Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Kaspersky 2015 meldet dauernd not-a-virus

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 08.08.2015, 12:27   #1
Taymytt
 
Kaspersky 2015 meldet dauernd not-a-virus - Standard

Kaspersky 2015 meldet dauernd not-a-virus



HalloHallo

Mein Kaspersky meldet dauernd not-a-virus irgendwo aufm Laptop. Er schiebt die Dateien dann in die Quarantäne und zum Teil löscht er sie auch, desinfizieren nicht möglich.

Die Logs hab ich erstellt. Kann es aber nicht mit den Code Tags einfügen da der Text ansonsten zu lange ist.

Wie soll ich sonst die Logs posten damit ihr mir helfen könnt?

Alt 08.08.2015, 12:58   #2
Deathkid535
/// Malwareteam
 
Kaspersky 2015 meldet dauernd not-a-virus - Standard

Kaspersky 2015 meldet dauernd not-a-virus





Ich habe dein Thema in Arbeit und melde mich so schnell als möglich mit weiteren Anweisungen.

Bitte beachte, dass alle meine Antworten zuerst von einem Ausbilder freigegeben werden müssen, bevor ich diese hier posten darf. Dies garantiert, dass Du Hilfe von einem ausgebildeten Helfer bekommst.

Ich bedanke mich für deine Geduld

Bitte einfach auf mehrere Posts aufteilen
__________________

__________________

Alt 08.08.2015, 19:54   #3
Taymytt
 
Kaspersky 2015 meldet dauernd not-a-virus - Standard

Kaspersky 2015 meldet dauernd not-a-virus



wollt ich jetzt machen. Bin aber iwie zu doof

Wenn ich GMER oder den Addition Log mit den Codes posten will kommt immer noch die Meldung von Zeichenlänge überschritten.
__________________

Alt 08.08.2015, 19:55   #4
Deathkid535
/// Malwareteam
 
Kaspersky 2015 meldet dauernd not-a-virus - Standard

Kaspersky 2015 meldet dauernd not-a-virus



Post die erste Hälfte vom GMER-Log, dann die zweite. Das gleiche mit FRST.

Is ja egal wenn das mehrere Posts braucht. Schreib aber bitte immer dazu, der wievielte Teil das von welchem ist.

Alt 08.08.2015, 21:00   #5
Taymytt
 
Kaspersky 2015 meldet dauernd not-a-virus - Standard

Kaspersky 2015 meldet dauernd not-a-virus



okeli

Gmer Teil 1

Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-08-08 12:59:30
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 MTFDDAK2 rev.07TA 238.47GB
Running: Gmer-19357.exe; Driver: C:\Users\admin\AppData\Local\Temp\axddapow.sys


---- User code sections - GMER 2.1 ----

.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtClose                                                                                                                                                         0000000077bbfa2c 5 bytes JMP 000000016d19ea93
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtOpenKey                                                                                                                                                       0000000077bbfa74 5 bytes JMP 000000016d19f0f8
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateValueKey                                                                                                                                             0000000077bbfa8c 5 bytes JMP 000000016d19d830
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtQueryKey                                                                                                                                                      0000000077bbfadc 5 bytes JMP 000000016d19d38c
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey                                                                                                                                                 0000000077bbfaf4 5 bytes JMP 000000016d19d67d
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtCreateKey                                                                                                                                                     0000000077bbfb8c 5 bytes JMP 000000016d19f338
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                                                                                                                            0000000077bbfc84 5 bytes JMP 000000016d1aa713
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateKey                                                                                                                                                  0000000077bbfd98 5 bytes JMP 000000016d19d1d4
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                                                                                                      0000000077bbfdb0 5 bytes JMP 000000016d1a9d35
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile                                                                                                                                            0000000077bbfde4 5 bytes JMP 000000016d1aa030
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtDuplicateObject                                                                                                                                               0000000077bbfe90 5 bytes JMP 000000016d19e668
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile                                                                                                                                           0000000077bbfea8 5 bytes JMP 000000016d1a9e5e
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                                                                                    0000000077bc0100 5 bytes JMP 000000016d1a9b7a
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                                                                                   0000000077bc0210 5 bytes JMP 000000016d19d9d8
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtCreateKeyTransacted                                                                                                                                           0000000077bc07a0 5 bytes JMP 000000016d19f3da
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtDeleteFile                                                                                                                                                    0000000077bc0a30 5 bytes JMP 000000016d1a9d72
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtDeleteKey                                                                                                                                                     0000000077bc0a48 5 bytes JMP 000000016d19cfa8
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                                                                                                0000000077bc0a90 5 bytes JMP 000000016d19db8e
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtFlushKey                                                                                                                                                      0000000077bc0bcc 5 bytes JMP 000000016d19d0be
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeKey                                                                                                                                               0000000077bc0fbc 5 bytes JMP 000000016d19e01b
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeMultipleKeys                                                                                                                                      0000000077bc0fd4 5 bytes JMP 000000016d19e1b7
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyEx                                                                                                                                                     0000000077bc1064 5 bytes JMP 000000016d19f185
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyTransacted                                                                                                                                             0000000077bc107c 5 bytes JMP 000000016d19f2a8
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyTransactedEx                                                                                                                                           0000000077bc1094 5 bytes JMP 000000016d19f215
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile                                                                                                                                       0000000077bc1388 5 bytes JMP 000000016d1a9f47
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtQueryMultipleValueKey                                                                                                                                         0000000077bc14c8 5 bytes JMP 000000016d19de8e
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtQuerySecurityObject                                                                                                                                           0000000077bc1574 5 bytes JMP 000000016d19e37b
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtRenameKey                                                                                                                                                     0000000077bc1764 5 bytes JMP 000000016d19dd06
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationKey                                                                                                                                             0000000077bc1aa4 5 bytes JMP 000000016d19d535
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\SysWOW64\ntdll.dll!NtSetSecurityObject                                                                                                                                             0000000077bc1be8 5 bytes JMP 000000016d19e4fd
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\kernel32.dll!CreateProcessW                                                                                                                                               0000000075d3103d 5 bytes JMP 000000016d183904
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\kernel32.dll!CreateProcessA                                                                                                                                               0000000075d31072 5 bytes JMP 000000016d183d68
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\kernel32.dll!CreateProcessAsUserW                                                                                                                                         0000000075d5c9b5 5 bytes JMP 000000016d183a1e
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\kernel32.dll!WinExec                                                                                                                                                      0000000075db3051 5 bytes JMP 000000016d183c62
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ADVAPI32.dll!CreateProcessAsUserA                                                                                                                                         0000000076f7280a 5 bytes JMP 000000016d183f75
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!CoResumeClassObjects + 7                                                                                                                                        000000007604ea09 7 bytes JMP 000000016d1be370
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!OleRun                                                                                                                                                          00000000760507de 5 bytes JMP 000000016d1bde9e
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!CoRegisterClassObject                                                                                                                                           00000000760521e1 5 bytes JMP 000000016d1c1745
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!OleUninitialize                                                                                                                                                 000000007605eba1 6 bytes JMP 000000016d1bde15
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!OleInitialize                                                                                                                                                   000000007605efd7 5 bytes JMP 000000016d1bddcd
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!CoGetClassObject                                                                                                                                                00000000760754ad 5 bytes JMP 000000016d1bfdbb
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!CoInitializeEx                                                                                                                                                  00000000760809ad 5 bytes JMP 000000016d1bdd6d
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!CoUninitialize                                                                                                                                                  00000000760886d3 5 bytes JMP 000000016d1c07cf
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                                                                                                0000000076089d0b 5 bytes JMP 000000016d1c14ec
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!CoCreateInstanceEx                                                                                                                                              0000000076089d4e 5 bytes JMP 000000016d1bf3c7
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!CoSuspendClassObjects + 7                                                                                                                                       00000000760abaf9 7 bytes JMP 000000016d1bdee6
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!CoRevokeClassObject                                                                                                                                             00000000760ceabf 5 bytes JMP 000000016d1bfa7c
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!CoGetInstanceFromFile                                                                                                                                           000000007610352c 5 bytes JMP 000000016d1c08cf
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\ole32.dll!OleRegEnumFormatEtc                                                                                                                                             000000007614d0f1 5 bytes JMP 000000016d1bde56
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\OLEAUT32.dll!RegisterActiveObject                                                                                                                                         00000000774227a6 5 bytes JMP 000000016d1c03db
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\OLEAUT32.dll!RevokeActiveObject                                                                                                                                           000000007742329c 5 bytes JMP 000000016d1bdd25
.text    C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE[3168] C:\Windows\syswow64\OLEAUT32.dll!GetActiveObject                                                                                                                                              0000000077438f68 5 bytes JMP 000000016d1c056f
.text    C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExW + 17                                                                                                                                                0000000077171401 2 bytes JMP 75d5b21b C:\Windows\syswow64\kernel32.dll
.text    C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!EnumProcessModules + 17                                                                                                                                                  0000000077171419 2 bytes JMP 75d5b346 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 17                                                                                                                                                0000000077171431 2 bytes JMP 75dd8f29 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 42                                                                                                                                                000000007717144a 2 bytes CALL 75d3489d C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                                 * 9
.text    C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!EnumDeviceDrivers + 17                                                                                                                                                   00000000771714dd 2 bytes JMP 75dd8822 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameA + 17                                                                                                                                            00000000771714f5 2 bytes JMP 75dd89f8 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!QueryWorkingSetEx + 17                                                                                                                                                   000000007717150d 2 bytes JMP 75dd8718 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameW + 17                                                                                                                                            0000000077171525 2 bytes JMP 75dd8ae2 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameW + 17                                                                                                                                                  000000007717153d 2 bytes JMP 75d4fca8 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!EnumProcesses + 17                                                                                                                                                       0000000077171555 2 bytes JMP 75d568ef C:\Windows\syswow64\kernel32.dll
.text    C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetProcessMemoryInfo + 17                                                                                                                                                000000007717156d 2 bytes JMP 75dd8fe3 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetPerformanceInfo + 17                                                                                                                                                  0000000077171585 2 bytes JMP 75dd8b42 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!QueryWorkingSet + 17                                                                                                                                                     000000007717159d 2 bytes JMP 75dd86dc C:\Windows\syswow64\kernel32.dll
.text    C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameA + 17                                                                                                                                                  00000000771715b5 2 bytes JMP 75d4fd41 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExA + 17                                                                                                                                                00000000771715cd 2 bytes JMP 75d5b2dc C:\Windows\syswow64\kernel32.dll
.text    C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 20                                                                                                                                            00000000771716b2 2 bytes JMP 75dd8ea4 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe[3208] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 31                                                                                                                                            00000000771716bd 2 bytes JMP 75dd8671 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                                            0000000077171401 2 bytes JMP 75d5b21b C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                                              0000000077171419 2 bytes JMP 75d5b346 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                                            0000000077171431 2 bytes JMP 75dd8f29 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                                            000000007717144a 2 bytes CALL 75d3489d C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                                 * 9
.text    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                                               00000000771714dd 2 bytes JMP 75dd8822 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                                        00000000771714f5 2 bytes JMP 75dd89f8 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                                               000000007717150d 2 bytes JMP 75dd8718 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                                        0000000077171525 2 bytes JMP 75dd8ae2 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                                              000000007717153d 2 bytes JMP 75d4fca8 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                                   0000000077171555 2 bytes JMP 75d568ef C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                                            000000007717156d 2 bytes JMP 75dd8fe3 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                                              0000000077171585 2 bytes JMP 75dd8b42 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                                                 000000007717159d 2 bytes JMP 75dd86dc C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                                              00000000771715b5 2 bytes JMP 75d4fd41 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                                            00000000771715cd 2 bytes JMP 75d5b2dc C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                                        00000000771716b2 2 bytes JMP 75dd8ea4 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                                        00000000771716bd 2 bytes JMP 75dd8671 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe[4972] C:\Windows\syswow64\user32.dll!UserClientDllInitialize + 779                                                                                                                000000007701b9f8 4 bytes [10, 3D, FB, 74]
.text    C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe[4972] C:\Windows\syswow64\user32.dll!CallNextHookEx + 196                                                                                                                         0000000077026349 5 bytes JMP 0000000174fb4ae0
.text    C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe[4972] C:\Windows\syswow64\user32.dll!RemovePropA + 92                                                                                                                             00000000770282e0 5 bytes JMP 0000000174fb4a60
.text    C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe[4972] C:\Windows\syswow64\user32.dll!GetRawInputDeviceInfoW + 16                                                                                                                  000000007705c1b9 5 bytes JMP 0000000174fb4790
.text    C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe[4972] C:\Windows\syswow64\user32.dll!GetRawInputDeviceInfoW + 167                                                                                                                 000000007705c250 5 bytes JMP 0000000174fb49d0
.text    C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe[4972] C:\Windows\syswow64\user32.dll!GetRawInputDeviceInfoA + 231                                                                                                                 00000000770769f2 5 bytes JMP 0000000174fb4700
.text    C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe[4972] C:\Windows\syswow64\user32.dll!GetRawInputDeviceInfoA + 382                                                                                                                 0000000077076a89 5 bytes JMP 0000000174fb4940
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                                                        00000000779c13ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                                                                                        00000000779c1544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                                                00000000779c18ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                                                                                               00000000779c1ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                                                  00000000779c1d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                                                      00000000779c1e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                                                                                                    00000000779c1f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                                                                                        00000000779c2238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531                                                                                                             00000000779c2683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                                                    00000000779c26a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                                                  00000000779c26c2 8 bytes {JMP 0x10}
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                                                   00000000779c271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184                                                                                                  00000000779c2788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                                 * 4
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                                                          00000000779c2b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375                                                                                                          00000000779c2b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                                 * 2
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                                                      00000000779c306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920                                                                                                                      00000000779c31f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                                                     00000000779c388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                                                     00000000779c38e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                                                         00000000779c39b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                                                  00000000779c3f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161                                                                                                                 00000000779c4001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277                                                                                                                 00000000779c4075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                                 * 3
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214                                                                                                                     00000000779c41b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276                                                                                                                     00000000779c41f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609                                                                                                                               00000000779c4461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284                                                                                                                  00000000779c464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483                                                                                                                  00000000779c4713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231                                                                                                                               00000000779c4807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518                                                                                                                               00000000779c4926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                                 * 2
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256                                                                                                              00000000779c4a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67                                                                                                                 00000000779c4aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501                                                                                                              00000000779c4ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256                                                                                                                         00000000779c4ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247                                                                                                                   00000000779c4fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483                                                                                                                     00000000779c5193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438                                                                                                                     00000000779c5f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198                                                                                                                     00000000779c6016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!atol + 194                                                                                                                                        00000000779c610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76                                                                                                                                        00000000779c62fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45                                                                                                          00000000779c633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4                                                                                                              00000000779c6354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92                                                                                                             00000000779c63ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790                                                                                                                       00000000779c6b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                                            0000000077a0dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                                          0000000077a0de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                                0000000077a0de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                                              0000000077a0df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                                                  0000000077a0e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                                                  0000000077a0e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                                                0000000077a0e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                0000000077a0f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                                              00000000750913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                                              000000007509146b 8 bytes {JMP 0xffffffffffffffb0}
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                                                           00000000750916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                                        00000000750919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                                                        00000000750919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5912] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                                                  0000000075091a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                                                  00000000779c13ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                                                                                  00000000779c1544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                                          00000000779c18ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                                                                                         00000000779c1ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                                            00000000779c1d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                                                00000000779c1e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                                                                                              00000000779c1f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                                                                                  00000000779c2238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531                                                                                                       00000000779c2683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                                              00000000779c26a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                                            00000000779c26c2 8 bytes {JMP 0x10}
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                                             00000000779c271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6704] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184                                                                                            00000000779c2788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                                 * 4
         
Gmer Teil 2

Code:
ATTFilter
Library  c:\users\admin\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzmwujs.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208](2015-08-08 10:32:17)                                                 000000006c210000
Library  C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5Core.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:24)                     000000006bab0000
Library  C:\Users\admin\AppData\Roaming\Dropbox\bin\icuin55.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (ICU I18N DLL/The ICU Project)(2015-07-31 13:08:55)                                                                     000000004a900000
Library  C:\Users\admin\AppData\Roaming\Dropbox\bin\icuuc55.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (ICU Common DLL/The ICU Project)(2015-07-31 13:08:55)                                                                   0000000006be0000
Library  C:\Users\admin\AppData\Roaming\Dropbox\bin\icudt55.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (ICU Data DLL/The ICU Project)(2015-07-31 13:08:55)                                                                     000000006a1f0000
         
Gmer Teil 3

Code:
ATTFilter
Library  C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5Widgets.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:28)                  0000000069d30000
Library  C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5Gui.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)                      00000000698f0000
Library  C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5Network.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)                  0000000069750000
Library  C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5WebKit.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)                   0000000068730000
Library  C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5Quick.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)                    00000000684e0000
Library  C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5Qml.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)                      0000000068270000
Library  C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5WebChannel.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-07-31 13:08:55)               0000000068250000
Library  C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5Sql.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)                      0000000068220000
Library  C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5WebKitWidgets.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:28)            00000000681e0000
Library  C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5PrintSupport.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)             0000000068190000
Library  C:\Users\admin\AppData\Roaming\Dropbox\bin\Qt5OpenGL.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)                   0000000068140000
Library  C:\Users\admin\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:30)  0000000068050000
Library  C:\Users\admin\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:30)  0000000067890000
Library  C:\Users\admin\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208](2015-03-04 21:45:30)                                                                                   0000000067060000
Library  C:\Users\admin\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208](2015-03-04 21:45:30)                                                                     0000000066e60000
Library  C:\Users\admin\AppData\Roaming\Dropbox\bin\QtQuick\Layouts\qquicklayoutsplugin.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208](2015-07-31 13:08:56)                                                                        0000000066e40000
Library  C:\Users\admin\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll (*** suspicious ***) @ C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [3208](2015-03-04 21:45:30)                                                                              0000000066e30000

---- EOF - GMER 2.1 ----
         
Frst Teil 1

Code:
ATTFilter
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:08-08-2015
durchgeführt von admin (Administrator) auf PHOENIX (08-08-2015 12:51:27)
Gestartet von C:\Users\admin\Downloads
Geladene Profile: admin (Verfügbare Profile: admin)
Platform: Windows 7 Professional Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Opera)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe
(Hewlett-Packard Company) C:\Program Files (x86)\HP\Common\HPSupportSolutionsFrameworkService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP ENVY 5640 series\Bin\ScanToPCActivationApp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE
(Dropbox, Inc.) C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe
(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP ENVY 5640 series\Bin\HPNetworkCommunicatorCom.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera_crashreporter.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE


==================== Registry (Nicht auf der Ausnahmeliste) ==================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1664000 2012-11-12] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2812656 2014-01-24] (Synaptics Incorporated)
HKLM-x32\...\Run: [QLBController] => C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe [336672 2014-02-10] (Hewlett-Packard Company)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-29] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292088 2013-02-22] (Intel Corporation)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7063832 2014-11-21] (Piriform Ltd)
HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\...\Run: [HP ENVY 5640 series (NET)] => C:\Program Files\HP\HP ENVY 5640 series\Bin\ScanToPCActivationApp.exe [3483656 2014-08-22] (Hewlett-Packard Development Company, LP)
HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\...\Run: [Dropbox Update] => C:\Users\admin\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-19] (Dropbox, Inc.)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-05-13] (Microsoft Corporation)
Startup: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2014-08-17]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-10-10]
ShortcutTarget: Dropbox.lnk -> C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk [2015-07-04]
ShortcutTarget: phase-6 Reminder.lnk -> C:\Users\admin\AppData\Local\phase-6\phase-6-compendio\reminder\reminder.exe (phase-6)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-24] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-24] (Dropbox, Inc.)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}
HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=dspp&ts=1417814128&from=cvs&uid=MTFDDAK256MAM&q={searchTerms}
HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249
HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249
HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=dspp&ts=1417814128&from=cvs&uid=MTFDDAK256MAM&q={searchTerms}
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://Lasaoren.com/results.php?f=4&q={searchTerms}&a=lrn_secureddownload_14_45_ff&cd=2XzuyEtN2Y1L1QzuzzyEtA0AyE0BtDtBzy0E0B0DtCtByD0DtN0D0Tzu0StCtDyEyEtN1L2XzutAtFyCtFtCtFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyB0AyDtCyDtByD0AtGyBzy0C0AtGtDzyyByDtGtAyC0ByCtGtDyD0B0DtB0CyBzz0AyC0C0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0DyEtAtAtAyB0AtDtG0AyE0EyCtGyE0EyD0CtGzz0DyD0BtGtAyDyEtD0CzytByDyD0D0E0C2Q&cr=814032143&ir=
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000 -> {A25AC313-DD19-4238-ACA2-401D6BEE4321} URL = hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-06-09] (Microsoft Corporation)
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-25] (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-06-09] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-06-16] (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: LuckyTab Class -> {51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F} -> C:\Program Files (x86)\MiuiTab\SupTab.dll [2015-06-16] (Thinknice Co. Limited)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-25] (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-07-04] (Oracle Corporation)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-06-09] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-07-04] (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
Toolbar: HKLM - Perfect PDF 8 - {FE6BE06B-7324-4D38-AD78-79507F307D7D} - C:\Program Files (x86)\soft Xpansion\Perfect PDF 8\ieagent64.dll [2014-12-14] (soft Xpansion)
Toolbar: HKLM-x32 - Perfect PDF 8 - {FE6BE06B-7324-4D38-AD78-79507F307D7D} - C:\Program Files (x86)\soft Xpansion\Perfect PDF 8\ieagent32.dll [2014-12-14] (soft Xpansion)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{AE055004-6C80-4B3B-9C81-902050B152BE}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{F059243C-D0C1-44EE-AE24-7E9B8859776A}: [DhcpNameServer] 192.168.1.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
         


Alt 08.08.2015, 21:01   #6
Taymytt
 
Kaspersky 2015 meldet dauernd not-a-virus - Standard

Kaspersky 2015 meldet dauernd not-a-virus



Frst Teil 2

Code:
ATTFilter
FireFox:
========
FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default
FF NewTab: hxxp://www.delta-homes.com/newtab/?type=nt&ts=1434713643&z=24f644d9902c60e32aeef35g1z3c4z7m0g7caqdzbz&from=ient06192&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249
FF DefaultSearchEngine: delta-homes
FF SelectedSearchEngine: delta-homes
FF Homepage: hxxp://www.delta-homes.com/?type=hp&ts=1434713643&z=24f644d9902c60e32aeef35g1z3c4z7m0g7caqdzbz&from=ient06192&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-10] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-01-31] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-10] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-07-04] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-07-04] (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-10-25] ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-10-25] ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-10-25] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-08-16] (Microsoft Corporation)
FF Plugin-x32: @soft-xpansion/npsxpdf -> C:\Program Files (x86)\Common Files\soft Xpansion\np-sxpdf.dll [2014-12-14] (soft-Xpansion)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1824315975-2186341827-1397389162-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2015-08-08] ()
FF user.js: detected! => C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\user.js [2015-07-04]
FF SearchPlugin: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\searchplugins\delta-homes.xml [2015-06-19]
FF SearchPlugin: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\searchplugins\Lasaoren.xml [2014-11-10]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\webssearches.xml [2014-12-05]
FF Extension: Fast Start - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\faststartff@gmail.com [2014-12-05]
FF Extension: QuickSearch - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\quick_searchff@gmail.com [2015-06-07]
FF Extension: Search Enginer - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\searchengine@gmail.com [2015-04-07]
FF Extension: Search Enginer - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\sweetsearch@gmail.com [2015-06-19]
FF Extension: Mozilla Firefox Hotfixer - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\veggy@veggyAddon.com [2015-06-07]
FF Extension: Elegant Advisor - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\{20fec063-c59d-0c63-9ae8-03180eee7f1e} [2015-06-07]
FF Extension: My Swisscom Assistant - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\{} [2015-02-10]
FF Extension: Express Find - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\{7ab3cbb3-34f1-440b-b048-404cfae819c0}.xpi [2015-04-11]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [{067A541B-C896-42F1-92EA-79C69EF90ED5}] - C:\ProgramData\soft Xpansion\Perfect PDF 8\Data\fftb
FF Extension: Perfect PDF 8 - C:\ProgramData\soft Xpansion\Perfect PDF 8\Data\fftb [2014-12-14]
FF HKLM-x32\...\Firefox\Extensions: [searchengine@gmail.com] - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\searchengine@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [istart_ffnt@gmail.com] - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\istart_ffnt@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [sweetsearch@gmail.com] - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com
FF HKLM-x32\...\Thunderbird\Extensions: [{067A541B-C896-42F1-92EA-79C69EF90ED5}] - C:\ProgramData\soft Xpansion\Perfect PDF 8\Data\fftb

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2015-08-02] (BitRaider, LLC)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2753720 2015-07-01] (Microsoft Corporation)
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe [683296 2014-02-10] (Hewlett-Packard Company)
R3 hpqwmiex; C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe [1006424 2013-01-23] (Hewlett-Packard Company) [Datei ist nicht signiert]
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89840 2015-03-28] (Hewlett-Packard Company)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2013-10-11] ()
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [327680 2012-11-12] (IDT, Inc.) [Datei ist nicht signiert]
S3 SXDS10; C:\Program Files (x86)\Common Files\soft Xpansion\sxds10.exe [234096 2014-12-14] (soft Xpansion)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3671792 2013-10-11] (Intel® Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [141320 2014-10-25] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [793800 2014-10-25] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1866080 2012-11-28] ()
U3 Winsock; kein ImagePath
S3 BRDriver64_1_3_3_E02B25FC; \??\C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-08-08 12:51 - 2015-08-08 12:51 - 00030204 _____ C:\Users\admin\Downloads\FRST.txt
2015-08-08 12:51 - 2015-08-08 12:51 - 00000000 ____D C:\FRST
2015-08-08 12:50 - 2015-08-08 12:51 - 02169856 _____ (Farbar) C:\Users\admin\Downloads\FRST64.exe
2015-08-08 12:49 - 2015-08-08 12:49 - 00000472 _____ C:\Users\admin\Downloads\defogger_disable.log
2015-08-08 12:49 - 2015-08-08 12:49 - 00000000 _____ C:\Users\admin\defogger_reenable
2015-08-08 12:48 - 2015-08-08 12:48 - 00050477 _____ C:\Users\admin\Downloads\Defogger.exe
2015-08-08 12:32 - 2015-08-08 12:32 - 00000056 _____ C:\Windows\setupact.log
2015-08-08 12:32 - 2015-08-08 12:32 - 00000000 _____ C:\Windows\setuperr.log
2015-08-08 01:11 - 2015-08-08 01:11 - 00000000 ____D C:\Users\admin\AppData\Local\Ubisoft Game Launcher
2015-08-08 00:52 - 2015-08-08 00:52 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2015-08-08 00:52 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2015-08-08 00:52 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2015-08-08 00:52 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2015-08-08 00:52 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2015-08-08 00:52 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2015-08-08 00:52 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll
2015-08-08 00:52 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2015-08-08 00:52 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2015-08-08 00:52 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2015-08-08 00:52 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2015-08-08 00:52 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2015-08-08 00:52 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2015-08-02 19:52 - 2015-08-02 19:52 - 00010214 _____ C:\Users\admin\Documents\Uninstall STAR WARS The Old Republic.log
2015-08-02 19:45 - 2015-08-02 19:45 - 00000000 ____D C:\Users\Public\Documents\BitRaider
2015-08-02 19:45 - 2015-08-02 19:45 - 00000000 ____D C:\ProgramData\BitRaider
2015-08-02 19:44 - 2015-08-02 19:44 - 00000000 ____D C:\Users\admin\AppData\Local\SWTORPerf
2015-08-02 19:40 - 2015-08-02 19:40 - 00000000 ____D C:\Program Files (x86)\Electronic Arts
2015-08-02 19:37 - 2015-08-02 19:40 - 00017478 _____ C:\Users\admin\Documents\Install STAR WARS The Old Republic.log
2015-08-02 19:36 - 2015-08-02 19:37 - 29720272 _____ C:\Users\admin\Downloads\SWTOR_setup.exe
2015-08-01 02:21 - 2015-08-08 01:10 - 00000000 ____D C:\ProgramData\Solidshield
2015-07-31 18:34 - 2009-03-16 14:18 - 00521560 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll
2015-07-31 18:34 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2015-07-31 18:34 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2015-07-31 18:34 - 2009-03-16 14:18 - 00174936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll
2015-07-31 18:34 - 2009-03-16 14:18 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll
2015-07-31 18:34 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 05425496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 02430312 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_41.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 01846632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_41.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 00520544 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_41.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2015-07-31 18:34 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2015-07-31 18:34 - 2008-07-10 11:00 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2015-07-31 18:34 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2015-07-31 18:34 - 2008-07-10 11:00 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2015-07-31 18:34 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2015-07-31 18:34 - 2008-07-10 11:00 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2015-07-31 18:34 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll
2015-07-31 18:34 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2015-07-31 18:34 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2015-07-31 18:34 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll
2015-07-31 18:34 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll
2015-07-31 18:34 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2015-07-31 18:34 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2015-07-31 18:34 - 2008-05-30 14:16 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 04991496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 01941528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2015-07-31 18:34 - 2008-03-05 16:04 - 00489480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll
2015-07-31 18:34 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll
2015-07-31 18:34 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2015-07-31 18:34 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll
2015-07-31 18:34 - 2008-03-05 16:00 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll
2015-07-31 18:34 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll
2015-07-31 18:34 - 2008-03-05 15:56 - 04910088 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll
2015-07-31 18:34 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2015-07-31 18:34 - 2008-03-05 15:56 - 01860120 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll
2015-07-31 18:34 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll
2015-07-31 18:34 - 2008-02-05 23:07 - 00529424 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll
2015-07-31 18:34 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll
2015-07-31 18:34 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll
2015-07-31 18:34 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2015-07-31 18:34 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll
2015-07-31 18:34 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
2015-07-31 18:34 - 2007-10-12 15:14 - 05081608 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_36.dll
2015-07-31 18:34 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
2015-07-31 18:34 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll
2015-07-31 18:34 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
2015-07-31 18:34 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll
2015-07-31 18:34 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
2015-07-31 18:34 - 2007-07-20 00:57 - 00411496 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_9.dll
2015-07-31 18:34 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 01985904 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_35.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_35.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2015-07-31 18:34 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2015-07-31 18:34 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2015-07-31 18:34 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2015-07-31 18:34 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2015-07-31 18:34 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2015-07-31 18:34 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2015-07-31 18:34 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll
2015-07-31 18:34 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2015-07-31 18:34 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2015-07-31 18:34 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2015-07-31 18:34 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll
2015-07-31 18:34 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2015-07-31 18:34 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2015-07-31 18:34 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2015-07-31 18:34 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2015-07-31 18:34 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2015-07-31 18:34 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2015-07-31 18:34 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2015-07-31 18:34 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2015-07-31 18:34 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2015-07-31 18:34 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll
2015-07-31 18:34 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2015-07-31 18:34 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2015-07-31 18:34 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2015-07-31 18:34 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2015-07-31 18:34 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
2015-07-31 18:34 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2015-07-31 18:34 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2015-07-31 18:34 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2015-07-31 18:34 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2015-07-31 18:34 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2015-07-31 18:34 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2015-07-31 18:34 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2015-07-31 18:34 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
2015-07-31 18:34 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2015-07-31 18:34 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2015-07-31 18:34 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2015-07-31 18:34 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2015-07-31 18:34 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2015-07-31 18:34 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2015-07-31 18:34 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2015-07-31 18:34 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2015-07-31 18:34 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2015-07-31 18:34 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2015-07-31 18:34 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2015-07-31 18:34 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2015-07-31 18:34 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2015-07-31 18:34 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2015-07-31 18:34 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2015-07-31 18:34 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2015-07-31 18:34 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2015-07-31 18:34 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2015-07-31 18:34 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2015-07-31 18:34 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2015-07-31 15:08 - 2015-07-31 15:08 - 00000000 ____D C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-07-29 10:55 - 2015-07-25 20:07 - 00017856 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-07-29 10:55 - 2015-07-25 20:04 - 00765440 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-07-29 10:55 - 2015-07-25 20:04 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-07-29 10:55 - 2015-07-25 20:03 - 01085440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-07-29 10:55 - 2015-07-25 20:03 - 00433664 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-07-29 10:55 - 2015-07-25 20:03 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-07-29 10:55 - 2015-07-25 20:03 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-07-29 10:55 - 2015-07-25 19:55 - 01145856 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-07-26 13:39 - 2015-05-09 20:26 - 00493504 _____ (Microsoft Corporation) C:\Windows\system32\mcupdate_GenuineIntel.dll
2015-07-26 13:39 - 2015-03-14 05:21 - 01632768 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-07-26 13:39 - 2015-03-14 05:21 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2015-07-26 13:39 - 2015-03-14 05:04 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-07-26 13:39 - 2015-03-14 05:04 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2015-07-24 18:53 - 2015-07-24 18:53 - 05439072 _____ (TeamViewer) C:\Users\admin\Downloads\TeamViewerQS_de.exe
2015-07-24 18:53 - 2015-07-24 18:53 - 00000000 ____D C:\Users\admin\AppData\Roaming\TeamViewer
2015-07-23 23:41 - 2015-06-02 02:07 - 00254976 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll
2015-07-23 23:41 - 2015-06-02 01:47 - 00210432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cewmdm.dll
2015-07-23 23:40 - 2015-07-15 05:19 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-07-23 23:40 - 2015-07-15 05:19 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-07-23 23:40 - 2015-07-15 05:19 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-07-23 23:40 - 2015-07-15 05:19 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-07-23 23:40 - 2015-07-15 04:55 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-07-23 23:40 - 2015-07-15 04:55 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-07-23 23:40 - 2015-07-15 04:55 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-07-23 23:40 - 2015-07-15 04:54 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-07-23 23:40 - 2015-07-15 03:59 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-07-23 23:40 - 2015-07-15 03:52 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-07-23 23:40 - 2015-07-09 19:58 - 03154944 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-07-23 23:40 - 2015-07-09 19:58 - 02603008 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-07-23 23:40 - 2015-07-09 19:58 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-07-23 23:40 - 2015-07-09 19:58 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-07-23 23:40 - 2015-07-09 19:58 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-07-23 23:40 - 2015-07-09 19:58 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-07-23 23:40 - 2015-07-09 19:58 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-07-23 23:40 - 2015-07-09 19:58 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-07-23 23:40 - 2015-07-09 19:58 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-07-23 23:40 - 2015-07-09 19:58 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-07-23 23:40 - 2015-07-09 19:58 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-07-23 23:40 - 2015-07-09 19:43 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-07-23 23:40 - 2015-07-09 19:43 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-07-23 23:40 - 2015-07-09 19:43 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-07-23 23:40 - 2015-07-09 19:43 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-07-23 23:40 - 2015-07-09 19:42 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-07-23 23:39 - 2015-06-09 20:03 - 03180544 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-07-23 23:39 - 2015-06-09 20:03 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-07-23 23:38 - 2015-06-25 10:57 - 03207168 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-07-23 23:38 - 2015-06-17 19:47 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-23 23:38 - 2015-06-17 19:37 - 00312320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-07-23 23:37 - 2015-07-02 23:21 - 19877376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-07-23 23:37 - 2015-07-02 23:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-07-23 23:37 - 2015-07-02 22:50 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-07-23 23:37 - 2015-07-02 22:49 - 25193984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-07-23 23:37 - 2015-07-02 22:46 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-07-23 23:37 - 2015-07-02 22:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-07-23 23:37 - 2015-07-02 22:23 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-07-23 23:37 - 2015-07-02 22:19 - 12855296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-07-23 23:37 - 2015-07-02 22:12 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-07-23 23:37 - 2015-07-02 21:55 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-07-23 23:37 - 2015-07-02 21:20 - 14453248 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-07-23 23:37 - 2015-07-02 20:59 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-07-23 23:37 - 2015-06-27 04:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-07-23 23:37 - 2015-06-27 04:43 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-07-23 23:37 - 2015-06-27 03:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-07-23 23:37 - 2015-06-27 03:39 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-07-23 23:35 - 2015-06-25 20:09 - 00389832 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-07-23 23:35 - 2015-06-25 19:43 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-07-23 23:35 - 2015-06-20 22:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-07-23 23:35 - 2015-06-20 21:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-07-23 23:35 - 2015-06-20 21:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-07-23 23:35 - 2015-06-20 21:49 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-07-23 23:35 - 2015-06-20 21:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-07-23 23:35 - 2015-06-20 21:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-07-23 23:35 - 2015-06-20 21:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-07-23 23:35 - 2015-06-20 21:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-07-23 23:35 - 2015-06-20 21:34 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-07-23 23:35 - 2015-06-20 21:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-07-23 23:35 - 2015-06-20 21:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-07-23 23:35 - 2015-06-20 21:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-07-23 23:35 - 2015-06-20 21:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-07-23 23:35 - 2015-06-20 21:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-07-23 23:35 - 2015-06-20 21:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-07-23 23:35 - 2015-06-20 21:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-07-23 23:35 - 2015-06-20 21:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-07-23 23:35 - 2015-06-20 20:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-07-23 23:35 - 2015-06-20 20:48 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-07-23 23:35 - 2015-06-20 20:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-07-23 23:35 - 2015-06-20 20:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-07-23 23:35 - 2015-06-20 20:26 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-07-23 23:35 - 2015-06-20 20:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-07-23 23:35 - 2015-06-19 20:25 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-07-23 23:35 - 2015-06-19 20:25 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-07-23 23:35 - 2015-06-19 20:24 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-07-23 23:35 - 2015-06-19 20:24 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-07-23 23:35 - 2015-06-19 20:23 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-07-23 23:35 - 2015-06-19 20:17 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-07-23 23:35 - 2015-06-19 20:16 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-07-23 23:35 - 2015-06-19 20:13 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-07-23 23:35 - 2015-06-19 20:13 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-07-23 23:35 - 2015-06-19 20:03 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-07-23 23:35 - 2015-06-19 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-07-23 23:35 - 2015-06-19 19:53 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-07-23 23:35 - 2015-06-19 19:52 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-07-23 23:35 - 2015-06-19 19:51 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-07-23 23:35 - 2015-06-19 19:40 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-07-23 23:35 - 2015-06-19 19:40 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-07-23 23:35 - 2015-06-19 19:39 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-07-23 23:35 - 2015-06-19 19:15 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-07-23 23:35 - 2015-06-19 19:11 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-07-23 23:33 - 2015-06-11 19:57 - 06131200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-07-23 23:33 - 2015-06-11 19:57 - 00856064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2015-07-23 23:33 - 2015-06-11 19:57 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2015-07-23 23:33 - 2015-06-11 19:56 - 07077376 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-07-23 23:33 - 2015-06-11 19:56 - 01057792 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2015-07-23 23:33 - 2015-06-11 19:56 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2015-07-23 23:33 - 2015-06-11 15:15 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2015-07-23 23:32 - 2015-07-04 20:07 - 02087424 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-23 23:32 - 2015-07-04 19:48 - 01414656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-07-23 23:32 - 2015-04-27 21:23 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-07-23 23:32 - 2015-04-27 21:23 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-07-23 23:32 - 2015-04-27 21:23 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-07-23 23:32 - 2015-04-27 21:23 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-07-23 23:32 - 2015-04-27 21:05 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-07-23 23:32 - 2015-04-27 21:04 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-07-23 23:32 - 2015-04-27 21:04 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-07-23 23:32 - 2015-04-27 21:04 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-07-23 23:31 - 2015-07-01 22:56 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-07-23 23:31 - 2015-07-01 22:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-07-23 23:31 - 2015-07-01 22:49 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-07-23 23:31 - 2015-07-01 22:49 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-07-23 23:31 - 2015-07-01 22:49 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-23 23:31 - 2015-07-01 22:49 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-07-23 23:31 - 2015-07-01 22:49 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-07-23 23:31 - 2015-07-01 22:49 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-07-23 23:31 - 2015-07-01 22:49 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-07-23 23:31 - 2015-07-01 22:49 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-07-23 23:31 - 2015-07-01 22:49 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-07-23 23:31 - 2015-07-01 22:49 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-07-23 23:31 - 2015-07-01 22:49 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-07-23 23:31 - 2015-07-01 22:48 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-07-23 23:31 - 2015-07-01 22:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-07-23 23:31 - 2015-07-01 22:47 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-07-23 23:31 - 2015-07-01 22:47 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-07-23 23:31 - 2015-07-01 22:43 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-07-23 23:31 - 2015-07-01 22:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-07-23 23:31 - 2015-07-01 22:39 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-07-23 23:31 - 2015-07-01 22:30 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-07-23 23:31 - 2015-07-01 22:30 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-07-23 23:31 - 2015-07-01 22:30 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-07-23 23:31 - 2015-07-01 22:30 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-07-23 23:31 - 2015-07-01 22:30 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-07-23 23:31 - 2015-07-01 22:30 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-07-23 23:31 - 2015-07-01 22:30 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-07-23 23:31 - 2015-07-01 22:30 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-07-23 23:31 - 2015-07-01 22:30 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-07-23 23:31 - 2015-07-01 22:29 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-07-23 23:31 - 2015-07-01 22:29 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-07-23 23:31 - 2015-07-01 22:29 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-07-23 23:31 - 2015-07-01 22:27 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-07-23 23:31 - 2015-07-01 22:26 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-07-23 23:31 - 2015-07-01 22:24 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-07-23 23:31 - 2015-07-01 21:27 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-07-23 23:31 - 2015-07-01 21:26 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-07-23 23:31 - 2015-07-01 21:26 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-07-23 23:31 - 2015-06-15 23:50 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-07-23 23:31 - 2015-06-15 23:45 - 03242496 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-23 23:31 - 2015-06-15 23:45 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-07-23 23:31 - 2015-06-15 23:45 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2015-07-23 23:31 - 2015-06-15 23:45 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-07-23 23:31 - 2015-06-15 23:44 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-23 23:31 - 2015-06-15 23:43 - 02364416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-07-23 23:31 - 2015-06-15 23:43 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-07-23 23:31 - 2015-06-15 23:43 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2015-07-23 23:31 - 2015-06-15 23:42 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-07-23 23:31 - 2015-06-15 23:42 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2015-07-23 23:31 - 2015-06-15 23:37 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2015-07-11 20:49 - 2015-07-11 20:49 - 00000000 ____D C:\Users\admin\Desktop\CD's für Auto
2015-07-10 19:29 - 2015-07-29 11:39 - 00000000 ___HD C:\$Windows.~BT

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-08-08 12:49 - 2013-12-05 22:18 - 00000000 ____D C:\Users\admin
2015-08-08 12:47 - 2009-07-14 06:45 - 00026528 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-08-08 12:47 - 2009-07-14 06:45 - 00026528 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-08-08 12:38 - 2015-06-19 13:33 - 00000000 ____D C:\Program Files (x86)\MiuiTab
2015-08-08 12:38 - 2009-07-14 19:58 - 00699342 _____ C:\Windows\system32\perfh007.dat
2015-08-08 12:38 - 2009-07-14 19:58 - 00149450 _____ C:\Windows\system32\perfc007.dat
2015-08-08 12:38 - 2009-07-14 07:13 - 01619284 _____ C:\Windows\system32\PerfStringBackup.INI
2015-08-08 12:36 - 2015-01-14 20:35 - 01124122 _____ C:\Windows\WindowsUpdate.log
2015-08-08 12:32 - 2015-06-19 13:34 - 00000000 ____D C:\Users\admin\AppData\Everything
2015-08-08 12:32 - 2014-10-25 17:14 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2015-08-08 12:32 - 2014-10-10 15:37 - 00000000 ___RD C:\Users\admin\Dropbox
2015-08-08 12:32 - 2014-10-10 15:35 - 00000000 ____D C:\Users\admin\AppData\Roaming\Dropbox
2015-08-08 12:32 - 2014-08-14 14:20 - 00000435 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2015-08-08 12:32 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-08-08 12:13 - 2015-06-19 22:52 - 00001224 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000UA.job
2015-08-08 01:16 - 2014-05-13 19:21 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-08-08 01:16 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-08-08 00:35 - 2015-02-14 22:56 - 00003850 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1423947365
2015-08-08 00:35 - 2015-02-14 22:55 - 00000000 ____D C:\Program Files (x86)\Opera
2015-08-03 03:59 - 2015-06-19 22:52 - 00001172 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000Core.job
2015-08-02 19:40 - 2014-12-05 23:16 - 00000000 _____ C:\END
2015-08-01 15:53 - 2015-07-04 13:46 - 00000000 ____D C:\Users\admin\.phase-6
2015-08-01 15:07 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-07-31 15:13 - 2015-04-13 12:37 - 00000000 ___SD C:\Windows\system32\GWX
2015-07-29 11:30 - 2013-12-05 22:07 - 00000000 ____D C:\Windows\Panther
2015-07-29 11:00 - 2015-04-13 12:37 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-07-29 11:00 - 2014-05-13 21:48 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-07-27 07:26 - 2009-07-14 06:45 - 00499752 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-27 07:25 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-07-26 13:44 - 2014-05-13 21:39 - 01593564 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2015-07-26 13:43 - 2014-05-13 19:48 - 00000000 ____D C:\Windows\system32\MRT
2015-07-26 13:31 - 2014-12-11 13:59 - 00000000 ____D C:\Windows\system32\appraiser
2015-07-25 13:25 - 2014-08-16 21:49 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-07-25 13:22 - 2015-01-19 12:32 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-07-24 14:14 - 2015-05-12 14:56 - 00000000 ____D C:\Users\admin\Documents\TAMY
2015-07-23 23:08 - 2015-06-19 22:52 - 00004194 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000UA
2015-07-23 23:08 - 2015-06-19 22:52 - 00003798 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000Core
2015-07-23 23:06 - 2014-08-16 21:14 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-07-12 00:05 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-07-09 22:25 - 2015-05-12 14:56 - 00000000 ____D C:\Users\admin\Documents\SANDRO

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2015-04-24 12:11 - 2015-04-24 12:11 - 0001099 _____ () C:\Users\admin\AppData\Roaming\ShiftN.ini
2015-02-13 17:54 - 2015-02-13 17:54 - 0000057 _____ () C:\ProgramData\Ament.ini

Einige Dateien in TEMP:
====================
C:\Users\admin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzmwujs.dll


==================== Bamital & volsnap Check =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-08-02 18:46

==================== Ende von log ============================
         

Alt 08.08.2015, 21:40   #7
Deathkid535
/// Malwareteam
 
Kaspersky 2015 meldet dauernd not-a-virus - Standard

Kaspersky 2015 meldet dauernd not-a-virus



Und die Addition.txt?

Alt 09.08.2015, 13:51   #8
Taymytt
 
Kaspersky 2015 meldet dauernd not-a-virus - Standard

Kaspersky 2015 meldet dauernd not-a-virus



ou, vor lauter aufteilung total vergessen

Addition Teil 1

Code:
ATTFilter
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:08-08-2015
durchgeführt von admin (2015-08-08 12:51:58)
Gestartet von C:\Users\admin\Downloads
Start-Modus: Normal
==========================================================


==================== Konten: =============================

admin (S-1-5-21-1824315975-2186341827-1397389162-1000 - Administrator - Enabled) => C:\Users\admin
Administrator (S-1-5-21-1824315975-2186341827-1397389162-500 - Administrator - Disabled)
Gast (S-1-5-21-1824315975-2186341827-1397389162-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1824315975-2186341827-1397389162-1016 - Limited - Enabled)

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 17 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 17.0.0.134 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.12) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)
ANNO 1503 GOLD (HKLM-x32\...\{DB833EF9-A198-49BE-970A-BD46F30BFBB4}) (Version: 1.05.00 - )
BitRaider Streaming Client (HKLM-x32\...\BitRaider Streaming Client) (Version: 1.3.3.4098 - BitRaider, LLC)
CCleaner (HKLM\...\CCleaner) (Version: 5.00 - Piriform)
Dropbox (HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\...\Dropbox) (Version: 3.8.5 - Dropbox, Inc.)
eFisc2014 (HKLM-x32\...\{A2A7EAA2-1EFE-450D-A5E2-64BAE3D9C939}) (Version: 1.2.2 - Abraxas Informatik AG)
Free YouTube to MP3 Converter version 3.12.57.324 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.57.324 - DVDVideoSoft Ltd.)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
HP ENVY 5640 series - Grundlegende Software für das Gerät (HKLM\...\{8ED07F8D-A230-4DB7-B0A0-A67336FD7797}) (Version: 34.2.117.50647 - Hewlett-Packard Co.)
HP ENVY 5640 series Hilfe (HKLM-x32\...\{FE81C6FB-7A42-4ADE-A50A-2E44D6B7BD24}) (Version: 34.0.0 - Hewlett Packard)
HP HD Webcam Driver (HKLM-x32\...\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 6.0.1112.2_WHQL - Sonix)
HP Hotkey Support (HKLM-x32\...\{53C48A27-4079-49EB-8E73-76BA85D2BF6F}) (Version: 5.0.24.1 - Hewlett-Packard Company)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)
HP Support Solutions Framework (HKLM-x32\...\{FC3C2B77-6800-48C6-A15D-9D1031130C16}) (Version: 11.51.0049 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6435.0 - IDT)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 17.3 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2867 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.8.251 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{105fa5c4-72e1-41f2-a82c-884d8aa4b381}) (Version: 16.6.0 - Intel Corporation)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.0.463 - Kaspersky Lab) Hidden
MAGIX Foto & Grafik Designer 10 (HKLM-x32\...\MX.{ACC8C3C2-A29D-4287-85FB-230EDDA84488}) (Version: 10.1.1.34941 - MAGIX Software GmbH)
MAGIX Foto & Grafik Designer 10 (Version: 10.1.1.34941 - MAGIX Software GmbH) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4737.1003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\...\OneDriveSetup.exe) (Version: 17.0.4023.1211 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 35.0.1 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4737.1003 - Microsoft Corporation) Hidden
Opera Stable 31.0.1889.99 (HKLM-x32\...\Opera 31.0.1889.99) (Version: 31.0.1889.99 - Opera Software)
phase-6-compendio 2.3.5 (HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\...\phase-6-compendio) (Version: 2.3.5 - phase-6)
Photo & Graphic Designer 10 Update (Version: 10.1.4.36142 - MAGIX Software GmbH) Hidden
Photo & Graphic Designer 10 Update (Version: 10.1.6.37584 - MAGIX Software GmbH) Hidden
Picexa (HKLM-x32\...\Picexa) (Version:  - Taiwan Shui Mu Chih Ching Technology Limited)
soft Xpansion Perfect PDF 8 (HKLM-x32\...\{4E42E18A-7500-4ef6-A8DC-A5994B5F1BCD}) (Version: 8.0.4.0 - soft Xpansion)
Stronghold Crusader Extreme (HKLM-x32\...\{8C3727F2-8E37-49E4-820C-03B1677F53B6}) (Version: 1.20.0000 - Firefly Studios)
Studie zur Verbesserung von HP ENVY 5640 series (HKLM\...\{CC803199-ABD7-43B6-95CE-9B4D5695CF94}) (Version: 34.2.117.50647 - Hewlett-Packard Co.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.18.17 - Synaptics Incorporated)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
Validity Fingerprint Sensor Driver (HKLM\...\{AA51ED2E-DCE7-415F-9C32-CB9B561D216D}) (Version: 4.4.228.0 - Validity Sensors, Inc.)
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\admin\AppData\Local\Microsoft\SkyDrive\17.0.4023.1211\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\admin\AppData\Local\Microsoft\SkyDrive\17.0.4023.1211\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\admin\AppData\Local\Microsoft\SkyDrive\17.0.4023.1211\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\admin\AppData\Local\Microsoft\SkyDrive\17.0.4023.1211\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\admin\AppData\Local\Microsoft\SkyDrive\17.0.4023.1211\amd64\FileSyncApi64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)

==================== Wiederherstellungspunkte =========================

27-07-2015 07:08:51 Windows Update
29-07-2015 11:00:09 Windows Update
31-07-2015 18:33:40 DirectX wurde installiert
01-08-2015 12:52:35 Windows Update
08-08-2015 00:34:16 Windows Update
08-08-2015 00:50:56 DirectX wurde installiert
08-08-2015 00:52:47 Installed Ubisoft Game Launcher

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {07988186-E275-4DC6-BFB5-3AD97F0A2108} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-11-21] (Piriform Ltd)
Task: {1AB28D63-43C6-4F38-8905-75EB330B9CEE} - System32\Tasks\HPCustParticipation HP ENVY 5640 series => C:\Program Files\HP\HP ENVY 5640 series\Bin\HPCustPartic.exe [2014-08-22] (Hewlett-Packard Development Company, LP)
Task: {43AEB2F7-E9CA-406C-AE4F-7EA13A007501} - System32\Tasks\{D1B4DCDC-80CC-4483-A3C0-7C0C9D81DE0B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [2015-07-24] (Dropbox, Inc.)
Task: {49819460-E7F0-4D77-8E3B-24FA4BBDCCF7} - System32\Tasks\{D46DF4DC-16C0-4483-8489-33989792B7BB} => pcalua.exe -a "C:\Program Files (x86)\Picexa\uninstall.exe"
Task: {5B0A892F-BAAD-4CA6-8726-C67E57ADAC6E} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000Core => C:\Users\admin\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-19] (Dropbox, Inc.)
Task: {5ECD4F44-504E-4D38-A3B3-89DC793548CC} - System32\Tasks\{92967924-6A9D-44ED-8511-59B1FD4AAF62} => C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [2015-07-24] (Dropbox, Inc.)
Task: {7E7E622A-F8C9-4E92-9DD1-29A5C0F1A722} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000UA => C:\Users\admin\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-19] (Dropbox, Inc.)
Task: {905E170C-8E1A-4667-A617-2D6CF5E4C847} - System32\Tasks\Opera scheduled Autoupdate 1423947365 => C:\Program Files (x86)\Opera\launcher.exe [2015-07-30] (Opera Software)
Task: {A33FA311-F91B-4F8F-9099-27E116ED31BF} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-01] (Microsoft Corporation)
Task: {BA9181C6-BDD6-4C18-8D36-5513AB0AE252} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {BF885F03-AB02-4863-A643-11A35D01E11E} - System32\Tasks\{F9F6E89F-E106-4160-A974-653817E63E70} => C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [2015-07-24] (Dropbox, Inc.)
Task: {E78502F9-CC97-46AD-9598-9BB4EB32D2DD} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-01] (Microsoft Corporation)
Task: {F8ACBA80-9334-4330-8831-E22FB0B4AD88} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-06-09] (Microsoft Corporation)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000Core.job => C:\Users\admin\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000UA.job => C:\Users\admin\AppData\Local\Dropbox\Update\DropboxUpdate.exe
         
Addition Teil 2

Code:
ATTFilter
=================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2014-08-16 21:14 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2013-01-17 18:25 - 2013-01-17 18:25 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-11-22 02:03 - 2014-11-22 02:03 - 00053248 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2014-03-06 15:00 - 2014-03-06 15:00 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\kpcengine.2.3.dll
2014-11-22 19:50 - 2014-11-22 19:50 - 00316576 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream32.dll
2015-08-08 12:32 - 2015-08-08 12:32 - 00071168 _____ () c:\users\admin\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzmwujs.dll
2015-03-04 23:45 - 2015-07-17 02:31 - 00012800 _____ () C:\Users\admin\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll
2015-03-04 23:45 - 2015-07-17 02:31 - 00779776 _____ () C:\Users\admin\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-07-31 15:08 - 2015-07-17 02:31 - 00056320 _____ () C:\Users\admin\AppData\Roaming\Dropbox\bin\QtQuick\Layouts\qquicklayoutsplugin.dll
2015-03-04 23:45 - 2015-07-17 02:31 - 00012288 _____ () C:\Users\admin\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll
2014-10-24 19:25 - 2014-10-24 19:25 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\1eeea3ab8d69ec722bdcb28b8eb8dd75\IsdiInterop.ni.dll
2014-05-13 19:30 - 2012-02-01 17:25 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2015-08-08 00:35 - 2015-08-08 00:35 - 58599032 _____ () C:\Program Files (x86)\Opera\31.0.1889.99\opera.dll
2015-08-08 00:35 - 2015-08-08 00:34 - 01781368 _____ () C:\Program Files (x86)\Opera\31.0.1889.99\libglesv2.dll
2015-08-08 00:35 - 2015-08-08 00:34 - 00081528 _____ () C:\Program Files (x86)\Opera\31.0.1889.99\libegl.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer trusted/restricted ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 2) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)


==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{21E1CDB8-012B-4240-9670-F0758C7CA484}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{93A9DBF0-88AA-4DAC-B07A-8594315AAF44}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{A0EBF6F0-FAB0-46E2-BEF4-A93F7E05E9B7}] => (Allow) C:\Users\admin\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{739A8CB3-D456-422B-818E-39AA45CE462C}] => (Allow) C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{0A465F55-1677-4475-A522-2903854C596F}] => (Allow) C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{9094D041-DE7F-454F-BD4D-99F9D3DDE1AC}C:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{E6427678-1205-4256-8FB2-FF80473F4DA3}C:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{E43DC60F-54AD-4903-9E04-EE30F92F22B0}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{3C95E61F-172F-48FC-B824-8C514CC72144}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{C621C19E-C58A-487B-A914-39926DA59C7C}] => (Allow) C:\Program Files\HP\HP ENVY 5640 series\Bin\DeviceSetup.exe
FirewallRules: [{E506CAFE-B0E8-40B9-8B9F-16F41CC75340}] => (Allow) LPort=5357
FirewallRules: [{F96AC161-56F6-4A24-9956-CDA9A9B7D519}] => (Allow) C:\Program Files\HP\HP ENVY 5640 series\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{AC36D2ED-378A-47B9-95EA-FF34FA014F83}] => (Allow) C:\Users\admin\Documents\SANDRO\Spiele\Stronghold\Stronghold_Crusader_Extreme.exe
FirewallRules: [{54A897D7-3774-46CC-B3F2-D2F263052965}] => (Allow) C:\Users\admin\Documents\SANDRO\Spiele\Stronghold\Stronghold Crusader.exe
FirewallRules: [{D83B0290-D5CC-40F0-A36F-1665D38D1735}] => (Allow) C:\Users\admin\Documents\SANDRO\Spiele\Stronghold\Stronghold_Crusader_Extreme.exe
FirewallRules: [{24E3D750-66F9-42DF-9AEA-316ECB0A6AEF}] => (Allow) C:\Users\admin\Documents\SANDRO\Spiele\Stronghold\Stronghold Crusader.exe
FirewallRules: [{50160966-6B6D-40BA-A393-A3ECC2649FC2}] => (Allow) C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe
FirewallRules: [{C6B8D293-40F9-4678-A647-8965C370F6D3}] => (Allow) C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe

==================== Fehlerhafte Geräte im Gerätemanager =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: BCM20702A0
Description: BCM20702A0
Class Guid: 
Manufacturer: 
Service: 
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Basissystemgerät
Description: Basissystemgerät
Class Guid: 
Manufacturer: 
Service: 
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: HP hs2350 HSPA+ MobileBroadband
Description: HP hs2350 HSPA+ MobileBroadband
Class Guid: 
Manufacturer: 
Service: 
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (08/08/2015 12:32:20 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: Der Index kann nicht initialisiert werden.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (08/08/2015 12:32:20 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Die Anwendung kann nicht initialisiert werden.

Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (08/08/2015 12:32:20 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (08/08/2015 12:32:20 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)

Error: (08/08/2015 12:32:19 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (08/08/2015 12:32:19 PM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Die Eigenschaftenspeicherdaten können von Windows Search nicht geladen werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800) (0xc0041800)

Error: (08/08/2015 12:32:19 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (08/08/2015 12:32:19 PM) (Source: Windows Search Service) (EventID: 7040) (User: )
Description: Vom Suchdienst wurden beschädigte Datendateien im Index {id=4700} erkannt. Vom Dienst wird versucht, dieses Problem durch Neuerstellung des Indexes automatisch zu beheben.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (08/08/2015 12:32:19 PM) (Source: Windows Search Service) (EventID: 9000) (User: )
Description: Der Jet-Eigenschaftenspeicher kann von Windows Search nicht geöffnet werden.


Details:
	0x%08x (0xc0041800 - Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800))

Error: (08/08/2015 12:32:19 PM) (Source: ESENT) (EventID: 455) (User: )
Description: Windows (4524) Windows: Fehler -1811 beim Öffnen von Protokolldatei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0006F.log.


Systemfehler:
=============
Error: (08/08/2015 12:32:20 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (08/08/2015 12:32:20 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1073473535.

Error: (08/08/2015 12:32:18 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (08/08/2015 12:32:11 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎08.‎08.‎2015 um 12:31:39 unerwartet heruntergefahren.

Error: (08/08/2015 08:19:15 AM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (08/08/2015 12:43:37 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80240020 fehlgeschlagen: Upgrade auf Windows 10 Pro

Error: (08/03/2015 07:25:58 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80240020 fehlgeschlagen: Upgrade auf Windows 10 Pro

Error: (08/03/2015 07:23:13 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: 

Error: (08/03/2015 07:22:10 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: 

Error: (08/03/2015 10:29:27 AM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: 


Microsoft Office:
=========================
Error: (08/08/2015 12:32:20 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: 
Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (08/08/2015 12:32:20 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (08/08/2015 12:32:20 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (08/08/2015 12:32:20 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)
Search.TripoliIndexer

Error: (08/08/2015 12:32:19 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
Search.JetPropStore

Error: (08/08/2015 12:32:19 PM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800) (0xc0041800)

Error: (08/08/2015 12:32:19 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: 
Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
The catalog is corrupt

Error: (08/08/2015 12:32:19 PM) (Source: Windows Search Service) (EventID: 7040) (User: )
Description: 
Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
4700

Error: (08/08/2015 12:32:19 PM) (Source: Windows Search Service) (EventID: 9000) (User: )
Description: 
Details:
	0x%08x (0xc0041800 - Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800))

Error: (08/08/2015 12:32:19 PM) (Source: ESENT) (EventID: 455) (User: )
Description: Windows4524Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0006F.log-1811


CodeIntegrity:
===================================
  Date: 2015-07-29 11:36:06.196
  Description: Die Integrität der Datei "\Device\HarddiskVolume2\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_47662a2706182d6f\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-29 11:36:06.196
  Description: Die Integrität der Datei "\Device\HarddiskVolume2\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_47662a2706182d6f\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-29 11:36:04.194
  Description: Die Integrität der Datei "\Device\HarddiskVolume2\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_a384c5aabe759ea5\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-29 11:36:04.179
  Description: Die Integrität der Datei "\Device\HarddiskVolume2\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.10074.1_none_a384c5aabe759ea5\wermgr.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-29 11:36:03.180
  Description: Die Integrität der Datei "\Device\HarddiskVolume2\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.10074.1_none_f3153036f55ab3f5\werfault.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-29 11:36:03.180
  Description: Die Integrität der Datei "\Device\HarddiskVolume2\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.10074.1_none_f3153036f55ab3f5\werfault.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-29 11:36:00.140
  Description: Die Integrität der Datei "\Device\HarddiskVolume2\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.10074.1_none_96f694b33cfd42bf\werfault.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-07-29 11:36:00.140
  Description: Die Integrität der Datei "\Device\HarddiskVolume2\$Windows.~BT\Updates\Critical\8e08ca47-f6ba-409d-82de-698e324c0004\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.10074.1_none_96f694b33cfd42bf\werfault.exe" kann nicht geprüft werden, da das Signaturzertifikat gesperrt wurde. Erkundigen Sie sich beim Herausgeber, ob eine neue signierte Version des Kernelmoduls verfügbar ist.

  Date: 2015-02-16 10:13:43.264
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-16 10:13:43.186
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Speicherinformationen =========================== 

Processor: Intel(R) Core(TM) i7-3520M CPU @ 2.90GHz
Percentage of memory in use: 54%
Total physical RAM: 3961.51 MB
Available physical RAM: 1819.04 MB
Total Virtual: 7921.22 MB
Available Virtual: 5493.05 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:238.37 GB) (Free:176.17 GB) NTFS
Drive d: (1503GOLD_DVD) (CDROM) (Total:1.15 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: 00089B90)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=238.4 GB) - (Type=07 NTFS)

==================== Ende von log ============================
         

Alt 09.08.2015, 13:52   #9
Taymytt
 
Kaspersky 2015 meldet dauernd not-a-virus - Standard

Kaspersky 2015 meldet dauernd not-a-virus



Vom Kaspersky hätte ich da noch n'Systembericht

Code:
ATTFilter
<?xml version="1.0" encoding="WINDOWS-1251"?>

-<AVZ CompHash="4709EDDDBB9AD8E30C760BAE92C4680E" MainDBDate="30.12.1899 00:00:00" IsSRDisabled="False" Base64Mode="False" IsAdmin="True" IsWow64="True" Domain="WORKGROUP" Session="" ProfileDir="C:\Windows\system32\config\systemprofile" OS_CSDV="Service Pack 1" BootMode="0" OS_ProductName="Windows 7 Professional" OS_Build="7601" OS_MiVer="1" OS_MjVer="6" WinDir="C:\Windows\" LogDate="08.08.2015 13:06:43" Version="4.43">


-<PROCESS>

<ITEM IsPE="1" Ver="1.0.12.0" OFN="HPSupportSolutionsFrameworkService.exe" Product="SolutionsFrameworkService" Vendor="Hewlett-Packard Company" MD5="1878A79551F2EDAE7EBD110AAE6D33AD" ChangeDate="28.03.2015 12:58:42" CreateDate="28.03.2015 12:58:42" Attr="rsAh" Size="89840" CmdLine=""C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe"" Hidden="0" LegalCopyright="Copyright © Hewlett-Packard Company 2013" Descr="SolutionsFrameworkService" CheckResult="0" File="c:\program files (x86)\hp\common\hpsupportsolutionsframeworkservice.exe" PID="2004"/>

<ITEM IsPE="1" Ver="11.1.0.1006" OFN="IAStorDataMgrSvc.exe" Product="IAStorDataSvc" Vendor="Intel Corporation" MD5="7DEC78C80C628E9D36883C06C3C07E3C" ChangeDate="29.02.2012 18:06:36" CreateDate="13.05.2014 19:30:28" Attr="rsAh" Size="13592" CmdLine=""C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"" Hidden="0" LegalCopyright="Copyright © Intel Corporation 2009-2012" Descr="IAStorDataSvc" CheckResult="0" File="c:\program files (x86)\intel\intel(r) rapid storage technology\iastordatamgrsvc.exe" PID="6704"/>

<ITEM IsPE="1" Ver="11.1.0.1006" OFN="IAStorIcon.exe" Product="IAStorIcon" Vendor="Intel Corporation" MD5="CE4FA8A9D55E0031596387F7F59F2D4F" ChangeDate="29.02.2012 18:06:42" CreateDate="13.05.2014 19:30:28" Attr="rsAh" Size="284440" CmdLine=""C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe"" Hidden="0" LegalCopyright="Copyright © Intel Corporation 2009-2012" Descr="IAStorIcon" CheckResult="0" File="c:\program files (x86)\intel\intel(r) rapid storage technology\iastoricon.exe" PID="5912"/>

</PROCESS>


-<DLL>

<ITEM IsPE="1" Ver="4.0.30319.34209" OFN="System.ServiceProcess.dll" Product="Microsoft® .NET Framework" Vendor="Microsoft Corporation" MD5="236ED5BE9BCFEEA50EF0A2EB0E7E8870" ChangeDate="26.07.2015 13:47:51" CreateDate="26.07.2015 13:47:51" Attr="rsAh" Size="219648" Hidden="0" LegalCopyright="© Microsoft Corporation. All rights reserved." Descr=".NET Framework" CheckResult="-1" File="C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Serv759bfb78#\9b0793d9104deb6a366ceb6f77bcafc3\System.ServiceProcess.ni.dll" IsDLL="1" UsedBy="2004"/>

<ITEM IsPE="1" Ver="4.0.30319.34209" OFN="System.Core.dll" Product="Microsoft® .NET Framework" Vendor="Microsoft Corporation" MD5="F4876CD41FE61C6D2EDA9915BF746612" ChangeDate="26.07.2015 13:46:01" CreateDate="26.07.2015 13:46:01" Attr="rsAh" Size="7002624" Hidden="0" LegalCopyright="© Microsoft Corporation. All rights reserved." Descr=".NET Framework" CheckResult="-1" File="C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\02a4633b5f85cdbec8e14a51bdb028f9\System.Core.ni.dll" IsDLL="1" UsedBy="2004"/>

<ITEM IsPE="1" Ver="4.0.30319.34209" OFN="System.Configuration.dll" Product="Microsoft® .NET Framework" Vendor="Microsoft Corporation" MD5="E073F5E891F171D5B8AACB64936057D9" ChangeDate="26.07.2015 13:46:02" CreateDate="26.07.2015 13:46:02" Attr="rsAh" Size="972288" Hidden="0" LegalCopyright="© Microsoft Corporation. All rights reserved." Descr="System.Configuration.dll" CheckResult="-1" File="C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\93729611cd078029e0000b18ee38f506\System.Configuration.ni.dll" IsDLL="1" UsedBy="2004"/>

<ITEM IsPE="1" Ver="11.1.0.1006" OFN="IAStorDataMgrSvc.exe" Product="IAStorDataSvc" Vendor="Intel Corporation" MD5="8B226A71000914537EAB4A28B84D5794" ChangeDate="24.10.2014 19:25:09" CreateDate="24.10.2014 19:25:09" Attr="rsAh" Size="19968" Hidden="0" LegalCopyright="Copyright © Intel Corporation 2009-2012" Descr="IAStorDataSvc" CheckResult="-1" File="C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorDataMgrSvc\f539c02fbdad496b98cf56b8bd4d57b5\IAStorDataMgrSvc.ni.exe" IsDLL="1" UsedBy="6704"/>

<ITEM IsPE="1" Ver="11.1.0.1006" OFN="IAStorDataMgr.dll" Product="IAStorService" Vendor="Intel Corporation" MD5="2F9029C934C17ADBD36864551D4DF988" ChangeDate="18.05.2015 17:36:35" CreateDate="18.05.2015 17:36:35" Attr="rsAh" Size="228864" Hidden="0" LegalCopyright="Copyright © Intel Corporation 2009-2012" Descr="IAStorService" CheckResult="-1" File="C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorDataMgr\b2915c048820efe3f5dc73fcb4626626\IAStorDataMgr.ni.dll" IsDLL="1" UsedBy="6704"/>

<ITEM IsPE="1" Ver="11.1.0.1006" OFN="IAStorUtil.dll" Product="IAStorUtil" Vendor="Intel Corporation" MD5="249401F72F30ADFE73E1C34DC480A15B" ChangeDate="18.05.2015 17:36:35" CreateDate="18.05.2015 17:36:35" Attr="rsAh" Size="489472" Hidden="0" LegalCopyright="Copyright © Intel Corporation 2009-2012" Descr="IAStorUtil" CheckResult="-1" File="C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\425d7cea7addf909ff04be98b8292b99\IAStorUtil.ni.dll" IsDLL="1" UsedBy="6704,5912"/>

</DLL>


-<KERNELOBJ>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="C:\Users\admin\AppData\Local\Temp\axddapow.sys" MemSize="010000" Base="8E95000"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="C:\Windows\System32\Drivers\dump_dumpfve.sys" MemSize="013000" Base="81DC000"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="C:\Windows\System32\Drivers\dump_iaStor.sys" MemSize="3A4000" Base="7E38000"/>

</KERNELOBJ>

<Service> </Service>


-<Drivers>

<ITEM CheckResult="-1" File="C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys" State="1" Type="2" Name="BRDriver64_1_3_3_E02B25FC"/>

</Drivers>


-<AUTORUN>

<ITEM CheckResult="-1" File="C:\Program" Type="REG" Is64="0" X4="C:\Program Files (x86)" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\PicexaService" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\IPSEventLogMsg.dll" Type="REG" Is64="0" X4="%CommonProgramFiles%\Microsoft Shared\Ink\IPSEventLogMsg.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Handwriting Recognition" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Program Files (x86)\DVD" Type="REG" Is64="0" X4="%ProgramFiles%\DVD Maker\DVDMaker.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Dvd Maker" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Program Files (x86)\Synaptics\SynTP\SynTPCpl.dll" Type="REG" Is64="1" X4="Synaptics Control Panel" X3="{2F603045-309F-11CF-9774-0020AFD0CFF6}" X2="Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe" Type="REG" Is64="1" X4="%ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe" X3="SynTPEnh" X2="Software\Microsoft\Windows\CurrentVersion\Run" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Program Files (x86)\Windows Defender\MpEvMsg.dll" Type="REG" Is64="0" X4="%ProgramFiles%\Windows Defender\MpEvMsg.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\WinDefend" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Program Files (x86)\Windows Defender\mpsvc.dll" Type="REG" Is64="0" X4="%ProgramFiles%\Windows Defender\mpsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\WinDefend\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\ProgramData\WindowsMangerPro" Type="REG" Is64="0" X4="C:\ProgramData\WindowsMangerPro" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\Audiosrv.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\Audiosrv.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\AudioEndpointBuilder\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\Audiosrv.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\Audiosrv.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\AudioSrv\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\AxInstSV.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\AxInstSV.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\AxInstSV\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\AxInstSv.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\AxInstSv.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-AxInstallService" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\DFDTS.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\DFDTS.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Windows Disk Diagnostic" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\DispCI.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\DispCI.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Display" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\Drivers\Netwsw00.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\Drivers\Netwsw00.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\NETwNs64" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\Drivers\Pcmcia.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\Drivers\Pcmcia.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\pcmcia" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\Drivers\VolSnap.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\Drivers\VolSnap.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Volsnap" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\Drivers\acpi.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\Drivers\acpi.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\ACPI" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\Drivers\hidbth.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\Drivers\hidbth.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\HidBth" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\MsSpellCheckingFacility.dll" Type="REG" Is64="0" X4="%systemroot%\System32\MsSpellCheckingFacility.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-Spell-Checking" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\MsSpellCheckingFacility.dll" Type="REG" Is64="0" X4="%systemroot%\System32\MsSpellCheckingFacility.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-SpellChecker" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\MsSpellCheckingFacility.dll" Type="REG" Is64="0" X4="%systemroot%\System32\MsSpellCheckingFacility.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Spell-Checking" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\MsSpellCheckingFacility.dll" Type="REG" Is64="0" X4="%systemroot%\System32\MsSpellCheckingFacility.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-SpellChecker" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\RdpGroupPolicyExtension.dll" Type="REG" Is64="1" X4="C:\Windows\System32\RdpGroupPolicyExtension.dll" X3="DLLName" X2="Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{6cfb9c5c-138e-4bb3-8a3d-d5383e910e57}" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\RpcEpMap.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\RpcEpMap.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\RpcEptMapper\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\SCardSvr.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\SCardSvr.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\SCardSvr\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\SDRSVC.dll" Type="REG" Is64="0" X4="%Systemroot%\System32\SDRSVC.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\SDRSVC\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\SPReview\SPReview.exe" Type="REG" Is64="0" X4=""C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"hxxp://go.microsoft.com/fwlink/?LinkID=122915" /build:7601" X3="SPReview" X2=".DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce" X1="HKEY_USERS" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\SPReview\SPReview.exe" Type="REG" Is64="0" X4=""C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"hxxp://go.microsoft.com/fwlink/?LinkID=122915" /build:7601" X3="SPReview" X2="S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce" X1="HKEY_USERS" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\TabSvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\TabSvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\TabletInputService\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll" Type="REG" Is64="1" X4="C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll" X3="DLLName" X2="Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4bcd6cde-777b-48b6-9804-43568e23545d}" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\UI0Detect.exe" Type="REG" Is64="0" X4="%SystemRoot%\System32\UI0Detect.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Interactive Services detection" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\VSSVC.EXE" Type="REG" Is64="0" X4="%SystemRoot%\System32\VSSVC.EXE" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\VSS" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\VSSVC.EXE" Type="REG" Is64="0" X4="%SystemRoot%\System32\VSSVC.EXE" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Security\VSSAudit" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\WUDFHost.exe" Type="REG" Is64="1" X4="C:\Windows\System32\WUDFHost.exe" X3="HostProcessImagePath" X2="Software\Microsoft\Windows NT\CurrentVersion\WUDF\Services\{193a1820-d9ac-4997-8c55-be817523f6aa}" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\WUDFSvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\WUDFSvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\wudfsvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\WerSvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\WerSvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\WerSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\aelupsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\aelupsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\AeLookupSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\aelupsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\aelupsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\AeLookupSvc" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\appidsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\appidsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\AppIDSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\appinfo.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\appinfo.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\Appinfo\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\bdesvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\bdesvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\BDESVC\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\bfe.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\bfe.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\BFE\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\browser.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\browser.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\Browser\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\certprop.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\certprop.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\CertPropSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\certprop.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\certprop.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\SCPolicySvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\cscsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\cscsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\CscService\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\defragsvc.dll" Type="REG" Is64="0" X4="%Systemroot%\System32\defragsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\defragsvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\dnsrslvr.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\dnsrslvr.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\dot3svc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\dot3svc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\dot3svc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\HECIx64.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\HECIx64.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\MEIx64" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\MTConfig.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\MTConfig.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\MTConfig" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\SynTP.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\SynTP.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\SynTP" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\Wdf01000.sys" Type="REG" Is64="0" X4="C:\Windows\System32\drivers\Wdf01000.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\wdf01000" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\amdk8.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\amdk8.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\AmdK8" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\amdppm.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\amdppm.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\AmdPPM" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\avipbb.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\avipbb.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\avipbb" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\avkmgr.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\avkmgr.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\avkmgr" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\b57nd60a.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\b57nd60a.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\b57nd60a" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\bxvbda.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\bxvbda.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\b06bdrv" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\evbda.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\evbda.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\ebdrv" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\fltmgr.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\fltmgr.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\FltMgr" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\i8042prt.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\i8042prt.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\i8042prt" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\iaStor.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\iaStor.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\iaStor" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\iaStorV.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\iaStorV.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\iaStorV" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\intelppm.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\intelppm.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\intelppm" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\ipmidrv.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\ipmidrv.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\IPMIDRV" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\isapnp.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\isapnp.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\isapnp" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\kbdclass.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\kbdclass.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\kbdclass" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\kbdhid.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\kbdhid.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\kbdhid" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\mouclass.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\mouclass.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\mouclass" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\mouhid.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\mouhid.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\mouhid" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\mpio.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\mpio.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\mpio" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\nvstor.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\nvstor.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\nvstor" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\parport.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\parport.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Parport" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\processr.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\processr.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Processor" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\sbp2port.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\sbp2port.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\sbp2port" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\serial.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\serial.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Serial" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\sermouse.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\sermouse.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\sermouse" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\tpm.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\tpm.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\TPM" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\tsusbflt.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\tsusbflt.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\TsUsbFlt" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\vgapnp.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\vgapnp.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\vga" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\wacompen.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\wacompen.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\WacomPen" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\drivers\wd.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\drivers\wd.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Wd" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\e1cmsg.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\e1cmsg.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\e1cexpress" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\eapsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\eapsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\EapHost\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\gpsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\gpsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\gpsvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\ikeext.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\ikeext.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\IKEEXT\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\iphlpsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\iphlpsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\ipnathlp.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\ipnathlp.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\ipsecsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\ipsecsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\PolicyAgent\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\iscsiexe.dll" Type="REG" Is64="0" X4="%systemroot%\System32\iscsiexe.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\MSiSCSI" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\iscsilog.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\iscsilog.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\iScsiPrt" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\lltdsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\lltdsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\lltdsvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\lmhsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\lmhsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\lmhosts\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\lsasrv.dll" Type="REG" Is64="0" X4="%windir%\System32\lsasrv.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\LsaSrv" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\lsasrv.dll" Type="REG" Is64="0" X4="%windir%\System32\lsasrv.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Schannel" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\mctadmin.exe" Type="REG" Is64="0" X4="C:\Windows\System32\mctadmin.exe" X3="mctadmin" X2="S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce" X1="HKEY_USERS" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\mctadmin.exe" Type="REG" Is64="0" X4="C:\Windows\System32\mctadmin.exe" X3="mctadmin" X2="S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce" X1="HKEY_USERS" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\mdsched.exe" Type="REG" Is64="0" X4="%SystemRoot%\System32\mdsched.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-MemoryDiagnostics-Schedule" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\netman.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\netman.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\Netman\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\nlasvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\nlasvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\pcasvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\pcasvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\PcaSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\profsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\profsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-User Profiles Service" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\profsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\profsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Profsvc" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\qmgr.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\qmgr.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\BITS\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\rasauto.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\rasauto.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\RasAuto\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\rasmans.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\rasmans.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\RasMan\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\relpost.exe" Type="REG" Is64="0" X4="%SystemRoot%\System32\relpost.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-MemoryDiagnostics-Results" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\samsrv.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\samsrv.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Directory-Services-SAM" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\samsrv.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\samsrv.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\SAM" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\snmptrap.exe" Type="REG" Is64="0" X4="%SystemRoot%\System32\snmptrap.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\SNMPTRAP" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\ssdpsrv.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\ssdpsrv.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\SSDPSRV\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\sstpsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\sstpsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-RasSstp" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\swprv.dll" Type="REG" Is64="0" X4="%Systemroot%\System32\swprv.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\swprv\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\tbssvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\tbssvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\TBS\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\tcpmon.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\tcpmon.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\TCPMon" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\termsrv.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\termsrv.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\TermService\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\trkwks.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\trkwks.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\TrkWks\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\umpnpmgr.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\umpnpmgr.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\PlugPlayManager" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\umpo.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\umpo.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Power" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\umrdp.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\umrdp.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\UmRdpService\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\umrdp.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\umrdp.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\UmRdpService" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\uxsms.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\uxsms.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\UxSms\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\vds.exe" Type="REG" Is64="0" X4="%SystemRoot%\System32\vds.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Virtual Disk Service" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\vmbusres.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\vmbusres.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\vmbus" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\vmictimeprovider.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\vmictimeprovider.dll" X3="DllName" X2="SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\vmstorfltres.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\vmstorfltres.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\storflt" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\wbiosrvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wbiosrvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\WbioSrvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\wecsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wecsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\wecsvc" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\wercplsupport.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wercplsupport.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\wercplsupport\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\wersvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wersvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application Hang" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\wersvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wersvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\WerSvc" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\wevtsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wevtsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Security\Microsoft-Windows-Eventlog" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\wevtsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wevtsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Eventlog" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\wiaservc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wiaservc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\stisvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\wiaservc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wiaservc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\StillImage" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\win32k.sys" Type="REG" Is64="0" X4="%SystemRoot%\System32\win32k.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Win32k" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\winlogon.exe" Type="REG" Is64="0" X4="%SystemRoot%\System32\winlogon.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Winlogon" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\winlogon.exe" Type="REG" Is64="0" X4="%SystemRoot%\System32\winlogon.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Wlclntfy" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\wkssvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wkssvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\wlansvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wlansvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\Wlansvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\wscsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wscsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\wscsvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\wscsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wscsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\SecurityCenter" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\System32\wwansvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\System32\wwansvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\WwanSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\BlbEvents.dll" Type="REG" Is64="0" X4="%windir%\system32\BlbEvents.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-Backup" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\DRIVERS\iusb3hub.sys" Type="REG" Is64="0" X4="C:\Windows\system32\DRIVERS\iusb3hub.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\iusb3hub" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\DRIVERS\iusb3xhc.sys" Type="REG" Is64="0" X4="C:\Windows\system32\DRIVERS\iusb3xhc.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\iusb3xhc" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\EventProviders\spcmsg.dll" Type="REG" Is64="0" X4="%systemroot%\system32\EventProviders\spcmsg.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Service Pack Installer" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\FntCache.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\FntCache.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\FontCache\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\ListSvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\ListSvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\HomeGroupListener\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\Mcx2Svc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\Mcx2Svc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\Mcx2Svc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\WINSAT.EXE" Type="REG" Is64="0" X4="%SystemRoot%\system32\WINSAT.EXE" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-WindowsSystemAssessmentTool" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\WUDFPlatform.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\WUDFPlatform.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-DriverFrameworks-UserMode" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\Wat\WatUX.exe" Type="REG" Is64="0" X4="%SystemRoot%\system32\Wat\WatUX.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Windows Activation Technologies" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\bthserv.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\bthserv.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\bthserv\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\certprop.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\certprop.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-SCPNP" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\cofiredm.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\cofiredm.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-CorruptedFileRecovery-Client" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\cofiredm.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\cofiredm.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-CorruptedFileRecovery-Server" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\config\systemprofile\AppData\Local\phase-6\phase-6-compendio\reminder\reminder.exe" Type="LNK" Is64="1" X4="" X3="" X2="C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk" X1="C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\config\systemprofile\AppData\Roaming\Dropbox\bin\Dropbox.exe" Type="LNK" Is64="1" X4="" X3="" X2="C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk" X1="C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\cscsvc.dll" Type="REG" Is64="0" X4="%systemroot%\system32\cscsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-OfflineFiles" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\csrsrv.dll" Type="REG" Is64="0" X4="%windir%\system32\csrsrv.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Subsys-SMSS" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\defragsvc.dll" Type="REG" Is64="0" X4="%systemroot%\system32\defragsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-Defrag" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\dfdts.dll" Type="REG" Is64="0" X4="%windir%\system32\dfdts.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-DiskDiagnostic" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\diagtrack.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\diagtrack.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\DiagTrack\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\dps.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\dps.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\DPS\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\drivers\HTTP.SYS" Type="REG" Is64="0" X4="%SystemRoot%\system32\drivers\HTTP.SYS" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-HttpEvent" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\drivers\fltmgr.sys" Type="REG" Is64="0" X4="%SystemRoot%\system32\drivers\fltmgr.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-FilterManager" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\drivers\fvevol.sys" Type="REG" Is64="0" X4="%SystemRoot%\system32\drivers\fvevol.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-BitLocker-Driver" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\drivers\ntfs.sys" Type="REG" Is64="0" X4="%SystemRoot%\system32\drivers\ntfs.sys" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Ntfs" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\dwm.exe" Type="REG" Is64="0" X4="%SystemRoot%\system32\dwm.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Desktop Window Manager" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\eapsvc.dll" Type="REG" Is64="0" X4="%systemroot%\system32\eapsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-EapHost" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\fdPHost.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\fdPHost.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\fdPHost\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\fdphost.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\fdphost.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-FunctionDiscoveryHost" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\fdrespub.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\fdrespub.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\FDResPub\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\fdrespub.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\fdrespub.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-ResourcePublication" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\fveapi.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\fveapi.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-BitLocker-API" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\fxsevent.dll" Type="REG" Is64="0" X4="%systemroot%\system32\fxsevent.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft Fax" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\gpsvc.dll" Type="REG" Is64="0" X4="%systemroot%\system32\gpsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-GroupPolicy" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\hkcmd.exe" Type="REG" Is64="1" X4="C:\Windows\system32\hkcmd.exe" X3="HotKeysCmds" X2="Software\Microsoft\Windows\CurrentVersion\Run" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\igfxpers.exe" Type="REG" Is64="1" X4="C:\Windows\system32\igfxpers.exe" X3="Persistence" X2="Software\Microsoft\Windows\CurrentVersion\Run" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\igfxtray.exe" Type="REG" Is64="1" X4="C:\Windows\system32\igfxtray.exe" X3="IgfxTray" X2="Software\Microsoft\Windows\CurrentVersion\Run" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\ipbusenum.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\ipbusenum.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\IPBusEnum\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\ipbusenum.dll" Type="REG" Is64="0" X4="%systemroot%\system32\ipbusenum.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-IPBusEnum" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\iphlpsvc.dll" Type="REG" Is64="0" X4="%windir%\system32\iphlpsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Iphlpsvc" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\iscsiexe.dll" Type="REG" Is64="0" X4="%systemroot%\system32\iscsiexe.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\MSiSCSI\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\kmsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\kmsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\hkmsvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\lpksetup.exe" Type="REG" Is64="0" X4="%SystemRoot%\system32\lpksetup.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-LanguagePackSetup" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\lsm.exe" Type="REG" Is64="0" X4="%SystemRoot%\system32\lsm.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\LSM" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\lsm.exe" Type="REG" Is64="0" X4="%SystemRoot%\system32\lsm.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-TerminalServices-LocalSessionManager" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\microsoft-windows-hal-events.dll" Type="REG" Is64="0" X4="%systemroot%\system32\microsoft-windows-hal-events.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-HAL" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\microsoft-windows-kernel-power-events.dll" Type="REG" Is64="0" X4="%systemroot%\system32\microsoft-windows-kernel-power-events.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Kernel-Power" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\microsoft-windows-kernel-processor-power-events.dll" Type="REG" Is64="0" X4="%systemroot%\system32\microsoft-windows-kernel-processor-power-events.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Kernel-Processor-Power" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\mmcss.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\mmcss.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\MMCSS\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\mmcss.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\mmcss.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\THREADORDER\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\mpssvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\mpssvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\mpssvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\mpssvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Firewall" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\msdtckrm.dll" Type="REG" Is64="0" X4="%systemroot%\system32\msdtckrm.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\KtmRm\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\nsisvc.dll" Type="REG" Is64="0" X4="%systemroot%\system32\nsisvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\nsi\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\oobe\winsetup.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\oobe\winsetup.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Setup" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\p2psvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\p2psvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\p2psvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\peerdistsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\peerdistsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\PeerDistSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\pnrpauto.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\pnrpauto.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\PNRPAutoReg\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\pnrpsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\pnrpsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\p2pimsvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\pnrpsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\pnrpsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\PNRPsvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\profsvc.dll" Type="REG" Is64="0" X4="%systemroot%\system32\profsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\ProfSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\psxss.exe" Type="REG" Is64="0" X4="%SystemRoot%\system32\psxss.exe" X3="Posix" X2="System\CurrentControlSet\Control\Session Manager\SubSystems" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\qagentRT.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\qagentRT.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\napagent\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\qmgr.dll" Type="REG" Is64="0" X4="%systemroot%\system32\qmgr.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Bits-Client" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\recovery.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\recovery.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Recovery" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\regsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\regsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\RemoteRegistry\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\rpcss.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\rpcss.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\DcomLaunch\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\rpcss.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\rpcss.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\RpcSs\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\schedsvc.dll" Type="REG" Is64="0" X4="%systemroot%\system32\schedsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\Schedule\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\schedsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\schedsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-TaskScheduler" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\sdclt.exe" Type="REG" Is64="0" X4="%SystemRoot%\system32\sdclt.exe" X3="" X2="SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\BackupPath" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\sdengin2.dll" Type="REG" Is64="0" X4="%systemroot%\system32\sdengin2.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Windows Backup" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\seclogon.dll" Type="REG" Is64="0" X4="%windir%\system32\seclogon.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\seclogon\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\sensrsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\sensrsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\SensrSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\services.exe" Type="REG" Is64="0" X4="%SystemRoot%\system32\services.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Service Control Manager" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\sppsvc.exe" Type="REG" Is64="0" X4="%windir%\system32\sppsvc.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Software Protection Platform Service" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\sppsvc.exe" Type="REG" Is64="0" X4="%windir%\system32\sppsvc.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Key Management Service\KmsRequests" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\sppuinotify.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\sppuinotify.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\sppuinotify\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\srcore.dll" Type="REG" Is64="0" X4="%systemroot%\system32\srcore.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\System Restore" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\srvsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\srvsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\sstpsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\sstpsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\SstpSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\sstpsvc.dll" Type="REG" Is64="0" X4="%systemroot%\system32\sstpsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\RasSstp" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\storsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\storsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\StorSvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\sysmain.dll" Type="REG" Is64="0" X4="%systemroot%\system32\sysmain.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\SysMain\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\sysmain.dll" Type="REG" Is64="0" X4="%systemroot%\system32\sysmain.dll" X3="Library" X2="SYSTEM\CurrentControlSet\Services\rdyboost\Performance" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\tbssvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\tbssvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-TBS" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\termsrv.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\termsrv.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-TerminalServices-RemoteConnectionManager" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\termsrv.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\termsrv.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\TermService" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\themeservice.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\themeservice.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\Themes\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\umpnpmgr.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\umpnpmgr.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\PlugPlay\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\umpnpmgr.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\umpnpmgr.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-UserPnp" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\umpo.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\umpo.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\Power\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\w32time.dll" Type="REG" Is64="0" X4="%systemroot%\system32\w32time.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\W32Time\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\w32time.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\w32time.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Time-Service" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\w32time.dll" Type="REG" Is64="0" X4="%Systemroot%\system32\w32time.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\W32Time" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\w32time.dll" Type="REG" Is64="0" X4="%systemroot%\system32\w32time.dll" X3="DllName" X2="SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\w32time.dll" Type="REG" Is64="0" X4="%systemroot%\system32\w32time.dll" X3="DllName" X2="SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\wbem\WMIsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\wbem\WMIsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\Winmgmt\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\wecsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\wecsvc.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\Wecsvc\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\wecsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\wecsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-EventCollector" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\wecsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\wecsvc.dll" X3="DisplayNameFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\HardwareEvents" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\wecsvc.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\wecsvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-EventCollector" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\winlogon.exe" Type="REG" Is64="0" X4="%SystemRoot%\system32\winlogon.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Winlogon" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\winsrv.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\winsrv.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-Winsrv" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\wlansvc.dll" Type="REG" Is64="0" X4="%windir%\system32\wlansvc.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-WLAN-AutoConfig" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\wpdbusenum.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\wpdbusenum.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\WPDBusEnum\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\wsepno.dll" Type="REG" Is64="0" X4="%SystemRoot%\system32\wsepno.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Windows Search Service Profile Notification" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\wuaueng.dll" Type="REG" Is64="0" X4="%systemroot%\system32\wuaueng.dll" X3="ServiceDll" X2="SYSTEM\CurrentControlSet\Services\wuauserv\Parameters" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="C:\Windows\system32\wuaueng.dll" Type="REG" Is64="0" X4="%systemroot%\system32\wuaueng.dll" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-WindowsUpdateClient" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="C:\d8deeb25cfc8bc7553\DW\DW20.exe" Type="REG" Is64="0" X4="C:\d8deeb25cfc8bc7553\DW\DW20.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\VSSetup" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="Maker\DVDMaker.exe" Type="REG" Is64="0" X4="%ProgramFiles%\DVD Maker\DVDMaker.exe" X3="EventMessageFile" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Dvd Maker" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="\SystemRoot\System32\win32k.sys" Type="REG" Is64="0" X4="\SystemRoot\System32\win32k.sys" X3="Kmode" X2="System\CurrentControlSet\Control\Session Manager\SubSystems" X1="HKEY_LOCAL_MACHINE" Enabled="-1"/>

<ITEM CheckResult="-1" File="auditcse.dll" Type="REG" Is64="1" X4="auditcse.dll" X3="DLLName" X2="Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{f3ccc681-b74c-4060-9f26-cd84525dca2a}" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

<ITEM CheckResult="-1" File="igfxdev.dll" Type="REG" Is64="1" X4="igfxdev.dll" X3="DLLName" X2="Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui" X1="HKEY_LOCAL_MACHINE" Enabled="1"/>

</AUTORUN>


-<BHO>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="" Enabled="1" CLSID="{0C4CC089-D306-440D-9772-464E226F6539}" RegKey="HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions" BHOType="3"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="" Enabled="1" CLSID="{2670000A-7350-4f3c-8081-5663EE0C6C49}" RegKey="HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions" BHOType="3"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="" Enabled="1" CLSID="{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}" RegKey="HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions" BHOType="3"/>

</BHO>


-<ExplorerExt>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="" Enabled="1" CLSID="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" RegKey="SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved" ExtName="WebCheck" ExtType="1"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="" Enabled="1" CLSID="{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" RegKey="SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved" ExtName="Shell Extension for Malware scanning" ExtType="1"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="" Enabled="1" CLSID="{F9DB5320-233E-11D1-9F84-707F02C10627}" RegKey="SOFTWARE\Classes\Folder\shellex\ColumnHandlers" ExtName="ColumnHandler" ExtType="2"/>

</ExplorerExt>


-<PrintEXT>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="hpinkstsa211LM.dll" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="hpinkstsCC11LM.dll" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="HPDiscoPMCC11.dll" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="localspl.dll" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="FXSMON.DLL" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="tcpmon.dll" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="usbmon.dll" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="WSDMon.dll" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="inetpp.dll" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Providers"/>

</PrintEXT>


-<TaskScheduler>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File=" aitagent " Enabled="251281536" FullCmd=" aitagent " SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Application Experience\" Status="16777215" JobName="AitAgent"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="aepdu.dll" Enabled="251281536" FullCmd=" %windir%\system32\rundll32.exe aepdu.dll,AePduRunUpdate -nolegacy" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Application Experience\" Status="16777215" JobName="Microsoft Compatibility Appraiser"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="appraiser.dll" Enabled="251281536" FullCmd=" %windir%\system32\rundll32.exe appraiser.dll,DoScheduledTelemetryRun" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Application Experience\" Status="16777215" JobName="Microsoft Compatibility Appraiser"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="aepdu.dll" Enabled="251281536" FullCmd=" %windir%\system32\rundll32.exe aepdu.dll,AePduRunUpdate" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Application Experience\" Status="16777215" JobName="ProgramDataUpdater"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="invagent.dll" Enabled="251281536" FullCmd=" %windir%\system32\rundll32.exe invagent.dll,RunUpdate -noappraiser" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Application Experience\" Status="16777215" JobName="ProgramDataUpdater"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="acproxy.dll" Enabled="251281536" FullCmd=" %windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Autochk\" Status="16777215" JobName="Proxy"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="dfdts.dll" Enabled="251281536" FullCmd=" %windir%\system32\rundll32.exe dfdts.dll,DfdGetDefaultPolicyAndSMART" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\DiskDiagnostic\" Status="16777215" JobName="Microsoft-Windows-DiskDiagnosticDataCollector"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="C:\Windows\ehome\mcupdate" Enabled="251281536" FullCmd=" %SystemRoot%\ehome\mcupdate $(Arg0)" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Media Center\" Status="16777215" JobName="mcupdate"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="C:\Windows\ehome\ehrec" Enabled="251281536" FullCmd=" %SystemRoot%\ehome\ehrec /RestartRecording" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Media Center\" Status="16777215" JobName="RecordingRestart"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="C:\Windows\ehome\ehrec" Enabled="251281536" FullCmd=" %SystemRoot%\ehome\ehrec /StartRecording" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Media Center\" Status="16777215" JobName="StartRecording"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="srrstr.dll" Enabled="251281536" FullCmd=" %windir%\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\SystemRestore\" Status="16777215" JobName="SR"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="bfe.dll" Enabled="251281536" FullCmd=" %windir%\system32\rundll32.exe bfe.dll,BfeOnServiceStartTypeChange" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Windows Filtering Platform\" Status="16777215" JobName="BfeOnServiceStartTypeChange"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="C:\Program Files (x86)\Windows Media Player\wmpnscfg.exe" Enabled="251281536" FullCmd=" "%ProgramFiles%\Windows Media Player\wmpnscfg.exe" " SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Windows Media Sharing\" Status="16777215" JobName="UpdateLibrary"/>

</TaskScheduler>


-<SPI>

<ITEM IsPE="1" Ver="6.1.7601.18685" OFN="nlaapi.dll" Product="Microsoft® Windows® Operating System" Vendor="Microsoft Corporation" MD5="FE48346938C1CDDDF4E4097DB9B99764" ChangeDate="06.12.2014 05:50:19" CreateDate="19.01.2015 12:35:21" Attr="rsAh" Size="52224" LegalCopyright="© Microsoft Corporation. All rights reserved." Descr="Network Location Awareness 2" CheckResult="-1" File="C:\Windows\system32\NLAapi.dll" IsDLL="1" SPINaim="@%SystemRoot%\system32\nlasvc.dll,-1000" SPIType="1"/>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="napinsp.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="0B7E85364CB878E2AD531DB7B601A9E5" ChangeDate="14.07.2009 03:16:02" CreateDate="14.07.2009 01:54:55" Attr="rsAh" Size="52224" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="E-Mail-Namenshimanbieter" CheckResult="-1" File="C:\Windows\system32\napinsp.dll" IsDLL="1" SPINaim="@%SystemRoot%\system32\napinsp.dll,-1000" SPIType="1"/>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="pnrpnsp.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="5CF640EDDB1E40A5AB1BB743BCDEC610" ChangeDate="14.07.2009 03:16:12" CreateDate="14.07.2009 01:55:50" Attr="rsAh" Size="65024" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="PNRP-Namespaceanbieter" CheckResult="-1" File="C:\Windows\system32\pnrpnsp.dll" IsDLL="1" SPINaim="@%SystemRoot%\system32\pnrpnsp.dll,-1000" SPIType="1"/>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="pnrpnsp.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="5CF640EDDB1E40A5AB1BB743BCDEC610" ChangeDate="14.07.2009 03:16:12" CreateDate="14.07.2009 01:55:50" Attr="rsAh" Size="65024" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="PNRP-Namespaceanbieter" CheckResult="-1" File="C:\Windows\system32\pnrpnsp.dll" IsDLL="1" SPINaim="@%SystemRoot%\system32\pnrpnsp.dll,-1001" SPIType="1"/>

<ITEM IsPE="1" Ver="6.1.7601.18254" OFN="mswsock.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="E94C583CDE2348950155F2AF2876F34D" ChangeDate="08.09.2013 04:03:58" CreateDate="13.05.2014 20:58:34" Attr="rsAh" Size="231424" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="Microsoft Windows Sockets 2.0-Dienstanbieter" CheckResult="-1" File="C:\Windows\System32\mswsock.dll" IsDLL="1" SPINaim="@%SystemRoot%\system32\wshtcpip.dll,-60103" SPIType="1"/>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="winrnr" Product="Microsoft® Windows® Operating System" Vendor="Microsoft Corporation" MD5="5DF5D8CFD9B9573FA3B2C89D9061A240" ChangeDate="14.07.2009 03:16:19" CreateDate="14.07.2009 01:37:57" Attr="rsAh" Size="20992" LegalCopyright="© Microsoft Corporation. All rights reserved." Descr="LDAP RnR Provider DLL" CheckResult="-1" File="C:\Windows\System32\winrnr.dll" IsDLL="1" SPINaim="NTDS" SPIType="1"/>

<ITEM IsPE="1" Ver="6.1.7601.18254" OFN="mswsock.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="E94C583CDE2348950155F2AF2876F34D" ChangeDate="08.09.2013 04:03:58" CreateDate="13.05.2014 20:58:34" Attr="rsAh" Size="231424" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="Microsoft Windows Sockets 2.0-Dienstanbieter" CheckResult="-1" File="C:\Windows\system32\mswsock.dll" IsDLL="1" SPINaim="@%SystemRoot%\System32\wshtcpip.dll,-60100" SPIType="3"/>

<ITEM IsPE="1" Ver="6.1.7601.18254" OFN="mswsock.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="E94C583CDE2348950155F2AF2876F34D" ChangeDate="08.09.2013 04:03:58" CreateDate="13.05.2014 20:58:34" Attr="rsAh" Size="231424" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="Microsoft Windows Sockets 2.0-Dienstanbieter" CheckResult="-1" File="C:\Windows\system32\mswsock.dll" IsDLL="1" SPINaim="@%SystemRoot%\System32\wshtcpip.dll,-60101" SPIType="3"/>

<ITEM IsPE="1" Ver="6.1.7601.18254" OFN="mswsock.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="E94C583CDE2348950155F2AF2876F34D" ChangeDate="08.09.2013 04:03:58" CreateDate="13.05.2014 20:58:34" Attr="rsAh" Size="231424" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="Microsoft Windows Sockets 2.0-Dienstanbieter" CheckResult="-1" File="C:\Windows\system32\mswsock.dll" IsDLL="1" SPINaim="@%SystemRoot%\System32\wshtcpip.dll,-60102" SPIType="3"/>

<ITEM IsPE="1" Ver="6.1.7601.18254" OFN="mswsock.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="E94C583CDE2348950155F2AF2876F34D" ChangeDate="08.09.2013 04:03:58" CreateDate="13.05.2014 20:58:34" Attr="rsAh" Size="231424" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="Microsoft Windows Sockets 2.0-Dienstanbieter" CheckResult="-1" File="C:\Windows\system32\mswsock.dll" IsDLL="1" SPINaim="@%SystemRoot%\System32\wship6.dll,-60100" SPIType="3"/>

<ITEM IsPE="1" Ver="6.1.7601.18254" OFN="mswsock.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="E94C583CDE2348950155F2AF2876F34D" ChangeDate="08.09.2013 04:03:58" CreateDate="13.05.2014 20:58:34" Attr="rsAh" Size="231424" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="Microsoft Windows Sockets 2.0-Dienstanbieter" CheckResult="-1" File="C:\Windows\system32\mswsock.dll" IsDLL="1" SPINaim="@%SystemRoot%\System32\wship6.dll,-60101" SPIType="3"/>

<ITEM IsPE="1" Ver="6.1.7601.18254" OFN="mswsock.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="E94C583CDE2348950155F2AF2876F34D" ChangeDate="08.09.2013 04:03:58" CreateDate="13.05.2014 20:58:34" Attr="rsAh" Size="231424" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="Microsoft Windows Sockets 2.0-Dienstanbieter" CheckResult="-1" File="C:\Windows\system32\mswsock.dll" IsDLL="1" SPINaim="@%SystemRoot%\System32\wship6.dll,-60102" SPIType="3"/>

<ITEM IsPE="1" Ver="6.1.7601.18254" OFN="mswsock.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="E94C583CDE2348950155F2AF2876F34D" ChangeDate="08.09.2013 04:03:58" CreateDate="13.05.2014 20:58:34" Attr="rsAh" Size="231424" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="Microsoft Windows Sockets 2.0-Dienstanbieter" CheckResult="-1" File="C:\Windows\system32\mswsock.dll" IsDLL="1" SPINaim="@%SystemRoot%\System32\wshqos.dll,-100" SPIType="3"/>

<ITEM IsPE="1" Ver="6.1.7601.18254" OFN="mswsock.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="E94C583CDE2348950155F2AF2876F34D" ChangeDate="08.09.2013 04:03:58" CreateDate="13.05.2014 20:58:34" Attr="rsAh" Size="231424" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="Microsoft Windows Sockets 2.0-Dienstanbieter" CheckResult="-1" File="C:\Windows\system32\mswsock.dll" IsDLL="1" SPINaim="@%SystemRoot%\System32\wshqos.dll,-101" SPIType="3"/>

<ITEM IsPE="1" Ver="6.1.7601.18254" OFN="mswsock.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="E94C583CDE2348950155F2AF2876F34D" ChangeDate="08.09.2013 04:03:58" CreateDate="13.05.2014 20:58:34" Attr="rsAh" Size="231424" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="Microsoft Windows Sockets 2.0-Dienstanbieter" CheckResult="-1" File="C:\Windows\system32\mswsock.dll" IsDLL="1" SPINaim="@%SystemRoot%\System32\wshqos.dll,-102" SPIType="3"/>

<ITEM IsPE="1" Ver="6.1.7601.18254" OFN="mswsock.dll.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="E94C583CDE2348950155F2AF2876F34D" ChangeDate="08.09.2013 04:03:58" CreateDate="13.05.2014 20:58:34" Attr="rsAh" Size="231424" LegalCopyright="© Microsoft Corporation. Alle Rechte vorbehalten." Descr="Microsoft Windows Sockets 2.0-Dienstanbieter" CheckResult="-1" File="C:\Windows\system32\mswsock.dll" IsDLL="1" SPINaim="@%SystemRoot%\System32\wshqos.dll,-103" SPIType="3"/>

</SPI>


-<PORTS>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="135" PortType="1"/>

<ITEM CheckResult="-1" File="System.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="139" PortType="1"/>

<ITEM CheckResult="-1" File="System.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="445" PortType="1"/>

<ITEM CheckResult="-1" File="wmpnetwk.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="554" PortType="1"/>

<ITEM IsPE="1" Ver="15.0.0.463" OFN="avp.exe" Product="Kaspersky Anti-Virus" Vendor="Kaspersky Lab ZAO" MD5="058734C95991F6BEBF3D3075B8776234" ChangeDate="20.04.2014 16:15:58" CreateDate="20.04.2014 16:15:58" Attr="rsAh" Size="233552" CheckResult="0" File="c:\program files (x86)\kaspersky lab\kaspersky internet security 15.0.0\avp.exe" RemoteHost="127.0.0.1" RemotePort="50165" LocalPort="1110" PortType="1"/>

<ITEM IsPE="1" Ver="15.0.0.463" OFN="avp.exe" Product="Kaspersky Anti-Virus" Vendor="Kaspersky Lab ZAO" MD5="058734C95991F6BEBF3D3075B8776234" ChangeDate="20.04.2014 16:15:58" CreateDate="20.04.2014 16:15:58" Attr="rsAh" Size="233552" CheckResult="0" File="c:\program files (x86)\kaspersky lab\kaspersky internet security 15.0.0\avp.exe" RemoteHost="127.0.0.1" RemotePort="50181" LocalPort="1110" PortType="1"/>

<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="50185" LocalPort="1110" PortType="1"/>

<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="50188" LocalPort="1110" PortType="1"/>

<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="50189" LocalPort="1110" PortType="1"/>

<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="50190" LocalPort="1110" PortType="1"/>

<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="50191" LocalPort="1110" PortType="1"/>

<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="50192" LocalPort="1110" PortType="1"/>

<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="50207" LocalPort="1110" PortType="1"/>

<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="50208" LocalPort="1110" PortType="1"/>

<ITEM IsPE="1" Ver="15.0.0.463" OFN="avp.exe" Product="Kaspersky Anti-Virus" Vendor="Kaspersky Lab ZAO" MD5="058734C95991F6BEBF3D3075B8776234" ChangeDate="20.04.2014 16:15:58" CreateDate="20.04.2014 16:15:58" Attr="rsAh" Size="233552" CheckResult="0" File="c:\program files (x86)\kaspersky lab\kaspersky internet security 15.0.0\avp.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="1110" PortType="1"/>

<ITEM IsPE="1" Ver="15.0.0.463" OFN="avp.exe" Product="Kaspersky Anti-Virus" Vendor="Kaspersky Lab ZAO" MD5="058734C95991F6BEBF3D3075B8776234" ChangeDate="20.04.2014 16:15:58" CreateDate="20.04.2014 16:15:58" Attr="rsAh" Size="233552" CheckResult="0" File="c:\program files (x86)\kaspersky lab\kaspersky internet security 15.0.0\avp.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="1111" PortType="1"/>

<ITEM CheckResult="-1" File="System.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="2869" PortType="1"/>

<ITEM CheckResult="-1" File="System.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="5357" PortType="1"/>

<ITEM CheckResult="-1" File="System.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="8092" PortType="1"/>

<ITEM CheckResult="-1" File="System.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="10243" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="17500" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="17600" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="17603" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49176" LocalPort="19872" PortType="1"/>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="WinInit.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="B5C5DCAD3899512020D135600129D665" ChangeDate="14.07.2009 03:14:45" CreateDate="14.07.2009 01:36:49" Attr="rsAh" Size="96256" CheckResult="0" File="wininit.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="49152" PortType="1"/>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="49153" PortType="1"/>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="49154" PortType="1"/>

<ITEM CheckResult="-1" File="spoolsv.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="49155" PortType="1"/>

<ITEM CheckResult="-1" File="services.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="49156" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49159" LocalPort="49158" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49158" LocalPort="49159" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49161" LocalPort="49160" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49160" LocalPort="49161" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="108.160.172.204" RemotePort="443" LocalPort="49164" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49166" LocalPort="49165" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49165" LocalPort="49166" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49168" LocalPort="49167" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49167" LocalPort="49168" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49170" LocalPort="49169" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49169" LocalPort="49170" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49172" LocalPort="49171" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49171" LocalPort="49172" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49174" LocalPort="49173" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49173" LocalPort="49174" PortType="1"/>

<ITEM CheckResult="-1" File="lsass.exe" RemoteHost="0.0.0.0" RemotePort="0" LocalPort="49175" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="19872" LocalPort="49176" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="54.230.14.23" RemotePort="443" LocalPort="49177" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="54.230.14.23" RemotePort="443" LocalPort="49178" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="54.230.14.23" RemotePort="443" LocalPort="49179" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="108.160.172.193" RemotePort="443" LocalPort="49180" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49195" LocalPort="49194" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="49194" LocalPort="49195" PortType="1"/>

<ITEM CheckResult="-1" File="HPNetworkCommunicatorCom.exe" RemoteHost="127.0.0.1" RemotePort="1110" LocalPort="50165" PortType="1"/>

<ITEM IsPE="1" Ver="15.0.0.463" OFN="avp.exe" Product="Kaspersky Anti-Virus" Vendor="Kaspersky Lab ZAO" MD5="058734C95991F6BEBF3D3075B8776234" ChangeDate="20.04.2014 16:15:58" CreateDate="20.04.2014 16:15:58" Attr="rsAh" Size="233552" CheckResult="0" File="c:\program files (x86)\kaspersky lab\kaspersky internet security 15.0.0\avp.exe" RemoteHost="192.168.1.116" RemotePort="8080" LocalPort="50166" PortType="1"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="127.0.0.1" RemotePort="1110" LocalPort="50181" PortType="1"/>

<ITEM IsPE="1" Ver="15.0.0.463" OFN="avp.exe" Product="Kaspersky Anti-Virus" Vendor="Kaspersky Lab ZAO" MD5="058734C95991F6BEBF3D3075B8776234" ChangeDate="20.04.2014 16:15:58" CreateDate="20.04.2014 16:15:58" Attr="rsAh" Size="233552" CheckResult="0" File="c:\program files (x86)\kaspersky lab\kaspersky internet security 15.0.0\avp.exe" RemoteHost="108.160.169.54" RemotePort="443" LocalPort="50182" PortType="1"/>

<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="1111" LocalPort="50252" PortType="1"/>

<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="1111" LocalPort="50253" PortType="1"/>

<ITEM CheckResult="-1" File="" RemoteHost="81.19.104.111" RemotePort="443" LocalPort="50254" PortType="1"/>

<ITEM CheckResult="-1" File="" RemoteHost="62.128.100.55" RemotePort="443" LocalPort="50255" PortType="1"/>

<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="1111" LocalPort="50256" PortType="1"/>

<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="1111" LocalPort="50257" PortType="1"/>

<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="1111" LocalPort="50258" PortType="1"/>

<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="1111" LocalPort="50259" PortType="1"/>

<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="1111" LocalPort="50260" PortType="1"/>

<ITEM CheckResult="-1" File="" RemoteHost="127.0.0.1" RemotePort="1111" LocalPort="50261" PortType="1"/>

<ITEM IsPE="1" Ver="15.0.0.463" OFN="avp.exe" Product="Kaspersky Anti-Virus" Vendor="Kaspersky Lab ZAO" MD5="058734C95991F6BEBF3D3075B8776234" ChangeDate="20.04.2014 16:15:58" CreateDate="20.04.2014 16:15:58" Attr="rsAh" Size="233552" CheckResult="0" File="c:\program files (x86)\kaspersky lab\kaspersky internet security 15.0.0\avp.exe" RemoteHost="81.19.104.111" RemotePort="443" LocalPort="50262" PortType="1"/>

<ITEM IsPE="1" Ver="15.0.0.463" OFN="avp.exe" Product="Kaspersky Anti-Virus" Vendor="Kaspersky Lab ZAO" MD5="058734C95991F6BEBF3D3075B8776234" ChangeDate="20.04.2014 16:15:58" CreateDate="20.04.2014 16:15:58" Attr="rsAh" Size="233552" CheckResult="0" File="c:\program files (x86)\kaspersky lab\kaspersky internet security 15.0.0\avp.exe" RemoteHost="23.51.251.27" RemotePort="80" LocalPort="50263" PortType="1"/>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="68" PortType="2"/>

<ITEM CheckResult="-1" File="System.exe" RemoteHost="" RemotePort="0" LocalPort="137" PortType="2"/>

<ITEM CheckResult="-1" File="System.exe" RemoteHost="" RemotePort="0" LocalPort="138" PortType="2"/>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="500" PortType="2"/>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="1900" PortType="2"/>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="1900" PortType="2"/>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="3702" PortType="2"/>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="3702" PortType="2"/>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="3702" PortType="2"/>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="3702" PortType="2"/>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="4500" PortType="2"/>

<ITEM CheckResult="-1" File="wmpnetwk.exe" RemoteHost="" RemotePort="0" LocalPort="5004" PortType="2"/>

<ITEM CheckResult="-1" File="wmpnetwk.exe" RemoteHost="" RemotePort="0" LocalPort="5005" PortType="2"/>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="5355" PortType="2"/>

<ITEM IsPE="1" Ver="3.8.5.0" OFN="Dropbox.exe" Product="Dropbox" Vendor="Dropbox, Inc." MD5="DC316D2F74E2109B8348991EC2F4F2D4" ChangeDate="24.07.2015 03:58:06" CreateDate="05.05.2015 05:08:32" Attr="rsAh" Size="39179912" CheckResult="0" File="c:\users\admin\appdata\roaming\dropbox\bin\dropbox.exe" RemoteHost="" RemotePort="0" LocalPort="17500" PortType="2"/>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="49153" PortType="2"/>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="49154" PortType="2"/>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="60619" PortType="2"/>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="60620" PortType="2"/>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="63466" PortType="2"/>

<ITEM IsPE="1" Ver="6.1.7600.16385" OFN="svchost.exe.mui" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="54A47F6B5E09A77E61649109C6A08866" ChangeDate="14.07.2009 03:14:41" CreateDate="14.07.2009 01:19:28" Attr="rsAh" Size="20992" CheckResult="0" File="svchost.exe" RemoteHost="" RemotePort="0" LocalPort="63544" PortType="2"/>

</PORTS>

<DPF> </DPF>


-<CPL>

<ITEM IsPE="1" Ver="17.0.0.134" OFN="FlashPlayerCPLApp.cpl" Product="Adobe Flash Player Control Panel Applet" Vendor="Adobe Systems Incorporated" MD5="D58D2CC2E405CF3A1D899C57AE15DB40" ChangeDate="11.04.2015 18:36:45" CreateDate="15.08.2014 22:15:14" Attr="rsAh" Size="142512" LegalCopyright="Copyright © 1996-2015 Adobe Systems Incorporated. All Rights Reserved. Adobe and Flash are either trademarks or registered trademarks in the United States and/or other countries." Descr="Adobe Flash Player Control Panel Applet" CheckResult="-1" File="C:\Windows\system32\FlashPlayerCPLApp.cpl" IsDLL="1" Enabled="1"/>

</CPL>


-<ActiveSetup>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="C:\Windows\System32\ie4uinit.exe" Enabled="1" CLSID="{7D715857-A67C-4C2F-A929-038448584D63}" RegKey="Software\Microsoft\Active Setup\Installed Components"/>

<ITEM LegalCopyright="" Descr="" CheckResult="-1" File="C:\Windows\System32\ie4uinit.exe" Enabled="1" CLSID="{89820200-ECBD-11cf-8B85-00AA005B4383}" RegKey="Software\Microsoft\Active Setup\Installed Components"/>

</ActiveSetup>

<HOSTS> </HOSTS>

<ProtocolExt> </ProtocolExt>


-<NET_SHARE>

<ITEM Name="ADMIN$" Connections="0" Path="C:\Windows"/>

<ITEM Name="C$" Connections="0" Path="C:\"/>

<ITEM Name="HP ENVY 5640 series" Connections="0" Path="HP ENVY 5640 series,LocalsplOnly"/>

<ITEM Name="HP ENVY 5640 series (Netzwerk)" Connections="0" Path="HP ENVY 5640 series (Netzwerk),LocalsplOnly"/>

<ITEM Name="IPC$" Connections="0" Path=""/>

<ITEM Name="print$" Connections="0" Path="C:\Windows\system32\spool\drivers"/>

<ITEM Name="Users" Connections="0" Path="C:\Users"/>

</NET_SHARE>


-<SuspFiles>

<ITEM IsPE="1" Ver="6.1.7601.17567" OFN="EXPLORER.EXE.MUI" Product="Betriebssystem Microsoft® Windows®" Vendor="Microsoft Corporation" MD5="8B88EBBB05A0E56B7DCC708498C02B3E" ChangeDate="25.02.2011 07:30:54" CreateDate="13.05.2014 21:57:47" Attr="rsAh" Size="2616320" Descr=" Heuristische Analyse des Betriebssystems: Verdacht auf Datei mit verd?chtigem Namen (hohe Wahrscheinlichkeitsrate)" File="C:\Windows\system32\explorer.exe" VirType="3"/>

<ITEM IsPE="1" Ver="6.1.7601.18869" OFN="User.exe" Product="Microsoft® Windows® Operating System" Vendor="Microsoft Corporation" MD5="EC6E5AE2ECFE7A335B370865A1158EF8" ChangeDate="25.05.2015 18:50:36" CreateDate="14.06.2015 12:11:44" Attr="rsAh" Size="2048" Descr=" Heuristische Analyse des Betriebssystems: Verdacht auf Datei mit verd?chtigem Namen (CH) (hohe Wahrscheinlichkeitsrate)" File="C:\Windows\system32\user.exe" VirType="3"/>

</SuspFiles>


-<IPU>

<ITEM X2="@%SystemRoot%\System32\termsrv.dll,-268" X1="TermService" Code="1"/>

<ITEM X2="@%systemroot%\system32\ssdpsrv.dll,-100" X1="SSDPSRV" Code="1"/>

<ITEM X2="@%SystemRoot%\system32\schedsvc.dll,-100" X1="Schedule" Code="1"/>

<ITEM Code="3"/>

<ITEM Code="5"/>

<ITEM X1="-1" Code="8"/>

</IPU>

</AVZ>
         

Alt 09.08.2015, 17:49   #10
Deathkid535
/// Malwareteam
 
Kaspersky 2015 meldet dauernd not-a-virus - Standard

Kaspersky 2015 meldet dauernd not-a-virus



Hi,

Schritt # 1: MBAM

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.



Schritt # 2: AdwCleaner

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


Schritt # 3: JRT

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.



Schritt # 4: FRST

Bitte noch ein FRST-Log erstellen.



Schritt # 5: Bitte Posten
  • Das Logfile von MBAM
  • Das Logfile von AdwCleaner
  • Das Logfile von JRT
  • Das Logfile von FRST

Alt 11.08.2015, 12:45   #11
Taymytt
 
Kaspersky 2015 meldet dauernd not-a-virus - Standard

Kaspersky 2015 meldet dauernd not-a-virus



Hallo Miteinander

Ich komme z.Z nicht dazu und bin ab heute an nem Open-Air

Ich poste die Resultate nächste Woche

Schöne Woche und danke das Ihr euch die Zeit nehmt

Alt 11.08.2015, 13:10   #12
Deathkid535
/// Malwareteam
 
Kaspersky 2015 meldet dauernd not-a-virus - Standard

Kaspersky 2015 meldet dauernd not-a-virus



No Problemo

Alt 17.08.2015, 12:44   #13
Taymytt
 
Kaspersky 2015 meldet dauernd not-a-virus - Standard

Kaspersky 2015 meldet dauernd not-a-virus



Hallöölle

Mbam Teil 1

Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlaufdatum: 17.08.2015
Suchlaufzeit: 13:16
Protokolldatei: mbam.txt
Administrator: Ja

Version: 2.1.8.1057
Malware-Datenbank: v2015.08.17.05
Rootkit-Datenbank: v2015.08.16.01
Lizenz: Kostenlose Version
Malware-Schutz: Deaktiviert
Schutz vor bösartigen Websites: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: admin

Suchlauftyp: Bedrohungssuchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 349975
Abgelaufene Zeit: 5 Min., 26 Sek.

Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(keine bösartigen Elemente erkannt)

Module: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 33
PUP.Optional.SearchProtect.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}, In Quarantäne, [2fba2adf98f30432ca282275818134cc], 
PUP.Optional.Lasaoren.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, In Quarantäne, [3dace425a2e967cfb3b91a84ed17c23e], 
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [e00931d80c7f88aeb12b48d561a25da3], 
PUP.Optional.Delta.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\delta-homesSoftware, In Quarantäne, [93565aafc9c2f93d2cb8261f24df59a7], 
PUP.Optional.ExpressFind.A, HKLM\SOFTWARE\WOW6432NODE\ExpressFind, In Quarantäne, [b4353acf216a23133e05ef33a65d9868], 
PUP.Optional.FFPluginHp.A, HKLM\SOFTWARE\WOW6432NODE\FFPluginHp, In Quarantäne, [ab3e4bbed3b84ee8533e9c82b74c2cd4], 
PUP.Optional.IHProtect.A, HKLM\SOFTWARE\WOW6432NODE\IHProtect, In Quarantäne, [6881ea1f28631b1b669a0f208e754fb1], 
PUP.Optional.Picexa.A, HKLM\SOFTWARE\WOW6432NODE\Picexa, In Quarantäne, [c029c9403c4fea4c8e539313e91bdd23], 
PUP.Optional.Picexa.A, HKLM\SOFTWARE\WOW6432NODE\PicexaSvc, In Quarantäne, [ebfed83195f61b1bb32ffda951b3fb05], 
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\webssearchesSoftware, In Quarantäne, [cc1dda2fdab10f27052e60fb8e756d93], 
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [3dac61a84c3f2f0719c3809d5da6ce32], 
PUP.Optional.Iminent.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IMBoosterARP, In Quarantäne, [2abf64a57b104cea975930f87c87ae52], 
PUP.Optional.Iminent.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IminentToolbar, In Quarantäne, [e0090dfc2863ac8ae906cf590ff42ed2], 
PUP.Optional.Vosteran, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Vosteran.com, In Quarantäne, [2ebbe7227b1089ad4c0dde5843c003fd], 
PUP.Optional.Wajam.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WajIntEnhance, In Quarantäne, [569312f7c9c200360de1fe2a649fa65a], 
PUP.Optional.MiuiTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPDP, In Quarantäne, [fbee59b092f9181ee623b8f741c3f30d], 
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB, In Quarantäne, [0bde52b77a1176c06359c879ab587c84], 
PUP.Optional.WindowsMangerProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\WindowsMangerProtect, In Quarantäne, [a5440efbcdbedf5727713dfb06fdfa06], 
PUP.Optional.Gameo.C, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\Gameo, In Quarantäne, [d712d23796f582b4d023bd61c73c8b75], 
PUP.Optional.InstallCore.C, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\InstallCore, In Quarantäne, [f8f17396d0bbc6705b6a4069ab598b75], 
PUP.Optional.TNT.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\TNT2, In Quarantäne, [edfc3ccdf09b06302a6af931f60d718f], 
PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, In Quarantäne, [d31641c81f6c87af0785de437192ac54], 
PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}, In Quarantäne, [e108f3166724092dbfcd051c659ed030], 
PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [ecfdf3160b8068ce206cde43b1522ed2], 
PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{A25AC313-DD19-4238-ACA2-401D6BEE4321}, In Quarantäne, [ebfe0009fc8f7fb7206cca57bc473ec2], 
PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{E733165D-CBCF-4FDA-883E-ADEF965B476C}, In Quarantäne, [5b8e15f4aae164d2fe8e3be69172d030], 
PUP.Optional.Iminent.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IMBoosterARP, In Quarantäne, [e2077891bad1a393eeaf59cc2ad90ff1], 
PUP.Optional.Iminent.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IminentToolbar, In Quarantäne, [42a738d175167eb86638ce57f01314ec], 
PUP.Optional.Linkey.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Linkey, In Quarantäne, [4e9b7b8efe8d4aec5847c95cb053fb05], 
PUP.Optional.SearchProtect.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\SearchProtect, In Quarantäne, [eefbd2374d3ee155eeb2643e659f8878], 
PUP.Optional.Vosteran.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Vosteran.com, In Quarantäne, [de0b21e8e0ab0e288f119b8a5ea508f8], 
PUP.Optional.Wajam.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WajIntEnhance, In Quarantäne, [12d768a12863ae88fba6cb5a3cc709f7], 
PUP.Optional.IStart.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MOZILLA\EXTENDS, In Quarantäne, [5594a4655f2ccd6969ae9a8c16ed51af], 

Registrierungswerte: 28
PUP.Optional.Lasaoren.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|URL, hxxp://Lasaoren.com/results.php?f=4&q={searchTerms}&a=lrn_secureddownload_14_45_ff&cd=2XzuyEtN2Y1L1QzuzzyEtA0AyE0BtDtBzy0E0B0DtCtByD0DtN0D0Tzu0StCtDyEyEtN1L2XzutAtFyCtFtCtFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyB0AyDtCyDtByD0AtGyBzy0C0AtGtDzyyByDtGtAyC0ByCtGtDyD0B0DtB0CyBzz0AyC0C0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0DyEtAtAtAyB0AtDtG0AyE0EyCtGyE0EyD0CtGzz0DyD0BtGtAyDyEtD0CzytByDyD0D0E0C2Q&cr=814032143&ir=, In Quarantäne, [3dace425a2e967cfb3b91a84ed17c23e]
PUP.Optional.Lasaoren.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|TopResultURLFallback, hxxp://Lasaoren.com/results.php?f=4&q={searchTerms}&a=lrn_secureddownload_14_45_ff&cd=2XzuyEtN2Y1L1QzuzzyEtA0AyE0BtDtBzy0E0B0DtCtByD0DtN0D0Tzu0StCtDyEyEtN1L2XzutAtFyCtFtCtFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyB0AyDtCyDtByD0AtGyBzy0C0AtGtDzyyByDtGtAyC0ByCtGtDyD0B0DtB0CyBzz0AyC0C0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0DyEtAtAtAyB0AtDtG0AyE0EyCtGyE0EyD0CtGzz0DyD0BtGtAyDyEtD0CzytByDyD0D0E0C2Q&cr=814032143&ir=, In Quarantäne, [c52450b9cac158de4c207d2127dd38c8]
PUP.Optional.Lasaoren.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|FaviconPath, C:\Program Files (x86)\WSE_Lasaoren\\FavIcon.ico, In Quarantäne, [a64361a8296295a19fcd3f5fbe466e92]
PUP.Optional.Lasaoren.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}, Lasaoren, In Quarantäne, [e4053ecb6e1d72c44824c4da36cec739]
PUP.Optional.Lasaoren.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|DisplayName, Lasaoren, In Quarantäne, [e009b9505e2d171f3c30742acb39b749]
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|URL, hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}, In Quarantäne, [e00931d80c7f88aeb12b48d561a25da3]
PUP.Optional.Lasaoren.C, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY|AppPath, C:\Program Files (x86)\WSE_Lasaoren\\, In Quarantäne, [b732df2a701bf83ea48a53cc39ca639d]
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|URL, hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}, In Quarantäne, [3dac61a84c3f2f0719c3809d5da6ce32]
PUP.Optional.FastStart.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|faststartff@gmail.com, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com, In Quarantäne, [3aaf31d805861a1c82b0a2ef4bb9da26]
PUP.Optional.SearchEngine.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|searchengine@gmail.com, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\searchengine@gmail.com, In Quarantäne, [8465b356cdbeb680d43ff3a99f6518e8]
PUP.Optional.IStart.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|istart_ffnt@gmail.com, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\istart_ffnt@gmail.com, In Quarantäne, [bb2e27e22d5e0b2bd3b2012460a3bb45]
PUP.Optional.SweetSearch.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|sweetsearch@gmail.com, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com, In Quarantäne, [a44534d594f7f442e49b41de7e85f50b]
PUP.Optional.MiuiTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPDP|dir, C:\Program Files (x86)\MiuiTab, In Quarantäne, [fbee59b092f9181ee623b8f741c3f30d]
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB|ptid, wpm040732, In Quarantäne, [0bde52b77a1176c06359c879ab587c84]
PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}|URL, hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}, In Quarantäne, [a84167a2c1ca3ef86626c1607a89bf41]
PUP.Optional.Conduit.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}|SuggestionsURL_JSON, hxxp://suggest.seccint.com/CSuggestJson.ashx?prefix={searchTerms}, In Quarantäne, [6c7de22723685cdaaa308a960ff435cb]
PUP.Optional.Trovi.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}|DisplayName, Trovi search, In Quarantäne, [5d8cb455bfccd561d9c2dfbfc34139c7]
PUP.Optional.Trovi.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}|TopResultURL, hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3322197&octid=EB_ORIGINAL_CTID&ISID=MD80C5FFC-C33E-47D9-AC4C-6548469089DB&SearchSource=58&CUI=&UM=6&UP=SP2E003C0D-CC8E-4543-BB51-AED908D7F6BE&q={searchTerms}&SSPV=, In Quarantäne, [b4350ffac0cb77bfc0db247ab054af51]
PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|URL, hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}, In Quarantäne, [d31641c81f6c87af0785de437192ac54]
PUP.Optional.Lasaoren.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|TopResultURLFallback, hxxp://Lasaoren.com/results.php?f=4&q={searchTerms}&a=lrn_secureddownload_14_45_ff&cd=2XzuyEtN2Y1L1QzuzzyEtA0AyE0BtDtBzy0E0B0DtCtByD0DtN0D0Tzu0StCtDyEyEtN1L2XzutAtFyCtFtCtFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyB0AyDtCyDtByD0AtGyBzy0C0AtGtDzyyByDtGtAyC0ByCtGtDyD0B0DtB0CyBzz0AyC0C0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0DyEtAtAtAyB0AtDtG0AyE0EyCtGyE0EyD0CtGzz0DyD0BtGtAyDyEtD0CzytByDyD0D0E0C2Q&cr=814032143&ir=, In Quarantäne, [2dbc010858338aac18532d71f50ffe02]
PUP.Optional.Lasaoren.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}, Lasaoren, In Quarantäne, [2dbccc3d355685b1ef7c158906fea759]
PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}|URL, hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}, In Quarantäne, [e108f3166724092dbfcd051c659ed030]
PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}|FaviconURL, hxxp://www.delta-homes.com//favicon.ico, In Quarantäne, [16d34cbdfb90fa3c0f7d948d25de718f]
PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|URL, hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}, In Quarantäne, [ecfdf3160b8068ce206cde43b1522ed2]
PUP.Optional.WebsSearches.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|TopResultURL, hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}, In Quarantäne, [3eab2ddca3e8bf7715c6e33a758e0ff1]
PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{A25AC313-DD19-4238-ACA2-401D6BEE4321}|URL, hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}, In Quarantäne, [ebfe0009fc8f7fb7206cca57bc473ec2]
PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{E733165D-CBCF-4FDA-883E-ADEF965B476C}|URL, hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040732&utm_campaign=install_ie&utm_content=ds&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&ts=1428428814&type=default&q={searchTerms}, In Quarantäne, [5b8e15f4aae164d2fe8e3be69172d030]
PUP.Optional.IStart.A, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MOZILLA\EXTENDS|appid, istart_ffnt@gmail.com, In Quarantäne, [5594a4655f2ccd6969ae9a8c16ed51af]

Registrierungsdaten: 14
PUP.Optional.WebsSearches, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}),Ersetzt,[6188ef1aa1ea40f66812f94ec441cd33]
PUP.Optional.Delta.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249, Gut: (www.google.com), Schlecht: (hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249),Ersetzt,[b4350cfd98f3e2543825c68de91c6c94]
PUP.Optional.Delta.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249, Gut: (www.google.com), Schlecht: (hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249),Ersetzt,[6d7ca6639dee38feed700d46c73e758b]
PUP.Optional.WebsSearches, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}),Ersetzt,[05e4b257f992ee48502a15323dc82cd4]
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[16d3dd2ce2a93ff7edbd7ad853b240c0]
PUP.Optional.WebsSearches, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}),Ersetzt,[6386db2e06857eb897e3fe49ff06ce32]
PUP.Optional.Delta.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249, Gut: (www.google.com), Schlecht: (hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249),Ersetzt,[10d937d23853d363b7a67ed5986d2ed2]
PUP.Optional.Delta.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249, Gut: (www.google.com), Schlecht: (hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249),Ersetzt,[68814dbc9af1fc3a1d408bc8050060a0]
PUP.Optional.WebsSearches, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=ds&ts=1417814114&from=cvs&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249&q={searchTerms}),Ersetzt,[9c4da564fe8d84b229518dbaea1b4fb1]
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[2fbaed1c315aab8be9c1bf93a85ddd23]
PUP.Optional.WebsSearches, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://istart.webssearches.com/web/?type=dspp&ts=1417814128&from=cvs&uid=MTFDDAK256MAM&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=dspp&ts=1417814128&from=cvs&uid=MTFDDAK256MAM&q={searchTerms}),Ersetzt,[757458b1f8934ee8fd7ee364ef16758b]
PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249, Gut: (www.google.com), Schlecht: (hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249),Ersetzt,[5198c9401e6dbc7a8fcfb89bfd084bb5]
PUP.Optional.Delta.ShrtCln, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249, Gut: (www.google.com), Schlecht: (hxxp://www.delta-homes.com/?type=hp&ts=1428427638&from=wpm040732&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249),Ersetzt,[3eabf9100685979f3f1fc093a95c13ed]
PUP.Optional.WebsSearches, HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://istart.webssearches.com/web/?type=dspp&ts=1417814128&from=cvs&uid=MTFDDAK256MAM&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=dspp&ts=1417814128&from=cvs&uid=MTFDDAK256MAM&q={searchTerms}),Ersetzt,[6386b554e2a97bbb3c3f71d6db2a6e92]

Ordner: 135
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\index-dir, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\databases, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\IndexedDB, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Local Storage, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Picexa.A, C:\Users\admin\AppData\Roaming\Picexa Viewer\log, In Quarantäne, [5594af5a612a60d624b963436e9620e0], 
PUP.Optional.Picexa.A, C:\Users\admin\AppData\Roaming\Picexa Viewer, In Quarantäne, [5594af5a612a60d624b963436e9620e0], 
PUP.Optional.Picexa.A, C:\Users\admin\AppData\Roaming\Picexa Viewer\update, In Quarantäne, [5594af5a612a60d624b963436e9620e0], 
PUP.Optional.Picexa.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picexa, In Quarantäne, [569335d45f2c3ef85c84efb7ab590bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\include, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\include\tools, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\lib, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\module, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\pack, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\en, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\en-US, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\es, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\es-419, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\fr, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\fr-BE, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\fr-CA, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\fr-CH, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\fr-LU, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\it, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\it-CH, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\pl, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\pt-BR, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\ru, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\ru-MO, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\tr, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\vi, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\zh-CN, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\zh-TW, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\skin, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\defaults, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\defaults\preferences, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\modules, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect, In Quarantäne, [8b5eda2f602bf5410f2efbfbb250718f], 
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update, In Quarantäne, [8b5eda2f602bf5410f2efbfbb250718f], 
PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate, In Quarantäne, [9455c4457813cb6b66ca7e8c1fe41fe1], 
PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate\update, In Quarantäne, [9455c4457813cb6b66ca7e8c1fe41fe1], 
PUP.Optional.SearchEngine.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\searchengine@gmail.com, In Quarantäne, [559478911c6fe84e48622ce13cc715eb], 
PUP.Optional.SearchEngine.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\searchengine@gmail.com\chrome, In Quarantäne, [559478911c6fe84e48622ce13cc715eb], 
PUP.Optional.SearchEngine.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\searchengine@gmail.com\chrome\content, In Quarantäne, [559478911c6fe84e48622ce13cc715eb], 
PUP.Optional.SearchEngine.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\searchengine@gmail.com\chrome\skin, In Quarantäne, [559478911c6fe84e48622ce13cc715eb], 
PUP.Optional.ExpressFind.A, C:\ProgramData\77790361-426c-4fa2-8cf3-5994543d685d, In Quarantäne, [b237bf4ac5c6b77f00060f01aa59916f], 
PUP.Optional.ExpressFind.A, C:\ProgramData\77790361-426c-4fa2-8cf3-5994543d685d\plugincontainer, In Quarantäne, [b237bf4ac5c6b77f00060f01aa59916f], 
PUP.Optional.ExpressFind.A, C:\ProgramData\77790361-426c-4fa2-8cf3-5994543d685d\plugins, In Quarantäne, [b237bf4ac5c6b77f00060f01aa59916f], 
PUP.Optional.ExpressFind.A, C:\ProgramData\77790361-426c-4fa2-8cf3-5994543d685d\plugins\3, In Quarantäne, [b237bf4ac5c6b77f00060f01aa59916f], 
PUP.Optional.ExpressFind.A, C:\ProgramData\77790361-426c-4fa2-8cf3-5994543d685d\plugins\3bak, In Quarantäne, [b237bf4ac5c6b77f00060f01aa59916f], 
PUP.Optional.ExpressFind.A, C:\ProgramData\77790361-426c-4fa2-8cf3-5994543d685d\plugins\5, In Quarantäne, [b237bf4ac5c6b77f00060f01aa59916f], 
PUP.Optional.ExpressFind.A, C:\ProgramData\77790361-426c-4fa2-8cf3-5994543d685d\plugins\5bak, In Quarantäne, [b237bf4ac5c6b77f00060f01aa59916f], 
PUP.Optional.ExpressFind.A, C:\ProgramData\77790361-426c-4fa2-8cf3-5994543d685d\plugins\8, In Quarantäne, [b237bf4ac5c6b77f00060f01aa59916f], 
PUP.Optional.ExpressFind.A, C:\ProgramData\77790361-426c-4fa2-8cf3-5994543d685d\plugins\8bak, In Quarantäne, [b237bf4ac5c6b77f00060f01aa59916f], 
PUP.Optional.ExpressFind.A, C:\Program Files (x86)\Common Files\77790361-426c-4fa2-8cf3-5994543d685d, In Quarantäne, [8762ff0acac1b086907730e0ce356898], 
PUP.Optional.ExpressFind.A, C:\Program Files (x86)\Common Files\77790361-426c-4fa2-8cf3-5994543d685d\updater, In Quarantäne, [8762ff0acac1b086907730e0ce356898], 
PUP.Optional.ExpressFind.A, C:\Program Files (x86)\Express Find, In Quarantäne, [12d71dec177485b1061154bc818201ff], 
PUP.Optional.ExpressFind.A, C:\Program Files (x86)\Express Find\Extensions, In Quarantäne, [12d71dec177485b1061154bc818201ff], 
PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7], 
PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com\chrome, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7], 
PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com\chrome\content, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7], 
PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com\chrome\skin, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7], 
PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com\modules, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\include, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\include\tools, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\lib, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\module, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\pack, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\en, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\en-US, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\es, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\es-419, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\fr, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\fr-BE, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\fr-CA, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\fr-CH, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\fr-LU, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\it, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\it-CH, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\pl, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\pt-BR, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\ru, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\ru-MO, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\tr, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\vi, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\zh-CN, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\zh-TW, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\skin, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\defaults, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\defaults\preferences, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\modules, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.SweetSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com, In Quarantäne, [5198df2a8a01e650671b58b9dc27b848], 
PUP.Optional.SweetSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com\chrome, In Quarantäne, [5198df2a8a01e650671b58b9dc27b848], 
PUP.Optional.SweetSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com\chrome\content, In Quarantäne, [5198df2a8a01e650671b58b9dc27b848], 
PUP.Optional.SweetSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com\chrome\skin, In Quarantäne, [5198df2a8a01e650671b58b9dc27b848], 
PUP.Optional.WebExtend.A, C:\Users\admin\AppData\Roaming\WebExtend, In Quarantäne, [1fca8c7de3a86fc74bd6120008fbbb45], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\image, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\img, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\en-US, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\es-419, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\es-ES, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-BE, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-CA, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-CH, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-FR, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-LU, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\it-CH, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\it-IT, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\pl, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\pt, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\pt-BR, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\ru, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\ru-MO, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\tr-TR, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\vi-VI, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\zh-CN, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\zh-TW, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.SupTab.A, C:\Users\admin\SupTab, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af],
         
Mbam Teil 2

Code:
ATTFilter
Dateien: 362
PUP.Optional.DownloadGuide, C:\Users\admin\Downloads\PhotoScape_V3.6.5.exe, In Quarantäne, [8f5ae3269dee8ea8e449f262f110c63a], 
PUP.Optional.InstallCore, C:\Users\admin\Downloads\picasa_setup.exe, In Quarantäne, [61881fea404bfb3bec5e8afc8c7905fb], 
PUP.Optional.DownloadGuide, C:\Users\admin\Downloads\PhotoScape_V3.6.5(1).exe, In Quarantäne, [a44517f2a8e3cc6a909df46012efcc34], 
PUP.Optional.DownloadGuide.A, C:\Users\admin\Downloads\Dropbox_2.10.40_CB-DL-Manager.exe, In Quarantäne, [50992bde464540f6847bd3d605fc837d], 
PUP.Optional.Lasaoren.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\searchplugins\Lasaoren.xml, In Quarantäne, [d81125e49cefab8bb677aa93699a659b], 
PUP.Optional.Delta.ShrtCln, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\searchplugins\delta-homes.xml, In Quarantäne, [34b5d5342f5cd2644d2b0e3fce351be5], 
PUP.Optional.WebsSearches.A, C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\webssearches.xml, In Quarantäne, [f0f940c91477eb4bca6ae675b350b050], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\QuotaManager-journal, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\cookies, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\cookies-journal, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\QuotaManager, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\website.ico, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\05ff7aa027ded9b9_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\06103210ae5eb92b_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\0898a7127ee82f8f_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\0965e8217a127c2c_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\1041015f9233625e_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\10d56a2bfd90d48a_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\133ad3275ce900a2_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\19d84e595d8acdd8_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\1dafb2ed7113577d_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\95ddd53adf512dbc_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\97b38689ccb7555d_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\97c34b7c9179ae2c_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\9873f2673c3d8526_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\994a5eb4097b9a48_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\9a892590ca2fc6be_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\9ae29e3aa2842aa4_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\9b2d4542638c8d16_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\9b4012bd1d2d1072_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\9b82ccf4af53b6a8_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\5f75a92bd2957b35_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\5ff63e69bbe8fa3c_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\63d4ee9a9d42bc8c_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\654f0e1ca4374c53_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\67b8233399ef3c0a_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\6a46777b47d8863e_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\724344affef6866f_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\73094d84fde79b10_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\75857d5ed588a153_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\d95d79cbff1d0c73_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\d9ba3aa2fec10a15_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\de3ec9ddc2b44a14_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\de8e43b7133518e3_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\e0ea107913adae0a_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\e5037607f77dc331_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\e685b2ebc644ef56_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\e8f138151634cdee_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\e96840897e658496_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\ea34829245485817_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\ecfb11388b7aa485_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\edb699e63c7ce924_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\ee368c55bdf4deb0_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\f28780c6599b94f9_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\f2d573680310966b_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\f764108990553099_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\index, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\36201cb039264766_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\38628010c0fdbeaf_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\4269bab2f2409c5f_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\47cff2ba15008159_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\47e8420271c119db_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\4b62fe917181ed62_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\4c7b043df68ee6e0_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\4fc1d6c2f5c967dd_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\5065f3c1667cc082_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\53967fa8ca013df7_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\53d404518cfdeeee_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\59f8199c46c0ac72_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\c05916caaca1a201_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\c302cd6a980ea412_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\c89f38f36e14b01c_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\c97e1c023a3691fd_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\caa7243563bf80ae_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\cac3335e62156f19_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\cbc9138bfd5a95d8_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\cc73100810e7a377_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\ce6fbf4de7522baf_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\d17464ed1518ad1d_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\d3c58d3a88f5618a_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\34c65f273f242ede_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\5b61b13f31538e6d_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\76dddbb58cb7031b_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\94bef38ab05056c4_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\9c7627e2abfdccd9_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\bdfbf69242bfe131_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\d70ff74b0debd45f_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\7c000d76bf1f0157_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\7cc07ed3c66ea2df_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\803985260cc54636_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\83b903905e8ed28c_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\86285c0e2a5ab7a8_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\8a2abd4eed83e9d6_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\8dff389a62f2bd7d_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\931588a85f8c2743_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\94615c9a6099d7d2_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\20d08ebe23d790a4_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\294ff6649b79679e_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\2d616aaad663dffd_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\2e7742d72fca4eb8_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\2e7b1d54211b33d1_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\2ed7a48cdf691d09_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\305fcbb0ccbceb0d_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\314b1462e990072c_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\315a39b606bc4359_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\327e2f346370c855_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\a2dfb1d022eadb33_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\a502325b53a0ae16_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\a67a7318862561a7_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\a682a844981d4e40_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\a8d39bd6a3465001_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\a90f0297d5bfc8b2_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\ad16b48903615445_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\aeb7ec1701dd5ba5_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\aec9c1de677d8508_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\b129387bb9742eda_0, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Cache\index-dir\the-real-index, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\databases\Databases.db, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\databases\Databases.db-journal, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\000005.bak, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\000005.ldb, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\000006.log, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\CURRENT, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\LOCK, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\LOG, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\LOG.old, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\MANIFEST-000004, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Local Storage\file__0.localstorage, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Gameo.A, C:\Users\admin\AppData\Local\Gameo\Local Storage\file__0.localstorage-journal, In Quarantäne, [ce1b9f6a1d6e9c9ab84ecbc458ac9d63], 
PUP.Optional.Picexa.A, C:\Users\admin\AppData\Roaming\Picexa Viewer\log\install.log, In Quarantäne, [5594af5a612a60d624b963436e9620e0], 
PUP.Optional.Picexa.A, C:\Users\admin\AppData\Roaming\Picexa Viewer\log\uninstall.log, In Quarantäne, [5594af5a612a60d624b963436e9620e0], 
PUP.Optional.Picexa.A, C:\Users\admin\AppData\Roaming\Picexa Viewer\log\upgrade.log, In Quarantäne, [5594af5a612a60d624b963436e9620e0], 
PUP.Optional.Picexa.A, C:\Users\admin\AppData\Roaming\Picexa Viewer\update\px_update_v2.1.21.exe, In Quarantäne, [5594af5a612a60d624b963436e9620e0], 
PUP.Optional.Picexa.A, C:\Users\admin\AppData\Roaming\Picexa Viewer\update\px_update_v2.1.24.exe, In Quarantäne, [5594af5a612a60d624b963436e9620e0], 
PUP.Optional.Picexa.A, C:\Users\admin\AppData\Roaming\Picexa Viewer\update\px_update_v2.1.42.exe, In Quarantäne, [5594af5a612a60d624b963436e9620e0], 
PUP.Optional.Picexa.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picexa\Picexa.lnk, In Quarantäne, [569335d45f2c3ef85c84efb7ab590bf5], 
PUP.Optional.Picexa.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picexa\uninstall.lnk, In Quarantäne, [569335d45f2c3ef85c84efb7ab590bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome.manifest, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\install.rdf, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\index.html, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\quick_start.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\quick_start.xul, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\include\speed_dial.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\include\tools\about_blank_hook.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\include\tools\misc.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\include\tools\popup_image_helper.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\include\tools\urlrequestor.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\js.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\lib\doT.min.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\lib\jquery-2.1.0.min.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\lib\jquery.autocomplete.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\module\hotSearch.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\module\mostgrid.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\module\search.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\module\stat.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\pack\common.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\pack\ga.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\content\js\pack\xagainit.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\en\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\en-US\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\es\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\es-419\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\fr\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\fr-BE\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\fr-CA\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\fr-CH\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\fr-LU\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\it\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\it-CH\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\pl\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\pt-BR\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\ru\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\ru-MO\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\tr\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\vi\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\zh-CN\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\locale\zh-TW\locale.properties, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\skin\default_logo.png, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\skin\googlelogo.png, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\skin\google_trends.png, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\skin\icon.png, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\skin\loading.gif, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\skin\logo.png, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\skin\newtab.ico, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\skin\simple.css, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\chrome\skin\style.css, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\defaults\preferences\fvd.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\defaults\preferences\preferences.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\modules\addonmanager.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\modules\aes.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\modules\config.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\modules\dialogs.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\modules\last_tab.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\modules\misc.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\modules\properties.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\modules\remoterequest.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\modules\restoreprefs.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\faststartff@gmail.com\modules\settings.js, In Quarantäne, [f5f49b6ef497c274f654d81dfd050bf5], 
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update\conf, In Quarantäne, [8b5eda2f602bf5410f2efbfbb250718f], 
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update\update.exe, In Quarantäne, [8b5eda2f602bf5410f2efbfbb250718f], 
PUP.Optional.SearchEngine.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\searchengine@gmail.com\chrome.manifest, In Quarantäne, [559478911c6fe84e48622ce13cc715eb], 
PUP.Optional.SearchEngine.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\searchengine@gmail.com\install.rdf, In Quarantäne, [559478911c6fe84e48622ce13cc715eb], 
PUP.Optional.SearchEngine.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\searchengine@gmail.com\chrome\content\toolbar.js, In Quarantäne, [559478911c6fe84e48622ce13cc715eb], 
PUP.Optional.SearchEngine.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\searchengine@gmail.com\chrome\content\toolbar.xul, In Quarantäne, [559478911c6fe84e48622ce13cc715eb], 
PUP.Optional.SearchEngine.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\searchengine@gmail.com\chrome\skin\icon.png, In Quarantäne, [559478911c6fe84e48622ce13cc715eb], 
PUP.Optional.ExpressFind.A, C:\ProgramData\77790361-426c-4fa2-8cf3-5994543d685d\temp, In Quarantäne, [b237bf4ac5c6b77f00060f01aa59916f], 
PUP.Optional.ExpressFind.A, C:\Program Files (x86)\Express Find\7za.exe, In Quarantäne, [12d71dec177485b1061154bc818201ff], 
PUP.Optional.ExpressFind.A, C:\Program Files (x86)\Express Find\Extensions\{7ab3cbb3-34f1-440b-b048-404cfae819c0}.xpi, In Quarantäne, [12d71dec177485b1061154bc818201ff], 
PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com\chrome.manifest, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7], 
PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com\install.rdf, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7], 
PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com\chrome\content\main.js, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7], 
PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com\chrome\content\main.xul, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7], 
PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com\chrome\content\vgValidator.js, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7], 
PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com\chrome\skin\icon.png, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7], 
PUP.Optional.VeggyAddon.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com\modules\XCipher.js, In Quarantäne, [8e5b8386721967cfbbeab65abf4439c7], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome.manifest, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\install.rdf, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\awesome.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\awesome.xul, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\index.html, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\quick_start.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\quick_start.xul, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\include\speed_dial.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\include\tools\about_blank_hook.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\include\tools\misc.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\include\tools\popup_image_helper.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\include\tools\urlrequestor.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\js.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\lib\doT.min.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\lib\jquery-2.1.0.min.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\lib\jquery.autocomplete.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\module\hotSearch.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\module\mostgrid.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\module\search.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\module\stat.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\pack\common.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\pack\ga.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\content\js\pack\xagainit.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\en\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\en-US\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\es\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\es-419\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\fr\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\fr-BE\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\fr-CA\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\fr-CH\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\fr-LU\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\it\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\it-CH\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\pl\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\pt-BR\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\ru\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\ru-MO\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\tr\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\vi\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\zh-CN\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\locale\zh-TW\locale.properties, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\skin\default_logo.png, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\skin\googlelogo.png, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\skin\google_trends.png, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\skin\icon.png, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\skin\loading.gif, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\skin\logo.png, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\skin\luck.png, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\skin\newtab.ico, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\skin\simple.css, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\chrome\skin\style.css, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\defaults\preferences\fvd.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\defaults\preferences\preferences.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\modules\addonmanager.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\modules\aes.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\modules\config.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\modules\dialogs.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\modules\last_tab.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\modules\misc.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\modules\properties.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\modules\remoterequest.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\modules\restoreprefs.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com\modules\settings.js, In Quarantäne, [ebfee227246753e359287b96aa59c040], 
PUP.Optional.SweetSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com\chrome.manifest, In Quarantäne, [5198df2a8a01e650671b58b9dc27b848], 
PUP.Optional.SweetSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com\install.rdf, In Quarantäne, [5198df2a8a01e650671b58b9dc27b848], 
PUP.Optional.SweetSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com\chrome\content\toolbar.js, In Quarantäne, [5198df2a8a01e650671b58b9dc27b848], 
PUP.Optional.SweetSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com\chrome\content\toolbar.xul, In Quarantäne, [5198df2a8a01e650671b58b9dc27b848], 
PUP.Optional.SweetSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com\chrome\skin\icon.png, In Quarantäne, [5198df2a8a01e650671b58b9dc27b848], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\conf, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\ffsearch_toolbar!1.0.0.1031.xpi, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\install.data, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\msvcp110.dll, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\msvcr110.dll, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\searchProvider.xml, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\uninstall.exe, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\about.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\about_bk.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\btn.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\btn_apply.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\close.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\conf.xml, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\conf_back.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\input_bk.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\logo.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\main.xml, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\radio_1.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\radio_2.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\rigth_arrow.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\skin\settings.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\data.html, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\indexIE.html, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\indexIE8.html, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\main.css, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\img\google_trends.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\img\icon128.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\img\icon16.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\img\icon48.png, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\img\loading.gif, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\img\logo32.ico, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\common.js, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\ga.js, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\jquery-1.11.0.min.js, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\jquery.autocomplete.js, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\jquery.xdomainrequest.min.js, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\js.js, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\library.js, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\xagainit-ie8.js, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\xagainit2.0.js, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\js\xdomain.min.js, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\en-US\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\es-419\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\es-ES\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-BE\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-CA\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-CH\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-FR\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\fr-LU\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\it-CH\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\it-IT\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\pl\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\pt\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\pt-BR\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\ru\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\ru-MO\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\tr-TR\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\vi-VI\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\zh-CN\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.MiuiTab.A, C:\Program Files (x86)\MiuiTab\web\_locales\zh-TW\messages.json, In Quarantäne, [b13847c2850656e025062ce8f0133ec2], 
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\domain, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af], 
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\expirationDate, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af], 
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\hotsearch, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af], 
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\hotsearch_uptime, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af], 
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\name, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af], 
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\path, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af], 
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\set_country, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af], 
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\set_z, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af], 
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\TABts, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af], 
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\uid, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af], 
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\updateTime, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af], 
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\url, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af], 
PUP.Optional.SupTab.A, C:\Users\admin\SupTab\_ver, In Quarantäne, [be2b8b7eee9d989ea73cb1636b9851af], 
PUP.Optional.Delta.ShrtCln, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://www.delta-homes.com/newtab/?type=nt&ts=1434713643&z=24f644d9902c60e32aeef35g1z3c4z7m0g7caqdzbz&from=ient06192&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249");), Ersetzt,[18d16b9e187393a3f3c6c2cae124c937]
PUP.Optional.Delta.ShrtCln, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js, Gut: (browser.startup.homepage", "https://www.malwarebytes.org/restorebrowser/), Schlecht: (browser.startup.homepage", "hxxp://www.delta-homes.com), Ersetzt,[36b368a1404b999d541fa9e60005f808]
PUP.Optional.FastStart.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js, Gut: (), Schlecht: (faststartff@gmail.com), Ersetzt,[b4359a6fe3a80f278ac08f012dd8e020]
PUP.Optional.QuickSearch.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js, Gut: (), Schlecht: (quick_searchff@gmail.com), Ersetzt,[cf1a9673810a0036212b5a3619ecbe42]
PUP.Optional.SearchEngine.A, C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js, Gut: (), Schlecht: (searchengine@gmail.com), Ersetzt,[88611feabad140f686c8aee2e81dba46]

Physische Sektoren: 0
(keine bösartigen Elemente erkannt)


(end)
         
AdwCleaner

Code:
ATTFilter
# AdwCleaner v5.000 - Logfile created 17/08/2015 at 13:30:07
# Updated 14/08/2015 by Xplode
# Database : 2015-08-16.2 [Server]
# Operating system : Windows 7 Professional Service Pack 1 (x64)
# Username : admin - PHOENIX
# Running from : C:\Users\admin\Downloads\AdwCleaner_5.000.exe
# Option : Cleaning

***** [ Services ] *****


***** [ Folders ] *****

[-] Folder Deleted : C:\Program Files (x86)\PC Speed Maximizer
[-] Folder Deleted : C:\Program Files (x86)\STab
[-] Folder Deleted : C:\Program Files (x86)\Picexa
[-] Folder Deleted : C:\Users\admin\AppData\Roaming\RHEng

***** [ Files ] *****

[-] File Deleted : C:\END
[-] File Deleted : C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Picexa.lnk
[-] File Deleted : C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Play Games Online.url
[-] File Deleted : C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\user.js
[-] File Deleted : C:\Windows\Sysnative\log\iSafeKrnlCall.log

***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

[-] Key Deleted : HKLM\SOFTWARE\Classes\PicexaViewer.bmp
[-] Key Deleted : HKLM\SOFTWARE\Classes\PicexaViewer.gif
[-] Key Deleted : HKLM\SOFTWARE\Classes\PicexaViewer.ico
[-] Key Deleted : HKLM\SOFTWARE\Classes\PicexaViewer.jpeg
[-] Key Deleted : HKLM\SOFTWARE\Classes\PicexaViewer.jpg
[-] Key Deleted : HKLM\SOFTWARE\Classes\PicexaViewer.png
[-] Key Deleted : HKLM\SOFTWARE\Classes\PicexaViewer.tif
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B853E835-9F24-4F4B-B55C-E554D15CCCD2}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{B002FFEB-D622-4EC8-A061-549681AAA56E}
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F}]
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A25AC313-DD19-4238-ACA2-401D6BEE4321}
[-] Key Deleted : HKCU\Software\SecuredDownload
[-] Key Deleted : HKCU\Software\simplytech
[-] Key Deleted : HKCU\Software\V9
[-] Key Deleted : HKLM\SOFTWARE\hdcode
[-] Key Deleted : HKLM\SOFTWARE\SiteSee
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Linkey
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Picexa
[!] Key Not Deleted : [x64] HKCU\Software\SecuredDownload
[!] Key Not Deleted : [x64] HKCU\Software\simplytech
[!] Key Not Deleted : [x64] HKCU\Software\V9

***** [ Web browsers ] *****

[-] [C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js] [Preference] Deleted : user_pref("browser.search.searchengine.iconURL", "hxxp://search.delta-homes.com/favicon.ico");
[-] [C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js] [Preference] Deleted : user_pref("browser.search.searchengine.url", "hxxp://search.delta-homes.com/web/?type=ds&ts=1434713643&z=24f644d9902c60e32aeef35g1z3c4z7m0g7caqdzbz&from=ient06192&uid=MTFDDAK256MAM-1K12_1246091C424909[...]
[-] [C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js] [Preference] Deleted : user_pref("extensions.quick_start.enable_search1", false);
[-] [C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js] [Preference] Deleted : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);
[-] [C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js] [Preference] Deleted : user_pref("extensions.srchlsrn.hmpgUrl", "hxxp://Lasaoren.com/?f=1&a=lrn_secureddownload_14_45_ff&cd=2XzuyEtN2Y1L1QzuzzyEtA0AyE0BtDtBzy0E0B0DtCtByD0DtN0D0Tzu0StCtDyEyEtN1L2XzutAtFyCtFtCtFtDtN1L1CzutCy[...]
[-] [C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js] [Preference] Deleted : user_pref("extensions.srchlsrn.newTabUrl", "hxxp://Lasaoren.com/?f=2&a=lrn_secureddownload_14_45_ff&cd=2XzuyEtN2Y1L1QzuzzyEtA0AyE0BtDtBzy0E0B0DtCtByD0DtN0D0Tzu0StCtDyEyEtN1L2XzutAtFyCtFtCtFtDtN1L1Czut[...]
[-] [C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js] [Preference] Deleted : user_pref("extensions.srchlsrn.prtnrId", "WSE_Lasaoren");
[-] [C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js] [Preference] Deleted : user_pref("extensions.srchlsrn.srchPrvdr", "Lasaoren");
[-] [C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\prefs.js] [Preference] Deleted : user_pref("extensions.srchlsrn.tlbrSrchUrl", "hxxp://Lasaoren.com/?f=3&a=lrn_secureddownload_14_45_ff&cd=2XzuyEtN2Y1L1QzuzzyEtA0AyE0BtDtBzy0E0B0DtCtByD0DtN0D0Tzu0StCtDyEyEtN1L2XzutAtFyCtFtCtFtDtN1L1Cz[...]

*************************

:: Proxy settings cleared
:: Winsock settings cleared
!! Unable to delete Internet Explorer policies
!! Unable to delete Chrome policies

*************************

C:\AdwCleaner[C1].txt - [5216 octets] - [17/08/2015 13:30:07]
C:\AdwCleaner[S1].txt - [4924 octets] - [17/08/2015 13:28:21]
C:\AdwCleaner[S2].txt - [4987 octets] - [17/08/2015 13:29:20]

########## EOF - C:\AdwCleaner[C1].txt - [5405 octets] ##########
         
JRT

Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.5.6 (08.10.2015:1)
OS: Windows 7 Professional x64
Ran by admin on 17.08.2015 at 13:33:00.12
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{FE6BE06B-7324-4D38-AD78-79507F307D7D}



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{FE6BE06B-7324-4D38-AD78-79507F307D7D}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] C:\Users\admin\AppData\Roaming\goldengate



~~~ FireFox

Successfully deleted the following from C:\Users\admin\AppData\Roaming\mozilla\firefox\profiles\8u5y4rmx.default\prefs.js

user_pref(browser.search.defaultenginename, delta-homes);
user_pref(browser.search.searchengine.alias, delta-homes);
user_pref(browser.search.searchengine.desc, this is my first firefox searchEngine);
user_pref(browser.search.searchengine.name, delta-homes);
user_pref(browser.search.searchengine.ptid, ient06192);
user_pref(browser.search.searchengine.uid, MTFDDAK256MAM-1K12_1246091C4249091C4249);
user_pref(browser.search.selectedEngine, delta-homes);
Emptied folder: C:\Users\admin\AppData\Roaming\mozilla\firefox\profiles\8u5y4rmx.default\minidumps [2 files]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 17.08.2015 at 13:35:01.43
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Alt 17.08.2015, 12:47   #14
Taymytt
 
Kaspersky 2015 meldet dauernd not-a-virus - Standard

Kaspersky 2015 meldet dauernd not-a-virus



FRST Teil 1

Code:
ATTFilter
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:16-08-2015
durchgeführt von admin (Administrator) auf PHOENIX (17-08-2015 13:38:02)
Gestartet von C:\Users\admin\Downloads
Geladene Profile: admin (Verfügbare Profile: admin)
Platform: Windows 7 Professional Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Opera)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera_crashreporter.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.99\opera.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Farbar) C:\Users\admin\Downloads\FRST64 (1).exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1664000 2012-11-12] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2812656 2014-01-24] (Synaptics Incorporated)
HKLM-x32\...\Run: [QLBController] => C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe [336672 2014-02-10] (Hewlett-Packard Company)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-29] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292088 2013-02-22] (Intel Corporation)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7063832 2014-11-21] (Piriform Ltd)
HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\...\Run: [HP ENVY 5640 series (NET)] => C:\Program Files\HP\HP ENVY 5640 series\Bin\ScanToPCActivationApp.exe [3483656 2014-08-22] (Hewlett-Packard Development Company, LP)
HKU\S-1-5-21-1824315975-2186341827-1397389162-1000\...\Run: [Dropbox Update] => C:\Users\admin\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-19] (Dropbox, Inc.)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-05-13] (Microsoft Corporation)
Startup: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2014-08-17]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-10-10]
ShortcutTarget: Dropbox.lnk -> C:\Users\admin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk [2015-07-04]
ShortcutTarget: phase-6 Reminder.lnk -> C:\Users\admin\AppData\Local\phase-6\phase-6-compendio\reminder\reminder.exe (phase-6)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-06] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\admin\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-06] (Dropbox, Inc.)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = 
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-06-09] (Microsoft Corporation)
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-25] (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-06-09] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-06-16] (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-25] (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-07-04] (Oracle Corporation)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-06-09] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-07-04] (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
Toolbar: HKLM - Perfect PDF 8 - {FE6BE06B-7324-4D38-AD78-79507F307D7D} - C:\Program Files (x86)\soft Xpansion\Perfect PDF 8\ieagent64.dll [2014-12-14] (soft Xpansion)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{AE055004-6C80-4B3B-9C81-902050B152BE}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{F059243C-D0C1-44EE-AE24-7E9B8859776A}: [DhcpNameServer] 192.168.1.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default
FF Homepage: https://www.malwarebytes.org/restorebrowser//?type=hp&ts=1434713643&z=24f644d9902c60e32aeef35g1z3c4z7m0g7caqdzbz&from=ient06192&uid=MTFDDAK256MAM-1K12_1246091C4249091C4249
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-10] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-01-31] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-10] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-07-04] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-07-04] (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-10-25] ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-10-25] ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-10-25] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-08-16] (Microsoft Corporation)
FF Plugin-x32: @soft-xpansion/npsxpdf -> C:\Program Files (x86)\Common Files\soft Xpansion\np-sxpdf.dll [2014-12-14] (soft-Xpansion)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1824315975-2186341827-1397389162-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2015-08-08] ()
FF Extension: Elegant Advisor - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\{20fec063-c59d-0c63-9ae8-03180eee7f1e} [2015-06-07]
FF Extension: My Swisscom Assistant - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\{} [2015-02-10]
FF Extension: Express Find - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\{7ab3cbb3-34f1-440b-b048-404cfae819c0}.xpi [2015-04-11]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-10-25]
FF HKLM-x32\...\Firefox\Extensions: [{067A541B-C896-42F1-92EA-79C69EF90ED5}] - C:\ProgramData\soft Xpansion\Perfect PDF 8\Data\fftb
FF Extension: Perfect PDF 8 - C:\ProgramData\soft Xpansion\Perfect PDF 8\Data\fftb [2014-12-14]
FF HKLM-x32\...\Thunderbird\Extensions: [{067A541B-C896-42F1-92EA-79C69EF90ED5}] - C:\ProgramData\soft Xpansion\Perfect PDF 8\Data\fftb
FF Extension: Kein Name - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com [nicht gefunden]
FF Extension: Kein Name - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com [nicht gefunden]
FF Extension: Kein Name - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com [nicht gefunden]
FF Extension: Kein Name - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com [nicht gefunden]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2015-08-02] (BitRaider, LLC)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2753720 2015-07-01] (Microsoft Corporation)
S2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe [683296 2014-02-10] (Hewlett-Packard Company)
S3 hpqwmiex; C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe [1006424 2013-01-23] (Hewlett-Packard Company) [Datei ist nicht signiert]
S2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89840 2015-03-28] (Hewlett-Packard Company)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2013-10-11] ()
S2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [327680 2012-11-12] (IDT, Inc.) [Datei ist nicht signiert]
S3 SXDS10; C:\Program Files (x86)\Common Files\soft Xpansion\sxds10.exe [234096 2014-12-14] (soft Xpansion)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3671792 2013-10-11] (Intel® Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [141320 2014-10-25] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [793800 2014-10-25] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1866080 2012-11-28] ()
S3 BRDriver64_1_3_3_E02B25FC; \??\C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-08-17 13:38 - 2015-08-17 13:38 - 00021176 _____ C:\Users\admin\Downloads\FRST.txt
2015-08-17 13:37 - 2015-08-17 13:37 - 02173440 _____ (Farbar) C:\Users\admin\Downloads\FRST64 (1).exe
2015-08-17 13:35 - 2015-08-17 13:35 - 00001660 _____ C:\Users\admin\Desktop\JRT.txt
2015-08-17 13:32 - 2015-08-17 13:32 - 01791580 _____ (Malwarebytes Corporation) C:\Users\admin\Downloads\JRT.exe
2015-08-17 13:30 - 2015-08-17 13:30 - 00005490 _____ C:\Users\admin\Desktop\AdwCleaner[C1].txt
2015-08-17 13:29 - 2015-08-17 13:29 - 00004987 _____ C:\Users\admin\Desktop\AdwCleaner[S2].txt
2015-08-17 13:28 - 2015-08-17 13:30 - 00000000 ____D C:\AdwCleaner
2015-08-17 13:28 - 2015-08-17 13:28 - 00004924 _____ C:\Users\admin\Desktop\AdwCleaner[S1].txt
2015-08-17 13:27 - 2015-08-17 13:27 - 01563648 _____ C:\Users\admin\Downloads\AdwCleaner_5.000.exe
2015-08-17 13:24 - 2015-08-17 13:24 - 00106146 _____ C:\Users\admin\Desktop\mbam.txt
2015-08-17 13:22 - 2015-08-17 13:30 - 00158348 _____ C:\Windows\PFRO.log
2015-08-17 13:22 - 2015-08-17 13:30 - 00000112 _____ C:\Windows\setupact.log
2015-08-17 13:22 - 2015-08-17 13:22 - 00000000 _____ C:\Windows\setuperr.log
2015-08-17 13:14 - 2015-08-17 13:14 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-08-17 13:12 - 2015-08-17 13:13 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\admin\Downloads\mbam-setup-2.1.8.1057 (1).exe
2015-08-17 11:19 - 2015-08-17 11:19 - 00000000 ____D C:\Users\admin\Documents\Benutzerdefinierte Office-Vorlagen
2015-08-16 04:14 - 2015-07-30 15:13 - 00124624 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-08-16 04:14 - 2015-07-30 15:13 - 00103120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-08-16 00:02 - 2015-07-28 22:09 - 00017344 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-08-16 00:02 - 2015-07-28 22:05 - 01116672 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-08-16 00:02 - 2015-07-28 22:05 - 00774656 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-08-16 00:02 - 2015-07-28 22:05 - 00743424 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-08-16 00:02 - 2015-07-28 22:05 - 00437760 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-08-16 00:02 - 2015-07-28 22:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-08-16 00:02 - 2015-07-28 22:05 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-08-16 00:02 - 2015-07-28 21:55 - 01148416 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-08-16 00:01 - 2015-07-16 21:12 - 06131200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-08-16 00:01 - 2015-07-16 21:12 - 00856064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2015-08-16 00:01 - 2015-07-16 21:12 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2015-08-16 00:01 - 2015-07-16 21:11 - 07077376 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-08-16 00:01 - 2015-07-16 21:11 - 01057792 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2015-08-16 00:01 - 2015-07-16 21:11 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2015-08-16 00:01 - 2015-07-15 20:15 - 05568960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-08-16 00:01 - 2015-07-15 20:15 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-08-16 00:01 - 2015-07-15 20:15 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-08-16 00:01 - 2015-07-15 20:15 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-08-16 00:01 - 2015-07-15 20:12 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-08-16 00:01 - 2015-07-15 20:11 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-08-16 00:01 - 2015-07-15 20:11 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-08-16 00:01 - 2015-07-15 20:11 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-08-16 00:01 - 2015-07-15 20:11 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-08-16 00:01 - 2015-07-15 20:11 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 01743360 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-08-16 00:01 - 2015-07-15 20:10 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-08-16 00:01 - 2015-07-15 20:10 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-08-16 00:01 - 2015-07-15 20:10 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-08-16 00:01 - 2015-07-15 20:10 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-08-16 00:01 - 2015-07-15 20:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-08-16 00:01 - 2015-07-15 20:09 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-08-16 00:01 - 2015-07-15 20:05 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-08-16 00:01 - 2015-07-15 20:05 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:59 - 03989952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-08-16 00:01 - 2015-07-15 19:59 - 03934656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-08-16 00:01 - 2015-07-15 19:56 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-08-16 00:01 - 2015-07-15 19:55 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-08-16 00:01 - 2015-07-15 19:55 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-08-16 00:01 - 2015-07-15 19:55 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-08-16 00:01 - 2015-07-15 19:55 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-08-16 00:01 - 2015-07-15 19:55 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-08-16 00:01 - 2015-07-15 19:54 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-08-16 00:01 - 2015-07-15 19:54 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-08-16 00:01 - 2015-07-15 19:54 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-08-16 00:01 - 2015-07-15 19:54 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-08-16 00:01 - 2015-07-15 19:54 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-08-16 00:01 - 2015-07-15 19:54 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-08-16 00:01 - 2015-07-15 19:54 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-08-16 00:01 - 2015-07-15 19:53 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-08-16 00:01 - 2015-07-15 19:53 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-08-16 00:01 - 2015-07-15 19:53 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-08-16 00:01 - 2015-07-15 19:53 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-08-16 00:01 - 2015-07-15 19:53 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-08-16 00:01 - 2015-07-15 19:53 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-08-16 00:01 - 2015-07-15 19:49 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-08-16 00:01 - 2015-07-15 19:48 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 18:46 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-08-16 00:01 - 2015-07-15 18:46 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-08-16 00:01 - 2015-07-15 18:46 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-08-16 00:01 - 2015-07-15 18:37 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-08-16 00:01 - 2015-07-15 18:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-08-16 00:01 - 2015-07-15 18:34 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 18:34 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 18:34 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-08-16 00:01 - 2015-07-15 18:34 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-08-16 00:01 - 2015-07-11 15:15 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2015-08-16 00:00 - 2015-07-15 05:19 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\basesrv.dll
2015-08-15 23:59 - 2015-07-21 02:39 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-08-15 23:59 - 2015-07-21 02:12 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-08-15 23:59 - 2015-07-16 23:14 - 25192448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-08-15 23:59 - 2015-07-16 22:54 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-08-15 23:59 - 2015-07-16 22:54 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-08-15 23:59 - 2015-07-16 22:37 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-08-15 23:59 - 2015-07-16 22:36 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-08-15 23:59 - 2015-07-16 22:36 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-08-15 23:59 - 2015-07-16 22:36 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-08-15 23:59 - 2015-07-16 22:35 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-08-15 23:59 - 2015-07-16 22:35 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-08-15 23:59 - 2015-07-16 22:27 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-08-15 23:59 - 2015-07-16 22:26 - 05923328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-08-15 23:59 - 2015-07-16 22:26 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-08-15 23:59 - 2015-07-16 22:23 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-08-15 23:59 - 2015-07-16 22:21 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-08-15 23:59 - 2015-07-16 22:21 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-08-15 23:59 - 2015-07-16 22:21 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-08-15 23:59 - 2015-07-16 22:21 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-08-15 23:59 - 2015-07-16 22:20 - 19870208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-08-15 23:59 - 2015-07-16 22:12 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-08-15 23:59 - 2015-07-16 22:08 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-08-15 23:59 - 2015-07-16 22:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-08-15 23:59 - 2015-07-16 22:00 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-08-15 23:59 - 2015-07-16 21:55 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-08-15 23:59 - 2015-07-16 21:54 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-08-15 23:59 - 2015-07-16 21:51 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-08-15 23:59 - 2015-07-16 21:51 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-08-15 23:59 - 2015-07-16 21:51 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-08-15 23:59 - 2015-07-16 21:50 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-08-15 23:59 - 2015-07-16 21:50 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-08-15 23:59 - 2015-07-16 21:49 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-08-15 23:59 - 2015-07-16 21:45 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-08-15 23:59 - 2015-07-16 21:43 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-08-15 23:59 - 2015-07-16 21:43 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-08-15 23:59 - 2015-07-16 21:41 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-08-15 23:59 - 2015-07-16 21:39 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-08-15 23:59 - 2015-07-16 21:39 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-08-15 23:59 - 2015-07-16 21:38 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-08-15 23:59 - 2015-07-16 21:36 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-08-15 23:59 - 2015-07-16 21:35 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-08-15 23:59 - 2015-07-16 21:34 - 14451200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-08-15 23:59 - 2015-07-16 21:33 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-08-15 23:59 - 2015-07-16 21:32 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-08-15 23:59 - 2015-07-16 21:29 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-08-15 23:59 - 2015-07-16 21:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-08-15 23:59 - 2015-07-16 21:20 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-08-15 23:59 - 2015-07-16 21:19 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-08-15 23:59 - 2015-07-16 21:17 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-08-15 23:59 - 2015-07-16 21:12 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-08-15 23:59 - 2015-07-16 21:12 - 02427904 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-08-15 23:59 - 2015-07-16 21:10 - 12856832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-08-15 23:59 - 2015-07-16 21:06 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-08-15 23:59 - 2015-07-16 21:06 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-08-15 23:59 - 2015-07-16 21:05 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-08-15 23:59 - 2015-07-16 21:01 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-08-15 23:59 - 2015-07-16 20:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-08-15 23:59 - 2015-07-16 20:42 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-08-15 23:59 - 2015-07-16 20:38 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-08-15 23:59 - 2015-07-16 20:37 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-08-15 23:58 - 2015-07-01 22:49 - 00260096 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2015-08-15 23:58 - 2015-07-01 22:48 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2015-08-15 23:58 - 2015-07-01 22:30 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2015-08-15 23:58 - 2015-07-01 22:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2015-08-15 23:57 - 2015-07-30 20:06 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2015-08-15 23:57 - 2015-07-30 20:06 - 01648128 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-08-15 23:57 - 2015-07-30 20:06 - 01180160 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-08-15 23:57 - 2015-07-30 20:06 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-08-15 23:57 - 2015-07-30 20:06 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-08-15 23:57 - 2015-07-30 20:06 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-08-15 23:57 - 2015-07-30 20:06 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-08-15 23:57 - 2015-07-30 19:57 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2015-08-15 23:57 - 2015-07-30 19:57 - 01251328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-08-15 23:57 - 2015-07-30 19:57 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-08-15 23:57 - 2015-07-30 19:57 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-08-15 23:57 - 2015-07-30 19:57 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-08-15 23:57 - 2015-07-30 19:55 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-08-15 23:57 - 2015-07-30 18:56 - 03208192 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-08-15 23:57 - 2015-07-30 18:52 - 00372736 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-08-15 23:57 - 2015-07-30 18:49 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-08-15 23:57 - 2015-07-15 05:19 - 02004992 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2015-08-15 23:57 - 2015-07-15 05:19 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-08-15 23:57 - 2015-07-15 05:14 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2015-08-15 23:57 - 2015-07-15 05:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-08-15 23:57 - 2015-07-15 04:55 - 01390592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2015-08-15 23:57 - 2015-07-15 04:55 - 01241088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-08-15 23:57 - 2015-07-15 04:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2015-08-15 23:57 - 2015-07-15 04:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-08-15 23:56 - 2015-07-20 20:12 - 03154944 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-08-15 23:56 - 2015-07-20 20:12 - 02606080 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-08-15 23:56 - 2015-07-20 20:12 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-08-15 23:56 - 2015-07-20 20:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-08-15 23:56 - 2015-07-20 20:12 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-08-15 23:56 - 2015-07-20 20:12 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-08-15 23:56 - 2015-07-20 20:12 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-08-15 23:56 - 2015-07-20 20:12 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-08-15 23:56 - 2015-07-20 20:12 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-08-15 23:56 - 2015-07-20 20:12 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-08-15 23:56 - 2015-07-20 20:12 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-08-15 23:56 - 2015-07-20 19:56 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-08-15 23:56 - 2015-07-20 19:56 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-08-15 23:56 - 2015-07-20 19:56 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-08-15 23:56 - 2015-07-20 19:56 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-08-15 23:56 - 2015-07-20 19:56 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-08-15 23:56 - 2015-07-10 19:51 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-08-15 23:56 - 2015-07-10 19:34 - 12875776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-08-15 23:56 - 2015-07-09 19:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\notepad.exe
2015-08-15 23:56 - 2015-07-09 19:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\notepad.exe
2015-08-15 23:56 - 2015-07-09 19:42 - 00179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
2015-08-15 23:44 - 2015-08-15 23:44 - 00000000 ____D C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-08-11 13:44 - 2015-08-11 13:44 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\admin\Downloads\mbam-setup-2.1.8.1057.exe
2015-08-10 17:42 - 2015-08-10 17:42 - 00000000 ____D C:\Windows\System32\Tasks\Leader Technologies
2015-08-10 17:42 - 2015-08-10 17:42 - 00000000 ____D C:\Users\admin\AppData\Roaming\Leadertech
2015-08-08 21:24 - 2015-08-08 21:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ubisoft
2015-08-08 12:55 - 2015-08-08 12:55 - 00380416 _____ C:\Users\admin\Downloads\Gmer-19357.exe
2015-08-08 12:51 - 2015-08-17 13:38 - 00000000 ____D C:\FRST
2015-08-08 12:50 - 2015-08-08 12:51 - 02169856 _____ (Farbar) C:\Users\admin\Downloads\FRST64.exe
2015-08-08 12:49 - 2015-08-08 12:49 - 00000000 _____ C:\Users\admin\defogger_reenable
2015-08-08 12:48 - 2015-08-08 12:48 - 00050477 _____ C:\Users\admin\Downloads\Defogger.exe
2015-08-08 01:11 - 2015-08-08 01:11 - 00000000 ____D C:\Users\admin\AppData\Local\Ubisoft Game Launcher
2015-08-08 00:52 - 2015-08-08 00:52 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2015-08-08 00:52 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2015-08-08 00:52 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2015-08-08 00:52 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2015-08-08 00:52 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2015-08-08 00:52 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2015-08-08 00:52 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2015-08-08 00:52 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2015-08-08 00:52 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll
2015-08-08 00:52 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll
2015-08-08 00:52 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll
2015-08-08 00:52 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll
2015-08-08 00:52 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2015-08-08 00:52 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2015-08-08 00:52 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2015-08-08 00:52 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2015-08-08 00:52 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2015-08-08 00:52 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2015-08-02 19:45 - 2015-08-02 19:45 - 00000000 ____D C:\Users\Public\Documents\BitRaider
2015-08-02 19:45 - 2015-08-02 19:45 - 00000000 ____D C:\ProgramData\BitRaider
2015-08-02 19:44 - 2015-08-02 19:44 - 00000000 ____D C:\Users\admin\AppData\Local\SWTORPerf
2015-08-02 19:40 - 2015-08-02 19:40 - 00000000 ____D C:\Program Files (x86)\Electronic Arts
2015-08-02 19:36 - 2015-08-02 19:37 - 29720272 _____ C:\Users\admin\Downloads\SWTOR_setup.exe
2015-08-01 02:21 - 2015-08-08 01:10 - 00000000 ____D C:\ProgramData\Solidshield
         
FRST Teil 2

Code:
ATTFilter
2015-07-31 18:34 - 2009-03-16 14:18 - 00521560 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll
2015-07-31 18:34 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2015-07-31 18:34 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2015-07-31 18:34 - 2009-03-16 14:18 - 00174936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll
2015-07-31 18:34 - 2009-03-16 14:18 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll
2015-07-31 18:34 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 05425496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 02430312 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_41.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 01846632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_41.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 00520544 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll
2015-07-31 18:34 - 2009-03-09 15:27 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_41.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2015-07-31 18:34 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2015-07-31 18:34 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2015-07-31 18:34 - 2008-07-10 11:00 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2015-07-31 18:34 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2015-07-31 18:34 - 2008-07-10 11:00 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2015-07-31 18:34 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2015-07-31 18:34 - 2008-07-10 11:00 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2015-07-31 18:34 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll
2015-07-31 18:34 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2015-07-31 18:34 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2015-07-31 18:34 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll
2015-07-31 18:34 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll
2015-07-31 18:34 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2015-07-31 18:34 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2015-07-31 18:34 - 2008-05-30 14:16 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 04991496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 01941528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll
2015-07-31 18:34 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2015-07-31 18:34 - 2008-03-05 16:04 - 00489480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll
2015-07-31 18:34 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll
2015-07-31 18:34 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2015-07-31 18:34 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll
2015-07-31 18:34 - 2008-03-05 16:00 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll
2015-07-31 18:34 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll
2015-07-31 18:34 - 2008-03-05 15:56 - 04910088 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll
2015-07-31 18:34 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2015-07-31 18:34 - 2008-03-05 15:56 - 01860120 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll
2015-07-31 18:34 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll
2015-07-31 18:34 - 2008-02-05 23:07 - 00529424 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll
2015-07-31 18:34 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll
2015-07-31 18:34 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll
2015-07-31 18:34 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2015-07-31 18:34 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll
2015-07-31 18:34 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
2015-07-31 18:34 - 2007-10-12 15:14 - 05081608 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_36.dll
2015-07-31 18:34 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
2015-07-31 18:34 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll
2015-07-31 18:34 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
2015-07-31 18:34 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll
2015-07-31 18:34 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
2015-07-31 18:34 - 2007-07-20 00:57 - 00411496 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_9.dll
2015-07-31 18:34 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 01985904 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_35.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_35.dll
2015-07-31 18:34 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2015-07-31 18:34 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2015-07-31 18:34 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2015-07-31 18:34 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2015-07-31 18:34 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2015-07-31 18:34 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2015-07-31 18:34 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2015-07-31 18:34 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2015-07-31 18:34 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll
2015-07-31 18:34 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2015-07-31 18:34 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2015-07-31 18:34 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2015-07-31 18:34 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll
2015-07-31 18:34 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2015-07-31 18:34 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2015-07-31 18:34 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2015-07-31 18:34 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2015-07-31 18:34 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2015-07-31 18:34 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2015-07-31 18:34 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2015-07-31 18:34 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2015-07-31 18:34 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2015-07-31 18:34 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll
2015-07-31 18:34 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2015-07-31 18:34 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2015-07-31 18:34 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2015-07-31 18:34 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2015-07-31 18:34 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
2015-07-31 18:34 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2015-07-31 18:34 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2015-07-31 18:34 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2015-07-31 18:34 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2015-07-31 18:34 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2015-07-31 18:34 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2015-07-31 18:34 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2015-07-31 18:34 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
2015-07-31 18:34 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2015-07-31 18:34 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2015-07-31 18:34 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2015-07-31 18:34 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2015-07-31 18:34 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2015-07-31 18:34 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2015-07-31 18:34 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2015-07-31 18:34 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2015-07-31 18:34 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2015-07-31 18:34 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2015-07-31 18:34 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2015-07-31 18:34 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2015-07-31 18:34 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2015-07-31 18:34 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2015-07-31 18:34 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2015-07-31 18:34 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2015-07-31 18:34 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2015-07-31 18:34 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2015-07-31 18:34 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2015-07-31 18:34 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2015-07-26 13:39 - 2015-05-09 20:26 - 00493504 _____ (Microsoft Corporation) C:\Windows\system32\mcupdate_GenuineIntel.dll
2015-07-26 13:39 - 2015-03-14 05:21 - 01632768 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-07-26 13:39 - 2015-03-14 05:21 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2015-07-26 13:39 - 2015-03-14 05:04 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-07-26 13:39 - 2015-03-14 05:04 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2015-07-24 18:53 - 2015-07-24 18:53 - 05439072 _____ (TeamViewer) C:\Users\admin\Downloads\TeamViewerQS_de.exe
2015-07-24 18:53 - 2015-07-24 18:53 - 00000000 ____D C:\Users\admin\AppData\Roaming\TeamViewer
2015-07-23 23:41 - 2015-06-02 02:07 - 00254976 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll
2015-07-23 23:41 - 2015-06-02 01:47 - 00210432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cewmdm.dll
2015-07-23 23:39 - 2015-06-09 20:03 - 03180544 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-07-23 23:39 - 2015-06-09 20:03 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-07-23 23:38 - 2015-06-17 19:47 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-23 23:38 - 2015-06-17 19:37 - 00312320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-07-23 23:32 - 2015-07-04 20:07 - 02087424 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-23 23:32 - 2015-07-04 19:48 - 01414656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-07-23 23:32 - 2015-04-27 21:23 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-07-23 23:32 - 2015-04-27 21:23 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-07-23 23:32 - 2015-04-27 21:23 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-07-23 23:32 - 2015-04-27 21:23 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-07-23 23:32 - 2015-04-27 21:05 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-07-23 23:32 - 2015-04-27 21:04 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-07-23 23:32 - 2015-04-27 21:04 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-07-23 23:32 - 2015-04-27 21:04 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-07-23 23:31 - 2015-06-15 23:50 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-07-23 23:31 - 2015-06-15 23:45 - 03242496 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-23 23:31 - 2015-06-15 23:45 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-07-23 23:31 - 2015-06-15 23:45 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2015-07-23 23:31 - 2015-06-15 23:45 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-07-23 23:31 - 2015-06-15 23:44 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-23 23:31 - 2015-06-15 23:43 - 02364416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-07-23 23:31 - 2015-06-15 23:43 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-07-23 23:31 - 2015-06-15 23:43 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2015-07-23 23:31 - 2015-06-15 23:42 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-07-23 23:31 - 2015-06-15 23:42 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2015-07-23 23:31 - 2015-06-15 23:37 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-08-17 13:37 - 2014-10-25 17:14 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2015-08-17 13:35 - 2009-07-14 19:58 - 00699342 _____ C:\Windows\system32\perfh007.dat
2015-08-17 13:35 - 2009-07-14 19:58 - 00149450 _____ C:\Windows\system32\perfc007.dat
2015-08-17 13:35 - 2009-07-14 07:13 - 01619284 _____ C:\Windows\system32\PerfStringBackup.INI
2015-08-17 13:33 - 2015-01-14 20:35 - 01386561 _____ C:\Windows\WindowsUpdate.log
2015-08-17 13:33 - 2009-07-14 06:45 - 00026528 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-08-17 13:33 - 2009-07-14 06:45 - 00026528 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-08-17 13:30 - 2015-05-14 13:17 - 00000000 ____D C:\Windows\system32\log
2015-08-17 13:30 - 2014-10-10 15:37 - 00000000 ___RD C:\Users\admin\Dropbox
2015-08-17 13:30 - 2014-10-10 15:35 - 00000000 ____D C:\Users\admin\AppData\Roaming\Dropbox
2015-08-17 13:30 - 2014-08-14 14:20 - 00000435 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2015-08-17 13:30 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-08-17 13:21 - 2015-02-14 22:56 - 00001115 _____ C:\Users\Public\Desktop\Opera.lnk
2015-08-17 13:21 - 2013-12-05 22:18 - 00000000 ____D C:\Users\admin
2015-08-17 13:21 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\Performance
2015-08-17 13:13 - 2015-06-19 22:52 - 00001224 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000UA.job
2015-08-17 13:00 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-08-17 10:53 - 2015-06-19 22:52 - 00001172 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000Core.job
2015-08-16 22:22 - 2014-12-13 23:33 - 00000000 ____D C:\Users\admin\Documents\Briefvorlagen
2015-08-16 22:18 - 2015-05-12 14:56 - 00000000 ____D C:\Users\admin\Documents\TAMY
2015-08-16 12:28 - 2009-07-14 06:45 - 00499752 _____ C:\Windows\system32\FNTCACHE.DAT
2015-08-16 04:15 - 2014-12-11 13:59 - 00000000 ____D C:\Windows\system32\appraiser
2015-08-16 04:15 - 2014-05-13 21:48 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-08-16 04:12 - 2014-05-13 19:48 - 00000000 ____D C:\Windows\system32\MRT
2015-08-16 04:10 - 2014-05-13 19:48 - 132483416 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-08-08 21:26 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-08-08 12:32 - 2015-06-19 13:34 - 00000000 ____D C:\Users\admin\AppData\Everything
2015-08-08 01:16 - 2014-05-13 19:21 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-08-08 00:35 - 2015-02-14 22:56 - 00003850 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1423947365
2015-08-08 00:35 - 2015-02-14 22:55 - 00000000 ____D C:\Program Files (x86)\Opera
2015-08-01 15:53 - 2015-07-04 13:46 - 00000000 ____D C:\Users\admin\.phase-6
2015-07-31 15:13 - 2015-04-13 12:37 - 00000000 ___SD C:\Windows\system32\GWX
2015-07-29 11:39 - 2015-07-10 19:29 - 00000000 ___HD C:\$Windows.~BT
2015-07-29 11:30 - 2013-12-05 22:07 - 00000000 ____D C:\Windows\Panther
2015-07-29 11:00 - 2015-04-13 12:37 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-07-27 07:25 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-07-26 13:44 - 2014-05-13 21:39 - 01593564 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2015-07-25 13:25 - 2014-08-16 21:49 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-07-25 13:22 - 2015-01-19 12:32 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-07-23 23:08 - 2015-06-19 22:52 - 00004194 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000UA
2015-07-23 23:08 - 2015-06-19 22:52 - 00003798 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1824315975-2186341827-1397389162-1000Core
2015-07-23 23:06 - 2014-08-16 21:14 - 00000000 ____D C:\Program Files\Microsoft Office 15

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2015-04-24 12:11 - 2015-04-24 12:11 - 0001099 _____ () C:\Users\admin\AppData\Roaming\ShiftN.ini
2015-02-13 17:54 - 2015-02-13 17:54 - 0000057 _____ () C:\ProgramData\Ament.ini

Einige Dateien in TEMP:
====================
C:\Users\admin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpndjxlh.dll
C:\Users\admin\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-08-17 12:53

==================== Ende von Ergebnis ============================
         

Alt 17.08.2015, 16:31   #15
Deathkid535
/// Malwareteam
 
Kaspersky 2015 meldet dauernd not-a-virus - Standard

Kaspersky 2015 meldet dauernd not-a-virus



Hi,

Schritt # 1: FRST-Fix

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
CloseProcesses:
HKLM-x32\...\Run: [] => [X]
SearchScopes: HKU\S-1-5-21-1824315975-2186341827-1397389162-1000 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = 
FF Extension: Express Find - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\Extensions\{7ab3cbb3-34f1-440b-b048-404cfae819c0}.xpi [2015-04-11]
FF Extension: Kein Name - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\veggy@veggyAddon.com [nicht gefunden]
FF Extension: Kein Name - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\quick_searchff@gmail.com [nicht gefunden]
FF Extension: Kein Name - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com [nicht gefunden]
FF Extension: Kein Name - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\8u5y4rmx.default\extensions\sweetsearch@gmail.com [nicht gefunden]
EmtyTemp:
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Schritt # 2: ESET


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset



Schritt # 3: SecurityCheck

Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.


Schritt # 4: FRST

Noch ein frisches FRST-Log bitte.



Schritt # 5: Frage

Noch Probleme?



Schritt # 6: Bitte Posten
  • Das Fixlog von FRST
  • Das Log von ESET
  • Das Log von SecurityCheck
  • Das frische FRST-Log
  • Die Antwort auf meine Frage

Antwort

Themen zu Kaspersky 2015 meldet dauernd not-a-virus
code, confused, dateien, dauernd, desinfizieren, einfügen, erstell, kaspersky, lange, lösch, löscht, melde, meldet, not-a-virus, poste, posten, quara, quarantäne



Ähnliche Themen: Kaspersky 2015 meldet dauernd not-a-virus


  1. Sandboxie - Kaspersky AntiVirus 2015
    Antiviren-, Firewall- und andere Schutzprogramme - 12.11.2015 (5)
  2. Kaspersky Internet Security 2015 Fehlarlam?
    Antiviren-, Firewall- und andere Schutzprogramme - 25.09.2015 (43)
  3. Wechsel von Avast auf Kaspersky Internet Security 2015 - Win 8.1 Notebook
    Antiviren-, Firewall- und andere Schutzprogramme - 16.08.2015 (1)
  4. Windows7: Avira meldet am 6.3.2015 ebenfalls PUA/DownloadSponsor.Gen
    Log-Analyse und Auswertung - 10.03.2015 (9)
  5. Windows 7 64bit - Kaspersky meldet immer eine Bedrohung: not-a-virus:WebToolbar.Win32.Perinet.d
    Plagegeister aller Art und deren Bekämpfung - 17.02.2015 (9)
  6. Kaspersky Internet Security 2015 macht Probleme
    Antiviren-, Firewall- und andere Schutzprogramme - 02.02.2015 (3)
  7. Kaspersky meldet Trojaner
    Log-Analyse und Auswertung - 19.11.2014 (19)
  8. Kaspersky Internetsecurity 2015 (Zertifikatprobleme)
    Alles rund um Windows - 25.10.2014 (1)
  9. Bitdefender Internet Security 2015 meldet ständig infizierte Webressource
    Plagegeister aller Art und deren Bekämpfung - 21.10.2014 (17)
  10. Antivir meldet dauernd wieder TR/ATRAPS.Gen. Lässt sich nicht löschen
    Plagegeister aller Art und deren Bekämpfung - 06.08.2012 (2)
  11. Avira meldet Virus, Avast und Kaspersky nicht!
    Plagegeister aller Art und deren Bekämpfung - 22.06.2012 (1)
  12. Ist alterIwnet vertrauenswürdig? Kaspersky meldet
    Antiviren-, Firewall- und andere Schutzprogramme - 28.01.2012 (7)
  13. Fehlalarm: Kaspersky-Engine meldet Virus auf heise.de
    Nachrichten - 07.12.2010 (0)
  14. Windows Defender meldet sich dauernd
    Log-Analyse und Auswertung - 16.05.2010 (2)
  15. kaspersky meldet dauernd trojaner
    Log-Analyse und Auswertung - 25.01.2010 (3)
  16. Avast meldet dauernd Schädling
    Plagegeister aller Art und deren Bekämpfung - 21.12.2009 (1)
  17. Norton meldet dauernd Trojaner Angriffe
    Plagegeister aller Art und deren Bekämpfung - 14.11.2004 (8)

Zum Thema Kaspersky 2015 meldet dauernd not-a-virus - HalloHallo Mein Kaspersky meldet dauernd not-a-virus irgendwo aufm Laptop. Er schiebt die Dateien dann in die Quarantäne und zum Teil löscht er sie auch, desinfizieren nicht möglich. Die Logs hab - Kaspersky 2015 meldet dauernd not-a-virus...
Archiv
Du betrachtest: Kaspersky 2015 meldet dauernd not-a-virus auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.