
Volksverschlüsselungs-Software v1.08-0 (HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\{75D939AB-C78E-4EA3-99E6-404FB33D1E2D}) (Version: v1.08-0 - Fraunhofer SIT)
WhatsApp (HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\WhatsApp) (Version: 0.2.2732 - WhatsApp)
Windows Driver Package - Mitac (ACPIEXT) System  (07/01/2011 1.0.2.42) (HKLM\...\0FC1EDE7A916BDAFE97A52F1ADA63101467DE8AD) (Version: 07/01/2011 1.0.2.42 - Mitac)
WinRAR 5.10 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)
WISO steuer:Sparbuch 2016 (HKLM-x32\...\{FD1EC892-B381-47E4-BECC-243CF6EA6EC4}) (Version: 23.00.1146 - Buhl Data Service GmbH)
WISO Steuer-Sparbuch 2015 (HKLM-x32\...\{DD5601E6-E8C4-4A32-8831-776BEC7A456E}) (Version: 22.00.8811 - Buhl Data Service GmbH)
Wunderlist - Wunderlist (HKLM-x32\...\Wunderlist Wunderlist) (Version: 3.4.3 - Wunderlist)
Z1 SQL Server 2012 (HKLM-x32\...\Z1 SQL Server 2012) (Version:  - )

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{0C8EE82E-A958-4E00-BC74-0AB54908B85B}\InprocServer32 -> C:\Users\z1\AppData\Roaming\Programme\SmartTools\Word Falz & Lochmarken-Assistent\adxloader64.dll ()
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{14BBBC99-AF48-3ACA-8FD0-9E795D843343}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{196AAB40-0AE4-30CE-B5A0-4C820A90CCE2}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{1F9FC50D-BD7C-3335-95ED-18FFB9273C50}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{4CDDA53F-5EBF-35FA-8EC1-D64D1DA8A751}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{4E266860-3FA5-3C65-8EDF-D0F846950884}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{572201C5-B3E6-3BE1-AFD7-7F0DC8091488}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{6295A54D-BD2A-4CF7-A288-62B0D91F7879}\InprocServer32 -> C:\Program Files (x86)\Outlook Backup Assistant\AddIn\adxloader64.dll ()
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{6A392F1D-CD13-3891-AF1E-DF25427368FD}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{6CA2939C-714D-3585-8714-BECD01E9D42B}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{743035C6-FA33-39DF-A741-34A81649705C}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{8894DB3B-ABA0-30A9-8E8C-E0B06E6C426E}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{8F18E4FD-6226-3AB5-B6B8-C8CDAB4B9CE5}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{90DDCBC7-4E54-3D0B-9734-D6AEC1969353}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{A746EA6E-6A7F-36E9-B971-61755969EF04}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{C479B1E6-7EF7-3495-879C-4E62669B3C28}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{C593E65B-613B-347B-A83A-5B03A481C017}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{CCBEF1A3-D558-36E2-81AB-C6D7077AF15F}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{CF2B96F5-0390-3F2A-93CB-4F39DD2F6D10}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{D298D05D-411C-36F1-8D78-85258C63B34D}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{E3DF3DC0-3869-3CF6-9638-ACE5BFCF8341}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{E444D266-68C3-4748-91FC-49A65C606776}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{F06C2BF9-E2F8-32F9-BA0A-59D6E6A4F593}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {045A4096-4139-46DA-8CA1-69D8BE7822B7} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-11-07] (Dropbox, Inc.)
Task: {08F5D30D-7BFA-4AED-A60B-D13788F5B40A} - System32\Tasks\OInstall => C:\Windows\OInstall.exe [2015-10-10] ()
Task: {0A5A75F5-3E67-474B-8866-AFAD15C8DF30} - System32\Tasks\Z1ClientUpdate => C:\Program Files (x86)\CG\Z1Lokal\exe\z1clientupdate.exe [2017-01-04] (CompuGroup Medical Dentalsysteme GmbH)
Task: {1236BA8F-C364-42BF-8B59-15B486137BA2} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Task: {50DF3688-8AFD-46BA-9FB8-EAAF6F1137E2} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-12-14] (Adobe Systems Incorporated)
Task: {5BDAD0BF-6E73-44B9-9D11-7DC078AD975A} - System32\Tasks\{921143A9-5903-442C-A91F-4FB455C14363} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{036F4752-39E3-4B9C-AD93-2A856A867C1E}\setup.exe" -c -runfromtemp -l0x0009 -removeonly
Task: {7F98C8B7-D1FB-4C6B-A139-C3E7C9751200} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-10-21] (Adobe Systems Incorporated)
Task: {96B94671-D5CD-462C-AEA0-10DBCADC669D} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe
Task: {A0D18D6F-E62B-4E34-921A-47EE2C5E64DC} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-11-07] (Dropbox, Inc.)
Task: {A4985B46-6175-47C0-A820-2EF115D82C49} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {A8FBB5DF-07E8-4B77-8D20-A0DE6DF44936} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe
Task: {C82BA783-8E24-4AEF-B3D9-DB5CF0F806D4} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Task: {D81BC290-DAF2-4626-AB43-A9207A54CC86} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe
Task: {EB7173CF-066C-45A6-90D5-F82B1AC9D63A} - System32\Tasks\{3ED7CDDD-0456-49A5-9112-4AFA57D98373} => pcalua.exe -a D:\CDViewerRun.exe -d D:\

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2016-09-01 17:12 - 2016-09-01 17:12 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2016-10-05 18:17 - 2016-10-05 18:17 - 01353528 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2016-05-22 18:33 - 2016-05-22 18:33 - 00491184 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
2017-01-02 18:34 - 2016-12-14 12:55 - 02259232 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll
2017-01-02 18:34 - 2016-12-14 12:55 - 02813904 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\arwlib.dll
2017-01-02 18:34 - 2016-12-14 12:55 - 02247632 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2015-09-22 14:40 - 2015-08-04 09:47 - 00861184 _____ () C:\Program Files (x86)\Syncios2\SynciosDeviceService.exe
2016-12-09 13:09 - 2016-01-28 15:33 - 01058624 _____ () C:\Program Files (x86)\StarMoney 10\ouservice\libxml2.dll
2016-12-09 13:09 - 2011-01-13 10:44 - 00232800 _____ () C:\Program Files (x86)\StarMoney 10\ouservice\PATCHW32.dll
2015-09-22 14:40 - 2015-08-28 16:01 - 00397824 _____ () C:\Program Files (x86)\Syncios2\DuiLib.dll
2015-09-22 14:40 - 2013-03-01 09:30 - 00059904 _____ () C:\Program Files (x86)\Syncios2\zlib.dll
2015-09-22 14:40 - 2015-07-21 16:17 - 00571392 _____ () C:\Program Files (x86)\Syncios2\sqlite3.dll
2016-09-01 17:13 - 2016-09-01 17:13 - 00080184 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2016-10-05 18:18 - 2016-10-05 18:18 - 01041720 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-09-22 14:40 - 2014-01-06 10:24 - 00671744 _____ () C:\Program Files (x86)\Syncios2\hashab.dll
2016-10-05 18:18 - 2016-10-05 18:18 - 00189752 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxslt.dll
2015-12-10 08:26 - 2016-11-11 21:36 - 00035792 _____ () C:\Program Files (x86)\Dropbox\Client\_multiprocessing.pyd
2015-12-10 08:26 - 2016-11-11 21:36 - 00100296 _____ () C:\Program Files (x86)\Dropbox\Client\_ctypes.pyd
2015-12-10 08:26 - 2016-11-11 21:36 - 00018888 _____ () C:\Program Files (x86)\Dropbox\Client\select.pyd
2015-12-10 08:26 - 2016-12-21 19:26 - 00019760 _____ () C:\Program Files (x86)\Dropbox\Client\tornado.speedups.pyd
2015-12-10 08:26 - 2016-11-11 21:36 - 00694224 _____ () C:\Program Files (x86)\Dropbox\Client\unicodedata.pyd
2016-12-22 05:01 - 2016-12-21 19:26 - 00020816 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._constant_time.pyd
2015-12-10 08:26 - 2016-11-11 21:37 - 00123856 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_backend.pyd
2016-12-22 05:01 - 2016-12-21 19:26 - 01682760 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._openssl.pyd
2016-12-22 05:01 - 2016-12-21 19:26 - 00020808 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._padding.pyd
2016-12-22 05:01 - 2016-11-11 21:36 - 00145864 _____ () C:\Program Files (x86)\Dropbox\Client\pyexpat.pyd
2016-12-22 05:01 - 2016-11-11 21:37 - 00019408 _____ () C:\Program Files (x86)\Dropbox\Client\faulthandler.pyd
2016-12-22 05:01 - 2016-11-11 21:36 - 00116688 _____ () C:\Program Files (x86)\Dropbox\Client\pywintypes27.dll
2015-12-10 08:26 - 2016-11-11 21:38 - 00105928 _____ () C:\Program Files (x86)\Dropbox\Client\win32api.pyd
2016-08-08 07:26 - 2016-12-21 19:26 - 00021312 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.crt.compiled._winffi_crt.pyd
2016-12-22 05:01 - 2016-12-21 19:26 - 00052024 _____ () C:\Program Files (x86)\Dropbox\Client\psutil._psutil_windows.pyd
2016-12-22 05:01 - 2016-12-21 19:26 - 00038696 _____ () C:\Program Files (x86)\Dropbox\Client\fastpath.pyd
2016-12-22 05:01 - 2016-11-11 21:36 - 00392144 _____ () C:\Program Files (x86)\Dropbox\Client\pythoncom27.dll
2016-12-22 05:01 - 2016-11-11 21:38 - 00020936 _____ () C:\Program Files (x86)\Dropbox\Client\mmapfile.pyd
2015-12-10 08:26 - 2016-11-11 21:38 - 00024528 _____ () C:\Program Files (x86)\Dropbox\Client\win32event.pyd
2015-12-10 08:26 - 2016-11-11 21:39 - 00116176 _____ () C:\Program Files (x86)\Dropbox\Client\win32security.pyd
2015-12-10 08:26 - 2016-12-21 19:26 - 00381752 _____ () C:\Program Files (x86)\Dropbox\Client\win32com.shell.shell.pyd
2015-12-10 08:26 - 2016-11-11 21:38 - 00124880 _____ () C:\Program Files (x86)\Dropbox\Client\win32file.pyd
2016-08-08 07:26 - 2016-12-21 19:26 - 00025424 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.kernel32.compiled._winffi_kernel32.pyd
2015-12-10 08:26 - 2016-11-11 21:38 - 00024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32clipboard.pyd
2015-12-10 08:26 - 2016-11-11 21:38 - 00175560 _____ () C:\Program Files (x86)\Dropbox\Client\win32gui.pyd
2015-12-10 08:26 - 2016-11-11 21:38 - 00030160 _____ () C:\Program Files (x86)\Dropbox\Client\win32pipe.pyd
2015-12-10 08:26 - 2016-11-11 21:39 - 00043472 _____ () C:\Program Files (x86)\Dropbox\Client\win32process.pyd
2015-12-10 08:26 - 2016-11-11 21:39 - 00048592 _____ () C:\Program Files (x86)\Dropbox\Client\win32service.pyd
2015-12-10 08:26 - 2016-11-11 21:38 - 00057808 _____ () C:\Program Files (x86)\Dropbox\Client\win32evtlog.pyd
2015-12-10 08:26 - 2016-11-11 21:39 - 00024016 _____ () C:\Program Files (x86)\Dropbox\Client\win32profile.pyd
2016-12-22 05:01 - 2016-12-21 19:26 - 00246592 _____ () C:\Program Files (x86)\Dropbox\Client\breakpad.client.windows.handler.pyd
2016-12-22 05:01 - 2016-12-21 19:26 - 00026456 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox.infinite.win.compiled._driverinstallation.pyd
2016-08-08 07:26 - 2016-11-11 21:37 - 00241104 _____ () C:\Program Files (x86)\Dropbox\Client\_jpegtran.pyd
2016-12-22 05:01 - 2016-12-21 19:26 - 00020280 _____ () C:\Program Files (x86)\Dropbox\Client\cpuid.compiled._cpuid.pyd
2015-12-10 08:26 - 2016-11-11 21:39 - 00028616 _____ () C:\Program Files (x86)\Dropbox\Client\win32ts.pyd
2015-12-10 08:26 - 2016-12-21 19:26 - 00023376 _____ () C:\Program Files (x86)\Dropbox\Client\winscreenshot.compiled._CaptureScreenshot.pyd
2016-02-11 04:27 - 2016-12-21 19:26 - 00020800 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.iphlpapi._winffi_iphlpapi.pyd
2016-02-11 04:27 - 2016-12-21 19:26 - 00019776 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winerror._winffi_winerror.pyd
2016-02-11 04:27 - 2016-12-21 19:26 - 00020800 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.wininet._winffi_wininet.pyd
2015-12-10 08:26 - 2016-11-11 21:39 - 00350152 _____ () C:\Program Files (x86)\Dropbox\Client\winxpgui.pyd
2016-02-11 04:27 - 2016-12-21 19:26 - 00022352 _____ () C:\Program Files (x86)\Dropbox\Client\winverifysignature.compiled._VerifySignature.pyd
2016-12-22 05:01 - 2016-12-21 19:26 - 00024392 _____ () C:\Program Files (x86)\Dropbox\Client\librsyncffi.compiled._librsyncffi.pyd
2016-12-22 05:01 - 2016-11-11 21:35 - 00036296 _____ () C:\Program Files (x86)\Dropbox\Client\librsync.dll
2016-12-22 05:01 - 2016-12-21 19:26 - 00084280 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_sqlite_ext.DLL
2016-12-22 05:01 - 2016-12-21 19:26 - 01826096 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtCore.pyd
2015-12-10 08:26 - 2016-11-11 21:37 - 00083912 _____ () C:\Program Files (x86)\Dropbox\Client\sip.pyd
2016-12-22 05:01 - 2016-12-21 19:26 - 00531248 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtNetwork.pyd
2016-12-22 05:01 - 2016-12-21 19:26 - 03928880 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWidgets.pyd
2016-12-22 05:01 - 2016-12-21 19:26 - 01972528 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtGui.pyd
2016-12-22 05:01 - 2016-12-21 19:26 - 00133424 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKit.pyd
2016-12-22 05:01 - 2016-12-21 19:26 - 00224056 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKitWidgets.pyd
2016-12-22 05:01 - 2016-12-21 19:26 - 00207672 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtPrintSupport.pyd
2016-08-08 07:26 - 2016-12-21 19:26 - 00020288 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.user32._winffi_user32.pyd
2016-12-22 05:01 - 2016-11-11 21:42 - 00017864 _____ () C:\Program Files (x86)\Dropbox\Client\libEGL.dll
2016-12-22 05:01 - 2016-11-11 21:42 - 01631184 _____ () C:\Program Files (x86)\Dropbox\Client\libGLESv2.dll
2016-12-22 05:01 - 2016-12-21 19:26 - 00042808 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebChannel.pyd
2016-12-22 05:01 - 2016-12-21 19:26 - 00171320 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngineWidgets.pyd
2016-12-22 05:01 - 2016-12-21 19:26 - 00357680 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQml.pyd
2015-12-10 08:26 - 2016-11-11 21:39 - 00060880 _____ () C:\Program Files (x86)\Dropbox\Client\win32print.pyd
2016-08-08 07:26 - 2016-12-21 19:26 - 00024904 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winhttp.compiled._winffi_winhttp.pyd
2016-12-22 05:01 - 2016-12-21 19:26 - 00546096 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQuick.pyd
2016-12-28 12:24 - 2015-09-08 16:41 - 00119822 _____ () C:\Program Files (x86)\CG\Z1Lokal\exe\wkflbin\libgcc_s_dw2-1.dll
2016-12-28 12:24 - 2015-09-08 16:41 - 01026574 _____ () C:\Program Files (x86)\CG\Z1Lokal\exe\wkflbin\libstdc++-6.dll
2016-12-28 12:25 - 2016-06-10 00:59 - 00111104 _____ () C:\Program Files (x86)\CG\Z1Lokal\exe\wkflbin\wkflsr32core.dll
2016-12-28 12:25 - 2016-11-02 18:18 - 00539136 _____ () C:\Program Files (x86)\CG\Z1Lokal\exe\wkflbin\sqldrivers\qsqlitecg.dll
2016-12-28 12:25 - 2016-11-02 18:17 - 00582656 _____ () C:\Program Files (x86)\CG\Z1Lokal\exe\wkflbin\sqlite3.dll
2016-12-28 12:24 - 2015-03-31 11:56 - 03920542 _____ () C:\Program Files (x86)\CG\Z1Lokal\exe\wkflbin\icuin54.dll
2016-12-28 12:24 - 2015-03-31 11:56 - 02177557 _____ () C:\Program Files (x86)\CG\Z1Lokal\exe\wkflbin\icuuc54.dll
2016-12-28 12:24 - 2015-03-31 11:56 - 25382664 _____ () C:\Program Files (x86)\CG\Z1Lokal\exe\wkflbin\icudt54.dll
2014-08-05 14:10 - 2014-04-24 12:22 - 00067072 _____ () \\z1server\Z1\vitax\bin\core\win\vxProcessId.dll
2017-01-09 07:44 - 2017-01-09 07:44 - 00541696 _____ () C:\Users\z1\AppData\Local\Temp\sqlite-3.7.2-sqlitejdbc.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)

AlternateDataStreams: C:\ProgramData\TEMP:CB0AACC9 [196]

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\GoToAssist Remote Support Customer => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)

HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\Software\Classes\.exe: exefile =>  <===== ACHTUNG

==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE trusted site: HKU\.DEFAULT\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\mediserv.de -> hxxps://rz.mediserv.de
IE trusted site: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\speedport.ip -> hxxps://speedport.ip

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2009-07-14 03:34 - 2016-04-05 12:52 - 00001011 ____A C:\Windows\system32\Drivers\etc\hosts


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\z1\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 10.11.34.10
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: AdobeUpdateService => 2
MSCONFIG\Services: chip1click => 2
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: NitroDriverReadSpool9 => 2
MSCONFIG\Services: NitroUpdateService => 2
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: StarMoney 9.0 OnlineUpdate => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Printkey2000.lnk => C:\Windows\pss\Printkey2000.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^z1^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma.lnk => C:\Windows\pss\Adobe Gamma.lnk.Startup
MSCONFIG\startupreg: Adobe Creative Cloud => "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" --showwindow=false --onOSstartup=true
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: ApplePhotoStreams => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
MSCONFIG\startupreg: BCSSync => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
MSCONFIG\startupreg: BrStsMon00 => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN
MSCONFIG\startupreg: CanonMyPrinter => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
MSCONFIG\startupreg: CanonQuickMenu => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE /logon
MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: iCloudDrive => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
MSCONFIG\startupreg: iCloudPhotos => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe
MSCONFIG\startupreg: iCloudServices => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: PopScan Scanner Reader => "C:\Users\z1\AppData\Roaming\popscan\popscan.exe" /autostart
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: TrojanScanner => C:\Program Files (x86)\Trojan Remover\Trjscan.exe /boot

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [SPPSVC-In-TCP] => %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => %SystemRoot%\system32\sppsvc.exe
FirewallRules: [VirtualPC-In-UDP-1] => %SystemRoot%\System32\vpc.exe
FirewallRules: [VirtualPC-In-UDP-2] => %SystemRoot%\System32\vpc.exe
FirewallRules: [VirtualPC-In-TCP-1] => %SystemRoot%\System32\vpc.exe
FirewallRules: [{A12DDDA4-BF60-4222-857A-BE25C8DFC05A}] => C:\CGM\PraxisArchiv\Client\PraxisArchiv.exe
FirewallRules: [{A50FF1E6-CD3B-401F-9CA9-0321E46258B6}] => C:\CGM\PraxisArchiv\Client\PraxisArchiv.exe
FirewallRules: [{C832BBC3-49E5-492C-B0F7-5712A2B51EB4}] => C:\CGM\PraxisArchiv\ArchiveTracerMT.exe
FirewallRules: [{5A051FD9-673D-456E-982D-AFF754D2817E}] => C:\CGM\PraxisArchiv\ArchiveTracerMT.exe
FirewallRules: [{46BD91C1-3BC3-4F3C-ABA6-8F8F1F13E748}] => C:\CGM\PraxisArchiv\Client\OfficeConnect.exe
FirewallRules: [{766CE507-51DD-42AC-93C9-071107F79AF3}] => C:\CGM\PraxisArchiv\Client\OfficeConnect.exe
FirewallRules: [{31AA891C-D827-4B92-9026-677F392F27EF}] => C:\CGM\PraxisArchiv\Client\WordX.exe
FirewallRules: [{B1CC1BE9-2B58-4C16-B259-44A1E96CB5DC}] => C:\CGM\PraxisArchiv\Client\WordX.exe
FirewallRules: [{62C18C13-7981-4707-BFAB-F20207176828}] => C:\CGM\PraxisArchiv\Common\FaxSrv\FaxServer.exe
FirewallRules: [{DE58A30B-BB17-41F7-B028-F148A41C0265}] => C:\CGM\PraxisArchiv\Common\FaxSrv\FaxServer.exe
FirewallRules: [{1FE6D62D-B961-446D-9972-C5A14AA716C3}] => LPort=135
FirewallRules: [{A8E9F12A-7D60-4D96-AEAC-7729D5F93739}] => C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{BB96759B-CE53-4ED6-8F67-BEE7959BAE9F}] => C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{1612AD1C-522D-416D-8B0E-18B8DADEA6BE}] => C:\Program Files (x86)\StarMoney 9.0\app\StarMoney.exe
FirewallRules: [{1D9593E0-E798-475B-9B81-930E69AC6F7D}] => C:\Program Files (x86)\StarMoney 9.0\app\StarMoney.exe
FirewallRules: [TCP Query User{9FD886CA-2004-4123-90C0-7B2FBCE88386}C:\program files (x86)\jdownloader\jre\bin\javaw.exe] => C:\program files (x86)\jdownloader\jre\bin\javaw.exe
FirewallRules: [UDP Query User{7B3A3525-0F8A-46E6-AD0F-3A6D323BA67D}C:\program files (x86)\jdownloader\jre\bin\javaw.exe] => C:\program files (x86)\jdownloader\jre\bin\javaw.exe
FirewallRules: [{34D58726-560C-44E8-B98B-39787E5C5F31}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{DF5C1E3A-BBAC-46E9-BF96-4396B2DE0BF2}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{7C543741-0259-403D-923E-7B001957C326}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{85674CC9-7E39-4EFF-8FE5-E50B7CD71E04}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{A6B55B30-8617-4418-93B2-185C1F1E3A0C}] => C:\Users\z1\AppData\Local\Temp\hpdiu2\HPDIU\HPDIUNetwork.exe
FirewallRules: [{68BBD085-A32E-415E-B499-9FB59D1BFA35}] => C:\Users\z1\AppData\Local\Temp\hpdiu2\HPDIU\HPDIUNetwork.exe
FirewallRules: [{136BF411-65C6-4B5F-8E65-127DF2B5C653}] => C:\Program Files (x86)\StarMoney 9\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{0AB9362A-9E70-46F8-8654-772353498A2F}] => C:\Program Files (x86)\StarMoney 9\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{601365B4-F676-4059-B9EE-2EF5FA4D34C9}] => C:\Program Files (x86)\StarMoney 9\app\StarMoney.exe
FirewallRules: [{37C87386-ED7B-4E03-9D5D-737564D04630}] => C:\Program Files (x86)\StarMoney 9\app\StarMoney.exe
FirewallRules: [{D4672AEA-6F67-4C23-BBB9-2DE04434307D}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{8A37FF64-F422-4069-A963-A6EFC230B884}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{FC556D71-F911-4864-BFB3-55E6EDDEA447}C:\cgm\praxisarchiv\client\praxisarchiv.exe] => C:\cgm\praxisarchiv\client\praxisarchiv.exe
FirewallRules: [UDP Query User{41430AED-DC19-44F8-965D-2B100026FB6A}C:\cgm\praxisarchiv\client\praxisarchiv.exe] => C:\cgm\praxisarchiv\client\praxisarchiv.exe
FirewallRules: [TCP Query User{69942187-B4E3-4587-8A7B-DCEEEC07024F}C:\cgm\praxisarchiv\archivetracermt.exe] => C:\cgm\praxisarchiv\archivetracermt.exe
FirewallRules: [UDP Query User{DA623227-B674-4836-8820-C538804A39AC}C:\cgm\praxisarchiv\archivetracermt.exe] => C:\cgm\praxisarchiv\archivetracermt.exe
FirewallRules: [TCP Query User{223E96AB-E0BC-4666-95AF-54FCFFDBB073}C:\program files (x86)\mozilla firefox\firefox.exe] => C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{94953767-F39D-4C2A-BE94-6B848DF7B412}C:\program files (x86)\mozilla firefox\firefox.exe] => C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{D1FC43C8-E106-435E-B183-07A6EC21E227}] => C:\Program Files (x86)\StarMoney 10\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{1692ADF6-EE30-4361-9268-CEDFA1B53970}] => C:\Program Files (x86)\StarMoney 10\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{4A727120-1393-44A6-ADCA-4A5A29CFDD89}] => C:\Program Files (x86)\StarMoney 10\app\StarMoney.exe
FirewallRules: [{FDFAD4B6-26AF-4971-BBB8-DDA5669DE843}] => C:\Program Files (x86)\StarMoney 10\app\StarMoney.exe
FirewallRules: [{9784F5C0-1F16-42B5-8389-36BF9C03C63C}] => %ProgramFiles% (x86)\WISO\Steuersoftware 2015\wiso2015.exe
FirewallRules: [TCP Query User{6A7C0E61-8BC3-4678-B101-87E6212A84E1}C:\program files (x86)\ivoclar vivadent\prograbase x10\prograbasex10.exe] => C:\program files (x86)\ivoclar vivadent\prograbase x10\prograbasex10.exe
FirewallRules: [UDP Query User{CF1E7149-E9E4-4D17-95DC-F483658BD596}C:\program files (x86)\ivoclar vivadent\prograbase x10\prograbasex10.exe] => C:\program files (x86)\ivoclar vivadent\prograbase x10\prograbasex10.exe
FirewallRules: [{57E215FD-F3AC-4E06-9576-00CD2EA82242}] => C:\Program Files (x86)\CG\Z1Lokal\exe\z1clientupdate.exe
FirewallRules: [{5C3EDCDA-DE83-443C-B714-1E044D77CEAF}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{730C36F8-5DD4-4FD9-8851-80DBAC39598D}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{2A81B9EF-5F1F-4557-9044-823844783DAE}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{926EFE7F-602D-4EA7-99A0-79F10EB097AF}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{8700C67E-B916-4452-90B0-45929A549FD4}] => C:\Program Files\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{2BAC1BC2-1AC5-4264-A71A-1964883F8779}] => C:\Program Files\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{14E0E3E0-9BF0-44CD-A0B6-A619900AB9F1}] => C:\Users\z1\AppData\Local\Microsoft\OneDrive\OneDrive.exe
FirewallRules: [{1B3C4C23-5BF0-4ACA-9217-CABF9EF081ED}] => C:\Windows\KMS-R@1n.exe
FirewallRules: [{86FD0B8C-CD7B-4CE2-907B-7BED0D1327A3}] => C:\Windows\KMS-R@1n.exe
FirewallRules: [{7634E134-9A6E-4EDC-8890-D7EC3C0667C2}] => C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{5C4F5B37-2950-4E67-9690-AAC912614163}] => C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{F7225C67-830F-47A5-8D69-3AFDA3A47428}] => C:\Users\z1\Downloads\2.6 BETA 2 SDL\Microsoft Toolkit.exe
FirewallRules: [{97C14B22-0470-4C6F-B7A0-BD3971C43653}] => C:\Users\z1\Downloads\2.6 BETA 2 SDL\Microsoft Toolkit.exe
FirewallRules: [{C4377250-4852-4818-8731-E6F686F50AAB}] => C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{0E77D178-B5E9-4730-BD79-2B57118CFF90}] => C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{0D398C3A-F3DF-4615-9F1F-3D564C0BC7FD}] => C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{3EB6E694-2869-41F7-8855-862496CDDCAE}] => C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{64BD3BF4-8D8A-4535-938E-93B83DDAD1EA}] => LPort=1688
FirewallRules: [{18E9EB5A-960F-4F18-9F7F-1A867941EEDF}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{863685CE-E24E-4749-9676-0D6213161FAA}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{E3B32A9E-CA7B-4336-899E-49CC1A60A0D7}C:\users\z1\appdata\local\temp\fritz!wlan repeater 1750e\fsetup.exe] => C:\users\z1\appdata\local\temp\fritz!wlan repeater 1750e\fsetup.exe
FirewallRules: [UDP Query User{6D0C669F-A87E-49E5-8FDA-2F86C9A000A9}C:\users\z1\appdata\local\temp\fritz!wlan repeater 1750e\fsetup.exe] => C:\users\z1\appdata\local\temp\fritz!wlan repeater 1750e\fsetup.exe
FirewallRules: [{94B6ADF9-CE41-4186-B314-E10A89129B66}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\Video Download Capture.exe
FirewallRules: [{47D12FDF-2E21-4A52-8C1A-DA01B37F047E}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\Video Download Capture.exe
FirewallRules: [{AB0C18F9-DC1C-46F2-BC03-177824FDF929}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftSrv.dll
FirewallRules: [{FB207166-9A73-4A36-B1D4-73FA042BDBE8}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftSrv.dll
FirewallRules: [{68329410-5998-4FF2-8121-A62A011DE657}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftDump.dll
FirewallRules: [{9B751EC5-B02C-4A4B-9A1B-C1C7F6C8C875}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftDump.dll
FirewallRules: [{623EEE6F-39E0-4CBA-ADCF-33BB59A636D7}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftAC.dll
FirewallRules: [{2D97FBA0-A10F-4C79-A7F1-1594AE3BAE7F}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftAC.dll
FirewallRules: [{1AD0E90C-78C4-4BF9-AA80-BBDBDC7A7B9E}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftPlayer.dll
FirewallRules: [{616EE04D-2131-4BEE-BF5E-FEEF198E0123}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftPlayer.dll
FirewallRules: [{A1EFE9C5-DDFD-4664-8F71-75F70CA1EBD4}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftDownloaderHelp.dll
FirewallRules: [{D3C02E8B-D50E-4071-97EC-F51A9D6CE25E}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftDownloaderHelp.dll
FirewallRules: [{07C1226B-C706-4756-8DD7-19AA486B5916}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftHDSDump.dll
FirewallRules: [{0EF61CAA-AD81-486B-811F-6BCC418DDCF0}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftHDSDump.dll
FirewallRules: [TCP Query User{7D3CC90E-7965-4E76-BB4E-28C8F1F05941}C:\xampp\apache\bin\httpd.exe] => C:\xampp\apache\bin\httpd.exe
FirewallRules: [UDP Query User{FF9AE1FA-6805-4E00-98FE-0333891A8038}C:\xampp\apache\bin\httpd.exe] => C:\xampp\apache\bin\httpd.exe
FirewallRules: [TCP Query User{66FB2D1E-98B4-4546-ADA6-0ECD6403AFFC}C:\xampp\mysql\bin\mysqld.exe] => C:\xampp\mysql\bin\mysqld.exe
FirewallRules: [UDP Query User{BC305472-886C-4B4C-93D4-E56B07070F06}C:\xampp\mysql\bin\mysqld.exe] => C:\xampp\mysql\bin\mysqld.exe
FirewallRules: [TCP Query User{56E73840-0C1E-4BD7-A7B0-122F30CA39B4}C:\program files (x86)\java\jre1.8.0_73\bin\java.exe] => C:\program files (x86)\java\jre1.8.0_73\bin\java.exe
FirewallRules: [UDP Query User{164AC24A-3592-402C-9F9D-86516CD46A87}C:\program files (x86)\java\jre1.8.0_73\bin\java.exe] => C:\program files (x86)\java\jre1.8.0_73\bin\java.exe
FirewallRules: [TCP Query User{F4F56B9E-05A5-4D7F-8464-5F9E4E6436C1}C:\xampp\filezillaftp\filezillaserver.exe] => C:\xampp\filezillaftp\filezillaserver.exe
FirewallRules: [UDP Query User{014EDE58-11C3-43DC-990D-3F0927E7A566}C:\xampp\filezillaftp\filezillaserver.exe] => C:\xampp\filezillaftp\filezillaserver.exe
FirewallRules: [TCP Query User{5C62F67E-DD1E-4D36-A4AC-E42E4861A155}C:\xampp\mercurymail\mercury.exe] => C:\xampp\mercurymail\mercury.exe
FirewallRules: [UDP Query User{9F21CB67-F1AD-47DE-966E-927DD6BA8381}C:\xampp\mercurymail\mercury.exe] => C:\xampp\mercurymail\mercury.exe
FirewallRules: [{C0008C73-2224-40EC-BACA-DCC1DCC4C296}] => LPort=8091
FirewallRules: [{9C2AD1F9-C3CD-4CE2-9AA7-449589351CB5}] => LPort=8091
FirewallRules: [{49495F2B-D3B7-4FCE-A17D-CDFF68634DFD}] => C:\CGM\ORGANIZER\Client\client\qma_client_launcher_menu.exe
FirewallRules: [{F4C8B082-D60C-4D6F-9B8F-CB60C25F1A72}] => C:\CGM\ORGANIZER\Client\client\qma_client_launcher_menu.exe
FirewallRules: [{BC4DA64F-6E7C-47BE-8680-8009CC3538A9}] => C:\CGM\ORGANIZER\Client\client\qma_client_launcher_menu.exe
FirewallRules: [{C8908A5A-6E06-4278-9A07-7BD1438BDA71}] => C:\CGM\ORGANIZER\Client\client\qma_client_launcher_menu.exe
FirewallRules: [{7BB1732F-F123-442B-8670-AC705BDFA785}] => LPort=8080
FirewallRules: [{C3F2CCA9-F2EF-4DAD-92D0-F85535F10989}] => LPort=8080
FirewallRules: [{CE4046D0-8861-4BCE-BF77-97A3BB56AAAE}] => C:\Program Files (x86)\CG\Z1Lokal\exe\z1poll2.exe
FirewallRules: [{E9A2E9A3-1FF7-46CC-801C-B0E8AE1D0CE2}] => C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{06AD5553-4875-434F-B936-B40491B680F7}] => C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{F99A91C7-6AFE-4E81-9AB8-A88290995850}] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
FirewallRules: [{179CF134-4BC1-4264-95A2-D2A59A9A9AB4}] => C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{FE70306D-9AE9-47FC-B610-22BFD1D55733}] => C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{2AEAFB32-F4D8-4E32-9F2A-99B3F2698287}] => C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{CA93337E-16DC-478B-B9BF-39E5E0A09CC7}] => C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe

==================== Wiederherstellungspunkte =========================

09-01-2017 00:00:00 Geplanter Prüfpunkt
09-01-2017 14:57:17 Removed Microsoft Office Home and Business 2010

==================== Fehlerhafte Geräte im Gerätemanager =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (01/09/2017 03:04:19 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: Fehler beim Laden des Protokollhandlers Mapi16. Fehlerbeschreibung: Das angegebene Modul wurde nicht gefunden.  (HRESULT : 0x8007007e).

Error: (01/09/2017 03:00:27 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: lpksetup.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7a1f7
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeb033f
Ausnahmecode: 0x40000015
Fehleroffset: 0x000000000002a84e
ID des fehlerhaften Prozesses: 0x850
Startzeit der fehlerhaften Anwendung: 0x01d26a80b00bc0f4
Pfad der fehlerhaften Anwendung: C:\Windows\system32\lpksetup.exe
Pfad des fehlerhaften Moduls: C:\Windows\system32\msvcrt.dll
Berichtskennung: f8b12236-d673-11e6-a002-dc85deaa056a

Error: (01/09/2017 03:00:09 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (01/09/2017 10:51:54 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: lpksetup.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7a1f7
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeb033f
Ausnahmecode: 0x40000015
Fehleroffset: 0x000000000002a84e
ID des fehlerhaften Prozesses: 0xdec
Startzeit der fehlerhaften Anwendung: 0x01d26a5dfa0f02cc
Pfad der fehlerhaften Anwendung: C:\Windows\system32\lpksetup.exe
Pfad des fehlerhaften Moduls: C:\Windows\system32\msvcrt.dll
Berichtskennung: 3fe36f11-d651-11e6-9946-dc85deaa056a

Error: (01/09/2017 10:51:36 AM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (01/03/2017 01:09:27 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: lpksetup.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7a1f7
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeb033f
Ausnahmecode: 0x40000015
Fehleroffset: 0x000000000002a84e
ID des fehlerhaften Prozesses: 0xa04
Startzeit der fehlerhaften Anwendung: 0x01d265ba30a49378
Pfad der fehlerhaften Anwendung: C:\Windows\system32\lpksetup.exe
Pfad des fehlerhaften Moduls: C:\Windows\system32\msvcrt.dll
Berichtskennung: 788a66ed-d1ad-11e6-9f17-dc85deaa056a

Error: (01/03/2017 01:09:08 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (01/03/2017 12:13:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: lpksetup.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7a1f7
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeb033f
Ausnahmecode: 0x40000015
Fehleroffset: 0x000000000002a84e
ID des fehlerhaften Prozesses: 0xa50
Startzeit der fehlerhaften Anwendung: 0x01d265b2740646e8
Pfad der fehlerhaften Anwendung: C:\Windows\system32\lpksetup.exe
Pfad des fehlerhaften Moduls: C:\Windows\system32\msvcrt.dll
Berichtskennung: b6d11b75-d1a5-11e6-bbfc-dc85deaa056a

Error: (01/03/2017 12:13:41 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (01/03/2017 11:57:52 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: lpksetup.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7a1f7
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeb033f
Ausnahmecode: 0x40000015
Fehleroffset: 0x000000000002a84e
ID des fehlerhaften Prozesses: 0xa44
Startzeit der fehlerhaften Anwendung: 0x01d265b03598620a
Pfad der fehlerhaften Anwendung: C:\Windows\system32\lpksetup.exe
Pfad des fehlerhaften Moduls: C:\Windows\system32\msvcrt.dll
Berichtskennung: 787abedc-d1a3-11e6-b053-dc85deaa056a


Systemfehler:
=============
Error: (01/09/2017 03:00:12 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "MB3Service" wurde mit folgendem Fehler beendet: 
Die Klasse wurde so konfiguriert, dass sie unter einer anderen Sicherheitskennung als der Aufrufer ausgeführt werden kann.

Error: (01/09/2017 03:00:11 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "KMS-R@1n" wurde aufgrund folgenden Fehlers nicht gestartet: 
Das System kann die angegebene Datei nicht finden.

Error: (01/09/2017 03:00:09 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "GoToAssist Remote Support Customer" wurde aufgrund folgenden Fehlers nicht gestartet: 
Das System kann die angegebene Datei nicht finden.

Error: (01/09/2017 03:00:05 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "HitmanPro Scheduler" wurde aufgrund folgenden Fehlers nicht gestartet: 
Das System kann die angegebene Datei nicht finden.

Error: (01/09/2017 02:22:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "KMS-R@1n" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/09/2017 10:51:38 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "MB3Service" wurde mit folgendem Fehler beendet: 
Die Klasse wurde so konfiguriert, dass sie unter einer anderen Sicherheitskennung als der Aufrufer ausgeführt werden kann.

Error: (01/09/2017 10:51:36 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "GoToAssist Remote Support Customer" wurde aufgrund folgenden Fehlers nicht gestartet: 
Das System kann die angegebene Datei nicht finden.

Error: (01/09/2017 10:51:32 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "HitmanPro Scheduler" wurde aufgrund folgenden Fehlers nicht gestartet: 
Das System kann die angegebene Datei nicht finden.

Error: (01/09/2017 10:50:29 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler beendet: 
Zugriff verweigert

Error: (01/09/2017 10:49:59 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler beendet: 
Zugriff verweigert


==================== Speicherinformationen =========================== 

Prozessor: Intel(R) Core(TM) i7-4770T CPU @ 2.50GHz
Prozentuale Nutzung des RAM: 38%
Installierter physikalischer RAM: 8107.71 MB
Verfügbarer physikalischer RAM: 4947.53 MB
Summe virtueller Speicher: 16213.61 MB
Verfügbarer virtueller Speicher: 12644.63 MB

==================== Laufwerke ================================

Drive c: () (Fixed) (Total:232.78 GB) (Free:38.29 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive e: () (Fixed) (Total:0.1 GB) (Free:0.03 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive x: (Daten) (Network) (Total:1568.74 GB) (Free:1034.05 GB) NTFS
Drive y: (DATEN) (Network) (Total:931.51 GB) (Free:869.86 GB) NTFS
Drive z: (Daten) (Network) (Total:1568.74 GB) (Free:1034.05 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 63E9C119)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=232.8 GB) - (Type=07 NTFS)

==================== Ende von Addition.txt ============================
         

+++ WICHTIGER HINWEIS +++

Während der Analyse und Bereinigung nimmst du KEINERLEI Änderungen auf eigene Faust vor, d.h. du installierst oder deinstallierst keine Software ohne Absprache.
Auch veränderst du keine Systemeinstellungen, solange wir deinen Fall bearbeiten. Änderungen, Installationen oder Deinstallationen machst du AUSSCHLIESSLICH nur auf Anweisung!
Es wird erforderlich sein, deinen Virenscanner zu deaktivieren und in bestimmten Fällen auch zu deinstallieren, damit vernünftig bereinigt werden kann. Dein System ist daher erst wenn wir hier fertig sind wieder für den alltäglichen Gebrauch wie surfen oder mailen von mir freigegeben.

Gelesen und verstanden?




1. Schritt: Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

• Starte bitte die mbar.exe.
• Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
• Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
• Klicke auf den CleanUp Button und erlaube den Neustart.
• Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
• Nach dem Neustart starte die mbar.exe erneut.
• Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers




2. Schritt: Kaspersky TDSS-Killer

Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop

• Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
• Drücke Start Scan
  
• Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
  TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
  Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org

Database version:
  main:    v2017.01.09.06
  rootkit: v2016.11.20.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.18537
z1 :: BUERO01 [administrator]

09.01.2017 16:01:05
mbar-log-2017-01-09 (16-01-05).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Kernel memory modifications detected. Deep Anti-Rootkit Scan engaged.
Objects scanned: 359040
Time elapsed: 11 minute(s), 25 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
         

16:14:29.0369 0x158c  TDSS rootkit removing tool 3.1.0.12 Nov  7 2016 07:10:01
16:14:40.0273 0x158c  ============================================================
16:14:40.0273 0x158c  Current date / time: 2017/01/09 16:14:40.0273
16:14:40.0273 0x158c  SystemInfo:
16:14:40.0273 0x158c  
16:14:40.0273 0x158c  OS Version: 6.1.7601 ServicePack: 1.0
16:14:40.0273 0x158c  Product type: Workstation
16:14:40.0273 0x158c  ComputerName: BUERO01
16:14:40.0273 0x158c  UserName: z1
16:14:40.0273 0x158c  Windows directory: C:\Windows
16:14:40.0273 0x158c  System windows directory: C:\Windows
16:14:40.0273 0x158c  Running under WOW64
16:14:40.0273 0x158c  Processor architecture: Intel x64
16:14:40.0273 0x158c  Number of processors: 8
16:14:40.0273 0x158c  Page size: 0x1000
16:14:40.0273 0x158c  Boot type: Normal boot
16:14:40.0273 0x158c  CodeIntegrityOptions = 0x00000001
16:14:40.0273 0x158c  ============================================================
16:14:40.0429 0x158c  KLMD registered as C:\Windows\system32\drivers\88604934.sys
16:14:40.0429 0x158c  KLMD ARK init status: drvProperties = 0xFFF00, osBuild = 7601.23572, osProperties = 0x1
16:14:40.0679 0x158c  System UUID: {2F16C6C4-8CA9-5C9C-D03A-9D52D2AB473A}
16:14:41.0022 0x158c  Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 ( 232.89 Gb ), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
16:14:41.0038 0x158c  ============================================================
16:14:41.0038 0x158c  \Device\Harddisk0\DR0:
16:14:41.0038 0x158c  MBR partitions:
16:14:41.0038 0x158c  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
16:14:41.0038 0x158c  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x1D191000
16:14:41.0038 0x158c  ============================================================
16:14:41.0038 0x158c  C: <-> \Device\Harddisk0\DR0\Partition2
16:14:41.0038 0x158c  E: <-> \Device\Harddisk0\DR0\Partition1
16:14:41.0038 0x158c  ============================================================
16:14:41.0038 0x158c  Initialize success
16:14:41.0038 0x158c  ============================================================
16:15:21.0676 0x0f50  ============================================================
16:15:21.0676 0x0f50  Scan started
16:15:21.0676 0x0f50  Mode: Manual; SigCheck; TDLFS; 
16:15:21.0676 0x0f50  ============================================================
16:15:21.0676 0x0f50  KSN ping started
16:15:22.0128 0x0f50  KSN ping finished: true
16:15:22.0565 0x0f50  ================ Scan system memory ========================
16:15:22.0565 0x0f50  System memory - ok
16:15:22.0565 0x0f50  ================ Scan services =============================
16:15:22.0581 0x0f50  [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
16:15:22.0659 0x0f50  1394ohci - ok
16:15:22.0659 0x0f50  [ 08E0CE1695B7BBE9F3AD5A9882A55AA9, 01558CF3CDFC9205D6725D31311C6A78866E5319E243EF3522448CC3AA452794 ] 3wareDrv        C:\Windows\system32\drivers\3wareDrv.sys
16:15:22.0674 0x0f50  3wareDrv - ok
16:15:22.0690 0x0f50  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
16:15:22.0706 0x0f50  ACPI - ok
16:15:22.0706 0x0f50  [ 5482923252471736E4613FC7DF2A45A8, B54D0E2940C2CDC52F7844CA061F73576007E9545038E4BDE849C58766035430 ] ACPIEXT         C:\Windows\system32\DRIVERS\ext_acpi.sys
16:15:22.0721 0x0f50  ACPIEXT - ok
16:15:22.0721 0x0f50  [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys
16:15:22.0737 0x0f50  AcpiPmi - ok
16:15:22.0752 0x0f50  [ 8B46D5A1D3EF08232C04D0EAFB871FB2, 5306F8452EF675851CB0015F9E5C5EB750137D6D65C9CB7E47F8EF5B10A44D10 ] Adobe LM Service C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
16:15:22.0784 0x0f50  Adobe LM Service - detected UnsignedFile.Multi.Generic ( 1 )
16:15:23.0111 0x0f50  Detect skipped due to KSN trusted
16:15:23.0111 0x0f50  Adobe LM Service - ok
16:15:23.0111 0x0f50  [ C92B0A0957ACAD3CEEF502A2CA10ACB8, 78BF46318B69D9479ECDC83446DD8D454AA2A9A9D94B33C5FC68933DB18AFA3B ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
16:15:23.0142 0x0f50  AdobeARMservice - ok
16:15:23.0158 0x0f50  [ B79750091FC0842182FE49D263791294, 32FC260A74C9C45CD1E8998523642C285866378FCD9478FEFD15A0CC42EC0E0B ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
16:15:23.0189 0x0f50  AdobeFlashPlayerUpdateSvc - ok
16:15:23.0205 0x0f50  [ 8A910356CAE9606D1F40F25570B284AF, 1D28A78E2666D9CC924D1604483D83EEC55920935D8720614202F62521071B9F ] AdobeUpdateService C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
16:15:23.0236 0x0f50  AdobeUpdateService - ok
16:15:23.0252 0x0f50  [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx         C:\Windows\system32\drivers\adp94xx.sys
16:15:23.0267 0x0f50  adp94xx - ok
16:15:23.0283 0x0f50  [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci         C:\Windows\system32\drivers\adpahci.sys
16:15:23.0298 0x0f50  adpahci - ok
16:15:23.0298 0x0f50  [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320         C:\Windows\system32\drivers\adpu320.sys
16:15:23.0314 0x0f50  adpu320 - ok
16:15:23.0314 0x0f50  [ 262D7C87D0AC20B96EF9877D3CA478A0, 54F7E5A5F8991C5525500C1ECCF3D3135D13F48866C366E52DF1D052DB2EE15B ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
16:15:23.0330 0x0f50  AeLookupSvc - ok
16:15:23.0330 0x0f50  [ 9A4A1EEE802BF2F878EE8EAB407B21B7, 177EB7DF4B35FE4C0E45E775A0FD5D48D39B410052E3EE18BDEEC809E152D9D8 ] AFD             C:\Windows\system32\drivers\afd.sys
16:15:23.0361 0x0f50  AFD - ok
16:15:23.0361 0x0f50  [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440          C:\Windows\system32\drivers\agp440.sys
16:15:23.0376 0x0f50  agp440 - ok
16:15:23.0408 0x0f50  [ 840E0468368EB5FD87371EF508D72ACF, 7E05854D29C24E9BBB27B038620C345E063FF3B8F1AE0FDA054BEDF842FB29A9 ] AGSService      C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
16:15:23.0470 0x0f50  AGSService - ok
16:15:23.0486 0x0f50  [ 8A1E9B76248E60650176DA32941FD8CD, 4726FAF73C1E12C5DD40B362CC4ACB80F119DCE7900154E1C9E84AF980D0029A ] ahcix64s        C:\Windows\system32\drivers\ahcix64s.sys
16:15:23.0501 0x0f50  ahcix64s - ok
16:15:23.0501 0x0f50  [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG             C:\Windows\System32\alg.exe
16:15:23.0517 0x0f50  ALG - ok
16:15:23.0517 0x0f50  [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide          C:\Windows\system32\drivers\aliide.sys
16:15:23.0532 0x0f50  aliide - ok
16:15:23.0532 0x0f50  [ 8B68C8C83EAA1A9CA3469E8D8C5EF1C3, 5B89C6ECCAB72DF62B9893C851AD1A96AD02A4D4984DE200D2EC84EF2D74AD7D ] AMDCIR64        C:\Windows\system32\drivers\AMDCIR64.sys
16:15:23.0548 0x0f50  AMDCIR64 - ok
16:15:23.0548 0x0f50  [ 30BFEEE0DFFD5BD79D29157CF080DEED, D3176AA5CFD43CAE7180E9E51A2C76DC2AC02897CA730391A54F647D263ED4E0 ] amdhub30        C:\Windows\system32\drivers\amdhub30.sys
16:15:23.0564 0x0f50  amdhub30 - ok
16:15:23.0564 0x0f50  [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide          C:\Windows\system32\drivers\amdide.sys
16:15:23.0564 0x0f50  amdide - ok
16:15:23.0579 0x0f50  [ 35D34AD337A1AC46F74C3377B4CCA88E, 046695BDF540EDCA87C36EDC725615ACA99DA57558A54CAC1B49F245D702B406 ] amdide64        C:\Windows\system32\drivers\amdide64.sys
16:15:23.0579 0x0f50  amdide64 - ok
16:15:23.0579 0x0f50  [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8           C:\Windows\system32\drivers\amdk8.sys
16:15:23.0595 0x0f50  AmdK8 - ok
16:15:23.0610 0x0f50  [ 8A375CB3B6D1A56A2AEEE72A5F1D0926, 03D6EA77B141675B719E66DA09D1DACC7137B19F9918C303DD6870B3F36ADEBB ] amdkmpfd        C:\Windows\system32\drivers\amdkmpfd.sys
16:15:23.0610 0x0f50  amdkmpfd - ok
16:15:23.0610 0x0f50  [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM          C:\Windows\system32\drivers\amdppm.sys
16:15:23.0626 0x0f50  AmdPPM - ok
16:15:23.0642 0x0f50  [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
16:15:23.0642 0x0f50  amdsata - ok
16:15:23.0657 0x0f50  [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys
16:15:23.0657 0x0f50  amdsbs - ok
16:15:23.0673 0x0f50  [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata         C:\Windows\system32\drivers\amdxata.sys
16:15:23.0673 0x0f50  amdxata - ok
16:15:23.0688 0x0f50  [ 321533578132C811EC834A1B741C994C, 82B62C52018655B8A596E1E503CB31F0FA581780425A9FF44BE1248C0F3D4B3E ] amdxhc          C:\Windows\system32\drivers\amdxhc.sys
16:15:23.0688 0x0f50  amdxhc - ok
16:15:23.0704 0x0f50  [ 172C69FE64D07BDF5CE24146274F8CB8, 0A36069BA7B1E2C8B00E8E611E5F2AEF3A7571FAEA252752577EF9DE11F343DA ] amd_sata        C:\Windows\system32\drivers\amd_sata.sys
16:15:23.0704 0x0f50  amd_sata - ok
16:15:23.0720 0x0f50  [ A8FD2F5F3E70BE8FF66D2AFC6B6FB051, E5C9CDBEA96B008F2B73E5151B85867128479FBEEADF2500AB16E3B0692AC030 ] amd_xata        C:\Windows\system32\drivers\amd_xata.sys
16:15:23.0720 0x0f50  amd_xata - ok
16:15:23.0735 0x0f50  [ 8EFB9AD5E61A8B5D63739CB71499B642, 95BFDC90DF1AE629AA0F5AAC794FD86744E7A78E610AFD33B472A1157E8B0A5D ] AntiVirMailService C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
16:15:23.0782 0x0f50  AntiVirMailService - ok
16:15:23.0782 0x0f50  [ EBC58B585BC502B59EC2CC93FB4C43CF, 5D04E272CB4D5C66028B7959C37B8AA34B2E1FF02F3C3572F64340CFB7E27127 ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
16:15:23.0813 0x0f50  AntiVirSchedulerService - ok
16:15:23.0829 0x0f50  [ EBC58B585BC502B59EC2CC93FB4C43CF, 5D04E272CB4D5C66028B7959C37B8AA34B2E1FF02F3C3572F64340CFB7E27127 ] AntiVirService  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
16:15:23.0844 0x0f50  AntiVirService - ok
16:15:23.0860 0x0f50  [ A5C3BD78DC7D4DEC4A710E67381C0ABD, 7A5AADF26370C1CD3452579DB1688CF3B6FC743D1033049B43119370D15F5120 ] AntiVirWebService C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
16:15:23.0907 0x0f50  AntiVirWebService - ok
16:15:23.0907 0x0f50  [ 4542CC17440E85D2D2D73A7D40FAED0A, F157F9A137DEACFC5A1A982265F5CE05A79C0CF8F13291773E2351BEFCB94E08 ] Apowersoft_AudioDevice C:\Windows\system32\drivers\Apowersoft_AudioDevice.sys
16:15:23.0922 0x0f50  Apowersoft_AudioDevice - ok
16:15:23.0922 0x0f50  [ FCE5C79717A487BDC71F3DEC78A684CA, F5520F112A4EBDD10444AA5E9FDB9125219FCF768FEB95AB608BC84D60136816 ] AppID           C:\Windows\system32\drivers\appid.sys
16:15:23.0938 0x0f50  AppID - ok
16:15:23.0938 0x0f50  [ 8921E1D8AE5171691F186A7C5B98B630, 4A37313BB94D4B49D0294C9439AD0793DE328F9F4DA1C47E34E6ACEA46AF6E14 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
16:15:23.0954 0x0f50  AppIDSvc - ok
16:15:23.0954 0x0f50  [ DE23E052E557580674785CDF45B613F3, A955ADC6CC7D816BA7CE1065F911E7A3295A1908C22BE0A3C506C38CFEE8DE0D ] Appinfo         C:\Windows\System32\appinfo.dll
16:15:23.0969 0x0f50  Appinfo - ok
16:15:23.0985 0x0f50  [ 7D811EA7A2AAA49B0446D42CBC1CD338, AFECE5E44E48F756C7EB81D95C9237552AF8A9C02CBE756E0F3D3C6524DE49AD ] Apple Mobile Device Service C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
16:15:23.0985 0x0f50  Apple Mobile Device Service - ok
16:15:24.0000 0x0f50  [ 4ABA3E75A76195A3E38ED2766C962899, E2001ACD44DA270B8289DA362D26416676301773AB22616C211F31CF2E7869AA ] AppMgmt         C:\Windows\System32\appmgmts.dll
16:15:24.0016 0x0f50  AppMgmt - ok
16:15:24.0016 0x0f50  [ 599B1E15E806D6751FB7050B57571A4F, 2C805E320D4D85ABA67D5024E822A07A4F099A89A8C8F5713CC2FD2CCF9FC3CF ] arc             C:\Windows\system32\drivers\arc.sys
16:15:24.0032 0x0f50  arc - ok
16:15:24.0032 0x0f50  [ 7DA8553ED135357FE7B9C45529B5DC88, C78C0EA40C3DC24048AD0125A59A2FE01FC324CB0E641CC0286C668439D1B607 ] arcsas          C:\Windows\system32\drivers\arcsas.sys
16:15:24.0047 0x0f50  arcsas - ok
16:15:24.0063 0x0f50  [ EE424A5CE56E3923D59BB7DE2E15036D, 8B8196870EFE74D43EDA72674021A46846D370E97A6A058134D84A721AECD091 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
16:15:24.0063 0x0f50  aspnet_state - ok
16:15:24.0078 0x0f50  [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
16:15:24.0110 0x0f50  AsyncMac - ok
16:15:24.0110 0x0f50  [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi           C:\Windows\system32\drivers\atapi.sys
16:15:24.0125 0x0f50  atapi - ok
16:15:24.0125 0x0f50  [ 059A9BE0B331532F70623B6B0DF9A78D, 9E493A5C38D4DC1F16C91A611B7EE5156E06BAB37B91A9AACA388ECA7352C6E8 ] AtiPcie         C:\Windows\system32\drivers\AtiPcie.sys
16:15:24.0141 0x0f50  AtiPcie - ok
16:15:24.0156 0x0f50  [ 67C717EC24FCAAE7B518D9E06AD036AB, F08550E4FCEC2899FACEF2A18CEE3D068D5911FFD2FF5534E4921E56FB0AEF59 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
16:15:24.0172 0x0f50  AudioEndpointBuilder - ok
16:15:24.0188 0x0f50  [ 67C717EC24FCAAE7B518D9E06AD036AB, F08550E4FCEC2899FACEF2A18CEE3D068D5911FFD2FF5534E4921E56FB0AEF59 ] AudioSrv        C:\Windows\System32\Audiosrv.dll
16:15:24.0219 0x0f50  AudioSrv - ok
16:15:24.0219 0x0f50  [ 92C7B635DF75182734593518D6B2B9EC, EAE9F2F6632EE2EF5D969DF59638154214F3E3B362BED487B650572E40E79FC1 ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
16:15:24.0234 0x0f50  avgntflt - ok
16:15:24.0234 0x0f50  [ 0FA902548690E3B3435EB60ACB142352, 2C9D5FB253BD55B0452F0F74C0E939B256011A1282494EBF529A8795A8F8DD71 ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
16:15:24.0250 0x0f50  avipbb - ok
16:15:24.0250 0x0f50  [ 390184FAD8FCC1B6DA25AEBAE928C3B6, 537B0E0FAE080B55D70E990BBA0F7F22903CA340F6A42039BAD617A8ECF59119 ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
16:15:24.0266 0x0f50  avkmgr - ok
16:15:24.0266 0x0f50  [ 13253E5E3B6BDF945B63B336A8C9489B, 671C716E43F89D4BDDAA2BE045CDEBBB569C85BC2BA334E1F550187B79A7740D ] avnetflt        C:\Windows\system32\DRIVERS\avnetflt.sys
16:15:24.0281 0x0f50  avnetflt - ok
16:15:24.0281 0x0f50  [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV        C:\Windows\System32\AxInstSV.dll
16:15:24.0297 0x0f50  AxInstSV - ok
16:15:24.0312 0x0f50  [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv         C:\Windows\system32\drivers\bxvbda.sys
16:15:24.0328 0x0f50  b06bdrv - ok
16:15:24.0344 0x0f50  [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
16:15:24.0359 0x0f50  b57nd60a - ok
16:15:24.0359 0x0f50  [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC          C:\Windows\System32\bdesvc.dll
16:15:24.0375 0x0f50  BDESVC - ok
16:15:24.0375 0x0f50  [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep            C:\Windows\system32\drivers\Beep.sys
16:15:24.0406 0x0f50  Beep - ok
16:15:24.0422 0x0f50  [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE             C:\Windows\System32\bfe.dll
16:15:24.0437 0x0f50  BFE - ok
16:15:24.0453 0x0f50  [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS            C:\Windows\System32\qmgr.dll
16:15:24.0515 0x0f50  BITS - ok
16:15:24.0515 0x0f50  [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
16:15:24.0531 0x0f50  blbdrive - ok
16:15:24.0546 0x0f50  [ B5C2F92EE1106DFE7BB1CCE4D35B6037, E399C390687589194D8AAD385055F0CFA7D52AD9E837D8FF95008B8EB2B34E50 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
16:15:24.0562 0x0f50  Bonjour Service - ok
16:15:24.0578 0x0f50  [ ABA3984C822E4D3F889699912D85D6C5, 2251FA135CC290DA13DAE4743F393C7CC9E6A737C054707CB8D72C369D1FFACB ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
16:15:24.0593 0x0f50  bowser - ok
16:15:24.0593 0x0f50  [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo        C:\Windows\system32\drivers\BrFiltLo.sys
16:15:24.0609 0x0f50  BrFiltLo - ok
16:15:24.0609 0x0f50  [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp        C:\Windows\system32\drivers\BrFiltUp.sys
16:15:24.0624 0x0f50  BrFiltUp - ok
16:15:24.0624 0x0f50  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser         C:\Windows\System32\browser.dll
16:15:24.0640 0x0f50  Browser - ok
16:15:24.0656 0x0f50  [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
16:15:24.0671 0x0f50  Brserid - ok
16:15:24.0671 0x0f50  [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
16:15:24.0687 0x0f50  BrSerWdm - ok
16:15:24.0687 0x0f50  [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
16:15:24.0702 0x0f50  BrUsbMdm - ok
16:15:24.0702 0x0f50  [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
16:15:24.0718 0x0f50  BrUsbSer - ok
16:15:24.0718 0x0f50  [ 62D38645A251A5742027B0A48672FFE5, 60EDAFB548EF5BC2C90308189E4C14435C83065CE4B23830A255D2D4AE5884F9 ] BrYNSvc         C:\Program Files (x86)\Browny02\BrYNSvc.exe
16:15:24.0749 0x0f50  BrYNSvc - detected UnsignedFile.Multi.Generic ( 1 )
16:15:25.0124 0x0f50  Detect skipped due to KSN trusted
16:15:25.0124 0x0f50  BrYNSvc - ok
16:15:25.0139 0x0f50  BsHelpCS - ok
16:15:25.0139 0x0f50  BtAudioBusSrv - ok
16:15:25.0139 0x0f50  [ CF98190A94F62E405C8CB255018B2315, E1B2540023C4FE9FD588E4B6AE6347DFA565EB3898F21E5360882BF3E8B5E781 ] BthEnum         C:\Windows\system32\drivers\BthEnum.sys
16:15:25.0155 0x0f50  BthEnum - ok
16:15:25.0155 0x0f50  BthL2caScoIfSrv - ok
16:15:25.0155 0x0f50  [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
16:15:25.0170 0x0f50  BTHMODEM - ok
16:15:25.0186 0x0f50  [ 02DD601B708DD0667E1331FA8518E9FF, 7DE6CC4DBB621CD03B01D9CE6CF66EAFE31D39030A391562CD0E278E1D70ADE1 ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys
16:15:25.0202 0x0f50  BthPan - ok
16:15:25.0202 0x0f50  [ 738D0E9272F59EB7A1449C3EC118E6C4, FE3D32C2A5E4DC21376A0F89C0B2EE024ECF1A3FB99213CC9BBC986ADF7AF080 ] BTHPORT         C:\Windows\System32\Drivers\BTHport.sys
16:15:25.0233 0x0f50  BTHPORT - ok
16:15:25.0233 0x0f50  [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv         C:\Windows\system32\bthserv.dll
16:15:25.0264 0x0f50  bthserv - ok
16:15:25.0264 0x0f50  [ F188B7394D81010767B6DF3178519A37, 576304E92FD94908F093A6AB5F4D328F25829BE32EC3CA0D29EBFDF5DE83539B ] BTHUSB          C:\Windows\System32\Drivers\BTHUSB.sys
16:15:25.0280 0x0f50  BTHUSB - ok
16:15:25.0280 0x0f50  btUrbFilterDrv - ok
16:15:25.0280 0x0f50  [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
16:15:25.0311 0x0f50  cdfs - ok
16:15:25.0311 0x0f50  [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys
16:15:25.0326 0x0f50  cdrom - ok
16:15:25.0326 0x0f50  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc     C:\Windows\System32\certprop.dll
16:15:25.0358 0x0f50  CertPropSvc - ok
16:15:25.0358 0x0f50  [ CF3FFDA7B06A62DC018AFF75B4749FF4, B9ECE0A37CA4A389114737EADF68334DBF6A77214E8794ADFC6F83AD42F90D56 ] chip1click      C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe
16:15:25.0451 0x0f50  chip1click - detected UnsignedFile.Multi.Generic ( 1 )
16:15:25.0857 0x0f50  chip1click ( UnsignedFile.Multi.Generic ) - warning
16:15:26.0340 0x0f50  [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass        C:\Windows\system32\drivers\circlass.sys
16:15:26.0356 0x0f50  circlass - ok
16:15:26.0356 0x0f50  [ 3D67C27DD17B254D7915FA16A5AE3573, 5B3A6C6A7F940C06362775DAF13CEADA37C7AA84A509458A57C23B4369970A90 ] CLFS            C:\Windows\system32\CLFS.sys
16:15:26.0387 0x0f50  CLFS - ok
16:15:26.0387 0x0f50  [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
16:15:26.0403 0x0f50  clr_optimization_v2.0.50727_32 - ok
16:15:26.0403 0x0f50  [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
16:15:26.0418 0x0f50  clr_optimization_v2.0.50727_64 - ok
16:15:26.0418 0x0f50  [ 5BAF4F1296D4D91FC28560CDB4C37C4B, ACA4BC57ED1F8432F18F0F215EC7FF956BAEF6E02760779E264E4008A979E9DD ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
16:15:26.0434 0x0f50  clr_optimization_v4.0.30319_32 - ok
16:15:26.0450 0x0f50  [ 569B54004A7E85A74FD92841DE6058E2, 58949313D0F6B1C06359B2F3C68E29940B1655A17E93FFC3718F6D2EAE1633E4 ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
16:15:26.0465 0x0f50  clr_optimization_v4.0.30319_64 - ok
16:15:26.0465 0x0f50  [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt          C:\Windows\system32\drivers\CmBatt.sys
16:15:26.0465 0x0f50  CmBatt - ok
16:15:26.0481 0x0f50  [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide          C:\Windows\system32\drivers\cmdide.sys
16:15:26.0481 0x0f50  cmdide - ok
16:15:26.0496 0x0f50  [ A98CED39AD91B445E2E442A9BD67E8B4, B4189DEEF1C0EE22AE983119047B1A40FFDD8F3E163DFFABD7C2706231B0B1B0 ] CNG             C:\Windows\system32\Drivers\cng.sys
16:15:26.0512 0x0f50  CNG - ok
16:15:26.0512 0x0f50  [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt        C:\Windows\system32\drivers\compbatt.sys
16:15:26.0528 0x0f50  Compbatt - ok
16:15:26.0528 0x0f50  [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus    C:\Windows\system32\DRIVERS\CompositeBus.sys
16:15:26.0543 0x0f50  CompositeBus - ok
16:15:26.0543 0x0f50  COMSysApp - ok
16:15:26.0559 0x0f50  [ 49230342527B6C9628F3D5357B524620, C17813469C293F3C47D63E73A94B3E46AA4E6C67B487A06F6D0FFF8B2D5EC6FF ] cphs            C:\Windows\SysWow64\IntelCpHeciSvc.exe
16:15:26.0590 0x0f50  cphs - ok
16:15:26.0590 0x0f50  [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk         C:\Windows\system32\drivers\crcdisk.sys
16:15:26.0606 0x0f50  crcdisk - ok
16:15:26.0606 0x0f50  [ 2C6632CECFDBBE793FDA8AF9CA55A9CC, 335188515F798483660E529204A13012E4D21B0ECA489224A11C26F91A5B3CCE ] CryptSvc        C:\Windows\system32\cryptsvc.dll
16:15:26.0621 0x0f50  CryptSvc - ok
16:15:26.0637 0x0f50  [ 54DA3DFD29ED9F1619B6F53F3CE55E49, 9177C6907A983296BF188892A894B668A09FFA058FD56B50FE12940D54B0FA5E ] CSC             C:\Windows\system32\drivers\csc.sys
16:15:26.0652 0x0f50  CSC - ok
16:15:26.0668 0x0f50  [ 3AB183AB4D2C79DCF459CD2C1266B043, 72B0187EBA9DC74E61EC5CB3DC24058DDB768843E865801894AAEAA211610C56 ] CscService      C:\Windows\System32\cscsvc.dll
16:15:26.0684 0x0f50  CscService - ok
16:15:26.0699 0x0f50  [ 9A82EA202D718C5A589936F8E06E1A28, C05707B17CC30984527BC2FC6426BEEAD6D2BEF795F769EEF5A89B7A2529C286 ] DATEV Sicherheitspaket-Dienst C:\Program Files (x86)\DATEV\SiPacompact\SiPaHostService.exe
16:15:26.0715 0x0f50  DATEV Sicherheitspaket-Dienst - ok
16:15:26.0730 0x0f50  [ A1F58FFF448E4099297D6EE0641D4D0E, 47839789332AAF8861F7731BF2D3FBB5E0991EA0D0B457BB4C8C1784F76C73DC ] dbupdate        C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
16:15:26.0746 0x0f50  dbupdate - ok
16:15:26.0746 0x0f50  [ A1F58FFF448E4099297D6EE0641D4D0E, 47839789332AAF8861F7731BF2D3FBB5E0991EA0D0B457BB4C8C1784F76C73DC ] dbupdatem       C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
16:15:26.0777 0x0f50  dbupdatem - ok
16:15:26.0777 0x0f50  dbx - ok
16:15:26.0777 0x0f50  [ BC8C3896575B06303564265742142775, 38F64F215755E410F69F5BD88FCE6011093665F4C29DEE60A70632221D0C2BB3 ] DbxSvc          C:\Windows\system32\DbxSvc.exe
16:15:26.0793 0x0f50  DbxSvc - ok
16:15:26.0808 0x0f50  [ 622C96AFB07BB82C8650B47172137AC4, B74CEA5A3F4945E5A3EAE7AF1B1FA75F611C65C6FACE393052A512FA81B0C17C ] DcomLaunch      C:\Windows\system32\rpcss.dll
16:15:26.0824 0x0f50  DcomLaunch - ok
16:15:26.0840 0x0f50  [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc       C:\Windows\System32\defragsvc.dll
16:15:26.0855 0x0f50  defragsvc - ok
16:15:26.0871 0x0f50  [ 9B38580063D281A99E68EF5813022A5F, D91676B0E0A8E2A090E3E5DD340ABCFC20AE0F55B4C82869D6CFB34239BD27DA ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
16:15:26.0886 0x0f50  DfsC - ok
16:15:26.0886 0x0f50  [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp            C:\Windows\system32\dhcpcore.dll
16:15:26.0918 0x0f50  Dhcp - ok
16:15:26.0933 0x0f50  [ EE9954237F15BE4DD9304D12E4D305ED, F295C9BAF20F0E669B673AFCC16B4969EE31B6A3808980DAB93D9B0F167DA3C0 ] DiagTrack       C:\Windows\system32\diagtrack.dll
16:15:26.0964 0x0f50  DiagTrack - ok
16:15:26.0964 0x0f50  DIRECTIO - ok
16:15:26.0980 0x0f50  [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache        C:\Windows\system32\drivers\discache.sys
16:15:26.0996 0x0f50  discache - ok
16:15:26.0996 0x0f50  [ 616387BBD83372220B09DE95F4E67BBC, 5E2D5280BB775576E7CDE3FA6BDE494E183123635E5908CF7EBF1FF52966D07D ] Disk            C:\Windows\system32\drivers\disk.sys
16:15:27.0011 0x0f50  Disk - ok
16:15:27.0011 0x0f50  [ 5DB085A8A6600BE6401F2B24EECB5415, 5FC5C7C1B4DB7BF6EFD0992E91DB41FD047E90D1ABA0B8F868CB72557F88FB13 ] dmvsc           C:\Windows\system32\drivers\dmvsc.sys
16:15:27.0027 0x0f50  dmvsc - ok
16:15:27.0042 0x0f50  [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
16:15:27.0058 0x0f50  Dnscache - ok
16:15:27.0058 0x0f50  [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc         C:\Windows\System32\dot3svc.dll
16:15:27.0089 0x0f50  dot3svc - ok
16:15:27.0089 0x0f50  [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS             C:\Windows\system32\dps.dll
16:15:27.0120 0x0f50  DPS - ok
16:15:27.0120 0x0f50  [ 26FE888505E5A945B0536AF9A2A27A6F, A6B16ED498BAFE300E1F0E0A241E3D62F7A1C5973EE775904ED14F33A2BC08A6 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
16:15:27.0136 0x0f50  drmkaud - ok
16:15:27.0152 0x0f50  [ 3A9D7D464BDB3B70D7ECF689ADABBD4D, B4F5B23705EA1BA453FE30791CA245E1A5F7FBEABAD026E4A8A15A9FC44E8C9C ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
16:15:27.0167 0x0f50  DXGKrnl - ok
16:15:27.0183 0x0f50  [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost         C:\Windows\System32\eapsvc.dll
16:15:27.0198 0x0f50  EapHost - ok
16:15:27.0245 0x0f50  [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv           C:\Windows\system32\drivers\evbda.sys
16:15:27.0308 0x0f50  ebdrv - ok
16:15:27.0323 0x0f50  [ 6918ACBA1558AF363F6AA8D217AFCA8D, D8CA4E9F3FA0F5CE674D647DDBFD3C3676A07FB0268BBB51782468E144575F49 ] EFS             C:\Windows\System32\lsass.exe
16:15:27.0339 0x0f50  EFS - ok
16:15:27.0339 0x0f50  [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
16:15:27.0370 0x0f50  ehRecvr - ok
16:15:27.0370 0x0f50  [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched         C:\Windows\ehome\ehsched.exe
16:15:27.0386 0x0f50  ehSched - ok
16:15:27.0401 0x0f50  [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor         C:\Windows\system32\drivers\elxstor.sys
16:15:27.0417 0x0f50  elxstor - ok
16:15:27.0417 0x0f50  [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
16:15:27.0432 0x0f50  ErrDev - ok
16:15:27.0432 0x0f50  [ 047244823B2EA707E1F6076CA20DEF90, FEC862FA755A2D94306C774E9AE1E79334E5BB31992B78B0DAE8DA41C14DC839 ] ESProtectionDriver C:\Windows\system32\drivers\mbae64.sys
16:15:27.0448 0x0f50  ESProtectionDriver - ok
16:15:27.0448 0x0f50  [ 3663291D0D26001A2BB67678AB61D14C, 33199EA9E25E2C262E58ADAA41030AF353A73F3C23225F457CDE1AC22E9A4FE3 ] EtronHub3       C:\Windows\System32\Drivers\EtronHub3.sys
16:15:27.0464 0x0f50  EtronHub3 - ok
16:15:27.0464 0x0f50  [ 744420D6C062C38F7361870F010D6D4B, F4FFA21A6DE872D5ACEC3DAD46AE2F18517CD11FD04D19D959643AA508B3E85E ] EtronXHCI       C:\Windows\System32\Drivers\EtronXHCI.sys
16:15:27.0479 0x0f50  EtronXHCI - ok
16:15:27.0495 0x0f50  [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem     C:\Windows\system32\es.dll
16:15:27.0526 0x0f50  EventSystem - ok
16:15:27.0526 0x0f50  [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat           C:\Windows\system32\drivers\exfat.sys
16:15:27.0557 0x0f50  exfat - ok
16:15:27.0557 0x0f50  [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat         C:\Windows\system32\drivers\fastfat.sys
16:15:27.0588 0x0f50  fastfat - ok
16:15:27.0604 0x0f50  [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax             C:\Windows\system32\fxssvc.exe
16:15:27.0620 0x0f50  Fax - ok
16:15:27.0620 0x0f50  [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc             C:\Windows\system32\drivers\fdc.sys
16:15:27.0635 0x0f50  fdc - ok
16:15:27.0635 0x0f50  [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost         C:\Windows\system32\fdPHost.dll
16:15:27.0666 0x0f50  fdPHost - ok
16:15:27.0666 0x0f50  [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub        C:\Windows\system32\fdrespub.dll
16:15:27.0698 0x0f50  FDResPub - ok
16:15:27.0698 0x0f50  [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
16:15:27.0713 0x0f50  FileInfo - ok
16:15:27.0713 0x0f50  [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
16:15:27.0729 0x0f50  Filetrace - ok
16:15:27.0744 0x0f50  [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk        C:\Windows\system32\drivers\flpydisk.sys
16:15:27.0744 0x0f50  flpydisk - ok
16:15:27.0760 0x0f50  [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
16:15:27.0776 0x0f50  FltMgr - ok
16:15:27.0791 0x0f50  [ 700A5373FA66F1DAAECBD2CFB88C73ED, D6C1C4C846BC24EB6539ECC701A456FA53BB6679C79391F5B70580D47B6CE395 ] FontCache       C:\Windows\system32\FntCache.dll
16:15:27.0822 0x0f50  FontCache - ok
16:15:27.0822 0x0f50  [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
16:15:27.0838 0x0f50  FontCache3.0.0.0 - ok
16:15:27.0838 0x0f50  [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
16:15:27.0854 0x0f50  FsDepends - ok
16:15:27.0854 0x0f50  [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
16:15:27.0869 0x0f50  Fs_Rec - ok
16:15:27.0869 0x0f50  [ 7135030CBF87D724B6037BB023923730, 1F6D9A7D7033226507DEDD53CB686C0F3CDC15FD7E77DBC5263256E8EB541E4E ] FUJ02E3         C:\Windows\system32\drivers\FUJ02E3.sys
16:15:27.0885 0x0f50  FUJ02E3 - ok
16:15:27.0885 0x0f50  [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
16:15:27.0900 0x0f50  fvevol - ok
16:15:27.0900 0x0f50  [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
16:15:27.0916 0x0f50  gagp30kx - ok
16:15:27.0916 0x0f50  [ 8E98D21EE06192492A5671A6144D092F, B8F656B34D361EA5AFB47F3A67AB2221580DADA59C8CD0CB83181E4AD8B562B4 ] GEARAspiWDM     C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
16:15:27.0932 0x0f50  GEARAspiWDM - ok
16:15:27.0932 0x0f50  GoToAssist Remote Support Customer - ok
16:15:27.0947 0x0f50  [ E4AE497857409127ED57562AF913A903, 262ADD713B1FBF6200550967D1F8635B55D01BBD8FA2E753536E71A4EC87867B ] gpsvc           C:\Windows\System32\gpsvc.dll
16:15:27.0963 0x0f50  gpsvc - ok
16:15:27.0978 0x0f50  [ C8B54E81501386A91B0E0BD596965C9B, DC2580D45BA96C81C0BC005781BBB5E70652A1CAA637FE1B779AB538B040BB97 ] gzflt           C:\Program Files\ITbrain\AntiMalware\gzflt.sys
16:15:27.0994 0x0f50  gzflt - ok
16:15:27.0994 0x0f50  [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
16:15:28.0010 0x0f50  hcw85cir - ok
16:15:28.0010 0x0f50  [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
16:15:28.0025 0x0f50  HDAudBus - ok
16:15:28.0025 0x0f50  [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt         C:\Windows\system32\drivers\HidBatt.sys
16:15:28.0041 0x0f50  HidBatt - ok
16:15:28.0041 0x0f50  [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth          C:\Windows\system32\drivers\hidbth.sys
16:15:28.0056 0x0f50  HidBth - ok
16:15:28.0056 0x0f50  [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr           C:\Windows\system32\drivers\hidir.sys
16:15:28.0072 0x0f50  HidIr - ok
16:15:28.0072 0x0f50  [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv         C:\Windows\system32\hidserv.dll
16:15:28.0103 0x0f50  hidserv - ok
16:15:28.0103 0x0f50  [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
16:15:28.0119 0x0f50  HidUsb - ok
16:15:28.0119 0x0f50  HitmanProScheduler - ok
16:15:28.0119 0x0f50  [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc          C:\Windows\system32\kmsvc.dll
16:15:28.0150 0x0f50  hkmsvc - ok
16:15:28.0150 0x0f50  [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
16:15:28.0181 0x0f50  HomeGroupListener - ok
16:15:28.0181 0x0f50  [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
16:15:28.0197 0x0f50  HomeGroupProvider - ok
16:15:28.0197 0x0f50  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
16:15:28.0212 0x0f50  HpSAMD - ok
16:15:28.0228 0x0f50  [ F61634BEC53F73702A10DE69F6DCAF57, BBA7344CF3AB96A46D1A6F1D50F2758EA8D097FE558C38B4EF45C8C334AF96E1 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
16:15:28.0244 0x0f50  HTTP - ok
16:15:28.0259 0x0f50  [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
16:15:28.0259 0x0f50  hwpolicy - ok
16:15:28.0259 0x0f50  [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
16:15:28.0275 0x0f50  i8042prt - ok
16:15:28.0290 0x0f50  [ 87A72502C8AC5E89B5A46FF6E874F5C5, A72C8C96BA29B5894A3085CA2ADB6343FEFA79534B334416F8D4751CF8A30008 ] IAMTVE          C:\Windows\system32\drivers\IAMTVE.sys
16:15:28.0290 0x0f50  IAMTVE - ok
16:15:28.0306 0x0f50  [ 5516F8E518A2F6A8755498F3E73957CF, 55CCE4501B44F756D31BA0E353597F0C9E12FDFF7205B05114A8CF1D7D506365 ] IAMTXPE         C:\Windows\system32\drivers\IAMTXPE.sys
16:15:28.0306 0x0f50  IAMTXPE - ok
16:15:28.0322 0x0f50  [ 57CD95DEB3529181BCC931DD2DFB2341, 03ACF906E4C3CF954F503900F42C7A60FCD5624772B90A956F032484146E42B7 ] iaStorA         C:\Windows\system32\drivers\iaStorA.sys
16:15:28.0337 0x0f50  iaStorA - ok
16:15:28.0337 0x0f50  [ CE5CD8CBE940965867D507AB8EA2795A, 1CC2C23A1436E4C911DD3B942D8F6DABB7249AB04426F9AB6B6045034226DD25 ] iaStorF         C:\Windows\system32\drivers\iaStorF.sys
16:15:28.0353 0x0f50  iaStorF - ok
16:15:28.0368 0x0f50  [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
16:15:28.0384 0x0f50  iaStorV - ok
16:15:28.0415 0x0f50  [ 5AD5A7781BE907D6E2D75CA1DADAA97B, 355234ED6E49A1080CFFC9C18D185DA653A00C6B79B204368A971EACE5A416A9 ] IconMan_R       C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
16:15:28.0462 0x0f50  IconMan_R - ok
16:15:28.0478 0x0f50  [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
16:15:28.0509 0x0f50  idsvc - ok
16:15:28.0509 0x0f50  IEEtwCollectorService - ok
16:15:28.0509 0x0f50  [ 35AB259CD3F49D16B705EF63C1D215E6, 0754483442B9DD64C347590137269991CCACEC0174FE497999BC32BE1B4AA1A9 ] IFCoEMP         C:\Windows\system32\drivers\ifM60x64.sys
16:15:28.0540 0x0f50  IFCoEMP - ok
16:15:28.0540 0x0f50  [ 8E9C28F603738B1E5FA31B1D48605C51, 62B4B31D5E3C5BECC05B895589A0307C1D1F6AD78928F265B3B10D531B67E69D ] IFCoES          C:\Windows\system32\drivers\IFP60X64.sys
16:15:28.0556 0x0f50  IFCoES - ok
16:15:28.0556 0x0f50  [ 8E9C28F603738B1E5FA31B1D48605C51, 62B4B31D5E3C5BECC05B895589A0307C1D1F6AD78928F265B3B10D531B67E69D ] IFCoEVB         C:\Windows\system32\drivers\ifP60X64.sys
16:15:28.0571 0x0f50  IFCoEVB - ok
16:15:28.0618 0x0f50  [ A8E76E4E3F32F33A6DE07B666460ACED, 109B8AA6DE02BE84792BA06AD1D12E086208A90CC35DCFF513D15EFFCE13306A ] igfx            C:\Windows\system32\DRIVERS\igdkmd64.sys
16:15:28.0712 0x0f50  igfx - ok
16:15:28.0727 0x0f50  [ 3051E3530952CD960C9A5A5AF4725049, F561284D3AC68AC4380D8079F58A25B8ADEA5990BC4EA4345E317D27F58B3BC8 ] igfxCUIService1.0.0.0 C:\Windows\system32\igfxCUIService.exe
16:15:28.0743 0x0f50  igfxCUIService1.0.0.0 - ok
16:15:28.0743 0x0f50  [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp           C:\Windows\system32\drivers\iirsp.sys
16:15:28.0758 0x0f50  iirsp - ok
16:15:28.0774 0x0f50  [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT          C:\Windows\System32\ikeext.dll
16:15:28.0805 0x0f50  IKEEXT - ok
16:15:28.0805 0x0f50  [ DD587A55390ED2295BCE6D36AD567DA9, AEB7DCB8EF89BEE8D9649A05FC482B1E4E3F44243D57A2577C862EB69166C48E ] Impcd           C:\Windows\system32\drivers\Impcd.sys
16:15:28.0821 0x0f50  Impcd - ok
16:15:28.0883 0x0f50  [ 689F04285EF20E98B4F338AF7523A4C2, C2D1EB41382A346607BD91CDBFAEACBC4087EC8482312CBE2E6FBCB87E1B8320 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
16:15:28.0961 0x0f50  IntcAzAudAddService - ok
16:15:28.0961 0x0f50  [ 8AEEE0F4D210B61F917CFEA9653973C4, F09389C2A3E1DED402C08BF1A30BD79A342B0E55AD4996CF2E5189A004E6E62F ] IntcDAud        C:\Windows\system32\DRIVERS\IntcDAud.sys
16:15:28.0992 0x0f50  IntcDAud - ok
16:15:28.0992 0x0f50  [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide        C:\Windows\system32\drivers\intelide.sys
16:15:29.0008 0x0f50  intelide - ok
16:15:29.0008 0x0f50  [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
16:15:29.0024 0x0f50  intelppm - ok
16:15:29.0024 0x0f50  [ E45575812630B049CE0F679D87561A4D, 2645B87960DAA51295530ECF5518E5872B17520293068E7DEA064FEAE3884E87 ] ioatdma1        C:\Windows\System32\Drivers\qd162x64.sys
16:15:29.0024 0x0f50  ioatdma1 - ok
16:15:29.0039 0x0f50  [ 2C23820DD9E81199E60F553EB50BC449, AF3847AD90A79E9D22DC67F4ED52B1D3FAF7C6420D60F2044C1FB49FD338BB70 ] ioatdma2        C:\Windows\System32\Drivers\qd262x64.sys
16:15:29.0039 0x0f50  ioatdma2 - ok
16:15:29.0055 0x0f50  [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
16:15:29.0070 0x0f50  IPBusEnum - ok
16:15:29.0070 0x0f50  [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
16:15:29.0102 0x0f50  IpFilterDriver - ok
16:15:29.0117 0x0f50  [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
16:15:29.0133 0x0f50  iphlpsvc - ok
16:15:29.0133 0x0f50  [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys
16:15:29.0148 0x0f50  IPMIDRV - ok
16:15:29.0148 0x0f50  [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
16:15:29.0180 0x0f50  IPNAT - ok
16:15:29.0195 0x0f50  [ 17EE7DFC68F1656A00A686DF2FB67E09, 759B66F7C9169B8728ECE9D4800DF218B303CEA4D69DDE20239B7C13EDB1DB65 ] iPod Service    C:\Program Files\iPod\bin\iPodService.exe
16:15:29.0211 0x0f50  iPod Service - ok
16:15:29.0211 0x0f50  [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM          C:\Windows\system32\drivers\irenum.sys
16:15:29.0226 0x0f50  IRENUM - ok
16:15:29.0242 0x0f50  [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
16:15:29.0242 0x0f50  isapnp - ok
16:15:29.0258 0x0f50  [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
16:15:29.0273 0x0f50  iScsiPrt - ok
16:15:29.0273 0x0f50  [ 8D8CF4CC76BA92C272DD0E1F4A23D892, 85F83BE5C0720ACA3B4F7AE16A286D607A25F3B736F49CDDDB5ACA3D0AA3594D ] iSSetup         C:\Windows\system32\drivers\iSSetup.sys
16:15:29.0289 0x0f50  iSSetup - ok
16:15:29.0351 0x0f50  [ DEB91E8B603FBE1CD8D08AF25317ECBE, 2E3C8C3A335E78A0A4DE1294AEF6D4ACD1B039E4F04559DE4BE2C2DE0D2BCF9F ] ITbrainAntiMalwareService C:\Program Files\ITbrain\AntiMalware\ITbrain_AntiMalware_Service.exe
16:15:29.0429 0x0f50  ITbrainAntiMalwareService - ok
16:15:29.0445 0x0f50  [ 45392E76EE30DC9C8F0181C785F0BA48, 7FB522E1AA9B877B9FB1A29C2ADC42EA794E8864AD2411AD275F00F00547F8F3 ] iusb3hcs        C:\Windows\system32\drivers\iusb3hcs.sys
16:15:29.0445 0x0f50  iusb3hcs - ok
16:15:29.0460 0x0f50  [ C6E8FB7FF41877378CCB30DE6E9941DF, CA808A00C0CC21C1C7BE54F0D1E5D3F24C0032BE821C064E0A63901F20F3C6BC ] iusb3hub        C:\Windows\system32\DRIVERS\iusb3hub.sys
16:15:29.0476 0x0f50  iusb3hub - ok
16:15:29.0492 0x0f50  [ 6FBA980433B2B21604CE990FBF542D3F, ACB35A5558DD9EF9A339C9D061207AF5527D3AEFC9AC99AB6CFBA1CE92F8B62D ] iusb3xhc        C:\Windows\system32\DRIVERS\iusb3xhc.sys
16:15:29.0507 0x0f50  iusb3xhc - ok
16:15:29.0523 0x0f50  [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
16:15:29.0523 0x0f50  kbdclass - ok
16:15:29.0523 0x0f50  [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
16:15:29.0538 0x0f50  kbdhid - ok
16:15:29.0538 0x0f50  [ 6918ACBA1558AF363F6AA8D217AFCA8D, D8CA4E9F3FA0F5CE674D647DDBFD3C3676A07FB0268BBB51782468E144575F49 ] KeyIso          C:\Windows\system32\lsass.exe
16:15:29.0554 0x0f50  KeyIso - ok
16:15:29.0554 0x0f50  KMS-R@1n - ok
16:15:29.0570 0x0f50  [ 3209D40399078C1091398F43215EDD1A, 4F4A5D85D06352DAD09ECB5BD272FC011DF23F6787CCE51AC9BCDD2A48DDA16F ] KOBCCID         C:\Windows\system32\drivers\KOBCCID.sys
16:15:29.0585 0x0f50  KOBCCID - ok
16:15:29.0585 0x0f50  [ F54475BA70B5CDA4EF11DC44BFB07F40, 9A6FA4978746F2F75D6B5892C1FE2042FF86C588AFEEC80534E0FB2F4450F9C3 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
16:15:29.0601 0x0f50  KSecDD - ok
16:15:29.0601 0x0f50  [ ED1D1E1AAACF08438F9BCF731C8CA168, 8DFE5F7E1080B65A75BC840708AB7A42EA42510D5507EF86294649C72430B569 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
16:15:29.0616 0x0f50  KSecPkg - ok
16:15:29.0616 0x0f50  [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys
16:15:29.0648 0x0f50  ksthunk - ok
16:15:29.0648 0x0f50  [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm           C:\Windows\system32\msdtckrm.dll
16:15:29.0679 0x0f50  KtmRm - ok
16:15:29.0694 0x0f50  [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer    C:\Windows\system32\srvsvc.dll
16:15:29.0710 0x0f50  LanmanServer - ok
16:15:29.0726 0x0f50  [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
16:15:29.0757 0x0f50  LanmanWorkstation - ok
16:15:29.0757 0x0f50  [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
16:15:29.0788 0x0f50  lltdio - ok
16:15:29.0788 0x0f50  [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc         C:\Windows\System32\lltdsvc.dll
16:15:29.0819 0x0f50  lltdsvc - ok
16:15:29.0819 0x0f50  [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts         C:\Windows\System32\lmhsvc.dll
16:15:29.0850 0x0f50  lmhosts - ok
16:15:29.0850 0x0f50  [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
16:15:29.0866 0x0f50  LSI_FC - ok
16:15:29.0866 0x0f50  [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS         C:\Windows\system32\drivers\lsi_sas.sys
16:15:29.0882 0x0f50  LSI_SAS - ok
16:15:29.0882 0x0f50  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys
16:15:29.0897 0x0f50  LSI_SAS2 - ok
16:15:29.0897 0x0f50  [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
16:15:29.0913 0x0f50  LSI_SCSI - ok
16:15:29.0913 0x0f50  [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv           C:\Windows\system32\drivers\luafv.sys
16:15:29.0944 0x0f50  luafv - ok
16:15:29.0991 0x0f50  [ 9A1C84ADA9AC4AC2267DAD1B6A7B215A, CF2DC5A43C3AB3F5BAB4D72460141D6FA78441CF9973BD3CDBE7859242B065E3 ] MB3Service      C:\Program Files\Malwarebytes\Anti-Ransomware\MB3Service.exe
16:15:30.0053 0x0f50  MB3Service - ok
16:15:30.0069 0x0f50  [ 63A21EA86645B123AA785B67B42DF14A, C4678E2F9AB656A736DB067D59C57F00C839C2A935DE7E2874FB574F4AB7532C ] MB3SwissArmy    C:\Windows\system32\drivers\MB3SwissArmy.sys
16:15:30.0084 0x0f50  MB3SwissArmy - ok
16:15:30.0084 0x0f50  [ 3BEC6134F1E45AEF5E971F69F0D38510, 245D7CEEB6561166EE0472551D39A9D3CFDDA52A6BF2E924AB243CCA7FBC9009 ] MBAMChameleon   C:\Windows\system32\drivers\MBAMChameleon.sys
16:15:30.0100 0x0f50  MBAMChameleon - ok
16:15:30.0116 0x0f50  [ F3960CA85778E5D7611EE0F501972340, 0DE5C8509A9A66C8185B9FAA7EAF69C0FA9C28CD9DE84AA23E128E4FF8E06BF4 ] MBAMFarflt      C:\Windows\system32\drivers\farflt.sys
16:15:30.0131 0x0f50  MBAMFarflt - ok
16:15:30.0131 0x0f50  [ 88BD122C3A35DE63D75D382DF75554CE, ABDF59543CAD186A6ED4E66257205D9CF5047732A5DA74A96A28B468B41BC396 ] MBAMProtection  C:\Windows\system32\drivers\mbam.sys
16:15:30.0147 0x0f50  MBAMProtection - ok
16:15:30.0209 0x0f50  [ 28E521A6ABA9DE062A3719452816F495, B312A37DA052229DFB19353170CD5828582F8AC6426E857CA7C8ACA0DD91C160 ] MBAMService     C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
16:15:30.0272 0x0f50  MBAMService - ok
16:15:30.0287 0x0f50  [ ABB371D9AEF728B0489B0E6872B4A1C0, E9539A4F85FE30F5BAED742778CA74C879995728668ABE6877C37633716D8770 ] MBAMSwissArmy   C:\Windows\system32\drivers\MBAMSwissArmy.sys
16:15:30.0303 0x0f50  MBAMSwissArmy - ok
16:15:30.0303 0x0f50  [ 90AF4ED8A8D28C40F162DDC1ABD49C42, 32F93DD5E627097762FC42C3E211DD86D5FDA82A7FCF8DFCD81569E1D5BC680F ] MBAMWebProtection C:\Windows\system32\drivers\mwac.sys
16:15:30.0318 0x0f50  MBAMWebProtection - ok
16:15:30.0334 0x0f50  [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
16:15:30.0350 0x0f50  Mcx2Svc - ok
16:15:30.0350 0x0f50  [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas         C:\Windows\system32\drivers\megasas.sys
16:15:30.0350 0x0f50  megasas - ok
16:15:30.0365 0x0f50  [ EFB11AABBBD7F23236B62FBAD361220A, FB35405D28B9283E26D2555827DB65A9F6A31955991720BDD1D079D630A94A20 ] megasas2        C:\Windows\system32\drivers\megasas2.sys
16:15:30.0381 0x0f50  megasas2 - ok
16:15:30.0381 0x0f50  [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR          C:\Windows\system32\drivers\MegaSR.sys
16:15:30.0396 0x0f50  MegaSR - ok
16:15:30.0396 0x0f50  [ 8751062F2F7EC78DE92D778A08099DDE, F10BE771FF9E02A51CF3A167BB967167DE4F66647D7F1508CB27D8FDD8623700 ] MEIx64          C:\Windows\system32\DRIVERS\TeeDriverx64.sys
16:15:30.0412 0x0f50  MEIx64 - ok
16:15:30.0412 0x0f50  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS           C:\Windows\system32\mmcss.dll
16:15:30.0443 0x0f50  MMCSS - ok
16:15:30.0443 0x0f50  [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem           C:\Windows\system32\drivers\modem.sys
16:15:30.0474 0x0f50  Modem - ok
16:15:30.0474 0x0f50  [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
16:15:30.0490 0x0f50  monitor - ok
16:15:30.0490 0x0f50  [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
16:15:30.0506 0x0f50  mouclass - ok
16:15:30.0506 0x0f50  [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
16:15:30.0521 0x0f50  mouhid - ok
16:15:30.0521 0x0f50  [ 8ADB5445B29941CB41AF2846FD5C93C7, 689582430FE29EC0845B1DB841D3CC49D5D09DE264586E3999EEFE616986D12B ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
16:15:30.0537 0x0f50  mountmgr - ok
16:15:30.0537 0x0f50  [ E464A0A92E2E354D07DDA713D3E10DE4, D5CF213F03DF54EF9933027A7A7D4413371C1ECBFF61E4DE818D50FA72C8C5FC ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
16:15:30.0568 0x0f50  MozillaMaintenance - ok
16:15:30.0568 0x0f50  [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio            C:\Windows\system32\drivers\mpio.sys
16:15:30.0584 0x0f50  mpio - ok
16:15:30.0584 0x0f50  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
16:15:30.0615 0x0f50  mpsdrv - ok
16:15:30.0615 0x0f50  [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc          C:\Windows\system32\mpssvc.dll
16:15:30.0662 0x0f50  MpsSvc - ok
         

16:15:30.0662 0x0f50  [ 98DB1790F0A584E0A2528B92B052417F, 9AA04CA73AFE599810CD233B9CEC212E16D44DCEDF5C7D0181C7257F498068B5 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
16:15:30.0677 0x0f50  MRxDAV - ok
16:15:30.0677 0x0f50  [ 8A6DD6FDCCC010F7C6480EE7D0C3B92E, F061B59E5569D334C293420A4E98A2E2842037419E13001FF4FDCB9DE4A90BC5 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
16:15:30.0693 0x0f50  mrxsmb - ok
16:15:30.0708 0x0f50  [ 68C12354AEA8FB5B559F5F69EF1C0DF0, E73BEFA5615231B86962FDB5201BA05B8A15D51F09BB6232315F44B39C46560D ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
16:15:30.0724 0x0f50  mrxsmb10 - ok
16:15:30.0724 0x0f50  [ 307E956C0DE630EE0ACE657233C0E83F, 45918BAFA9A1C4F4552A2A259CDFB89146FEE6622BDBC7B6B92D5BB2528586A4 ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
16:15:30.0740 0x0f50  mrxsmb20 - ok
16:15:30.0740 0x0f50  [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci          C:\Windows\system32\drivers\msahci.sys
16:15:30.0755 0x0f50  msahci - ok
16:15:30.0755 0x0f50  [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
16:15:30.0771 0x0f50  msdsm - ok
16:15:30.0771 0x0f50  [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC           C:\Windows\System32\msdtc.exe
16:15:30.0786 0x0f50  MSDTC - ok
16:15:30.0802 0x0f50  [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
16:15:30.0818 0x0f50  Msfs - ok
16:15:30.0833 0x0f50  [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
16:15:30.0849 0x0f50  mshidkmdf - ok
16:15:30.0849 0x0f50  [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
16:15:30.0864 0x0f50  msisadrv - ok
16:15:30.0864 0x0f50  [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
16:15:30.0896 0x0f50  MSiSCSI - ok
16:15:30.0911 0x0f50  msiserver - ok
16:15:30.0911 0x0f50  [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
16:15:30.0927 0x0f50  MSKSSRV - ok
16:15:30.0942 0x0f50  [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
16:15:30.0958 0x0f50  MSPCLOCK - ok
16:15:30.0974 0x0f50  [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
16:15:30.0989 0x0f50  MSPQM - ok
16:15:31.0005 0x0f50  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
16:15:31.0020 0x0f50  MsRPC - ok
16:15:31.0020 0x0f50  [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
16:15:31.0036 0x0f50  mssmbios - ok
16:15:31.0036 0x0f50  [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
16:15:31.0067 0x0f50  MSTEE - ok
16:15:31.0067 0x0f50  [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig        C:\Windows\system32\drivers\MTConfig.sys
16:15:31.0083 0x0f50  MTConfig - ok
16:15:31.0083 0x0f50  [ 2219A3D695405E7BA2186BA6B9EDE14A, 8B99BD22DACB56FF544ED922962FE4EC1172BF90987A46E3A5F62A3B4E720B0C ] MTsensor        C:\Windows\system32\drivers\ASACPI.sys
16:15:31.0098 0x0f50  MTsensor - ok
16:15:31.0098 0x0f50  [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup             C:\Windows\system32\Drivers\mup.sys
16:15:31.0114 0x0f50  Mup - ok
16:15:31.0130 0x0f50  [ C71594206AC4E2BDCC3CBEEE1F39739D, EC3A095F3FDE7FC6FBDB5E3DD53F6DA00892019E68048AA149DDE8C4CEE2AE68 ] mv91xx          C:\Windows\system32\drivers\mv91xx.sys
16:15:31.0145 0x0f50  mv91xx - ok
16:15:31.0161 0x0f50  [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent        C:\Windows\system32\qagentRT.dll
16:15:31.0192 0x0f50  napagent - ok
16:15:31.0192 0x0f50  [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
16:15:31.0223 0x0f50  NativeWifiP - ok
16:15:31.0239 0x0f50  [ F7309F42555F8AAB7144A51A1F2585B0, 065277A8AFAEE3888C997A76D2F751070F92DF4C3354D16B194860B4BDAFF937 ] NDIS            C:\Windows\system32\drivers\ndis.sys
16:15:31.0270 0x0f50  NDIS - ok
16:15:31.0270 0x0f50  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
16:15:31.0301 0x0f50  NdisCap - ok
16:15:31.0301 0x0f50  [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
16:15:31.0332 0x0f50  NdisTapi - ok
16:15:31.0332 0x0f50  [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
16:15:31.0364 0x0f50  Ndisuio - ok
16:15:31.0364 0x0f50  [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
16:15:31.0395 0x0f50  NdisWan - ok
16:15:31.0395 0x0f50  [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
16:15:31.0426 0x0f50  NDProxy - ok
16:15:31.0426 0x0f50  [ F69CE47C64A55E92B1CDAB37CBDFA518, 5B7968D6FA586FC60B489B53CB504A86C6FF2BC94F697C2EFAC73B278AB7BC19 ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll
16:15:31.0442 0x0f50  Net Driver HPZ12 - detected UnsignedFile.Multi.Generic ( 1 )
16:15:31.0800 0x0f50  Detect skipped due to KSN trusted
16:15:31.0800 0x0f50  Net Driver HPZ12 - ok
16:15:31.0800 0x0f50  [ EE00C544C025958AF50C7B199F3C8595, D774DB020D9C46D1AA0B2DB9FA2C36C4A9C38D904CC6929695321D32ACA0D4D1 ] Netaapl         C:\Windows\system32\DRIVERS\netaapl64.sys
16:15:31.0832 0x0f50  Netaapl - ok
16:15:31.0832 0x0f50  [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
16:15:31.0847 0x0f50  NetBIOS - ok
16:15:31.0863 0x0f50  [ E47D571FEC2C76E867935109AB2A770C, F349D25890B6F476B106FD75BFB081DB737CA9B224D95E44927942FFF2DF82CD ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
16:15:31.0878 0x0f50  NetBT - ok
16:15:31.0878 0x0f50  [ 6918ACBA1558AF363F6AA8D217AFCA8D, D8CA4E9F3FA0F5CE674D647DDBFD3C3676A07FB0268BBB51782468E144575F49 ] Netlogon        C:\Windows\system32\lsass.exe
16:15:31.0894 0x0f50  Netlogon - ok
16:15:31.0910 0x0f50  [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman          C:\Windows\System32\netman.dll
16:15:31.0941 0x0f50  Netman - ok
16:15:31.0941 0x0f50  [ 0BEF1F19F32C9F3DBE9A503F2E66CC22, 4F4812CDDB675C5D655B5B90375F188A3A5AA52A2BC2CED383B03449CF8210C8 ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
16:15:31.0972 0x0f50  NetMsmqActivator - ok
16:15:31.0972 0x0f50  [ 0BEF1F19F32C9F3DBE9A503F2E66CC22, 4F4812CDDB675C5D655B5B90375F188A3A5AA52A2BC2CED383B03449CF8210C8 ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
16:15:31.0988 0x0f50  NetPipeActivator - ok
16:15:32.0003 0x0f50  [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm        C:\Windows\System32\netprofm.dll
16:15:32.0034 0x0f50  netprofm - ok
16:15:32.0066 0x0f50  [ 8B5CCD0323FFD5E6A472A5FF30A14799, A27C6680336ADB95663F7FD2774C533D8371908D928CECF7307DC26ED3E96BA3 ] netr28x         C:\Windows\system32\DRIVERS\netr28x.sys
16:15:32.0128 0x0f50  netr28x - ok
16:15:32.0128 0x0f50  [ 0BEF1F19F32C9F3DBE9A503F2E66CC22, 4F4812CDDB675C5D655B5B90375F188A3A5AA52A2BC2CED383B03449CF8210C8 ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
16:15:32.0144 0x0f50  NetTcpActivator - ok
16:15:32.0159 0x0f50  [ 0BEF1F19F32C9F3DBE9A503F2E66CC22, 4F4812CDDB675C5D655B5B90375F188A3A5AA52A2BC2CED383B03449CF8210C8 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
16:15:32.0175 0x0f50  NetTcpPortSharing - ok
16:15:32.0175 0x0f50  [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960         C:\Windows\system32\drivers\nfrd960.sys
16:15:32.0190 0x0f50  nfrd960 - ok
16:15:32.0190 0x0f50  [ 66965DD61BDB0BA4A08C55DA71FF608F, 1FD6DAE1BB6CC3931270989C795FE1B3E2E264A72B5B2B04B2B9726F0FF827ED ] NitroDriverReadSpool9 C:\Program Files\Nitro\Pro 9\NitroPDFDriverService9x64.exe
16:15:32.0206 0x0f50  NitroDriverReadSpool9 - ok
16:15:32.0222 0x0f50  [ F22C29CF59CBEF4E38BD5A0C0D8B070B, 2A049D73B70662B6490193CCE2073443076565AFDE08EDFE499B180FF0D35B25 ] NitroUpdateService C:\Program Files\Nitro\Pro 9\Nitro_UpdateService.exe
16:15:32.0253 0x0f50  NitroUpdateService - ok
16:15:32.0253 0x0f50  [ 8B301D474B478E9A92823BAB50A7BC49, 8181816035F41B1DABEC05E65E4F67BCD785F56760A61F1049E91BA39D42F01D ] NlaSvc          C:\Windows\System32\nlasvc.dll
16:15:32.0284 0x0f50  NlaSvc - ok
16:15:32.0284 0x0f50  NmPar - ok
16:15:32.0284 0x0f50  nmserial - ok
16:15:32.0284 0x0f50  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs            C:\Windows\system32\drivers\Npfs.sys
16:15:32.0315 0x0f50  Npfs - ok
16:15:32.0315 0x0f50  [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi             C:\Windows\system32\nsisvc.dll
16:15:32.0346 0x0f50  nsi - ok
16:15:32.0346 0x0f50  [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
16:15:32.0378 0x0f50  nsiproxy - ok
16:15:32.0409 0x0f50  [ 47B2D0B31BDC3EBE6090228E2BA3764D, 984A4B38300954164BCBF57EC1A09C18B53779E60A26E9618B50E26016735787 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
16:15:32.0440 0x0f50  Ntfs - ok
16:15:32.0456 0x0f50  [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null            C:\Windows\system32\drivers\Null.sys
16:15:32.0487 0x0f50  Null - ok
16:15:32.0487 0x0f50  [ D584ABB6A308933A5F72B46C9E5A783F, 31922A27B3A9A64A9F71B7591FCAC6E0ACD15E36B9BFC4B4D75DE473E0F5CF6B ] nusb3hub        C:\Windows\system32\drivers\nusb3hub.sys
16:15:32.0502 0x0f50  nusb3hub - ok
16:15:32.0502 0x0f50  [ 345B9C04E2036DA4346E3249A5BDFD06, 2FCA4661757EC8E33F6D1E8066165C0E0A0D32649318412A79A915B83496236A ] nusb3xhc        C:\Windows\system32\drivers\nusb3xhc.sys
16:15:32.0518 0x0f50  nusb3xhc - ok
16:15:32.0534 0x0f50  [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
16:15:32.0549 0x0f50  nvraid - ok
16:15:32.0549 0x0f50  [ E58D81FB8616D0CB55C1E36AA0B213C9, D83F78615889A466ADE2BFEF7AB357C0D31B7FA9A1A52668DED32A51FEFA87B5 ] nvsmu           C:\Windows\system32\drivers\nvsmu.sys
16:15:32.0565 0x0f50  nvsmu - ok
16:15:32.0565 0x0f50  [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
16:15:32.0580 0x0f50  nvstor - ok
16:15:32.0580 0x0f50  [ 1E45F96342429D63DC30E0D9117DA3D8, 3D6DB9514594377CACFD766F0153B8DCF51DDF4172864DAF589CB1EE480D2027 ] nvstor64        C:\Windows\system32\drivers\nvstor64.sys
16:15:32.0596 0x0f50  nvstor64 - ok
16:15:32.0612 0x0f50  [ 38AADD3A3C06890DBA1ABC1A9FB69749, FC6A12CE341524B9592A097BD0346163EAC23BF47FC26C3500B75FBE2834B40D ] NvStUSB         C:\Windows\system32\drivers\nvstusb.sys
16:15:32.0627 0x0f50  NvStUSB - ok
16:15:32.0627 0x0f50  [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
16:15:32.0643 0x0f50  nv_agp - ok
16:15:32.0643 0x0f50  [ 26DA4B40670AD436F7DAEC053A2A9ECA, E43C1DE8EB9156AF2B083C868C71A1282E72FC38C4AF23459A0826CF1C632AC8 ] O2MDRDR         C:\Windows\system32\drivers\o2mdx64.sys
16:15:32.0658 0x0f50  O2MDRDR - ok
16:15:32.0658 0x0f50  [ 2E69A2ADC12DAA7AC7B4FFD8601E88B0, D153A31389411629A89A14C2631FED8656168C96DB0BD1A53D1017BE9E11853B ] O2SDRDR         C:\Windows\system32\drivers\o2sdx64.sys
16:15:32.0674 0x0f50  O2SDRDR - ok
16:15:32.0674 0x0f50  [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
16:15:32.0690 0x0f50  ohci1394 - ok
16:15:32.0690 0x0f50  [ 11E0B35479C895888BA3D7F619DCFFF3, 6ED82C19898101EC00BD64A9F90595C3D20AD2D2902AA8765B740FB3B9312DDF ] ose64           C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
16:15:32.0705 0x0f50  ose64 - ok
16:15:32.0783 0x0f50  [ FE9C0029E1AF26350D9985D00520E5C8, 967079CCF7B2CBD4B48C9F076675C26AF93A1CEC26C96811F279414E34004EE6 ] osppsvc         C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
16:15:32.0877 0x0f50  osppsvc - ok
16:15:32.0892 0x0f50  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
16:15:32.0908 0x0f50  p2pimsvc - ok
16:15:32.0924 0x0f50  [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc          C:\Windows\system32\p2psvc.dll
16:15:32.0939 0x0f50  p2psvc - ok
16:15:32.0939 0x0f50  [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport         C:\Windows\system32\drivers\parport.sys
16:15:32.0955 0x0f50  Parport - ok
16:15:32.0955 0x0f50  [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
16:15:32.0970 0x0f50  partmgr - ok
16:15:32.0970 0x0f50  [ 3CD83692C43D87088E85E3C916146FFB, 9E812535E8FBA045FDA30F68E9EB2031132C37721D542A2DC9D4C33E2B137FCF ] PcaSvc          C:\Windows\System32\pcasvc.dll
16:15:32.0986 0x0f50  PcaSvc - ok
16:15:32.0986 0x0f50  [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci             C:\Windows\system32\drivers\pci.sys
16:15:33.0002 0x0f50  pci - ok
16:15:33.0002 0x0f50  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide          C:\Windows\system32\drivers\pciide.sys
16:15:33.0017 0x0f50  pciide - ok
16:15:33.0017 0x0f50  [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
16:15:33.0033 0x0f50  pcmcia - ok
16:15:33.0033 0x0f50  [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw             C:\Windows\system32\drivers\pcw.sys
16:15:33.0048 0x0f50  pcw - ok
16:15:33.0064 0x0f50  [ EA4D67448BE493D543F1730D6CD04694, 24717C5E41B7CA522F3330EF2228B6685E710A5259396E9887A1C1E7A413F8CA ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
16:15:33.0080 0x0f50  PEAUTH - ok
16:15:33.0111 0x0f50  [ B9B0A4299DD2D76A4243F75FD54DC680, BBF62E9628131FA396EB08D63B76D2D5FBDD61339E92B759125A066470D1C039 ] PeerDistSvc     C:\Windows\system32\peerdistsvc.dll
16:15:33.0142 0x0f50  PeerDistSvc - ok
16:15:33.0158 0x0f50  [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost        C:\Windows\SysWow64\perfhost.exe
16:15:33.0158 0x0f50  PerfHost - ok
16:15:33.0189 0x0f50  [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla             C:\Windows\system32\pla.dll
16:15:33.0236 0x0f50  pla - ok
16:15:33.0251 0x0f50  [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
16:15:33.0267 0x0f50  PlugPlay - ok
16:15:33.0267 0x0f50  [ 1C5C9532D52D1C81E44BE2A43C02D5E8, 90A11C87A8D1A99FB842F291B9576DCA02381B3DB8D67390AEBA56BAB1B9A833 ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll
16:15:33.0282 0x0f50  Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic ( 1 )
16:15:33.0594 0x0f50  Detect skipped due to KSN trusted
16:15:33.0594 0x0f50  Pml Driver HPZ12 - ok
16:15:33.0594 0x0f50  [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
16:15:33.0610 0x0f50  PNRPAutoReg - ok
16:15:33.0626 0x0f50  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
16:15:33.0641 0x0f50  PNRPsvc - ok
16:15:33.0641 0x0f50  [ 80D6B0563ED2BF10656B1D4748331082, B7E6B5E1148B7EE537E8D5C3A65450876B61CD45A395267D08699746E98AD574 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
16:15:33.0672 0x0f50  PolicyAgent - ok
16:15:33.0672 0x0f50  [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power           C:\Windows\system32\umpo.dll
16:15:33.0704 0x0f50  Power - ok
16:15:33.0704 0x0f50  [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
16:15:33.0735 0x0f50  PptpMiniport - ok
16:15:33.0735 0x0f50  [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor       C:\Windows\system32\drivers\processr.sys
16:15:33.0750 0x0f50  Processor - ok
16:15:33.0750 0x0f50  [ B6A58491307B4CADA572583D863DC602, 5C44936605E52C9533E4CE22F18FAB8211475877F71EFD88DA4D02FD608C90A3 ] ProfSvc         C:\Windows\system32\profsvc.dll
16:15:33.0782 0x0f50  ProfSvc - ok
16:15:33.0782 0x0f50  [ 6918ACBA1558AF363F6AA8D217AFCA8D, D8CA4E9F3FA0F5CE674D647DDBFD3C3676A07FB0268BBB51782468E144575F49 ] ProtectedStorage C:\Windows\system32\lsass.exe
16:15:33.0797 0x0f50  ProtectedStorage - ok
16:15:33.0797 0x0f50  [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
16:15:33.0828 0x0f50  Psched - ok
16:15:33.0844 0x0f50  [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300          C:\Windows\system32\drivers\ql2300.sys
16:15:33.0875 0x0f50  ql2300 - ok
16:15:33.0891 0x0f50  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
16:15:33.0891 0x0f50  ql40xx - ok
16:15:33.0906 0x0f50  [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE           C:\Windows\system32\qwave.dll
16:15:33.0922 0x0f50  QWAVE - ok
16:15:33.0922 0x0f50  [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
16:15:33.0938 0x0f50  QWAVEdrv - ok
16:15:33.0953 0x0f50  [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
16:15:33.0969 0x0f50  RasAcd - ok
16:15:33.0969 0x0f50  [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
16:15:34.0000 0x0f50  RasAgileVpn - ok
16:15:34.0000 0x0f50  [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto         C:\Windows\System32\rasauto.dll
16:15:34.0031 0x0f50  RasAuto - ok
16:15:34.0031 0x0f50  [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
16:15:34.0062 0x0f50  Rasl2tp - ok
16:15:34.0062 0x0f50  [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan          C:\Windows\System32\rasmans.dll
16:15:34.0094 0x0f50  RasMan - ok
16:15:34.0109 0x0f50  [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
16:15:34.0125 0x0f50  RasPppoe - ok
16:15:34.0140 0x0f50  [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
16:15:34.0156 0x0f50  RasSstp - ok
16:15:34.0156 0x0f50  [ 5E2BB3DE9DF45BC69C8FB1A7186A458E, 7688DD9C2AB1885C37AA16CA3230BB68346A04F8A71596321C93DD8DA73CF389 ] rccfg           C:\Windows\system32\drivers\rccfg.sys
16:15:34.0172 0x0f50  rccfg - ok
16:15:34.0187 0x0f50  [ 090DE462B187D8C17E719B3016814A46, 98295D5BDA71C9B3D1AF63AA52BBFCCD303564A571A4CE1B9E0D977C10E3FC0E ] rcraid          C:\Windows\system32\drivers\rcraid.sys
16:15:34.0203 0x0f50  rcraid - ok
16:15:34.0203 0x0f50  [ 90F489A0A6BC302AEDCEDABFBC7952F8, 46E5065811A584209E84F2E39606EA9A355CF178BCD4D6CFFA83C2B45D740559 ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
16:15:34.0234 0x0f50  rdbss - ok
16:15:34.0234 0x0f50  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
16:15:34.0250 0x0f50  rdpbus - ok
16:15:34.0250 0x0f50  [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
16:15:34.0265 0x0f50  RDPCDD - ok
16:15:34.0281 0x0f50  [ 1B6163C503398B23FF8B939C67747683, 339A5AA7970FF34FAAB213B655860C5B0DEC5F983A4A11A088017D849F320ACE ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys
16:15:34.0296 0x0f50  RDPDR - ok
16:15:34.0296 0x0f50  [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
16:15:34.0312 0x0f50  RDPENCDD - ok
16:15:34.0328 0x0f50  [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
16:15:34.0343 0x0f50  RDPREFMP - ok
16:15:34.0359 0x0f50  [ 313F68E1A3E6345A4F47A36B07062F34, B8318A0AE06BDE278931CA52F960B9FE226FD9894B076858DDB755AE26E1E66F ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
16:15:34.0374 0x0f50  RdpVideoMiniport - ok
16:15:34.0374 0x0f50  [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
16:15:34.0390 0x0f50  RDPWD - ok
16:15:34.0390 0x0f50  [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
16:15:34.0406 0x0f50  rdyboost - ok
16:15:34.0406 0x0f50  [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess    C:\Windows\System32\mprdim.dll
16:15:34.0437 0x0f50  RemoteAccess - ok
16:15:34.0437 0x0f50  [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
16:15:34.0468 0x0f50  RemoteRegistry - ok
16:15:34.0484 0x0f50  [ 3DD798846E2C28102B922C56E71B7932, 30B111615D74CB2213997A5C08DD9C8613ADE441D9423CC1C49A753D13CE524D ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys
16:15:34.0499 0x0f50  RFCOMM - ok
16:15:34.0499 0x0f50  [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
16:15:34.0530 0x0f50  RpcEptMapper - ok
16:15:34.0530 0x0f50  [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator      C:\Windows\system32\locator.exe
16:15:34.0546 0x0f50  RpcLocator - ok
16:15:34.0546 0x0f50  [ 622C96AFB07BB82C8650B47172137AC4, B74CEA5A3F4945E5A3EAE7AF1B1FA75F611C65C6FACE393052A512FA81B0C17C ] RpcSs           C:\Windows\system32\rpcss.dll
16:15:34.0562 0x0f50  RpcSs - ok
16:15:34.0577 0x0f50  [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
16:15:34.0593 0x0f50  rspndr - ok
16:15:34.0608 0x0f50  [ DB30AA4DAA0D492FA5D7717D8181FFA1, 1126AD4998D410918CFB7DBD9C74DA7F4066A4C0F90F0E7D689A6E65B2420817 ] RSUSBSTOR       C:\Windows\System32\Drivers\RtsUStor.sys
16:15:34.0624 0x0f50  RSUSBSTOR - ok
16:15:34.0624 0x0f50  [ BC2D9FBC07A8A8D5A2763D86238C9B15, 490F7AB0149736954B6FE15BA2DB49AAD86A9BE229B651866DB6939159845EB6 ] RSUSBVSTOR      C:\Windows\system32\Drivers\RtsUVStor.sys
16:15:34.0640 0x0f50  RSUSBVSTOR - ok
16:15:34.0655 0x0f50  [ 8B17DEDA6ED54F4715C8B553AF34447E, 9784A3D01055E0AFA070A0CB63EFCB2DA92735031C069215D77C63501132160B ] rtbth           C:\Windows\system32\DRIVERS\rtbth.sys
16:15:34.0671 0x0f50  rtbth - ok
16:15:34.0671 0x0f50  [ E6458C9289160F440AC40D62926B39A6, 492867AE53791AD17035DAF5E57B5FC36018AAB5680D7EEE31EF342880E5D1DE ] rtcrfilt64      C:\Windows\system32\DRIVERS\rtcrfilt64.sys
16:15:34.0686 0x0f50  rtcrfilt64 - ok
16:15:34.0702 0x0f50  [ 9AAB5A7AE8EDBDFC41390272DD08A054, AE2407C1150CD220310B2F4685557F315EEF5417DB1FB1132A94106FFDD5C6EE ] RTL8167         C:\Windows\system32\DRIVERS\Rt64win7.sys
16:15:34.0733 0x0f50  RTL8167 - ok
16:15:34.0733 0x0f50  [ E60C0A09F997826C7627B244195AB581, E8630ED74B38B98BF584E353D992C1311BC36AB7F20A1BB66C9CD65CE1E46F8D ] s3cap           C:\Windows\system32\drivers\vms3cap.sys
16:15:34.0749 0x0f50  s3cap - ok
16:15:34.0749 0x0f50  [ 6918ACBA1558AF363F6AA8D217AFCA8D, D8CA4E9F3FA0F5CE674D647DDBFD3C3676A07FB0268BBB51782468E144575F49 ] SamSs           C:\Windows\system32\lsass.exe
16:15:34.0764 0x0f50  SamSs - ok
16:15:34.0764 0x0f50  [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
16:15:34.0780 0x0f50  sbp2port - ok
16:15:34.0780 0x0f50  [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
16:15:34.0811 0x0f50  SCardSvr - ok
16:15:34.0811 0x0f50  [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
16:15:34.0842 0x0f50  scfilter - ok
16:15:34.0858 0x0f50  [ 40686B59C127F0C93B4234E4A1E3472A, B2DD61CB796C6AA8AFD285D43472B94646CA6D331D282818E0FDC9DE28DDE9CF ] Schedule        C:\Windows\system32\schedsvc.dll
16:15:34.0889 0x0f50  Schedule - ok
16:15:34.0889 0x0f50  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc     C:\Windows\System32\certprop.dll
16:15:34.0920 0x0f50  SCPolicySvc - ok
16:15:34.0920 0x0f50  [ 111E0EBC0AD79CB0FA014B907B231CF0, B7D43D156C2524938503CF8E99C4D1F7A5C55E16C0368F57F4CD23C6D833B38F ] sdbus           C:\Windows\system32\drivers\sdbus.sys
16:15:34.0936 0x0f50  sdbus - ok
16:15:34.0936 0x0f50  [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
16:15:34.0952 0x0f50  SDRSVC - ok
16:15:34.0952 0x0f50  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\Windows\system32\drivers\secdrv.sys
16:15:34.0967 0x0f50  secdrv - ok
16:15:34.0967 0x0f50  [ A19623BDD61E66A12AB53992002B4F3A, E351CEEC086084A417BA3BD0EEF46114D3147EC38E3EF8BE49B724F9D028CC56 ] seclogon        C:\Windows\system32\seclogon.dll
16:15:34.0983 0x0f50  seclogon - ok
16:15:34.0983 0x0f50  [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS            C:\Windows\System32\sens.dll
16:15:35.0014 0x0f50  SENS - ok
16:15:35.0014 0x0f50  [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc        C:\Windows\system32\sensrsvc.dll
16:15:35.0030 0x0f50  SensrSvc - ok
16:15:35.0030 0x0f50  [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum         C:\Windows\system32\drivers\serenum.sys
16:15:35.0045 0x0f50  Serenum - ok
16:15:35.0045 0x0f50  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial          C:\Windows\system32\drivers\serial.sys
16:15:35.0061 0x0f50  Serial - ok
16:15:35.0061 0x0f50  [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse        C:\Windows\system32\drivers\sermouse.sys
16:15:35.0076 0x0f50  sermouse - ok
16:15:35.0092 0x0f50  [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv      C:\Windows\system32\sessenv.dll
16:15:35.0108 0x0f50  SessionEnv - ok
16:15:35.0123 0x0f50  [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
16:15:35.0139 0x0f50  sffdisk - ok
16:15:35.0139 0x0f50  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
16:15:35.0154 0x0f50  sffp_mmc - ok
16:15:35.0154 0x0f50  [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
16:15:35.0170 0x0f50  sffp_sd - ok
16:15:35.0170 0x0f50  [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy         C:\Windows\system32\drivers\sfloppy.sys
16:15:35.0186 0x0f50  sfloppy - ok
16:15:35.0201 0x0f50  [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
16:15:35.0232 0x0f50  SharedAccess - ok
16:15:35.0232 0x0f50  [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
16:15:35.0264 0x0f50  ShellHWDetection - ok
16:15:35.0264 0x0f50  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys
16:15:35.0279 0x0f50  SiSRaid2 - ok
16:15:35.0279 0x0f50  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
16:15:35.0295 0x0f50  SiSRaid4 - ok
16:15:35.0295 0x0f50  [ 704B4F81729F676BBF034529FC334D82, 1E50DAF97836807A500284385D99272780A8B69CA88761250451060B207824F8 ] SkypeUpdate     C:\Program Files (x86)\Skype\Updater\Updater.exe
16:15:35.0326 0x0f50  SkypeUpdate - ok
16:15:35.0326 0x0f50  [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
16:15:35.0357 0x0f50  Smb - ok
16:15:35.0357 0x0f50  [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
16:15:35.0373 0x0f50  SNMPTRAP - ok
16:15:35.0373 0x0f50  [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr           C:\Windows\system32\drivers\spldr.sys
16:15:35.0388 0x0f50  spldr - ok
16:15:35.0404 0x0f50  [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler         C:\Windows\System32\spoolsv.exe
16:15:35.0420 0x0f50  Spooler - ok
16:15:35.0466 0x0f50  [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc          C:\Windows\system32\sppsvc.exe
16:15:35.0544 0x0f50  sppsvc - ok
16:15:35.0560 0x0f50  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify     C:\Windows\system32\sppuinotify.dll
16:15:35.0576 0x0f50  sppuinotify - ok
16:15:35.0591 0x0f50  [ 74D30C2EF66C2EB19F17ED5423AA8038, F79AB2B2B60620565FB2169255F95F4B37F6113F0AF776D1BAD02681EBE0DB54 ] sptd            C:\Windows\System32\Drivers\sptd.sys
16:15:35.0607 0x0f50  sptd - ok
16:15:35.0622 0x0f50  [ EC666682FE8344CF7E6ED69E74FA9F4F, DCD2A1C046425630689E2C9A6A6E356FE5A2A6664D12C20CFE236FCB32240DF9 ] srv             C:\Windows\system32\DRIVERS\srv.sys
16:15:35.0638 0x0f50  srv - ok
16:15:35.0638 0x0f50  [ E450C0318DCE8ED28ED272C8806B8495, D2FD459F8C5E42103EF2F71421FA175A4F0821F8C2A3763093122D433D1C50FB ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
16:15:35.0669 0x0f50  srv2 - ok
16:15:35.0669 0x0f50  [ 9C12C78AD36C23D925711A4640228225, FF72C23F2A08EDF0C41BAF1EB0245AB44FF91365C5466F09C47A8F0928D20994 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
16:15:35.0685 0x0f50  srvnet - ok
16:15:35.0685 0x0f50  [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
16:15:35.0716 0x0f50  SSDPSRV - ok
16:15:35.0716 0x0f50  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc         C:\Windows\system32\sstpsvc.dll
16:15:35.0747 0x0f50  SstpSvc - ok
16:15:35.0763 0x0f50  [ A72B7C730B1EF1E7764044737E802FAD, D102122D2B938A48F8A6761F1F75D37476D628C1E5D644DFB30262CE50E2D250 ] StarMoney 10 OnlineUpdate C:\Program Files (x86)\StarMoney 10\ouservice\StarMoneyOnlineUpdate.exe
16:15:35.0794 0x0f50  StarMoney 10 OnlineUpdate - ok
16:15:35.0810 0x0f50  [ 3BF022F8064A83A23DF90971DD78CA83, 85754DF1C6DE745ADF9A0BAB1948AFF2CA16C4569128DA90AF610D199E621BF4 ] StarMoney 9.0 OnlineUpdate C:\Program Files (x86)\StarMoney 9\ouservice\StarMoneyOnlineUpdate.exe
16:15:35.0841 0x0f50  StarMoney 9.0 OnlineUpdate - ok
16:15:35.0841 0x0f50  [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor        C:\Windows\system32\drivers\stexstor.sys
16:15:35.0841 0x0f50  stexstor - ok
16:15:35.0856 0x0f50  [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc          C:\Windows\System32\wiaservc.dll
16:15:35.0888 0x0f50  stisvc - ok
16:15:35.0888 0x0f50  [ 7785DC213270D2FC066538DAF94087E7, F09CB2895241719CA5147B2EE9F7ECBD0303AFFB5CD896F06D4D29BAAAFC207B ] storflt         C:\Windows\system32\drivers\vmstorfl.sys
16:15:35.0903 0x0f50  storflt - ok
16:15:35.0903 0x0f50  [ C40841817EF57D491F22EB103DA587CC, 5FAA2DE43BADC16A898C0C290C44C41E4411D919A95FE8C6FF45EA7A34495079 ] StorSvc         C:\Windows\system32\storsvc.dll
16:15:35.0919 0x0f50  StorSvc - ok
16:15:35.0919 0x0f50  [ D34E4943D5AC096C8EDEEBFD80D76E23, 1DD7F6F97060B5F763A04ACA1F75E59DAB09EF824FD09B83FC3C192837D006DE ] storvsc         C:\Windows\system32\drivers\storvsc.sys
16:15:35.0919 0x0f50  storvsc - ok
16:15:35.0934 0x0f50  [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
16:15:35.0966 0x0f50  swenum - ok
16:15:35.0966 0x0f50  [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv           C:\Windows\System32\swprv.dll
16:15:36.0012 0x0f50  swprv - ok
16:15:36.0028 0x0f50  [ 2E730941CC5BF6200A4F56D1E9C24AAD, 758836D55DC84F3EBE9917DC6FAB8E6170A5B238FEDBCFDB6D7C5C6EA98E08B2 ] SysMain         C:\Windows\system32\sysmain.dll
16:15:36.0075 0x0f50  SysMain - ok
16:15:36.0075 0x0f50  [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
16:15:36.0090 0x0f50  TabletInputService - ok
16:15:36.0090 0x0f50  [ BCF5E78E87D258088346E399E406E501, FD75AC5A7085E08AB00A2D0CE01970873598E381B6542DC5EBAC240D727AF6D7 ] taphss6         C:\Windows\system32\DRIVERS\taphss6.sys
16:15:36.0106 0x0f50  taphss6 - ok
16:15:36.0122 0x0f50  [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv         C:\Windows\System32\tapisrv.dll
16:15:36.0153 0x0f50  TapiSrv - ok
16:15:36.0153 0x0f50  [ E91BCBD521606E60C2807813D8EAC579, 9B9329535AF753E5922BD53DEF08E5E99C51927923C7DF87112A0E293DE47FAC ] tbhsd           C:\Windows\system32\drivers\tbhsd.sys
16:15:36.0168 0x0f50  tbhsd - ok
16:15:36.0184 0x0f50  [ B2875D7ABB82867DC3AA03D991940201, F954C33FBA912A517B59330F6438C1953F9F1D8F4D8FD25945EB836A1DB07ABB ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
16:15:36.0231 0x0f50  Tcpip - ok
16:15:36.0262 0x0f50  [ B2875D7ABB82867DC3AA03D991940201, F954C33FBA912A517B59330F6438C1953F9F1D8F4D8FD25945EB836A1DB07ABB ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
16:15:36.0293 0x0f50  TCPIP6 - ok
16:15:36.0309 0x0f50  [ 7FE5586314EE7D6AA8483264A089E5AF, 4E3EA68713A45C22F1B9A1AA125E15D06D0C5E637B815537431ADFB6D7563879 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
16:15:36.0324 0x0f50  tcpipreg - ok
16:15:36.0324 0x0f50  [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
16:15:36.0340 0x0f50  TDPIPE - ok
16:15:36.0340 0x0f50  [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
16:15:36.0356 0x0f50  TDTCP - ok
16:15:36.0356 0x0f50  [ AA77EB517D2F07A947294F260E3ACA83, B7A5DF3066830C0C2302B059778A67419792058A0D300C471DE40AB245EA7E58 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
16:15:36.0371 0x0f50  tdx - ok
16:15:36.0449 0x0f50  [ 2AA61246A5B813C1B12BCCFAA6F23DD8, 74EE3DB839A0F4BC781294803281DB2248D013B8808FF05F2EE9597C14C6FEED ] TeamViewer      C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
16:15:36.0590 0x0f50  TeamViewer - ok
16:15:36.0605 0x0f50  [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
16:15:36.0605 0x0f50  TermDD - ok
16:15:36.0621 0x0f50  [ 008CD4EBFABCF78D0F19B3778492648C, 9050490EEE0AD86E73F0A82D83E4FC29DF84F6B6FDB389AE135FD712B5F425BE ] TermService     C:\Windows\System32\termsrv.dll
16:15:36.0652 0x0f50  TermService - ok
16:15:36.0652 0x0f50  [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes          C:\Windows\system32\themeservice.dll
16:15:36.0668 0x0f50  Themes - ok
16:15:36.0668 0x0f50  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER     C:\Windows\system32\mmcss.dll
16:15:36.0699 0x0f50  THREADORDER - ok
16:15:36.0699 0x0f50  [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks          C:\Windows\System32\trkwks.dll
16:15:36.0730 0x0f50  TrkWks - ok
16:15:36.0730 0x0f50  [ 3E75A47D2DEFD2683DCA409572FBE8B2, 33964B1A05E045D3B878CDFD9F52A9086B4FA54D6D4D1DC38062D2874CACD4A0 ] Trufos          C:\Windows\system32\DRIVERS\Trufos.sys
16:15:36.0761 0x0f50  Trufos - ok
16:15:36.0761 0x0f50  [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
16:15:36.0792 0x0f50  TrustedInstaller - ok
16:15:36.0792 0x0f50  [ 19BEDA57F3E0A06B8D5EB6D619BD5624, 952D5FAFD662C93628C12A6F7EB8E240A44216C0A15CBD2F5016BC357CBFE821 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
16:15:36.0808 0x0f50  tssecsrv - ok
16:15:36.0808 0x0f50  [ E9981ECE8D894CEF7038FD1D040EB426, DCDDCE933CAECE8180A3447199B07F2F0413704EEC1A09606EE357901A84A7CF ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
16:15:36.0824 0x0f50  TsUsbFlt - ok
16:15:36.0824 0x0f50  [ AD64450A4ABE076F5CB34CC08EEACB07, B5C386635441A19178E7FEEE299BA430C8D72F9110866C13A216B12A1080AD12 ] TsUsbGD         C:\Windows\system32\drivers\TsUsbGD.sys
16:15:36.0839 0x0f50  TsUsbGD - ok
16:15:36.0839 0x0f50  [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
16:15:36.0870 0x0f50  tunnel - ok
16:15:36.0870 0x0f50  [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
16:15:36.0886 0x0f50  uagp35 - ok
16:15:36.0886 0x0f50  [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
16:15:36.0917 0x0f50  udfs - ok
16:15:36.0933 0x0f50  [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect       C:\Windows\system32\UI0Detect.exe
16:15:36.0933 0x0f50  UI0Detect - ok
16:15:36.0948 0x0f50  [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
16:15:36.0964 0x0f50  uliagpkx - ok
16:15:36.0964 0x0f50  [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus           C:\Windows\system32\DRIVERS\umbus.sys
16:15:36.0980 0x0f50  umbus - ok
16:15:36.0980 0x0f50  [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass          C:\Windows\system32\drivers\umpass.sys
16:15:36.0995 0x0f50  UmPass - ok
16:15:36.0995 0x0f50  [ A293DCD756D04D8492A750D03B9A297C, 203600ED0B7F8BA4C6D6F4ED810F4DF5AB70928B06EC4131C5D8ADF628444ED1 ] UmRdpService    C:\Windows\System32\umrdp.dll
16:15:37.0011 0x0f50  UmRdpService - ok
16:15:37.0026 0x0f50  [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost        C:\Windows\System32\upnphost.dll
16:15:37.0058 0x0f50  upnphost - ok
16:15:37.0058 0x0f50  [ F957092C63CD71D85903CA0D8370F473, 4DEC2FC20329F248135DA24CB6694FD972DCCE8B1BBEA8D872FDE41939E96AAF ] USBAAPL64       C:\Windows\system32\Drivers\usbaapl64.sys
16:15:37.0073 0x0f50  USBAAPL64 - ok
16:15:37.0073 0x0f50  [ 28B81917A195B67617AF7DCF4DFE5736, 40A4D2AAE1BDE5ABA8708ED150396E913C566ECD5CDA40D6C6DB256F1B9FD4A9 ] usbccgp         C:\Windows\system32\drivers\usbccgp.sys
16:15:37.0089 0x0f50  usbccgp - ok
16:15:37.0104 0x0f50  [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir          C:\Windows\system32\drivers\usbcir.sys
16:15:37.0120 0x0f50  usbcir - ok
16:15:37.0120 0x0f50  [ B626F048318DAE65A3317F0592BE592C, 284D8FFE1D35F852EFDA182A72288AC3A10D6ED825FE2CC5812497D3FE291AF1 ] usbehci         C:\Windows\system32\drivers\usbehci.sys
16:15:37.0136 0x0f50  usbehci - ok
16:15:37.0136 0x0f50  [ 573D192E268F0C5B486B7E96F661E538, 0F32BD82CA7B5D4DE234EFC6527EF4C854BD15B3057FE4A0151C70115493FFDC ] usbfilter       C:\Windows\system32\drivers\usbfilter.sys
16:15:37.0151 0x0f50  usbfilter - ok
16:15:37.0151 0x0f50  [ 390109E8E05BA00375DCB1ED64DC60AF, B8628502590B423BEFB6F7C8C69FAD0667AD0746FF6B444EE02016E8E1052B78 ] usbhub          C:\Windows\system32\drivers\usbhub.sys
16:15:37.0182 0x0f50  usbhub - ok
16:15:37.0182 0x0f50  [ 9840FC418B4CBD632D3D0A667A725C31, 776D86A032DCA2842EF7AADB35473193CA80547223EFAA7F110F296C377077B0 ] usbohci         C:\Windows\system32\drivers\usbohci.sys
16:15:37.0182 0x0f50  usbohci - detected UnsignedFile.Multi.Generic ( 1 )
16:15:37.0682 0x0f50  Detect skipped due to KSN trusted
16:15:37.0682 0x0f50  usbohci - ok
16:15:37.0682 0x0f50  [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint        C:\Windows\system32\drivers\usbprint.sys
16:15:37.0697 0x0f50  usbprint - ok
16:15:37.0713 0x0f50  [ 9661DA76B4531B2DA272ECCE25A8AF24, FEA93254A21E71A7EB8AD35FCCAD2C1E41F7329EC33B1734F5B41307A34D8637 ] usbscan         C:\Windows\system32\DRIVERS\usbscan.sys
16:15:37.0728 0x0f50  usbscan - ok
16:15:37.0728 0x0f50  [ D029DD09E22EB24318A8FC3D8138BA43, C95805E8BF75ECB939520AE86420B16467B0771C161C51C9F1A37649ADFADCD0 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
16:15:37.0744 0x0f50  USBSTOR - ok
16:15:37.0744 0x0f50  [ 62069A34518BCF9C1FD9E74B3F6DB7CD, C58E21424718729324B285BEE1C96551540FCC3FD650B2D10895EBA48D981E25 ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys
16:15:37.0744 0x0f50  usbuhci - detected UnsignedFile.Multi.Generic ( 1 )
16:15:38.0087 0x0f50  Detect skipped due to KSN trusted
16:15:38.0087 0x0f50  usbuhci - ok
16:15:38.0103 0x0f50  [ 1F775DA4CF1A3A1834207E975A72E9D7, 6D3DE5BD3EF3A76E997E5BAF900C51D25308F5A9682D1F62017F577A24095B90 ] usbvideo        C:\Windows\system32\Drivers\usbvideo.sys
16:15:38.0118 0x0f50  usbvideo - ok
16:15:38.0118 0x0f50  [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms           C:\Windows\System32\uxsms.dll
16:15:38.0150 0x0f50  UxSms - ok
16:15:38.0150 0x0f50  [ 6918ACBA1558AF363F6AA8D217AFCA8D, D8CA4E9F3FA0F5CE674D647DDBFD3C3676A07FB0268BBB51782468E144575F49 ] VaultSvc        C:\Windows\system32\lsass.exe
16:15:38.0165 0x0f50  VaultSvc - ok
16:15:38.0165 0x0f50  [ 3C8E2C591345F38149C69FE8E5DF8C90, 9F4BB9BDA09CB2E99A6A888B288F322AE5C460B5D124CD714C6F00FF5029144B ] VClone          C:\Windows\system32\DRIVERS\VClone.sys
16:15:38.0181 0x0f50  VClone - ok
16:15:38.0181 0x0f50  [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
16:15:38.0196 0x0f50  vdrvroot - ok
16:15:38.0212 0x0f50  [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds             C:\Windows\System32\vds.exe
16:15:38.0243 0x0f50  vds - ok
16:15:38.0243 0x0f50  [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
16:15:38.0259 0x0f50  vga - ok
16:15:38.0259 0x0f50  [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave         C:\Windows\System32\drivers\vga.sys
16:15:38.0290 0x0f50  VgaSave - ok
16:15:38.0306 0x0f50  [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys
16:15:38.0321 0x0f50  vhdmp - ok
16:15:38.0321 0x0f50  [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide          C:\Windows\system32\drivers\viaide.sys
16:15:38.0337 0x0f50  viaide - ok
16:15:38.0337 0x0f50  [ 86EA3E79AE350FEA5331A1303054005F, 7E7D6027EB41E591633C7383A5D29A3BA8ECFC08C177D2BCF741EE27686B1691 ] vmbus           C:\Windows\system32\drivers\vmbus.sys
16:15:38.0352 0x0f50  vmbus - ok
16:15:38.0352 0x0f50  [ 7DE90B48F210D29649380545DB45A187, 09522F84285D62B961868DA98C40B82E746CA4D24A9780905673A2349D6B07F4 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
16:15:38.0368 0x0f50  VMBusHID - ok
16:15:38.0368 0x0f50  [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
16:15:38.0384 0x0f50  volmgr - ok
16:15:38.0399 0x0f50  [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
16:15:38.0415 0x0f50  volmgrx - ok
16:15:38.0430 0x0f50  [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap         C:\Windows\system32\drivers\volsnap.sys
16:15:38.0446 0x0f50  volsnap - ok
16:15:38.0446 0x0f50  [ B4A73CA4EF9A02B9738CEA9AD5FE5917, B6A8086189FE2F1C3FE5B3F484FBA3DB2E5E1836F3154D30090F136C27D16166 ] vpcbus          C:\Windows\system32\DRIVERS\vpchbus.sys
16:15:38.0462 0x0f50  vpcbus - ok
16:15:38.0477 0x0f50  [ E675FB2B48C54F09895482E2253B289C, 68BBFBF2356C849722E429CA753CC309A3CCE8CF00EBDBBD2695ECD292324DF2 ] vpcnfltr        C:\Windows\system32\DRIVERS\vpcnfltr.sys
16:15:38.0493 0x0f50  vpcnfltr - ok
16:15:38.0493 0x0f50  [ 5FB42082B0D19A0268705F1DD343DF20, 62F8EEE6A507CE6A8BD638020118D71B78332F79BA82654AB702AE46B04767D9 ] vpcusb          C:\Windows\system32\DRIVERS\vpcusb.sys
16:15:38.0508 0x0f50  vpcusb - ok
16:15:38.0508 0x0f50  [ 207B6539799CC1C112661A9B620DD233, 6B915CC7F77C867516D94865D7BF2E5C815402EF0A4488C3EB2FEF7CFA6C98F6 ] vpcvmm          C:\Windows\system32\drivers\vpcvmm.sys
16:15:38.0524 0x0f50  vpcvmm - ok
16:15:38.0540 0x0f50  [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid         C:\Windows\system32\drivers\vsmraid.sys
16:15:38.0555 0x0f50  vsmraid - ok
16:15:38.0571 0x0f50  [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS             C:\Windows\system32\vssvc.exe
16:15:38.0618 0x0f50  VSS - ok
16:15:38.0633 0x0f50  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys
16:15:38.0649 0x0f50  vwifibus - ok
16:15:38.0649 0x0f50  [ 6A3D66263414FF0D6FA754C646612F3F, 30F6BA594B0D3B94113064015A16D97811CD989DF1715CCE21CEAB9894C1B4FB ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
16:15:38.0664 0x0f50  vwififlt - ok
16:15:38.0664 0x0f50  [ 6A638FC4BFDDC4D9B186C28C91BD1A01, 5521F1DC515586777EC4837E0AEAA3E613CC178AF1074031C4D0D0C695A93168 ] vwifimp         C:\Windows\system32\DRIVERS\vwifimp.sys
16:15:38.0680 0x0f50  vwifimp - ok
16:15:38.0696 0x0f50  [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time         C:\Windows\system32\w32time.dll
16:15:38.0727 0x0f50  W32Time - ok
16:15:38.0727 0x0f50  [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
16:15:38.0742 0x0f50  WacomPen - ok
16:15:38.0742 0x0f50  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
16:15:38.0774 0x0f50  WANARP - ok
16:15:38.0774 0x0f50  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
16:15:38.0805 0x0f50  Wanarpv6 - ok
16:15:38.0820 0x0f50  [ 3CEC96DE223E49EAAE3651FCF8FAEA6C, 4150DAB33E8D61076F1D4767BCAFC9B4ECCCCBD58FD4FB3CFE5B8D27DCDCAB61 ] WatAdminSvc     C:\Windows\system32\Wat\WatAdminSvc.exe
16:15:38.0852 0x0f50  WatAdminSvc - ok
16:15:38.0883 0x0f50  [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine        C:\Windows\system32\wbengine.exe
16:15:38.0914 0x0f50  wbengine - ok
16:15:38.0914 0x0f50  [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
16:15:38.0945 0x0f50  WbioSrvc - ok
16:15:38.0945 0x0f50  [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc         C:\Windows\System32\wcncsvc.dll
16:15:38.0961 0x0f50  wcncsvc - ok
16:15:38.0976 0x0f50  [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
16:15:38.0992 0x0f50  WcsPlugInService - ok
16:15:38.0992 0x0f50  [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd              C:\Windows\system32\drivers\wd.sys
16:15:39.0008 0x0f50  Wd - ok
16:15:39.0008 0x0f50  [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
16:15:39.0039 0x0f50  Wdf01000 - ok
16:15:39.0039 0x0f50  [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiServiceHost  C:\Windows\system32\wdi.dll
16:15:39.0054 0x0f50  WdiServiceHost - ok
16:15:39.0054 0x0f50  [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiSystemHost   C:\Windows\system32\wdi.dll
16:15:39.0070 0x0f50  WdiSystemHost - ok
16:15:39.0086 0x0f50  [ EE841B6D1F2B9508D3ABAE52AC05A94F, F1AE981FCDBFC4672A4EABABD41382E93762EFC2EDAD96E75530E7ACA5AF1FD8 ] WebClient       C:\Windows\System32\webclnt.dll
16:15:39.0101 0x0f50  WebClient - ok
16:15:39.0101 0x0f50  [ CBA25A299ECDBAE3A2300B68598AABA3, 5AC6F75FBDA58CD9D17922AF2780A37B89067EB4A97EE792A644B238BE94490D ] Wecsvc          C:\Windows\system32\wecsvc.dll
16:15:39.0117 0x0f50  Wecsvc - ok
16:15:39.0132 0x0f50  [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
16:15:39.0148 0x0f50  wercplsupport - ok
16:15:39.0164 0x0f50  [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc          C:\Windows\System32\WerSvc.dll
16:15:39.0179 0x0f50  WerSvc - ok
16:15:39.0179 0x0f50  [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
16:15:39.0210 0x0f50  WfpLwf - ok
16:15:39.0210 0x0f50  [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
16:15:39.0226 0x0f50  WIMMount - ok
16:15:39.0226 0x0f50  WinDefend - ok
16:15:39.0242 0x0f50  WinHttpAutoProxySvc - ok
16:15:39.0242 0x0f50  [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
16:15:39.0273 0x0f50  Winmgmt - ok
16:15:39.0304 0x0f50  [ EBDA1B0F15CB9B2CBCC6C94824E4E054, C51314F7D611E4903DA00EFA8EB99365414436324D256083CE0B5A8E055E8E06 ] WinRM           C:\Windows\system32\WsmSvc.dll
16:15:39.0351 0x0f50  WinRM - ok
16:15:39.0351 0x0f50  [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
16:15:39.0366 0x0f50  WinUsb - ok
16:15:39.0382 0x0f50  [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc         C:\Windows\System32\wlansvc.dll
16:15:39.0413 0x0f50  Wlansvc - ok
16:15:39.0413 0x0f50  [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys
16:15:39.0429 0x0f50  WmiAcpi - ok
16:15:39.0444 0x0f50  [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
16:15:39.0460 0x0f50  wmiApSrv - ok
16:15:39.0460 0x0f50  WMPNetworkSvc - ok
16:15:39.0460 0x0f50  [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc          C:\Windows\System32\wpcsvc.dll
16:15:39.0476 0x0f50  WPCSvc - ok
16:15:39.0476 0x0f50  [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
16:15:39.0507 0x0f50  WPDBusEnum - ok
16:15:39.0507 0x0f50  [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
16:15:39.0538 0x0f50  ws2ifsl - ok
16:15:39.0538 0x0f50  [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc          C:\Windows\System32\wscsvc.dll
16:15:39.0554 0x0f50  wscsvc - ok
16:15:39.0554 0x0f50  [ 8D918B1DB190A4D9B1753A66FA8C96E8, DB7D2714DC04D2D6999A207D7399A5647C8653E5A1AD80856A65C5B6065AEDFE ] WSDPrintDevice  C:\Windows\system32\DRIVERS\WSDPrint.sys
16:15:39.0569 0x0f50  WSDPrintDevice - ok
16:15:39.0569 0x0f50  [ 4A2A5C50DD1A63577D3ACA94269FBC7F, F75C1906D431CF871AD954218DF32A0F206E45FF49332DEF9F13C0A36A407047 ] WSDScan         C:\Windows\system32\DRIVERS\WSDScan.sys
16:15:39.0585 0x0f50  WSDScan - ok
16:15:39.0585 0x0f50  WSearch - ok
16:15:39.0632 0x0f50  [ 31F32E0C1A8BA9A37EEC23DE5F27F847, 0180832BC6172C9A4C32B5B222BB3F91EA615A5EBDA98DB79ED4FED258C2D257 ] wuauserv        C:\Windows\system32\wuaueng.dll
16:15:39.0678 0x0f50  wuauserv - ok
16:15:39.0678 0x0f50  [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
16:15:39.0694 0x0f50  WudfPf - ok
16:15:39.0710 0x0f50  [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
16:15:39.0725 0x0f50  WUDFRd - ok
16:15:39.0725 0x0f50  [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
16:15:39.0741 0x0f50  wudfsvc - ok
16:15:39.0741 0x0f50  [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc         C:\Windows\System32\wwansvc.dll
16:15:39.0756 0x0f50  WwanSvc - ok
16:15:39.0772 0x0f50  ================ Scan global ===============================
16:15:39.0772 0x0f50  [ 168EA9CD9BD6056BB6F60B57D5304BBE, 5A2F98754F042A7D80E7483842967EB362F01D57CE9720B24C7EDAA047F24C6F ] C:\Windows\system32\basesrv.dll
16:15:39.0788 0x0f50  [ 93E5D2B763374F484918A0909724B3EB, 900F1CCAEFCF77AB678C74D542ABDDA7134CD33D7811537E2829FC69E99F2B3E ] C:\Windows\system32\winsrv.dll
16:15:39.0788 0x0f50  [ 93E5D2B763374F484918A0909724B3EB, 900F1CCAEFCF77AB678C74D542ABDDA7134CD33D7811537E2829FC69E99F2B3E ] C:\Windows\system32\winsrv.dll
16:15:39.0803 0x0f50  [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
16:15:39.0803 0x0f50  [ 71C85477DF9347FE8E7BC55768473FCA, A86D6A6D1F5A0EFCD649792A06F3AE9B37158D48493D2ECA7F52DCC1CB9B6536 ] C:\Windows\system32\services.exe
16:15:39.0803 0x0f50  [ Global ] - ok
16:15:39.0803 0x0f50  ================ Scan MBR ==================================
16:15:39.0803 0x0f50  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
16:15:39.0959 0x0f50  \Device\Harddisk0\DR0 - ok
16:15:39.0959 0x0f50  ================ Scan VBR ==================================
16:15:39.0959 0x0f50  [ 22BDB4EAFA7760532E4AD5789E07870B ] \Device\Harddisk0\DR0\Partition1
16:15:39.0959 0x0f50  \Device\Harddisk0\DR0\Partition1 - ok
16:15:39.0975 0x0f50  [ D2592C1E16D1656907CBB7F5C04F9300 ] \Device\Harddisk0\DR0\Partition2
16:15:39.0975 0x0f50  \Device\Harddisk0\DR0\Partition2 - ok
16:15:39.0975 0x0f50  ================ Scan generic autorun ======================
16:15:40.0162 0x0f50  [ 78D93C04E892F50D6264A05F4EBCE150, F24D26CAF44B81725AAE9FE84F24DB848BAA7857C89DC34C2E258617E886EE5B ] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
16:15:40.0380 0x0f50  RTHDVCPL - ok
16:15:40.0396 0x0f50  [ 605BB2B2A2171D3F5748F4919E80E6C7, 4EBAAE4E2122048603D058C83E32C56F64F8FB9E7B9BB2F83E659BFFD7CB12EE ] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe
16:15:40.0505 0x0f50  CanonSolutionMenu - ok
16:15:40.0521 0x0f50  [ D4E744D57FC8AFAFB32012ECF5F01D51, 61EB1B7EE22A35696832F3DBE1054065D517687AFC6001BE0CD7FC4DE8B7EA0E ] C:\Program Files\Malwarebytes\Anti-Ransomware\mbarw.exe
16:15:40.0536 0x0f50  Malwarebytes Anti-Ransomware - ok
16:15:40.0583 0x0f50  [ 666FEA598D1776C7F8EDD7746F0F7F59, 54E330BCDBAB646B555DACC15F9CFB0AD6A05BF4E273F73C5133259EEE976C21 ] C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe
16:15:40.0646 0x0f50  Malwarebytes TrayApp - ok
16:15:40.0661 0x0f50  [ 02EE28DC2B0B9C20366155A9EFC7384F, 905F104F01A2468A15697F9695F014D6047EFEF6834E81D874AD3E5B8BC3AD32 ] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
16:15:40.0692 0x0f50  avgnt - ok
16:15:40.0692 0x0f50  [ BB73B4A6D4A9F1410563D1BA4D53E7CA, 38641DF5215C770B30FEC045D930835CF8DC72F2F6CA30A85AD08B5D6B26AD33 ] C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe
16:15:40.0724 0x0f50  IJNetworkScanUtility - ok
16:15:40.0739 0x0f50  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
16:15:40.0770 0x0f50  Sidebar - ok
16:15:40.0770 0x0f50  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
16:15:40.0786 0x0f50  mctadmin - ok
16:15:40.0802 0x0f50  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
16:15:40.0833 0x0f50  Sidebar - ok
16:15:40.0833 0x0f50  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
16:15:40.0848 0x0f50  mctadmin - ok
16:15:40.0895 0x0f50  [ B023DE11916C2B9048FC01B0AFE0EF66, A6E929CF62D9CE3A7E1909B64829A678C60BC94FAD4FDAA0178D28FC932F722B ] C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe
16:15:40.0958 0x0f50  KeePass Password Safe 2 - ok
16:15:40.0958 0x0f50  AudialsNotifier - ok
16:15:40.0958 0x0f50  Waiting for KSN requests completion. In queue: 196
16:15:42.0018 0x0f50  AV detected via SS2: ITbrain Anti-Malware, C:\Program Files\ITbrain\AntiMalware\ITbrain_AntiMalware_WSCHandler.exe ( 1.0.0.0 ), 0x51000 ( enabled : updated )
16:15:42.0034 0x0f50  AV detected via SS2: Avira Desktop, C:\Program Files (x86)\Avira\AntiVir Desktop\wsctool.exe ( 14.0.24.26 ), 0x40000 ( disabled : updated )
16:15:42.0034 0x0f50  AV detected via SS2: Malwarebytes, C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe ( 3.0.0.134 ), 0x60000 ( disabled : updated )
16:15:42.0050 0x0f50  Win FW state via NFP2: enabled ( trusted )
16:15:42.0377 0x0f50  ============================================================
16:15:42.0377 0x0f50  Scan finished
16:15:42.0377 0x0f50  ============================================================
16:15:42.0377 0x1760  Detected object count: 1
16:15:42.0377 0x1760  Actual detected object count: 1
16:16:01.0300 0x1760  chip1click ( UnsignedFile.Multi.Generic ) - skipped by user
16:16:01.0300 0x1760  chip1click ( UnsignedFile.Multi.Generic ) - User select action: Skip
         

Adware/Junkware/Toolbars entfernen

Alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!
Virenscanner jetzt vor dem Einsatz dieser Tools bitte komplett deaktivieren!

1. Schritt: adwCleaner

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

# AdwCleaner v6.042 - Bericht erstellt am 09/01/2017 um 16:57:48
# Aktualisiert am 06/01/2017 von Malwarebytes
# Datenbank : 2017-01-09.2 [Lokal]
# Betriebssystem : Windows 7 Professional Service Pack 1 (X64)
# Benutzername : z1 - BUERO01
# Gestartet von : C:\Users\z1\Downloads\adwcleaner_6.042.exe
# Modus: Suchlauf
# Unterstützung : https://www.malwarebytes.com/support



***** [ Dienste ] *****

Keine schädlichen Dienste gefunden.


***** [ Ordner ] *****

Keine schädlichen Ordner gefunden.


***** [ Dateien ] *****

Keine schädlichen Dateien gefunden.


***** [ DLL ] *****

Keine infizierten DLLs gefunden.


***** [ WMI ] *****

Keine schädlichen Schlüssel gefunden.


***** [ Verknüpfungen ] *****

Keine infizierten Verknüpfungen gefunden.


***** [ Aufgabenplanung ] *****

Keine schädlichen Aufgaben gefunden.


***** [ Registrierungsdatenbank ] *****

Keine schädlichen Elemente in der Registrierungsdatenbank gefunden.


***** [ Internetbrowser ] *****

Keine schädlichen Elemente in Firefox basierten Browsern gefunden.
Keine schädlichen Elemente in Chrome basierten Browsern gefunden.

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [4922 Bytes] - [24/11/2015 08:18:39]
C:\AdwCleaner\AdwCleaner[C2].txt - [892 Bytes] - [24/11/2015 09:22:12]
C:\AdwCleaner\AdwCleaner[C3].txt - [8554 Bytes] - [03/01/2017 13:08:01]
C:\AdwCleaner\AdwCleaner[R0].txt - [2122 Bytes] - [07/10/2014 13:36:12]
C:\AdwCleaner\AdwCleaner[S1].txt - [978 Bytes] - [01/02/2016 14:42:52]
C:\AdwCleaner\AdwCleaner[S2].txt - [3488 Bytes] - [24/11/2015 08:17:44]
C:\AdwCleaner\AdwCleaner[S3].txt - [712 Bytes] - [24/11/2015 09:21:42]
C:\AdwCleaner\AdwCleaner[S4].txt - [8046 Bytes] - [03/01/2017 13:06:29]
C:\AdwCleaner\AdwCleaner[S5].txt - [1936 Bytes] - [09/01/2017 14:22:24]
C:\AdwCleaner\AdwCleaner[S6].txt - [1856 Bytes] - [09/01/2017 16:57:48]

########## EOF - C:\AdwCleaner\AdwCleaner[S6].txt - [1929 Bytes] ##########
         

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.0 (12.05.2016)
Operating System: Windows 7 Professional x64 
Ran by z1 (Administrator) on 09.01.2017 at 17:02:37,72
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 36 

Successfully deleted: C:\ProgramData\mntemp (File) 
Successfully deleted: C:\Users\z1\AppData\Local\{B5F70934-5E12-42d2-882D-62D42EA1FA67} (Empty Folder)
Successfully deleted: C:\Users\z1\AppData\Local\crashrpt (Folder) 
Successfully deleted: C:\Users\z1\Documents\add-in express (Folder) 
Successfully deleted: C:\Users\z1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\z1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1QFIK1VZ (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\z1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\40SD14WX (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\z1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\46N3L089 (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\z1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5 (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\z1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77Q92IGI (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\z1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AHBZPGVF (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\z1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BAM4JN5R (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\z1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDQANKZF (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\z1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C3O171A6 (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\z1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CDFVSHC4 (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\z1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5 (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\z1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I37COVXC (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\z1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KIRL2GHJ (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\z1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LIXMVQOA (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\z1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T1LDZ0W9 (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1QFIK1VZ (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\40SD14WX (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\46N3L089 (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5 (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77Q92IGI (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AHBZPGVF (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BAM4JN5R (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDQANKZF (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C3O171A6 (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CDFVSHC4 (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5 (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I37COVXC (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KIRL2GHJ (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LIXMVQOA (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T1LDZ0W9 (Temporary Internet Files Folder) 



Registry: 0 





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 09.01.2017 at 17:03:23,82
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Dann zeig mal frische FRST Logs. Haken setzen bei addition.txt dann auf Untersuchen klicken

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 08-01-2017
durchgeführt von z1 (Administrator) auf BUERO01 (10-01-2017 07:34:28)
Gestartet von C:\Users\z1\Desktop\anti-rootki
Geladene Profile: z1 (Verfügbare Profile: z1)
Platform: Windows 7 Professional Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(DATEV eG) C:\Program Files (x86)\DATEV\SiPacompact\SiPaHostService.exe
(Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(TeamViewer GmbH) C:\Program Files\ITbrain\AntiMalware\ITbrain_AntiMalware_Service.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 10\ouservice\StarMoneyOnlineUpdate.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
(CompuGroup Medical) C:\Program Files (x86)\CG\Z1Lokal\exe\wkflbin\wkflsr32.exe
(CompuGroup Medical) C:\Program Files (x86)\CG\Z1Lokal\exe\wkflbin\wkflbu32.exe
(CompuGroup Medical Software GmbH) \\z1server\Z1\vitax\vita-X.exe
(CompuGroup Medical Deutschland AG) C:\CGM\PraxisArchiv\ArchiveTracerMT.exe
(CompuGroup Medical Deutschland AG) C:\CGM\PraxisArchiv\Client\PraxisArchiv.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13667032 2014-05-16] (Realtek Semiconductor)
HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [767312 2009-09-03] (CANON INC.)
HKLM\...\Run: [Malwarebytes Anti-Ransomware] => C:\Program Files\Malwarebytes\Anti-Ransomware\mbarw.exe [722896 2016-08-26] (Malwarebytes)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2776528 2016-12-14] (Malwarebytes)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [777392 2016-12-15] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [IJNetworkScanUtility] => C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe [140640 2009-09-28] (CANON INC.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2779136 2016-06-11] (Dominik Reichl)
HKLM-x32\...\Run: [Syncios device service] => C:\Program Files (x86)\Syncios2\SynciosDeviceService.exe [861184 2015-08-04] ()
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [25779624 2016-12-21] (Dropbox, Inc.)
HKLM-x32\...\Run: [DVCServ] => C:\Program Files (x86)\DATEV\SipaCompact\SipaHost.exe [575016 2016-03-17] (DATEV eG)
Winlogon\Notify\GoToAssist Express Customer: C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\1092\g2ax_winlogonx64.dll [X]
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\Run: [KeePass Password Safe 2] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2779136 2016-06-11] (Dominik Reichl)
HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\Run: [AudialsNotifier] => C:\Program Files (x86)\Audials\Audials 2016\AudialsNotifier.exe
HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\MountPoints2: {78eb7145-14b5-11e5-858d-dc85deaa056a} - H:\start.exe /auto
HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\ssText3d.scr [333824 2010-11-21] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [67384 2016-10-05] (Apple Inc.)
ShellExecuteHooks: Kein Name - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} -  -> Keine Datei
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-05-22] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-05-22] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-05-22] ()
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt9] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2 (GFS Stub)] -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 3 (GFS Folder)] -> {16F3DD56-1AF5-4347-846D-7C10C4192619} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt10] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt9] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 10.11.34.10
Tcpip\..\Interfaces\{1D46F64B-10AF-4846-A1E2-3328F4D5E3C1}: [DhcpNameServer] 10.11.34.10
Tcpip\..\Interfaces\{5894CFCF-2FDA-4695-A601-6E86B221FF36}: [DhcpNameServer] 192.168.178.2
Tcpip\..\Interfaces\{816BB56E-DB65-4014-9518-6FAA3CDD697B}: [DhcpNameServer] 172.20.10.1

Internet Explorer:
==================
HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131043802421602492&GUID=00000000-0000-0000-0000-000000000000
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
BHO: Kein Name -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> Keine Datei
BHO: Password Depot 7 -> {9F79B165-70F7-4C46-B1A5-8828E2FF21F9} -> C:\Program Files (x86)\AceBIT\Password Depot 7\pdIEAddOn64.dll [2014-01-24] (AceBIT)
BHO: SCardBHOEvent Class -> {AF8CD625-E04A-4A8F-A90A-0C74846C2E30} -> C:\Program Files (x86)\DATEV\SipaCompact\DVCCSAScardBHO64002.dll [2016-03-17] (DATEV eG)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\ssv.dll [2016-09-08] (Oracle Corporation)
BHO-x32: Password Depot 7 -> {9F79B165-70F7-4C46-B1A5-8828E2FF21F9} -> C:\Program Files (x86)\AceBIT\Password Depot 7\pdIEAddOn32.dll [2014-01-24] (AceBIT)
BHO-x32: SCardBHOEvent Class -> {AF8CD625-E04A-4A8F-A90A-0C74846C2E30} -> C:\Program Files (x86)\DATEV\SiPacompact\DVCCSAScardBHO002.dll [2016-03-17] (DATEV eG)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-21] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2016-11-15] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-09-08] (Oracle Corporation)
Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL Keine Datei
Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL Keine Datei
Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL Keine Datei
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL Keine Datei

FireFox:
========
FF ProfilePath: C:\Users\z1\AppData\Roaming\Mozilla\Firefox\Profiles\tdwfzx6c.default-1483442638781 [2017-01-10]
FF Homepage: Mozilla\Firefox\Profiles\tdwfzx6c.default-1483442638781 -> hxxps://www.google.de/
FF HKLM-x32\...\Firefox\Extensions: [passworddepot@acebit.com] - C:\Program Files (x86)\AceBIT\Password Depot 7\Firefox
FF Extension: (Password Depot Extension) - C:\Program Files (x86)\AceBIT\Password Depot 7\Firefox [2014-12-16] [ist nicht signiert]
FF HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\z1\AppData\Roaming\Mozilla\Firefox\Profiles\9tlmz71o.default\extensions\cliqz@cliqz.com => nicht gefunden
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_24_0_0_186.dll [2016-12-14] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2016-06-08] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_24_0_0_186.dll [2016-12-14] ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL [2010-02-04] (CANON INC.)
FF Plugin-x32: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-09-08] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-09-08] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll [2014-07-16] (Nitro PDF)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2016-06-08] (Adobe Systems)
FF Plugin HKU\S-1-5-21-4170931350-1392568851-4209714175-1000: @citrixonline.com/appdetectorplugin -> C:\Users\z1\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2014-08-11] (Citrix Online)

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [imkcgcjpeajeajpcpbdbgbknfaijnpdc] - C:\Program Files (x86)\AceBIT\Password Depot 7\crx.crx [2014-12-16]
CHR HKLM-x32\...\Chrome\Extension: [ocbnpbkmjpgbdcgiflkgkpnkinifpgpj] - C:\Users\z1\ChromeExtensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj\amazon-icon-2.crx [2014-08-18]

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2016-05-24] (Adobe Systems) [Datei ist nicht signiert]
S4 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [737984 2016-06-03] (Adobe Systems Incorporated)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2218712 2016-12-13] (Adobe Systems, Incorporated)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [871584 2016-12-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [465832 2016-12-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [465832 2016-12-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1047744 2016-12-15] (Avira Operations GmbH & Co. KG)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [249856 2011-11-15] (Brother Industries, Ltd.) [Datei ist nicht signiert]
S4 chip1click; C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe [91136 2016-08-29] (Chip Digital GmbH) [Datei ist nicht signiert]
R2 DATEV Sicherheitspaket-Dienst; C:\Program Files (x86)\DATEV\SiPacompact\SiPaHostService.exe [345128 2016-03-17] (DATEV eG)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-07] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-07] (Dropbox, Inc.)
R2 DbxSvc; C:\Windows\system32\DbxSvc.exe [42096 2016-12-21] (Dropbox, Inc.)
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [2457232 2014-04-11] (Realsil Microelectronics Inc.)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319080 2015-06-04] (Intel Corporation)
R2 ITbrainAntiMalwareService; C:\Program Files\ITbrain\AntiMalware\ITbrain_AntiMalware_Service.exe [4500400 2016-12-01] (TeamViewer GmbH)
S2 MB3Service; C:\Program Files\Malwarebytes\Anti-Ransomware\MB3Service.exe [3291088 2016-08-26] (Malwarebytes)
S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4317648 2016-12-14] (Malwarebytes)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [50688 2014-04-28] (Hewlett-Packard) [Datei ist nicht signiert]
S4 NitroDriverReadSpool9; C:\Program Files\Nitro\Pro 9\NitroPDFDriverService9x64.exe [230920 2014-07-16] (Nitro PDF Software)
S4 NitroUpdateService; C:\Program Files\Nitro\Pro 9\Nitro_UpdateService.exe [417800 2014-07-16] ()
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [66048 2014-04-28] (Hewlett-Packard) [Datei ist nicht signiert]
R2 StarMoney 10 OnlineUpdate; C:\Program Files (x86)\StarMoney 10\ouservice\StarMoneyOnlineUpdate.exe [701760 2016-11-25] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
S4 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5702416 2015-09-11] (TeamViewer GmbH)
S4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2014-05-16] (Microsoft Corporation)
S3 BsHelpCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [X]
S2 GoToAssist Remote Support Customer; "C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\1092\g2ax_service.exe" "Start=service" [X]
S2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [X]
S2 KMS-R@1n; C:\Windows\KMS-R@1n.exe [X]

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 3wareDrv; C:\Windows\system32\drivers\3wareDrv.sys [125224 2014-05-16] (LSI)
R0 ACPIEXT; C:\Windows\System32\DRIVERS\ext_acpi.sys [20568 2014-04-11] (Mitac)
S3 AMDCIR64; C:\Windows\system32\drivers\AMDCIR64.sys [79488 2014-05-16] (Advanced Micro Devices)
S3 amdide64; C:\Windows\system32\drivers\amdide64.sys [11944 2014-05-16] (Advanced Micro Devices Inc.)
R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36096 2014-05-16] (Advanced Micro Devices, Inc.)
S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31920 2014-04-09] (Wondershare)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [167704 2016-12-15] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [139272 2016-12-15] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-08-08] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-10] (Avira Operations GmbH & Co. KG)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77408 2017-01-09] ()
S3 FUJ02E3; C:\Windows\system32\drivers\FUJ02E3.sys [7296 2014-05-16] (FUJITSU LIMITED)
R3 gzflt; C:\Program Files\ITbrain\AntiMalware\gzflt.sys [155912 2016-11-30] (BitDefender LLC)
S3 IAMTVE; C:\Windows\system32\drivers\IAMTVE.sys [43416 2014-05-16] (Intel Corporation)
S3 IAMTXPE; C:\Windows\system32\drivers\IAMTXPE.sys [51096 2014-05-16] (Intel Corporation)
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [28008 2014-05-16] (Intel Corporation)
S3 IFCoEMP; C:\Windows\system32\drivers\ifM60x64.sys [473968 2014-05-16] (Intel(R) Corporation)
S3 IFCoES; C:\Windows\system32\drivers\IFP60X64.sys [163696 2014-05-16] (Intel(R) Corporation)
S3 IFCoEVB; C:\Windows\system32\drivers\ifP60X64.sys [163696 2014-05-16] (Intel(R) Corporation)
S3 iSSetup; C:\Windows\system32\drivers\iSSetup.sys [219968 2014-05-16] (Intel Corporation)
S3 KOBCCID; C:\Windows\System32\drivers\KOBCCID.sys [116864 2015-09-30] (KOBIL Systems GmbH)
R0 MB3SwissArmy; C:\Windows\System32\drivers\MB3SwissArmy.sys [228800 2016-12-30] (Malwarebytes)
S3 megasas2; C:\Windows\system32\drivers\megasas2.sys [52464 2014-05-16] (LSI Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [118272 2014-05-16] (Intel Corporation)
S3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2014-05-16] ()
R3 netr28x; C:\Windows\System32\DRIVERS\netr28x.sys [2473616 2014-12-10] (MediaTek Inc.)
S3 O2MDRDR; C:\Windows\system32\drivers\o2mdx64.sys [63264 2014-05-16] (O2Micro )
S3 rccfg; C:\Windows\system32\drivers\rccfg.sys [21680 2014-05-16] (AMD, Inc.)
S3 rcraid; C:\Windows\system32\drivers\rcraid.sys [533680 2014-05-16] (AMD, Inc.)
R3 rtbth; C:\Windows\System32\DRIVERS\rtbth.sys [685152 2012-06-13] (Ralink Technology, Corp.)
R0 rtcrfilt64; C:\Windows\System32\DRIVERS\rtcrfilt64.sys [19600 2014-04-11] (Realtek Semiconductor Corp.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2015-12-18] (Duplex Secure Ltd.)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.)
S3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [452040 2016-11-30] (BitDefender S.R.L.)
S3 usbohci; C:\Windows\system32\drivers\usbohci.sys [25600 2014-05-16] (Microsoft Corporation) [Datei ist nicht signiert]
S3 usbuhci; C:\Windows\system32\drivers\usbuhci.sys [30720 2014-05-16] (Microsoft Corporation) [Datei ist nicht signiert]
S3 BtAudioBusSrv; System32\Drivers\BtAudioBus.sys [X]
S3 BthL2caScoIfSrv; System32\Drivers\BtL2caScoIf.sys [X]
S3 btUrbFilterDrv; System32\Drivers\IvtUrbBtFlt.sys [X]
S3 dbx; system32\DRIVERS\dbx.sys [X]
S3 DIRECTIO; \??\UNC\filer.prod.xnet\lab\8_systemtest\stresspack_pc\PerformanceTest\DirectIo64.sys [X]
S3 NmPar; \SystemRoot\system32\drivers\NmPar.sys [X]
S3 nmserial; \SystemRoot\system32\drivers\nmserial.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-01-09 17:03 - 2017-01-09 17:03 - 00006046 _____ C:\Users\z1\Desktop\JRT.txt
2017-01-09 16:14 - 2017-01-09 16:54 - 00241194 _____ C:\TDSSKiller.3.1.0.12_09.01.2017_16.14.29_log.txt
2017-01-09 16:00 - 2017-01-09 16:12 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2017-01-09 15:59 - 2017-01-10 07:34 - 00000000 ____D C:\Users\z1\Desktop\anti-rootki
2017-01-09 15:58 - 2017-01-09 15:58 - 00000000 ____D C:\Users\z1\Neuer Ordner
2017-01-09 14:33 - 2017-01-09 14:48 - 00000000 ____D C:\Users\z1\Desktop\office backup
2017-01-09 14:20 - 2017-01-09 14:20 - 03988944 _____ C:\Users\z1\Downloads\adwcleaner_6.042.exe
2017-01-09 11:19 - 2017-01-09 11:19 - 00000000 ____D C:\Users\z1\AppData\Local\WhatsApp
2017-01-09 11:18 - 2017-01-09 11:19 - 101616400 _____ (WhatsApp) C:\Users\z1\Downloads\WhatsAppSetup.exe
2017-01-09 11:17 - 2017-01-09 11:17 - 01496584 _____ C:\Users\z1\Downloads\WhatsApp2732Setup - CHIP-Installer.exe
2017-01-09 08:53 - 2017-01-10 07:34 - 00000000 ____D C:\FRST
2017-01-07 13:58 - 2017-01-10 07:32 - 00000000 ____D C:\Users\z1\AppData\LocalLow\Mozilla
2017-01-05 10:45 - 2017-01-07 13:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-01-03 12:49 - 2017-01-09 17:00 - 00081696 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2017-01-03 12:49 - 2017-01-09 16:59 - 00176064 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys
2017-01-03 12:49 - 2017-01-09 16:59 - 00043968 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-01-03 12:28 - 2017-01-03 12:38 - 00000000 ____D C:\Users\z1\Doctor Web
2017-01-03 12:24 - 2017-01-03 12:24 - 00000000 ____D C:\Users\z1\Desktop\Alte Firefox-Daten
2017-01-02 18:34 - 2017-01-09 16:01 - 00077408 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-01-02 18:34 - 2017-01-02 23:45 - 00001867 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2016-12-30 16:34 - 2017-01-09 16:58 - 03106139 ____H C:\Users\z1\AppData\Local\IconCache.db
2016-12-28 12:25 - 2016-12-28 12:25 - 00001123 _____ C:\Users\Public\Desktop\Z1-Datensicherung.lnk
2016-12-23 10:30 - 2016-12-23 10:30 - 00001909 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2016-12-23 10:30 - 2016-12-23 10:30 - 00000000 ____D C:\Program Files\HitmanPro
2016-12-23 09:40 - 2016-12-23 09:40 - 00000000 ____D C:\Program Files\ITbrain
2016-12-23 09:40 - 2016-11-30 13:41 - 00452040 _____ (BitDefender S.R.L.) C:\Windows\system32\Drivers\Trufos.sys
2016-12-23 09:39 - 2016-12-23 09:39 - 00000000 ____D C:\Users\z1\AppData\Local\TeamViewer
2016-12-22 10:26 - 2016-12-22 10:26 - 00137713 _____ C:\Users\z1\Desktop\Angebot #989.pdf
2016-12-22 05:01 - 2016-12-22 05:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2016-12-21 19:15 - 2016-12-21 19:15 - 00075888 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-stable.sys
2016-12-21 19:15 - 2016-12-21 19:15 - 00075888 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-dev.sys
2016-12-21 19:15 - 2016-12-21 19:15 - 00075888 _____ (Dropbox, Inc.) C:\Windows\system32\Drivers\dbx-canary.sys
2016-12-21 19:15 - 2016-12-21 19:15 - 00042096 _____ (Dropbox, Inc.) C:\Windows\system32\DbxSvc.exe
2016-12-20 08:47 - 2016-12-20 08:47 - 00002003 _____ C:\Users\Public\Desktop\Bestellkompass.lnk
2016-12-20 07:56 - 2017-01-03 12:08 - 00001962 _____ C:\Users\Public\Desktop\CGM ORGANIZER (z1server).lnk
2016-12-19 10:55 - 2016-12-19 10:55 - 00001254 _____ C:\Users\z1\Desktop\Z1-Fernwartung.lnk
2016-12-19 10:52 - 2013-07-05 03:53 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdbss.sys
2016-12-19 10:14 - 2016-12-19 10:14 - 00018280 _____ C:\Windows\system32\results.xml
2016-12-19 09:46 - 2016-12-19 09:46 - 00399976 _____ (Intel Corporation) C:\Windows\system32\CustomModeApp.exe
2016-12-19 09:24 - 2016-12-19 09:24 - 00000000 ____D C:\Windows\pss
2016-12-19 07:52 - 2016-12-19 08:57 - 00000000 ___HD C:\Users\Public\Documents\AdobeGC
2016-12-15 10:20 - 2016-12-15 10:20 - 00000000 ____D C:\Users\z1\Desktop\DVT Gerl, Rita
2016-12-14 13:43 - 2016-12-14 13:43 - 00055423 _____ C:\Users\z1\Documents\mayer.,therese.pdf
2016-12-13 23:18 - 2016-11-21 19:16 - 00154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-12-13 23:18 - 2016-11-21 19:16 - 00095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-12-13 23:18 - 2016-11-21 19:12 - 01462272 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00730624 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\hlink.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-12-13 23:18 - 2016-11-21 19:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-12-13 23:18 - 2016-11-20 17:20 - 00666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2016-12-13 23:18 - 2016-11-20 17:20 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2016-12-13 23:18 - 2016-11-20 17:20 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2016-12-13 23:18 - 2016-11-20 17:20 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2016-12-13 23:18 - 2016-11-20 17:20 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hlink.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2016-12-13 23:18 - 2016-11-20 17:19 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2016-12-13 23:18 - 2016-11-20 17:04 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2016-12-13 23:18 - 2016-11-20 16:58 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-12-13 23:18 - 2016-11-20 16:57 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-12-13 23:18 - 2016-11-20 16:57 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-12-13 23:18 - 2016-11-20 16:57 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2016-12-13 23:18 - 2016-11-20 16:57 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-12-13 23:18 - 2016-11-20 16:52 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2016-12-13 23:18 - 2016-11-20 15:07 - 00467392 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2016-12-13 23:18 - 2016-11-17 17:41 - 00370920 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2016-12-13 23:18 - 2016-11-15 00:27 - 00394448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-12-13 23:18 - 2016-11-14 23:39 - 00346320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-12-13 23:18 - 2016-11-12 20:48 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-12-13 23:18 - 2016-11-12 20:48 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2016-12-13 23:18 - 2016-11-12 20:28 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-12-13 23:18 - 2016-11-12 20:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-12-13 23:18 - 2016-11-12 20:26 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2016-12-13 23:18 - 2016-11-12 20:25 - 00576000 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-12-13 23:18 - 2016-11-12 20:25 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2016-12-13 23:18 - 2016-11-12 20:21 - 02896384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-12-13 23:18 - 2016-11-12 20:15 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-12-13 23:18 - 2016-11-12 20:14 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-12-13 23:18 - 2016-11-12 20:09 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-12-13 23:18 - 2016-11-12 20:08 - 25759744 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-12-13 23:18 - 2016-11-12 20:08 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-12-13 23:18 - 2016-11-12 20:08 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2016-12-13 23:18 - 2016-11-12 20:07 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-12-13 23:18 - 2016-11-12 20:07 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2016-12-13 23:18 - 2016-11-12 19:56 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2016-12-13 23:18 - 2016-11-12 19:53 - 06049280 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-12-13 23:18 - 2016-11-12 19:52 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-12-13 23:18 - 2016-11-12 19:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2016-12-13 23:18 - 2016-11-12 19:41 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-12-13 23:18 - 2016-11-12 19:40 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2016-12-13 23:18 - 2016-11-12 19:35 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2016-12-13 23:18 - 2016-11-12 19:34 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-12-13 23:18 - 2016-11-12 19:31 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-12-13 23:18 - 2016-11-12 19:30 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2016-12-13 23:18 - 2016-11-12 19:29 - 00498688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-12-13 23:18 - 2016-11-12 19:29 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2016-12-13 23:18 - 2016-11-12 19:29 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2016-12-13 23:18 - 2016-11-12 19:28 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2016-12-13 23:18 - 2016-11-12 19:27 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2016-12-13 23:18 - 2016-11-12 19:20 - 02287616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-12-13 23:18 - 2016-11-12 19:20 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2016-12-13 23:18 - 2016-11-12 19:19 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2016-12-13 23:18 - 2016-11-12 19:17 - 20302848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-12-13 23:18 - 2016-11-12 19:15 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2016-12-13 23:18 - 2016-11-12 19:14 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-12-13 23:18 - 2016-11-12 19:14 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2016-12-13 23:18 - 2016-11-12 19:14 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-12-13 23:18 - 2016-11-12 19:14 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2016-12-13 23:18 - 2016-11-12 19:11 - 00725504 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-12-13 23:18 - 2016-11-12 19:10 - 00806912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-12-13 23:18 - 2016-11-12 19:08 - 02131456 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-12-13 23:18 - 2016-11-12 19:08 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2016-12-13 23:18 - 2016-11-12 19:03 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2016-12-13 23:18 - 2016-11-12 18:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2016-12-13 23:18 - 2016-11-12 18:56 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2016-12-13 23:18 - 2016-11-12 18:52 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2016-12-13 23:18 - 2016-11-12 18:51 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2016-12-13 23:18 - 2016-11-12 18:49 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2016-12-13 23:18 - 2016-11-12 18:47 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2016-12-13 23:18 - 2016-11-12 18:41 - 15257088 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-12-13 23:18 - 2016-11-12 18:40 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2016-12-13 23:18 - 2016-11-12 18:38 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-12-13 23:18 - 2016-11-12 18:37 - 04608000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-12-13 23:18 - 2016-11-12 18:36 - 02055680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-12-13 23:18 - 2016-11-12 18:36 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2016-12-13 23:18 - 2016-11-12 18:35 - 02920960 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-12-13 23:18 - 2016-11-12 18:21 - 13653504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-12-13 23:18 - 2016-11-12 18:20 - 01543680 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-12-13 23:18 - 2016-11-12 18:11 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-12-13 23:18 - 2016-11-12 18:05 - 02444800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-12-13 23:18 - 2016-11-12 18:02 - 01312256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-12-13 23:18 - 2016-11-12 18:02 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-12-13 23:18 - 2016-11-10 17:32 - 01009152 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2016-12-13 23:18 - 2016-11-10 17:19 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2016-12-13 23:18 - 2016-11-09 17:41 - 00114408 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2016-12-13 23:18 - 2016-11-09 17:33 - 03244032 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2016-12-13 23:18 - 2016-11-09 17:33 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2016-12-13 23:18 - 2016-11-09 17:33 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2016-12-13 23:18 - 2016-11-09 17:33 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2016-12-13 23:18 - 2016-11-09 17:33 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2016-12-13 23:18 - 2016-11-09 17:33 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2016-12-13 23:18 - 2016-11-09 17:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2016-12-13 23:18 - 2016-11-09 17:17 - 01806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2016-12-13 23:18 - 2016-11-09 17:17 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2016-12-13 23:18 - 2016-11-09 17:17 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2016-12-13 23:18 - 2016-11-09 17:17 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2016-12-13 23:18 - 2016-11-09 17:02 - 00128512 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2016-12-13 23:18 - 2016-11-09 16:55 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2016-12-13 23:18 - 2016-11-06 17:33 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-12-13 23:18 - 2016-11-06 17:16 - 00312832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2016-12-13 23:18 - 2016-11-06 17:01 - 03219456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-12-13 23:18 - 2016-10-27 16:33 - 00802304 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2016-12-13 23:18 - 2016-10-27 16:20 - 00627712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2016-12-13 23:18 - 2016-10-11 16:40 - 00631176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2016-12-13 23:18 - 2016-10-11 16:37 - 05547752 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-12-13 23:18 - 2016-10-11 16:37 - 00706792 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2016-12-13 23:18 - 2016-10-11 16:34 - 01732864 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-12-13 23:18 - 2016-10-11 16:32 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2016-12-13 23:18 - 2016-10-11 16:32 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2016-12-13 23:18 - 2016-10-11 16:32 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2016-12-13 23:18 - 2016-10-11 16:32 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2016-12-13 23:18 - 2016-10-11 16:32 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\nlsbres.dll
2016-12-13 23:18 - 2016-10-11 16:32 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2016-12-13 23:18 - 2016-10-11 16:32 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2016-12-13 23:18 - 2016-10-11 16:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2016-12-13 23:18 - 2016-10-11 16:32 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:24 - 04000488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2016-12-13 23:18 - 2016-10-11 16:24 - 03944680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2016-12-13 23:18 - 2016-10-11 16:21 - 01314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlsbres.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:18 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 16:03 - 00148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2016-12-13 23:18 - 2016-10-11 16:03 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2016-12-13 23:18 - 2016-10-11 16:03 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2016-12-13 23:18 - 2016-10-11 15:59 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2016-12-13 23:18 - 2016-10-11 15:59 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2016-12-13 23:18 - 2016-10-11 15:55 - 00346112 _____ (Microsoft Corporation) C:\Windows\system32\bcdedit.exe
2016-12-13 23:18 - 2016-10-11 15:55 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2016-12-13 23:18 - 2016-10-11 15:51 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2016-12-13 23:18 - 2016-10-11 15:51 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2016-12-13 23:18 - 2016-10-11 15:51 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2016-12-13 23:18 - 2016-10-11 15:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2016-12-13 23:18 - 2016-10-11 15:50 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 15:50 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 15:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 15:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2016-12-13 23:18 - 2016-10-11 14:18 - 00419648 _____ C:\Windows\SysWOW64\locale.nls
2016-12-13 23:18 - 2016-10-11 14:17 - 00419648 _____ C:\Windows\system32\locale.nls
2016-12-13 23:18 - 2016-10-08 14:06 - 00633296 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2016-12-13 23:18 - 2016-10-04 16:31 - 01483264 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2016-12-13 23:18 - 2016-10-04 16:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2016-12-13 23:18 - 2016-10-04 16:31 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2016-12-13 23:18 - 2016-10-04 16:31 - 00141824 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2016-12-13 23:18 - 2016-10-04 16:13 - 01176064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2016-12-13 23:18 - 2016-10-04 16:13 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2016-12-13 23:18 - 2016-10-04 16:13 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2016-12-13 23:18 - 2016-10-04 16:13 - 00106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2016-12-12 10:50 - 2016-12-12 10:50 - 00282319 _____ C:\Users\z1\Documents\IMG_20161212_0002.pdf
2016-12-12 10:14 - 2016-12-12 10:14 - 00274226 _____ C:\Users\z1\Documents\IMG_20161212_0001.pdf

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-01-10 06:44 - 2014-08-12 15:51 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2017-01-10 06:41 - 2015-09-16 08:20 - 00001206 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
2017-01-10 04:41 - 2015-09-16 08:20 - 00001202 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
2017-01-10 03:53 - 2009-07-14 05:45 - 00030192 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-01-10 03:53 - 2009-07-14 05:45 - 00030192 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-01-10 03:00 - 2009-07-14 03:34 - 00000478 _____ C:\Windows\win.ini
2017-01-09 18:10 - 2015-01-13 18:16 - 00000000 ____D C:\Users\z1\AppData\Roaming\Nitro PDF
2017-01-09 17:56 - 2016-05-14 10:52 - 00000000 ____D C:\Users\z1\AppData\Roaming\WhatsApp
2017-01-09 17:03 - 2014-05-16 14:52 - 00704858 _____ C:\Windows\system32\perfh007.dat
2017-01-09 17:03 - 2014-05-16 14:52 - 00151258 _____ C:\Windows\system32\perfc007.dat
2017-01-09 17:03 - 2009-07-14 06:13 - 01629436 _____ C:\Windows\system32\PerfStringBackup.INI
2017-01-09 17:03 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2017-01-09 16:59 - 2016-11-21 08:14 - 00250816 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-01-09 16:59 - 2016-11-21 08:14 - 00102856 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2017-01-09 16:59 - 2015-09-16 08:32 - 00000000 ___RD C:\Users\z1\Dropbox
2017-01-09 16:59 - 2014-08-07 10:53 - 00000000 __SHD C:\Users\z1\IntelGraphicsProfiles
2017-01-09 16:58 - 2014-12-01 14:30 - 00000000 ____D C:\Users\z1\AppData\Roaming\KeePass
2017-01-09 16:58 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-01-09 16:57 - 2014-10-07 13:36 - 00000000 ____D C:\AdwCleaner
2017-01-09 16:01 - 2014-10-07 13:18 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-01-09 15:58 - 2014-08-06 15:16 - 00000000 ___HD C:\Users\z1
2017-01-09 15:02 - 2014-11-03 18:04 - 00114240 _____ C:\Windows\SysWOW64\GDIPFONTCACHEV1.DAT
2017-01-09 15:00 - 2014-11-03 18:06 - 00114240 _____ C:\Windows\system32\GDIPFONTCACHEV1.DAT
2017-01-09 15:00 - 2009-07-14 05:45 - 00446984 _____ C:\Windows\system32\FNTCACHE.DAT
2017-01-09 14:59 - 2015-10-29 08:02 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2017-01-09 14:58 - 2015-10-29 11:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2017-01-09 14:58 - 2010-11-21 08:17 - 00000000 ____D C:\Windows\ShellNew
2017-01-09 14:57 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2017-01-09 14:48 - 2015-02-24 16:41 - 00000000 ____D C:\Users\z1\Documents\Outlook-Dateien
2017-01-09 14:26 - 2016-07-26 08:54 - 00000000 ____D C:\Users\z1\AppData\Local\5838A438-B957-4AA2-BCE9-678C09561139.aplzod
2017-01-09 13:49 - 2014-11-17 15:53 - 00000000 ____D C:\ProgramData\TEMP
2017-01-09 11:19 - 2016-05-14 10:52 - 00002153 _____ C:\Users\z1\Desktop\WhatsApp.lnk
2017-01-09 11:19 - 2016-05-14 10:52 - 00000000 ____D C:\Users\z1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WhatsApp
2017-01-09 11:19 - 2016-05-14 10:52 - 00000000 ____D C:\Users\z1\AppData\Local\SquirrelTemp
2017-01-09 10:51 - 2014-08-11 07:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-01-09 08:59 - 2015-07-22 11:24 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2017-01-09 08:35 - 2014-11-04 17:50 - 00000000 ____D C:\Users\z1\Documents\Backups
2017-01-05 18:27 - 2015-05-12 09:51 - 00000000 ____D C:\Program Files (x86)\StarMoney 10
2017-01-03 12:53 - 2014-08-18 13:07 - 00000000 ____D C:\Users\z1\AppData\Local\JDownloader v2.0
2017-01-03 12:08 - 2016-09-08 13:21 - 00001337 _____ C:\Users\z1\Desktop\GoToAssist Customer.lnk
2017-01-03 12:08 - 2016-04-25 10:38 - 00001956 _____ C:\Users\Public\Desktop\Dashboard CGM ORGANIZER (z1server).lnk
2017-01-03 12:08 - 2016-04-05 07:32 - 00003306 _____ C:\Users\Public\Desktop\DATEV Unternehmen online.lnk
2017-01-03 12:08 - 2009-07-14 06:01 - 00001218 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
2017-01-03 12:08 - 2009-07-14 05:57 - 00001523 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2017-01-03 12:08 - 2009-07-14 05:57 - 00001292 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
2017-01-03 12:08 - 2009-07-14 05:49 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
2017-01-02 23:45 - 2016-11-21 08:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-01-02 18:34 - 2016-11-21 08:13 - 00000000 ____D C:\Program Files\Malwarebytes
2016-12-30 16:35 - 2016-11-21 08:15 - 00228800 _____ (Malwarebytes) C:\Windows\system32\Drivers\MB3SwissArmy.sys
2016-12-29 13:21 - 2014-08-06 15:16 - 00000000 ___RD C:\Users\z1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
2016-12-28 12:25 - 2015-07-01 12:21 - 00003016 _____ C:\Windows\System32\Tasks\Z1ClientUpdate
2016-12-28 12:25 - 2014-08-08 11:40 - 00001201 _____ C:\Users\Public\Desktop\Z1.lnk
2016-12-28 12:24 - 2014-08-08 11:39 - 00000508 _____ C:\Windows\pbl.ini
2016-12-23 19:56 - 2014-08-06 15:16 - 00000000 ____D C:\Users\z1\AppData\Roaming
2016-12-23 12:21 - 2016-03-02 10:09 - 00016728 _____ C:\Users\z1\Desktop\Rechnungen an EOS.xlsx
2016-12-23 10:55 - 2016-10-12 08:47 - 00000000 ____D C:\Program Files (x86)\Movavi Video Converter 15
2016-12-23 10:30 - 2016-01-20 11:07 - 00000000 ____D C:\ProgramData\HitmanPro
2016-12-23 10:14 - 2015-07-22 11:24 - 00000931 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2016-12-22 11:08 - 2014-08-18 13:03 - 00000000 ____D C:\Users\z1\AppData\Local\CrashDumps
2016-12-22 10:16 - 2016-07-04 10:04 - 00007616 _____ C:\Users\z1\Desktop\Kosten Polo 2016.lnk
2016-12-22 10:16 - 2016-02-02 18:11 - 00014923 _____ C:\Users\z1\Desktop\OP-Protokoll Implantation - Verknüpfung.lnk
2016-12-22 10:16 - 2016-02-02 15:50 - 00002765 _____ C:\Users\z1\Desktop\Temp - Übertragung.lnk
2016-12-22 10:16 - 2016-01-21 09:15 - 00002866 _____ C:\Users\z1\Desktop\Shootcamp - Verknüpfung.lnk
2016-12-22 10:16 - 2016-01-20 13:14 - 00004736 _____ C:\Users\z1\Desktop\Teambesprechung - Verknüpfung.lnk
2016-12-22 10:16 - 2015-12-21 16:40 - 00002292 _____ C:\Users\z1\Desktop\Eigene Videos - Verknüpfung.lnk
2016-12-22 10:16 - 2015-11-26 15:49 - 00004140 _____ C:\Users\z1\Desktop\Polo Club.lnk
2016-12-22 10:16 - 2015-06-02 07:14 - 00004521 _____ C:\Users\z1\Desktop\Gerätebuch - Verknüpfung.lnk
2016-12-22 10:16 - 2015-04-21 12:11 - 00001498 _____ C:\Users\Public\Desktop\CGM PRAXISTIMER.lnk
2016-12-22 10:16 - 2015-02-03 17:40 - 00002832 _____ C:\Users\z1\Desktop\Praxis.lnk
2016-12-22 10:16 - 2014-10-06 13:09 - 00002832 _____ C:\Users\z1\Desktop\Privat.lnk
2016-12-22 05:01 - 2015-09-16 08:20 - 00000000 ____D C:\Program Files (x86)\Dropbox
2016-12-20 12:06 - 2015-03-03 10:09 - 00001096 _____ C:\Users\Public\Desktop\TA.lnk
2016-12-20 08:47 - 2015-01-20 16:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AERA
2016-12-20 08:47 - 2015-01-20 16:05 - 00000000 ____D C:\Program Files (x86)\AERA
2016-12-19 11:13 - 2009-07-14 06:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-12-19 10:03 - 2014-08-19 07:14 - 01831844 _____ C:\Windows\ntbtlog.txt
2016-12-19 09:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\catroot
2016-12-19 09:47 - 2009-07-14 05:54 - 00000404 ___SH C:\Users\Public\Desktop\desktop.ini
2016-12-19 09:47 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\DriverStore
2016-12-19 09:46 - 2014-06-24 19:42 - 00000000 ____D C:\Intel
2016-12-19 09:42 - 2014-08-06 18:29 - 00000000 ____D C:\Windows\Minidump
2016-12-19 09:24 - 2014-08-06 15:16 - 00000000 ___RD C:\Users\z1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2016-12-19 09:24 - 2009-07-14 04:20 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2016-12-19 09:00 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\catroot2
2016-12-19 08:57 - 2014-11-28 11:37 - 00000000 ___RD C:\Users\z1\iCloudDrive
2016-12-19 08:29 - 2016-09-07 10:02 - 00524288 ___SH C:\Windows\system32\config\components{b2086b64-74d9-11e6-b253-dc85deaa056a}.TMContainer00000000000000000001.regtrans-ms
2016-12-19 07:52 - 2014-08-13 10:35 - 00000000 ____D C:\Users\z1\AppData\Local\Adobe
2016-12-15 13:59 - 2014-08-08 13:37 - 00167704 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2016-12-15 13:59 - 2014-08-08 13:37 - 00139272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2016-12-14 13:58 - 2014-08-08 12:34 - 00002242 ____H C:\Users\z1\Documents\Default.rdp
2016-12-14 11:45 - 2014-08-12 15:51 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-12-14 11:44 - 2014-08-12 15:51 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-12-14 11:44 - 2014-08-12 15:51 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-12-14 11:44 - 2014-08-12 15:51 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2016-12-14 11:44 - 2014-08-12 15:51 - 00000000 ____D C:\Windows\system32\Macromed
2016-12-14 10:49 - 2015-03-10 17:18 - 00000000 ____D C:\Users\z1\temp
2016-12-14 03:59 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2016-12-14 03:30 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Microsoft.NET
2016-12-14 03:22 - 2009-07-14 03:34 - 00189440 ____H C:\Users\Default\NTUSER.DAT.LOG1
2016-12-14 03:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\en-US
2016-12-14 03:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\de-DE
2016-12-14 03:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\en-US
2016-12-14 03:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\de-DE
2016-12-14 03:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\Boot
2016-12-14 03:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\AppPatch
2016-12-14 03:21 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Internet Explorer
2016-12-14 03:21 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files (x86)\Internet Explorer
2016-12-14 03:05 - 2014-08-06 15:50 - 00000000 ____D C:\Windows\system32\MRT
2016-12-14 03:03 - 2014-08-06 15:50 - 135632432 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-12-14 03:02 - 2014-05-16 15:21 - 01606524 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2016-12-13 15:49 - 2015-03-18 09:50 - 00000000 ____D C:\SYNADOC-CD
2016-12-13 15:47 - 2016-04-06 07:17 - 00001455 _____ C:\Users\z1\Desktop\Synadoc-CD auf Laufwerk Z.lnk
2016-12-12 09:12 - 2014-08-08 12:36 - 00000000 ____D C:\ProgramData\TW

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2015-02-27 10:12 - 2015-02-27 10:12 - 0038475 _____ () C:\Users\z1\AppData\Roaming\Kommagetrennte Werte (DOS).ADR
2015-02-27 10:46 - 2015-02-27 10:46 - 0038465 _____ () C:\Users\z1\AppData\Roaming\Microsoft Excel 97-2003.ADR
2015-02-27 11:20 - 2015-02-27 11:23 - 0038478 _____ () C:\Users\z1\AppData\Roaming\Tabulatorgetrennte Werte (DOS).ADR
2015-02-27 11:07 - 2015-02-27 11:07 - 0038487 _____ () C:\Users\z1\AppData\Roaming\Tabulatorgetrennte Werte (Windows).ADR
2014-11-21 10:21 - 2014-11-21 10:21 - 0111752 _____ () C:\Users\z1\AppData\Local\ars.cache
2015-11-02 11:10 - 2015-11-02 11:10 - 0000423 _____ () C:\Users\z1\AppData\Local\belegtransfer_setup.log
2014-11-21 10:21 - 2014-11-21 10:21 - 0242928 _____ () C:\Users\z1\AppData\Local\census.cache
2014-11-21 09:45 - 2014-11-21 09:45 - 0000036 _____ () C:\Users\z1\AppData\Local\housecall.guid.cache
2015-04-10 08:17 - 2015-04-10 08:17 - 0000017 _____ () C:\Users\z1\AppData\Local\resmon.resmoncfg
2014-06-24 19:43 - 2014-06-24 19:43 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2016-10-12 08:40 - 2016-10-12 08:40 - 0005106 _____ () C:\ProgramData\mudtcpaz.vzs

Einige Dateien in TEMP:
====================
C:\Users\z1\AppData\Local\Temp\avgnt.exe
C:\Users\z1\AppData\Local\Temp\jna2026503319534643980.dll
C:\Users\z1\AppData\Local\Temp\jna2572421679924466072.dll
C:\Users\z1\AppData\Local\Temp\jna5885813360373430274.dll
C:\Users\z1\AppData\Local\Temp\jna7609583068531516420.dll
C:\Users\z1\AppData\Local\Temp\sqlite-3.7.2-sqlitejdbc.dll


==================== Bamital & volsnap ======================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert

LastRegBack: 2017-01-03 00:08

==================== Ende von FRST.txt ============================
         

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 08-01-2017
durchgeführt von z1 (10-01-2017 07:34:46)
Gestartet von C:\Users\z1\Desktop\anti-rootki
Windows 7 Professional Service Pack 1 (X64) (2014-08-06 14:16:13)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-4170931350-1392568851-4209714175-500 - Administrator - Disabled)
Gast (S-1-5-21-4170931350-1392568851-4209714175-501 - Limited - Enabled)
z1 (S-1-5-21-4170931350-1392568851-4209714175-1000 - Administrator - Enabled) => C:\Users\z1

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: ITbrain Anti-Malware (Enabled - Up to date) {0DF788D5-9792-056A-E90E-8A863B242341}
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Malwarebytes (Disabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Malwarebytes (Disabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: ITbrain Anti-Malware (Enabled - Up to date) {B6966931-B1A8-0AE4-D3BE-B1F440A369FC}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

3D-Patientenberater Plus (HKLM-x32\...\3D-Patientenberater Plus) (Version:  - CompuDENT Praxiscomputer)
64 Bit HP CIO Components Installer (Version: 17.2.1 - Hewlett-Packard) Hidden
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.020.20042 - Adobe Systems Incorporated)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 3.7.0.272 - Adobe Systems Incorporated)
Adobe Flash Player 24 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 24.0.0.186 - Adobe Systems Incorporated)
Adobe Flash Player 24 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 24.0.0.186 - Adobe Systems Incorporated)
Adobe Photoshop CS2 (HKLM-x32\...\Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0407-1E257A25E34D}) (Version: 9.0 - Adobe Systems, Inc.)
Adobe Photoshop Lightroom 5 (HKLM-x32\...\{D176CB09-1505-4D2B-838A-4483D7DF23FB}) (Version: 5.0.1 - Adobe)
Adobe Photoshop Lightroom 5.7.1 64-bit (HKLM\...\{BC86B82C-8C0E-4408-9AC1-6B0F2D636963}) (Version: 5.7.1 - Adobe Systems Incorporated)
AERA Bestellkompass (HKLM-x32\...\AERA_Bestellkompass) (Version: 5.5 - AERA)
AERA plus (HKLM-x32\...\AERA_AERA plus) (Version: 1.0.9 - AERA)
Apple Application Support (32-Bit) (HKLM-x32\...\{F2871C89-C8A5-42EE-8D45-0F02506385A6}) (Version: 5.1 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{9BC93467-75D1-4AA4-BD58-D9C51D88DFAB}) (Version: 5.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{55BB2110-FB43-49B3-93F4-945A0CFB0A6C}) (Version: 10.0.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.6.3.0 - Asmedia Technology)
AudibleManager (HKLM-x32\...\AudibleManager) (Version: 1997091889.48.56.2430194 - Audible, Inc.)
Avira Professional Security (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.24.37 - Avira Operations GmbH & Co. KG)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Canon CanoScan LiDE 120 On-screen Manual (HKLM-x32\...\Canon CanoScan LiDE 120 On-screen Manual) (Version: 7.7.1 - Canon Inc.)
Canon IJ Network Scan Utility (HKLM-x32\...\Canon_IJ_Network_Scan_UTILITY) (Version:  - )
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version:  - )
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version: 1.1.11.1 - Canon Inc.)
Canon Kurzwahlprogramm (HKLM-x32\...\Speed Dial Utility) (Version:  - )
Canon MP Navigator EX 3.1 (HKLM-x32\...\MP Navigator EX 3.1) (Version:  - )
Canon MX870 series Benutzerregistrierung (HKLM-x32\...\Canon MX870 series Benutzerregistrierung) (Version:  - )
Canon MX870 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX870_series) (Version:  - )
Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.4.0 - Canon Inc.)
Canon RAW Codec (HKLM-x32\...\Canon RAW Codec) (Version: 1.8.0.68 - Canon Inc.)
Canon Utilities Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version:  - )
Canon Utilities My Printer (HKLM-x32\...\CanonMyPrinter) (Version:  - )
Canon Utilities Solution Menu (HKLM-x32\...\CanonSolutionMenu) (Version:  - )
CanoScan LiDE 120 Scanner Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ2415) (Version: 1.00 - Canon Inc.)
CGM ORGANIZER (HKLM-x32\...\{12F112BB-DFF4-41CB-B8BB-33962DC90843}) (Version: 1.11.226 - CompuGroup Medical Deutschland AG)
CGM PRAXISARCHIV (HKLM-x32\...\{4430C052-AF7C-468C-915D-222E26E2B153}) (Version: 4.12.2100.8815 - CompuGroup Medical Deutschland AG)
CGM PRAXISTIMER 4.12.1607.0 (HKLM-x32\...\PraxisTimer) (Version:  - )
CGM Z1 (HKLM-x32\...\CGM Z1) (Version: 2.56 - )
chip 1-click download service (HKLM-x32\...\{503CA94E-0834-4CEE-AD92-BA17AF4E809A}) (Version: 3.6.9.0 - Chip Digital GmbH)
Citrix Online Launcher (HKLM-x32\...\{678753E6-E526-4AE5-A144-00240772543A}) (Version: 1.0.393 - Citrix)
CodeTwo Sync for iCloud (HKLM-x32\...\{0D8DF5B9-96A7-47B3-9D9C-49F044DB603C}) (Version: 1.3.3.3 - CodeTwo)
CR Driver (remove only) (HKLM-x32\...\Driver CR) (Version: 1.3.39.0 - )
CS 3D Imaging Software (remove only) (HKLM-x32\...\3DViewer) (Version: 3.2.12.0 - )
CS FilmComposer (remove only) (HKLM-x32\...\FilmComposer) (Version: 3.2.9.0 - Carestream Health, Inc.)
CS Volume Converter (remove only) (HKLM-x32\...\VolumeConverter) (Version: 1.0.6.0 - )
DATEV Belegtransfer V.3.32 (HKLM-x32\...\{EC561A24-754E-44F1-B76F-2FDA3DF9E912}) (Version: 2.03 - DATEV eG)
DriverRVG (HKLM-x32\...\{A9273B11-2A0C-4477-926C-54D66291B8B1}) (Version:  - )
Dropbox (HKLM-x32\...\Dropbox) (Version: 16.4.30 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.59.1 - Dropbox, Inc.) Hidden
EclipseDB (HKLM-x32\...\{C3857AE9-B016-404E-9E22-7D87A00625DE}) (Version: 1.0.0.41 - Carestream)
EOS Health Transfer (2.5.0) (HKLM-x32\...\EOS Health Transfer) (Version:  - EOS Health Honorarmanagement AG)
Ez3D Plus (HKLM-x32\...\{036F4752-39E3-4B9C-AD93-2A856A867C1E}) (Version: 1.2.6.2 - E-WOO Technology Co.,LTD)
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.15.281 - SurfRight B.V.)
HL-5470DW (HKLM-x32\...\{7171B206-5C5A-4B7F-B9E1-1F1827FC769F}) (Version: 1.1.7.0 - Brother Industries, Ltd.)
HP Color LaserJet 3600 (02/27/2007 61.063.461.41) (HKLM\...\hpc3600w) (Version: 02/27/2007 61.063.461.41 - HP)
iCloud (HKLM\...\{29AAC3D3-23FC-496D-8266-0E3833686758}) (Version: 6.0.2.10 - Apple Inc.)
Intel Driver Update Utility (HKLM-x32\...\{fe92d390-13ee-4660-a2f8-39a066fdffe0}) (Version: 2.2.0.5 - Intel)
Intel(R) Driver Update Utility 2.2.0.5 (x32 Version: 2.2.0.1 - Intel) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4226 - Intel Corporation)
ITbrain Anti-Malware (HKLM\...\ITbrain Anti-Malware) (Version: 1.0.71681  - TeamViewer)
iTunes (HKLM\...\{2C49F336-2E86-4407-83E2-16AC65598EF4}) (Version: 12.5.3.16 - Apple Inc.)
Java 8 Update 101 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180101F0}) (Version: 8.0.1010.13 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
KOBIL CCID driver x64x86 (x32 Version: 1.013.02121 - KOBIL Systems) Hidden
Kodak Dental Imaging Software Installation (HKLM-x32\...\InstallShield_{03F102FB-18C9-4B2A-B464-55FFD9AB2C2B}) (Version: 6.12.32.0-C - Kodak-Trophy)
Kodak Dental Imaging Software Installation (x32 Version: 6.12.32.0-C - Kodak-Trophy) Hidden
Kodak Dental Software (x32 Version: 6.12.32.0-C - Kodak) Hidden
Kodak Patient File (x32 Version: 6.12.32.0-C - Kodak) Hidden
Leitfaden Praxisbegehung 1.0 (HKLM-x32\...\{34951065-2C8A-42B4-B75A-F110679A48AD}) (Version: 3.22 - Spitta Verlag GmbH & Co. KG)
Malwarebytes Version 3.0.5.1299 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.0.5.1299 - Malwarebytes)
mediserv Abrechnungsmodul 4.8.6 (Build 1056) (HKLM-x32\...\mediserv Abrechnungsmodul) (Version:  - mediserv GmbH)
Microsoft .NET Framework 4.6.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft Camera Codec Pack (HKLM\...\{F7930EE9-0929-439D-A57B-D40C2C69C890}) (Version: 6.3.9723.0 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\OneDriveSetup.exe) (Version: 17.3.5951.0827 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Facebook 32-bit (HKLM-x32\...\{95140000-007C-0409-0000-0000000FF1CE}) (Version: 14.0.6114.5003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Native Client (HKLM\...\{CB95CD7D-FDCC-449A-86AE-67C257745A0B}) (Version: 10.50.1600.1 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client  (HKLM\...\{93945D16-4C3D-433E-B7E4-3D0D86B284C8}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{D285FC5F-3021-32E9-9C59-24CA325BDC5C}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23918 (HKLM-x32\...\{dab68466-3a7d-41a8-a5cf-415e3ff8ef71}) (Version: 14.0.23918.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23918 (HKLM-x32\...\{2e085fd2-a3e4-4b39-8e10-6b8d35f55244}) (Version: 14.0.23918.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Movavi Video Converter 15 (HKLM-x32\...\Movavi Video Converter 15) (Version: 15.2.1 - Movavi)
Mozilla Firefox 50.1.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 50.1.0 (x86 de)) (Version: 50.1.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 50.1.0.6186 - Mozilla)
Mozilla Thunderbird 38.2.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 38.2.0 (x86 de)) (Version: 38.2.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML4.0 component (x32 Version: 1.0.0.0 - Trophy) Hidden
Nitro Pro 9 (HKLM\...\{4A53F617-750C-4322-86FC-02F467B0CA70}) (Version: 9.5.2.29 - Nitro)
Office 16 Click-to-Run Extensibility Component (Version: 16.0.6001.1034 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.6001.1034 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (Version: 16.0.6001.1034 - Microsoft Corporation) Hidden
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
pcvisit Support 15.0 (HKLM-x32\...\pcvisit Support 15.0) (Version: 15.0.11.872 - pcvisit Software AG)
PopScan ReadScanner (HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\PopScan Scanner Reader) (Version: 0.2.4.2 - Sensational AG)
PraxisArchiv (HKLM-x32\...\{8C9F0911-4E29-4C35-BB7F-E5F263E96DCA}) (Version: 4.8.5800.6095 - CompuGroup Medical Deutschland AG)
PrintKey2000 (HKLM-x32\...\PrintKey2000) (Version:  - )
PrograBase X10 (HKLM-x32\...\{ADC71A09-D373-47B9-84A5-C0B6563A1E76}) (Version: 2.10.0 - Ivoclar Vivadent)
Ralink RT2860 Wireless LAN Card (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309B0}) (Version: 1.2.0.40 - Ralink)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.97.1001.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7179 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.2.8400.39032 - Realtek Semiconductor Corp.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version:  - Microsoft)
Sicherheitspaket compact (HKLM-x32\...\{394a49d9-02fa-4439-9433-ce2f135972f3}) (Version: 3.2.100.16077 - DATEV eG)
Sicherheitspaket compact (x32 Version: 3.2.100.16077 - DATEV eG) Hidden
Skype™ 7.3 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.3.101 - Skype Technologies S.A.)
SmartTools Publishing • Word Falz & Lochmarken-Assistent (HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\SmartToolsWordFalz & Lochmarken-Assistent) (Version: 8.00 - SmartTools Publishing)
Spitta Abrechnungsportal Schnittstelle (HKLM-x32\...\spittaaportzm) (Version:  - )
Spitta-Aufklärungssystem (HKLM-x32\...\{402F6E21-EEC4-4D45-8FB5-4A6AF6998744}) (Version: 3.1 - Spitta Verlag GmbH & Co. KG)
StarMoney (x32 Version: 4.0.4.16 - StarFinanz) Hidden
StarMoney (x32 Version: 4.0.6.107 - StarFinanz) Hidden
StarMoney (x32 Version: 5.0.0.226 - StarFinanz) Hidden
StarMoney 10  (HKLM-x32\...\{8A9B4DDC-91F1-4670-B301-8B6C2B4D2FA6}) (Version: 10 - Star Finanz GmbH)
StarMoney 9.0  (HKLM-x32\...\{4D7B9450-BA40-4856-8932-F6765A1AFF5C}) (Version: 9.0 - Star Finanz GmbH)
StarMoney 9.0  (HKLM-x32\...\{548C3C0B-CAF5-4088-A8EB-39D7A1BB95E3}) (Version: 9.0 - Star Finanz GmbH)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.47484 - TeamViewer)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
Volksverschlüsselungs-Software v1.08-0 (HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\{75D939AB-C78E-4EA3-99E6-404FB33D1E2D}) (Version: v1.08-0 - Fraunhofer SIT)
WhatsApp (HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\WhatsApp) (Version: 0.2.2732 - WhatsApp)
Windows Driver Package - Mitac (ACPIEXT) System  (07/01/2011 1.0.2.42) (HKLM\...\0FC1EDE7A916BDAFE97A52F1ADA63101467DE8AD) (Version: 07/01/2011 1.0.2.42 - Mitac)
WinRAR 5.10 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)
WISO steuer:Sparbuch 2016 (HKLM-x32\...\{FD1EC892-B381-47E4-BECC-243CF6EA6EC4}) (Version: 23.00.1146 - Buhl Data Service GmbH)
WISO Steuer-Sparbuch 2015 (HKLM-x32\...\{DD5601E6-E8C4-4A32-8831-776BEC7A456E}) (Version: 22.00.8811 - Buhl Data Service GmbH)
Wunderlist - Wunderlist (HKLM-x32\...\Wunderlist Wunderlist) (Version: 3.4.3 - Wunderlist)
Z1 SQL Server 2012 (HKLM-x32\...\Z1 SQL Server 2012) (Version:  - )

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{0C8EE82E-A958-4E00-BC74-0AB54908B85B}\InprocServer32 -> C:\Users\z1\AppData\Roaming\Programme\SmartTools\Word Falz & Lochmarken-Assistent\adxloader64.dll ()
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{14BBBC99-AF48-3ACA-8FD0-9E795D843343}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{196AAB40-0AE4-30CE-B5A0-4C820A90CCE2}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{1F9FC50D-BD7C-3335-95ED-18FFB9273C50}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{4CDDA53F-5EBF-35FA-8EC1-D64D1DA8A751}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{4E266860-3FA5-3C65-8EDF-D0F846950884}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{572201C5-B3E6-3BE1-AFD7-7F0DC8091488}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{6295A54D-BD2A-4CF7-A288-62B0D91F7879}\InprocServer32 -> C:\Program Files (x86)\Outlook Backup Assistant\AddIn\adxloader64.dll ()
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{6A392F1D-CD13-3891-AF1E-DF25427368FD}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{6CA2939C-714D-3585-8714-BECD01E9D42B}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{743035C6-FA33-39DF-A741-34A81649705C}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{8894DB3B-ABA0-30A9-8E8C-E0B06E6C426E}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{8F18E4FD-6226-3AB5-B6B8-C8CDAB4B9CE5}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{90DDCBC7-4E54-3D0B-9734-D6AEC1969353}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{A746EA6E-6A7F-36E9-B971-61755969EF04}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{C479B1E6-7EF7-3495-879C-4E62669B3C28}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{C593E65B-613B-347B-A83A-5B03A481C017}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{CCBEF1A3-D558-36E2-81AB-C6D7077AF15F}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{CF2B96F5-0390-3F2A-93CB-4F39DD2F6D10}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{D298D05D-411C-36F1-8D78-85258C63B34D}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{E3DF3DC0-3869-3CF6-9638-ACE5BFCF8341}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{E444D266-68C3-4748-91FC-49A65C606776}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
CustomCLSID: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000_Classes\CLSID\{F06C2BF9-E2F8-32F9-BA0A-59D6E6A4F593}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {045A4096-4139-46DA-8CA1-69D8BE7822B7} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-11-07] (Dropbox, Inc.)
Task: {08F5D30D-7BFA-4AED-A60B-D13788F5B40A} - System32\Tasks\OInstall => C:\Windows\OInstall.exe [2015-10-10] ()
Task: {0A5A75F5-3E67-474B-8866-AFAD15C8DF30} - System32\Tasks\Z1ClientUpdate => C:\Program Files (x86)\CG\Z1Lokal\exe\z1clientupdate.exe [2017-01-04] (CompuGroup Medical Dentalsysteme GmbH)
Task: {1236BA8F-C364-42BF-8B59-15B486137BA2} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Task: {50DF3688-8AFD-46BA-9FB8-EAAF6F1137E2} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-12-14] (Adobe Systems Incorporated)
Task: {5BDAD0BF-6E73-44B9-9D11-7DC078AD975A} - System32\Tasks\{921143A9-5903-442C-A91F-4FB455C14363} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{036F4752-39E3-4B9C-AD93-2A856A867C1E}\setup.exe" -c -runfromtemp -l0x0009 -removeonly
Task: {7F98C8B7-D1FB-4C6B-A139-C3E7C9751200} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-10-21] (Adobe Systems Incorporated)
Task: {96B94671-D5CD-462C-AEA0-10DBCADC669D} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe
Task: {A0D18D6F-E62B-4E34-921A-47EE2C5E64DC} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-11-07] (Dropbox, Inc.)
Task: {A4985B46-6175-47C0-A820-2EF115D82C49} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {A8FBB5DF-07E8-4B77-8D20-A0DE6DF44936} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe
Task: {C82BA783-8E24-4AEF-B3D9-DB5CF0F806D4} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe
Task: {D81BC290-DAF2-4626-AB43-A9207A54CC86} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe
Task: {EB7173CF-066C-45A6-90D5-F82B1AC9D63A} - System32\Tasks\{3ED7CDDD-0456-49A5-9112-4AFA57D98373} => pcalua.exe -a D:\CDViewerRun.exe -d D:\

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2016-09-01 17:12 - 2016-09-01 17:12 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2016-10-05 18:17 - 2016-10-05 18:17 - 01353528 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2016-05-22 18:33 - 2016-05-22 18:33 - 00491184 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
2016-12-09 13:09 - 2016-01-28 15:33 - 01058624 _____ () C:\Program Files (x86)\StarMoney 10\ouservice\libxml2.dll
2016-12-09 13:09 - 2011-01-13 10:44 - 00232800 _____ () C:\Program Files (x86)\StarMoney 10\ouservice\PATCHW32.dll
2016-12-28 12:24 - 2015-09-08 16:41 - 00119822 _____ () C:\Program Files (x86)\CG\Z1Lokal\exe\wkflbin\libgcc_s_dw2-1.dll
2016-12-28 12:24 - 2015-09-08 16:41 - 01026574 _____ () C:\Program Files (x86)\CG\Z1Lokal\exe\wkflbin\libstdc++-6.dll
2016-12-28 12:25 - 2016-06-10 00:59 - 00111104 _____ () C:\Program Files (x86)\CG\Z1Lokal\exe\wkflbin\wkflsr32core.dll
2016-12-28 12:25 - 2016-11-02 18:18 - 00539136 _____ () C:\Program Files (x86)\CG\Z1Lokal\exe\wkflbin\sqldrivers\qsqlitecg.dll
2016-12-28 12:25 - 2016-11-02 18:17 - 00582656 _____ () C:\Program Files (x86)\CG\Z1Lokal\exe\wkflbin\sqlite3.dll
2016-12-28 12:24 - 2015-03-31 11:56 - 03920542 _____ () C:\Program Files (x86)\CG\Z1Lokal\exe\wkflbin\icuin54.dll
2016-12-28 12:24 - 2015-03-31 11:56 - 02177557 _____ () C:\Program Files (x86)\CG\Z1Lokal\exe\wkflbin\icuuc54.dll
2016-12-28 12:24 - 2015-03-31 11:56 - 25382664 _____ () C:\Program Files (x86)\CG\Z1Lokal\exe\wkflbin\icudt54.dll
2014-08-05 14:10 - 2014-04-24 12:22 - 00067072 _____ () \\z1server\Z1\vitax\bin\core\win\vxProcessId.dll
2017-01-09 07:44 - 2017-01-09 07:44 - 00541696 _____ () C:\Users\z1\AppData\Local\Temp\sqlite-3.7.2-sqlitejdbc.dll
2014-07-17 12:50 - 2014-07-17 12:50 - 00010752 _____ () C:\CGM\PraxisArchiv\Client\DocClientPS.dll
2014-07-17 12:50 - 2014-07-17 12:50 - 00014848 _____ () C:\CGM\PraxisArchiv\Common\interfacelibs\DocSrvPS.dll
2014-07-17 12:50 - 2014-07-17 12:50 - 00040960 _____ () C:\CGM\PraxisArchiv\Common\interfacelibs\DBSrvPS.dll
2014-07-17 12:53 - 2014-07-17 12:53 - 00015872 _____ () C:\CGM\PraxisArchiv\Client\PraxisArchivPS.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)

AlternateDataStreams: C:\ProgramData\TEMP:CB0AACC9 [196]

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\GoToAssist Remote Support Customer => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)

HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\Software\Classes\.exe: exefile =>  <===== ACHTUNG

==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE trusted site: HKU\.DEFAULT\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\mediserv.de -> hxxps://rz.mediserv.de
IE trusted site: HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\speedport.ip -> hxxps://speedport.ip

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2009-07-14 03:34 - 2016-04-05 12:52 - 00001011 ____A C:\Windows\system32\Drivers\etc\hosts


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\z1\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 10.11.34.10
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: AdobeUpdateService => 2
MSCONFIG\Services: chip1click => 2
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: NitroDriverReadSpool9 => 2
MSCONFIG\Services: NitroUpdateService => 2
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: StarMoney 9.0 OnlineUpdate => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Printkey2000.lnk => C:\Windows\pss\Printkey2000.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^z1^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma.lnk => C:\Windows\pss\Adobe Gamma.lnk.Startup
MSCONFIG\startupreg: Adobe Creative Cloud => "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" --showwindow=false --onOSstartup=true
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: ApplePhotoStreams => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
MSCONFIG\startupreg: BCSSync => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
MSCONFIG\startupreg: BrStsMon00 => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN
MSCONFIG\startupreg: CanonMyPrinter => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
MSCONFIG\startupreg: CanonQuickMenu => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE /logon
MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: iCloudDrive => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
MSCONFIG\startupreg: iCloudPhotos => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe
MSCONFIG\startupreg: iCloudServices => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: PopScan Scanner Reader => "C:\Users\z1\AppData\Roaming\popscan\popscan.exe" /autostart
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: TrojanScanner => C:\Program Files (x86)\Trojan Remover\Trjscan.exe /boot

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [SPPSVC-In-TCP] => %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => %SystemRoot%\system32\sppsvc.exe
FirewallRules: [VirtualPC-In-UDP-1] => %SystemRoot%\System32\vpc.exe
FirewallRules: [VirtualPC-In-UDP-2] => %SystemRoot%\System32\vpc.exe
FirewallRules: [VirtualPC-In-TCP-1] => %SystemRoot%\System32\vpc.exe
FirewallRules: [{A12DDDA4-BF60-4222-857A-BE25C8DFC05A}] => C:\CGM\PraxisArchiv\Client\PraxisArchiv.exe
FirewallRules: [{A50FF1E6-CD3B-401F-9CA9-0321E46258B6}] => C:\CGM\PraxisArchiv\Client\PraxisArchiv.exe
FirewallRules: [{C832BBC3-49E5-492C-B0F7-5712A2B51EB4}] => C:\CGM\PraxisArchiv\ArchiveTracerMT.exe
FirewallRules: [{5A051FD9-673D-456E-982D-AFF754D2817E}] => C:\CGM\PraxisArchiv\ArchiveTracerMT.exe
FirewallRules: [{46BD91C1-3BC3-4F3C-ABA6-8F8F1F13E748}] => C:\CGM\PraxisArchiv\Client\OfficeConnect.exe
FirewallRules: [{766CE507-51DD-42AC-93C9-071107F79AF3}] => C:\CGM\PraxisArchiv\Client\OfficeConnect.exe
FirewallRules: [{31AA891C-D827-4B92-9026-677F392F27EF}] => C:\CGM\PraxisArchiv\Client\WordX.exe
FirewallRules: [{B1CC1BE9-2B58-4C16-B259-44A1E96CB5DC}] => C:\CGM\PraxisArchiv\Client\WordX.exe
FirewallRules: [{62C18C13-7981-4707-BFAB-F20207176828}] => C:\CGM\PraxisArchiv\Common\FaxSrv\FaxServer.exe
FirewallRules: [{DE58A30B-BB17-41F7-B028-F148A41C0265}] => C:\CGM\PraxisArchiv\Common\FaxSrv\FaxServer.exe
FirewallRules: [{1FE6D62D-B961-446D-9972-C5A14AA716C3}] => LPort=135
FirewallRules: [{A8E9F12A-7D60-4D96-AEAC-7729D5F93739}] => C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{BB96759B-CE53-4ED6-8F67-BEE7959BAE9F}] => C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{1612AD1C-522D-416D-8B0E-18B8DADEA6BE}] => C:\Program Files (x86)\StarMoney 9.0\app\StarMoney.exe
FirewallRules: [{1D9593E0-E798-475B-9B81-930E69AC6F7D}] => C:\Program Files (x86)\StarMoney 9.0\app\StarMoney.exe
FirewallRules: [TCP Query User{9FD886CA-2004-4123-90C0-7B2FBCE88386}C:\program files (x86)\jdownloader\jre\bin\javaw.exe] => C:\program files (x86)\jdownloader\jre\bin\javaw.exe
FirewallRules: [UDP Query User{7B3A3525-0F8A-46E6-AD0F-3A6D323BA67D}C:\program files (x86)\jdownloader\jre\bin\javaw.exe] => C:\program files (x86)\jdownloader\jre\bin\javaw.exe
FirewallRules: [{34D58726-560C-44E8-B98B-39787E5C5F31}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{DF5C1E3A-BBAC-46E9-BF96-4396B2DE0BF2}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{7C543741-0259-403D-923E-7B001957C326}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{85674CC9-7E39-4EFF-8FE5-E50B7CD71E04}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{A6B55B30-8617-4418-93B2-185C1F1E3A0C}] => C:\Users\z1\AppData\Local\Temp\hpdiu2\HPDIU\HPDIUNetwork.exe
FirewallRules: [{68BBD085-A32E-415E-B499-9FB59D1BFA35}] => C:\Users\z1\AppData\Local\Temp\hpdiu2\HPDIU\HPDIUNetwork.exe
FirewallRules: [{136BF411-65C6-4B5F-8E65-127DF2B5C653}] => C:\Program Files (x86)\StarMoney 9\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{0AB9362A-9E70-46F8-8654-772353498A2F}] => C:\Program Files (x86)\StarMoney 9\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{601365B4-F676-4059-B9EE-2EF5FA4D34C9}] => C:\Program Files (x86)\StarMoney 9\app\StarMoney.exe
FirewallRules: [{37C87386-ED7B-4E03-9D5D-737564D04630}] => C:\Program Files (x86)\StarMoney 9\app\StarMoney.exe
FirewallRules: [{D4672AEA-6F67-4C23-BBB9-2DE04434307D}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{8A37FF64-F422-4069-A963-A6EFC230B884}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{FC556D71-F911-4864-BFB3-55E6EDDEA447}C:\cgm\praxisarchiv\client\praxisarchiv.exe] => C:\cgm\praxisarchiv\client\praxisarchiv.exe
FirewallRules: [UDP Query User{41430AED-DC19-44F8-965D-2B100026FB6A}C:\cgm\praxisarchiv\client\praxisarchiv.exe] => C:\cgm\praxisarchiv\client\praxisarchiv.exe
FirewallRules: [TCP Query User{69942187-B4E3-4587-8A7B-DCEEEC07024F}C:\cgm\praxisarchiv\archivetracermt.exe] => C:\cgm\praxisarchiv\archivetracermt.exe
FirewallRules: [UDP Query User{DA623227-B674-4836-8820-C538804A39AC}C:\cgm\praxisarchiv\archivetracermt.exe] => C:\cgm\praxisarchiv\archivetracermt.exe
FirewallRules: [TCP Query User{223E96AB-E0BC-4666-95AF-54FCFFDBB073}C:\program files (x86)\mozilla firefox\firefox.exe] => C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{94953767-F39D-4C2A-BE94-6B848DF7B412}C:\program files (x86)\mozilla firefox\firefox.exe] => C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{D1FC43C8-E106-435E-B183-07A6EC21E227}] => C:\Program Files (x86)\StarMoney 10\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{1692ADF6-EE30-4361-9268-CEDFA1B53970}] => C:\Program Files (x86)\StarMoney 10\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{4A727120-1393-44A6-ADCA-4A5A29CFDD89}] => C:\Program Files (x86)\StarMoney 10\app\StarMoney.exe
FirewallRules: [{FDFAD4B6-26AF-4971-BBB8-DDA5669DE843}] => C:\Program Files (x86)\StarMoney 10\app\StarMoney.exe
FirewallRules: [{9784F5C0-1F16-42B5-8389-36BF9C03C63C}] => %ProgramFiles% (x86)\WISO\Steuersoftware 2015\wiso2015.exe
FirewallRules: [TCP Query User{6A7C0E61-8BC3-4678-B101-87E6212A84E1}C:\program files (x86)\ivoclar vivadent\prograbase x10\prograbasex10.exe] => C:\program files (x86)\ivoclar vivadent\prograbase x10\prograbasex10.exe
FirewallRules: [UDP Query User{CF1E7149-E9E4-4D17-95DC-F483658BD596}C:\program files (x86)\ivoclar vivadent\prograbase x10\prograbasex10.exe] => C:\program files (x86)\ivoclar vivadent\prograbase x10\prograbasex10.exe
FirewallRules: [{57E215FD-F3AC-4E06-9576-00CD2EA82242}] => C:\Program Files (x86)\CG\Z1Lokal\exe\z1clientupdate.exe
FirewallRules: [{5C3EDCDA-DE83-443C-B714-1E044D77CEAF}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{730C36F8-5DD4-4FD9-8851-80DBAC39598D}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{2A81B9EF-5F1F-4557-9044-823844783DAE}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{926EFE7F-602D-4EA7-99A0-79F10EB097AF}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{8700C67E-B916-4452-90B0-45929A549FD4}] => C:\Program Files\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{2BAC1BC2-1AC5-4264-A71A-1964883F8779}] => C:\Program Files\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{14E0E3E0-9BF0-44CD-A0B6-A619900AB9F1}] => C:\Users\z1\AppData\Local\Microsoft\OneDrive\OneDrive.exe
FirewallRules: [{1B3C4C23-5BF0-4ACA-9217-CABF9EF081ED}] => C:\Windows\KMS-R@1n.exe
FirewallRules: [{86FD0B8C-CD7B-4CE2-907B-7BED0D1327A3}] => C:\Windows\KMS-R@1n.exe
FirewallRules: [{7634E134-9A6E-4EDC-8890-D7EC3C0667C2}] => C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{5C4F5B37-2950-4E67-9690-AAC912614163}] => C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{F7225C67-830F-47A5-8D69-3AFDA3A47428}] => C:\Users\z1\Downloads\2.6 BETA 2 SDL\Microsoft Toolkit.exe
FirewallRules: [{97C14B22-0470-4C6F-B7A0-BD3971C43653}] => C:\Users\z1\Downloads\2.6 BETA 2 SDL\Microsoft Toolkit.exe
FirewallRules: [{C4377250-4852-4818-8731-E6F686F50AAB}] => C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{0E77D178-B5E9-4730-BD79-2B57118CFF90}] => C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{0D398C3A-F3DF-4615-9F1F-3D564C0BC7FD}] => C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{3EB6E694-2869-41F7-8855-862496CDDCAE}] => C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{64BD3BF4-8D8A-4535-938E-93B83DDAD1EA}] => LPort=1688
FirewallRules: [{18E9EB5A-960F-4F18-9F7F-1A867941EEDF}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{863685CE-E24E-4749-9676-0D6213161FAA}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{E3B32A9E-CA7B-4336-899E-49CC1A60A0D7}C:\users\z1\appdata\local\temp\fritz!wlan repeater 1750e\fsetup.exe] => C:\users\z1\appdata\local\temp\fritz!wlan repeater 1750e\fsetup.exe
FirewallRules: [UDP Query User{6D0C669F-A87E-49E5-8FDA-2F86C9A000A9}C:\users\z1\appdata\local\temp\fritz!wlan repeater 1750e\fsetup.exe] => C:\users\z1\appdata\local\temp\fritz!wlan repeater 1750e\fsetup.exe
FirewallRules: [{94B6ADF9-CE41-4186-B314-E10A89129B66}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\Video Download Capture.exe
FirewallRules: [{47D12FDF-2E21-4A52-8C1A-DA01B37F047E}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\Video Download Capture.exe
FirewallRules: [{AB0C18F9-DC1C-46F2-BC03-177824FDF929}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftSrv.dll
FirewallRules: [{FB207166-9A73-4A36-B1D4-73FA042BDBE8}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftSrv.dll
FirewallRules: [{68329410-5998-4FF2-8121-A62A011DE657}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftDump.dll
FirewallRules: [{9B751EC5-B02C-4A4B-9A1B-C1C7F6C8C875}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftDump.dll
FirewallRules: [{623EEE6F-39E0-4CBA-ADCF-33BB59A636D7}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftAC.dll
FirewallRules: [{2D97FBA0-A10F-4C79-A7F1-1594AE3BAE7F}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftAC.dll
FirewallRules: [{1AD0E90C-78C4-4BF9-AA80-BBDBDC7A7B9E}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftPlayer.dll
FirewallRules: [{616EE04D-2131-4BEE-BF5E-FEEF198E0123}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftPlayer.dll
FirewallRules: [{A1EFE9C5-DDFD-4664-8F71-75F70CA1EBD4}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftDownloaderHelp.dll
FirewallRules: [{D3C02E8B-D50E-4071-97EC-F51A9D6CE25E}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftDownloaderHelp.dll
FirewallRules: [{07C1226B-C706-4756-8DD7-19AA486B5916}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftHDSDump.dll
FirewallRules: [{0EF61CAA-AD81-486B-811F-6BCC418DDCF0}] => C:\Program Files (x86)\Apowersoft\Video Download Capture\ApowersoftHDSDump.dll
FirewallRules: [TCP Query User{7D3CC90E-7965-4E76-BB4E-28C8F1F05941}C:\xampp\apache\bin\httpd.exe] => C:\xampp\apache\bin\httpd.exe
FirewallRules: [UDP Query User{FF9AE1FA-6805-4E00-98FE-0333891A8038}C:\xampp\apache\bin\httpd.exe] => C:\xampp\apache\bin\httpd.exe
FirewallRules: [TCP Query User{66FB2D1E-98B4-4546-ADA6-0ECD6403AFFC}C:\xampp\mysql\bin\mysqld.exe] => C:\xampp\mysql\bin\mysqld.exe
FirewallRules: [UDP Query User{BC305472-886C-4B4C-93D4-E56B07070F06}C:\xampp\mysql\bin\mysqld.exe] => C:\xampp\mysql\bin\mysqld.exe
FirewallRules: [TCP Query User{56E73840-0C1E-4BD7-A7B0-122F30CA39B4}C:\program files (x86)\java\jre1.8.0_73\bin\java.exe] => C:\program files (x86)\java\jre1.8.0_73\bin\java.exe
FirewallRules: [UDP Query User{164AC24A-3592-402C-9F9D-86516CD46A87}C:\program files (x86)\java\jre1.8.0_73\bin\java.exe] => C:\program files (x86)\java\jre1.8.0_73\bin\java.exe
FirewallRules: [TCP Query User{F4F56B9E-05A5-4D7F-8464-5F9E4E6436C1}C:\xampp\filezillaftp\filezillaserver.exe] => C:\xampp\filezillaftp\filezillaserver.exe
FirewallRules: [UDP Query User{014EDE58-11C3-43DC-990D-3F0927E7A566}C:\xampp\filezillaftp\filezillaserver.exe] => C:\xampp\filezillaftp\filezillaserver.exe
FirewallRules: [TCP Query User{5C62F67E-DD1E-4D36-A4AC-E42E4861A155}C:\xampp\mercurymail\mercury.exe] => C:\xampp\mercurymail\mercury.exe
FirewallRules: [UDP Query User{9F21CB67-F1AD-47DE-966E-927DD6BA8381}C:\xampp\mercurymail\mercury.exe] => C:\xampp\mercurymail\mercury.exe
FirewallRules: [{C0008C73-2224-40EC-BACA-DCC1DCC4C296}] => LPort=8091
FirewallRules: [{9C2AD1F9-C3CD-4CE2-9AA7-449589351CB5}] => LPort=8091
FirewallRules: [{49495F2B-D3B7-4FCE-A17D-CDFF68634DFD}] => C:\CGM\ORGANIZER\Client\client\qma_client_launcher_menu.exe
FirewallRules: [{F4C8B082-D60C-4D6F-9B8F-CB60C25F1A72}] => C:\CGM\ORGANIZER\Client\client\qma_client_launcher_menu.exe
FirewallRules: [{BC4DA64F-6E7C-47BE-8680-8009CC3538A9}] => C:\CGM\ORGANIZER\Client\client\qma_client_launcher_menu.exe
FirewallRules: [{C8908A5A-6E06-4278-9A07-7BD1438BDA71}] => C:\CGM\ORGANIZER\Client\client\qma_client_launcher_menu.exe
FirewallRules: [{7BB1732F-F123-442B-8670-AC705BDFA785}] => LPort=8080
FirewallRules: [{C3F2CCA9-F2EF-4DAD-92D0-F85535F10989}] => LPort=8080
FirewallRules: [{CE4046D0-8861-4BCE-BF77-97A3BB56AAAE}] => C:\Program Files (x86)\CG\Z1Lokal\exe\z1poll2.exe
FirewallRules: [{E9A2E9A3-1FF7-46CC-801C-B0E8AE1D0CE2}] => C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{06AD5553-4875-434F-B936-B40491B680F7}] => C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{F99A91C7-6AFE-4E81-9AB8-A88290995850}] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
FirewallRules: [{179CF134-4BC1-4264-95A2-D2A59A9A9AB4}] => C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{FE70306D-9AE9-47FC-B610-22BFD1D55733}] => C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{2AEAFB32-F4D8-4E32-9F2A-99B3F2698287}] => C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{CA93337E-16DC-478B-B9BF-39E5E0A09CC7}] => C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe

==================== Wiederherstellungspunkte =========================

09-01-2017 14:57:17 Removed Microsoft Office Home and Business 2010
09-01-2017 17:02:38 JRT Pre-Junkware Removal
10-01-2017 03:00:10 Windows Update

==================== Fehlerhafte Geräte im Gerätemanager =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (01/09/2017 04:59:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: lpksetup.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7a1f7
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeb033f
Ausnahmecode: 0x40000015
Fehleroffset: 0x000000000002a84e
ID des fehlerhaften Prozesses: 0x4e0
Startzeit der fehlerhaften Anwendung: 0x01d26a914d6592c6
Pfad der fehlerhaften Anwendung: C:\Windows\system32\lpksetup.exe
Pfad des fehlerhaften Moduls: C:\Windows\system32\msvcrt.dll
Berichtskennung: 9018886f-d684-11e6-a1c7-dc85deaa056a

Error: (01/09/2017 04:58:57 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (01/09/2017 03:04:19 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: Fehler beim Laden des Protokollhandlers Mapi16. Fehlerbeschreibung: Das angegebene Modul wurde nicht gefunden.  (HRESULT : 0x8007007e).

Error: (01/09/2017 03:00:27 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: lpksetup.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7a1f7
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeb033f
Ausnahmecode: 0x40000015
Fehleroffset: 0x000000000002a84e
ID des fehlerhaften Prozesses: 0x850
Startzeit der fehlerhaften Anwendung: 0x01d26a80b00bc0f4
Pfad der fehlerhaften Anwendung: C:\Windows\system32\lpksetup.exe
Pfad des fehlerhaften Moduls: C:\Windows\system32\msvcrt.dll
Berichtskennung: f8b12236-d673-11e6-a002-dc85deaa056a

Error: (01/09/2017 03:00:09 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (01/09/2017 10:51:54 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: lpksetup.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7a1f7
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeb033f
Ausnahmecode: 0x40000015
Fehleroffset: 0x000000000002a84e
ID des fehlerhaften Prozesses: 0xdec
Startzeit der fehlerhaften Anwendung: 0x01d26a5dfa0f02cc
Pfad der fehlerhaften Anwendung: C:\Windows\system32\lpksetup.exe
Pfad des fehlerhaften Moduls: C:\Windows\system32\msvcrt.dll
Berichtskennung: 3fe36f11-d651-11e6-9946-dc85deaa056a

Error: (01/09/2017 10:51:36 AM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (01/03/2017 01:09:27 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: lpksetup.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7a1f7
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeb033f
Ausnahmecode: 0x40000015
Fehleroffset: 0x000000000002a84e
ID des fehlerhaften Prozesses: 0xa04
Startzeit der fehlerhaften Anwendung: 0x01d265ba30a49378
Pfad der fehlerhaften Anwendung: C:\Windows\system32\lpksetup.exe
Pfad des fehlerhaften Moduls: C:\Windows\system32\msvcrt.dll
Berichtskennung: 788a66ed-d1ad-11e6-9f17-dc85deaa056a

Error: (01/03/2017 01:09:08 PM) (Source: DbxSvc) (EventID: 320) (User: )
Description: Failed to connect to the driver: (-2147024894) Das System kann die angegebene Datei nicht finden.

Error: (01/03/2017 12:13:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: lpksetup.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7a1f7
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeb033f
Ausnahmecode: 0x40000015
Fehleroffset: 0x000000000002a84e
ID des fehlerhaften Prozesses: 0xa50
Startzeit der fehlerhaften Anwendung: 0x01d265b2740646e8
Pfad der fehlerhaften Anwendung: C:\Windows\system32\lpksetup.exe
Pfad des fehlerhaften Moduls: C:\Windows\system32\msvcrt.dll
Berichtskennung: b6d11b75-d1a5-11e6-bbfc-dc85deaa056a


Systemfehler:
=============
Error: (01/09/2017 04:58:59 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "MB3Service" wurde mit folgendem Fehler beendet: 
Die Klasse wurde so konfiguriert, dass sie unter einer anderen Sicherheitskennung als der Aufrufer ausgeführt werden kann.

Error: (01/09/2017 04:58:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "KMS-R@1n" wurde aufgrund folgenden Fehlers nicht gestartet: 
Das System kann die angegebene Datei nicht finden.

Error: (01/09/2017 04:58:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "GoToAssist Remote Support Customer" wurde aufgrund folgenden Fehlers nicht gestartet: 
Das System kann die angegebene Datei nicht finden.

Error: (01/09/2017 04:58:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "HitmanPro Scheduler" wurde aufgrund folgenden Fehlers nicht gestartet: 
Das System kann die angegebene Datei nicht finden.

Error: (01/09/2017 04:01:38 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "MBAMProtection" wurde aufgrund folgenden Fehlers nicht gestartet: 
Das System kann die angegebene Datei nicht finden.

Error: (01/09/2017 03:00:12 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "MB3Service" wurde mit folgendem Fehler beendet: 
Die Klasse wurde so konfiguriert, dass sie unter einer anderen Sicherheitskennung als der Aufrufer ausgeführt werden kann.

Error: (01/09/2017 03:00:11 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "KMS-R@1n" wurde aufgrund folgenden Fehlers nicht gestartet: 
Das System kann die angegebene Datei nicht finden.

Error: (01/09/2017 03:00:09 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "GoToAssist Remote Support Customer" wurde aufgrund folgenden Fehlers nicht gestartet: 
Das System kann die angegebene Datei nicht finden.

Error: (01/09/2017 03:00:05 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "HitmanPro Scheduler" wurde aufgrund folgenden Fehlers nicht gestartet: 
Das System kann die angegebene Datei nicht finden.

Error: (01/09/2017 02:22:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "KMS-R@1n" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


==================== Speicherinformationen =========================== 

Prozessor: Intel(R) Core(TM) i7-4770T CPU @ 2.50GHz
Prozentuale Nutzung des RAM: 36%
Installierter physikalischer RAM: 8107.71 MB
Verfügbarer physikalischer RAM: 5142.74 MB
Summe virtueller Speicher: 16213.61 MB
Verfügbarer virtueller Speicher: 13049.6 MB

==================== Laufwerke ================================

Drive c: () (Fixed) (Total:232.78 GB) (Free:43.31 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive e: () (Fixed) (Total:0.1 GB) (Free:0.03 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive x: (Daten) (Network) (Total:1568.74 GB) (Free:1033.99 GB) NTFS
Drive y: (DATEN) (Network) (Total:931.51 GB) (Free:869.86 GB) NTFS
Drive z: (Daten) (Network) (Total:1568.74 GB) (Free:1033.99 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 63E9C119)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=232.8 GB) - (Type=07 NTFS)

==================== Ende von Addition.txt ============================
         

FRST-Fix

Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft!

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

HKLM-x32\...\Run: [] => [X]
ShellExecuteHooks: Kein Name - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} -  -> Keine Datei
HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG
FF HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\z1\AppData\Roaming\Mozilla\Firefox\Profiles\9tlmz71o.default\extensions\cliqz@cliqz.com => nicht gefunden
S2 KMS-R@1n; C:\Windows\KMS-R@1n.exe [X]
C:\Program Files\KMSpico
C:\Windows\KMS-R@1n.exe
emptytemp:
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version: 08-01-2017
durchgeführt von z1 (10-01-2017 09:41:17) Run:1
Gestartet von C:\Users\z1\Desktop\anti-rootki
Geladene Profile: z1 (Verfügbare Profile: z1)
Start-Modus: Normal
==============================================

fixlist Inhalt:
*****************
HKLM-x32\...\Run: [] => [X]
ShellExecuteHooks: Kein Name - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} -  -> Keine Datei
HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <======= ACHTUNG
FF HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\z1\AppData\Roaming\Mozilla\Firefox\Profiles\9tlmz71o.default\extensions\cliqz@cliqz.com => nicht gefunden
S2 KMS-R@1n; C:\Windows\KMS-R@1n.exe [X]
C:\Program Files\KMSpico
C:\Windows\KMS-R@1n.exe
emptytemp:
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => Wert erfolgreich entfernt
HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks\\{B5A7F190-DDA6-4420-B3BA-52453494E6CD} => Wert erfolgreich entfernt
HKCR\CLSID\{B5A7F190-DDA6-4420-B3BA-52453494E6CD} => Schlüssel nicht gefunden. 
HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\SOFTWARE\Policies\Microsoft\Internet Explorer => Schlüssel erfolgreich entfernt
HKU\S-1-5-21-4170931350-1392568851-4209714175-1000\Software\Mozilla\Firefox\Extensions\\cliqz@cliqz.com => Wert erfolgreich entfernt
HKLM\System\CurrentControlSet\Services\KMS-R@1n => Schlüssel erfolgreich entfernt
KMS-R@1n => Dienst erfolgreich entfernt
"C:\Program Files\KMSpico" => nicht gefunden.
"C:\Windows\KMS-R@1n.exe" => nicht gefunden.

=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 26055519 B
Java, Flash, Steam htmlcache => 5473 B
Windows/system/drivers => 7344 B
Edge => 0 B
Chrome => 0 B
Firefox => 702593069 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 176920 B
systemprofile32 => 66088 B
LocalService => 2 B
NetworkService => 564172 B
z1 => 261324909 B

RecycleBin => 140196 B
EmptyTemp: => 953 MB temporäre Dateien entfernt.

================================


Das System musste neu gestartet werden.

==== Ende von Fixlog 09:41:37 ====
         

Kontrollscans mit (1) MBAM, (2) ESET und (3) SecurityCheck bitte:


1. Schritt: MBAM

Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

2. Schritt: ESET

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

3. Schritt: SecurityCheck

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlaufdatum: 10.01.2017
Suchlaufzeit: 11:00
Protokolldatei: mbam.txt
Administrator: Ja

Version: 2.2.1.1043
Malware-Datenbank: v2017.01.10.03
Rootkit-Datenbank: v2016.11.20.01
Lizenz: Premium-Version
Malware-Schutz: Aktiviert
Schutz vor bösartigen Websites: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: z1

Suchlauftyp: Bedrohungssuchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 357067
Abgelaufene Zeit: 5 Min., 8 Sek.

Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(keine bösartigen Elemente erkannt)

Module: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)

Registrierungswerte: 0
(keine bösartigen Elemente erkannt)

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Ordner: 0
(keine bösartigen Elemente erkannt)

Dateien: 0
(keine bösartigen Elemente erkannt)

Physische Sektoren: 0
(keine bösartigen Elemente erkannt)


(end)
         

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=2c886bc20aece840bd198a4e33d53cc5
# end=init
# utc_time=2017-01-10 10:10:54
# local_time=2017-01-10 11:10:54 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
Update Finalize
Updated modules version: 32014
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=2c886bc20aece840bd198a4e33d53cc5
# end=updated
# utc_time=2017-01-10 10:18:54
# local_time=2017-01-10 11:18:54 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=2c886bc20aece840bd198a4e33d53cc5
# engine=32014
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2017-01-10 11:00:46
# local_time=2017-01-10 12:00:46 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1813 16777213 100 100 10194 76544612 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 1571097 235675896 0 0
# scanned=305010
# found=2
# cleaned=0
# scan_time=2512
sh=A62C6A3196F654D387D1FFB5F77CD2117C18FA90 ft=0 fh=0000000000000000 vn="JS/Adware.Spigot.H Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\files\pwbyovlshxmsrovjxggybiygsqwnwpre\extensions\{b2bfe60c-eef8-4e20-8334-c53afdc1ffdd}\chrome\content\spigot.js"
sh=A20682FBCBDA3F215650BCB4CC7C621001136FDC ft=1 fh=043eb0fafbc97e13 vn="Variante von Win32/DownloadSponsor.C eventuell unerwünschte Anwendung" ac=I fn="C:\Users\z1\Downloads\WhatsApp2732Setup - CHIP-Installer.exe"
         

 Results of screen317's Security Check version 1.009  
 Windows 7 Service Pack 1 x64 (UAC is disabled!)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
ITbrain Anti-Malware   
Avira Desktop          
Malwarebytes           
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Java 8 Update 101  
 Java version 32-bit out of Date! 
 Adobe Flash Player 24.0.0.186  
 Mozilla Firefox (50.1.0) 
 Mozilla Thunderbird (38.2.0) 
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
 ITbrain AntiMalware ITbrain_AntiMalware_Service.exe  
 ITbrain AntiMalware AntiMalwareUserControl.exe  
 Malwarebytes Anti-Malware mbamscheduler.exe   
 StarMoney 10 ouservice StarMoneyOnlineUpdate.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````