Meldung help file decrypt bei Start des Computers

uttella · 10.08.2015, 13:21

Hallo,

beim Start des PC's (Windows7) kommt immer die Meldung:

Die folgende Datei kann nicht geöffnet werden.

Datei: help-file-decrypt.enc

Das Programm, mit dem Sie diese Datei öffnen möchten, muss bekannt sein, damit sie geöffnet werden kann. Die Suche kann automatisch online erfolgen, oder Sie können manuell ein Programm aus der Liste der auf dem Computer installierten Programme auswählen.

Wie möchten Sie vorgehen?

angeklickt Webdienst für die Suche nach dem richtigen Programm verwenden

Programm aus einer Liste installierter Programme auswählen

Auch beim Start von Excel kommt ständig eine Start Datei mit Namen"help-file-decrypt"
Malwarebyte hat zwei unerwünwchte Programme gefunden.

Farbar's Recovery Scan Tool installieren funkioniert nicht!

Vielen Dank schon mal

uttella

schrauber · 10.08.2015, 13:22

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

uttella · 10.08.2015, 13:51

Starten von FRST funktioniert leider nicht.
Hatte ich oben schon geschrieben.
Hier erscheint auch eine Fehlermeldung.

schrauber · 11.08.2015, 08:27

dann von aussen:

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)

Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)

Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 32-Bit | FRST 64-Bit

Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.

Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Über den Boot Manager:

Starte den Rechner neu.

Während dem Hochfahren drücke mehrmals die F8 Taste

Wähle nun Computer reparieren.

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD (auch bei Windows 8 möglich):

Lege die Windows CD in dein Laufwerk.

Starte den Rechner neu und starte von der CD.

Wähle die Spracheinstellungen und klicke "Weiter".

Klicke auf Computerreparaturoptionen !

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen: Eingabeaufforderung

Gib nun bitte notepad ein und drücke Enter.

Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.

Schließe Notepad wieder

Gib nun bitte folgenden Befehl ein.
e:\frst.exe bzw. e:\frst64.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.

Akzeptiere den Disclaimer mit Ja und klicke Untersuchen

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

uttella · 12.08.2015, 05:07

Code:

ATTFilter

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:11-08-2015 02
durchgeführt von Max-Uttendorfer (2015-08-12 05:51:07)
Gestartet von E:\
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-3038766165-3120518270-3538088492-500 - Administrator - Disabled)
Gast (S-1-5-21-3038766165-3120518270-3538088492-501 - Limited - Disabled)
Max-Uttendorfer (S-1-5-21-3038766165-3120518270-3538088492-1000 - Administrator - Enabled) => C:\Users\Max-Uttendorfer
Netzbenutzer (S-1-5-21-3038766165-3120518270-3538088492-1001 - Administrator - Enabled)

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.12) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)
Audacity 1.2.6 (HKLM-x32\...\Audacity_is1) (Version:  - )
Audiograbber 1.83 SE  (HKLM-x32\...\Audiograbber) (Version: 1.83 SE  - Audiograbber)
Audiograbber MP3-Plugin (HKLM-x32\...\Audiograbber-Lame) (Version: 1.0 - AG)
Avira (HKLM-x32\...\{a5e00a72-db4a-4f77-8874-d1265b8fcd7e}) (Version: 1.1.42.10415 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.42.10415 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.12.408 - Avira Operations GmbH & Co. KG)
CCleaner (HKLM\...\CCleaner) (Version: 5.00 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.4.0.2838 - CDBurnerXP)
Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
EASEUS Data Recovery Wizard Professional 5.5.1 Demo (HKLM-x32\...\EASEUS Data Recovery Wizard Professional 5.5.1 Demo_is1) (Version:  - EASEUS)
Etron USB3.0 Host Controller (HKLM-x32\...\InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}) (Version: 0.96 - Etron Technology)
Etron USB3.0 Host Controller (x32 Version: 0.96 - Etron Technology) Hidden
Free YouTube to MP3 Converter version 3.12.50.1122 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.50.1122 - DVDVideoSoft Ltd.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 44.0.2403.130 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6710.2136 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.28.1 - Google Inc.) Hidden
Guitar Pro 5.2 (HKLM-x32\...\Guitar Pro 5_is1) (Version:  - Arobas Music)
Guitar Pro 6 (HKLM-x32\...\{14A487F2-1259-4E6C-AE3C-3C888DDBCB60}_is1) (Version:  - Arobas Music)
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Officejet 4620 series - Grundlegende Software für das Gerät (HKLM\...\{B16F9E6E-1388-472C-98C3-F32D397EF85D}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet 4620 series Hilfe (HKLM-x32\...\{72EDA2AC-2908-4BB3-97E5-4F9DDEBF9731}) (Version: 6.0.0 - Hewlett Packard)
HP Officejet Pro 8620 - Grundlegende Software für das Gerät (HKLM\...\{F6CE08BC-6929-412E-BB42-A9A7CD9721D7}) (Version: 32.3.198.49673 - Hewlett-Packard Co.)
HP Officejet Pro 8620 Hilfe (HKLM-x32\...\{F8E43C63-DFF2-4134-A46C-2A6F00517A35}) (Version: 32.0.0 - Hewlett Packard)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.0.1008 - Intel Corporation)
Intel® Chipsatz-Gerätesoftware (x32 Version: 10.0.13 - Intel(R) Corporation) Hidden
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM-x32\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 39.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 39.0.3 (x86 de)) (Version: 39.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.1.1 - Mozilla)
Nvu 1.0 (HKLM-x32\...\Nvu_is1) (Version: 1.0 - Thorsten Fritz)
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.23.623.2010 - Realtek)
Spotify (HKU\S-1-5-21-3038766165-3120518270-3538088492-1000\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)
StarMoney (x32 Version: 3.0.0.124 - StarFinanz) Hidden
StarMoney (x32 Version: 4.0.0.203 - StarFinanz) Hidden
StarMoney 8.0 S-Edition (HKLM-x32\...\{091A81E2-5385-4514-84AB-D361A869C152}) (Version: 8.0 - Star Finanz GmbH)
StarMoney 9.0 S-Edition (HKLM-x32\...\{4F2ED2F5-F812-4391-B2EF-A86780CCA2C1}) (Version: 9.0 - Star Finanz GmbH)
TAPI Services for FRITZ!Box (HKLM\...\{8505C641-422E-4E3C-B6B0-0F070E289FDD}) (Version: 1.0.6 - AVM Berlin)
TuxGuitar (HKLM-x32\...\{03534DA5-2F88-4B8E-A978-849B979E1B8F}) (Version: 1.2 - Herac)
VLC media player 1.1.11 (HKLM-x32\...\VLC media player) (Version: 1.1.11 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Wiederherstellungspunkte =========================

10-08-2015 23:46:13 Geplanter Prüfpunkt
11-08-2015 17:08:57 Wiederherstellungsvorgang

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2009-07-14 04:34 - 2013-08-06 17:59 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {08B0DE10-A0FB-45C4-B6DA-D78CC1EF2A8F} - System32\Tasks\{6D0A9B16-E462-4904-8F44-8E1BEA6AF4C7} => C:\Users\Max-Uttendorfer\Desktop\SESSION\SESSION.EXE [1993-03-15] ()
Task: {0BFFCF06-330A-4300-AAA2-27512A93B69B} - System32\Tasks\{15052B15-FFEC-4FCE-8A4C-E9B024E660BD} => pcalua.exe -a D:\Downloads\avira_antivir_personal_de.exe -d D:\Downloads
Task: {16FC7402-B700-4B23-A89F-66E72F596532} - System32\Tasks\{6F5CD08E-921D-4C12-B6C5-B64FC58E0657} => C:\Users\Max-Uttendorfer\Desktop\SESSION\SESSION.EXE [1993-03-15] ()
Task: {248E700F-267E-4048-AA0A-287404555228} - System32\Tasks\{5D002866-F188-4E6C-AFE7-D6E71FD64D16} => pcalua.exe -a C:\Users\Max-Uttendorfer\AppData\Local\Temp\Temp3_ME_Win7-64_Win7_Vista64_Vista_XP64_XP(7.0.4.1197).zip\ME(7.0.4.1197)\setup.exe
Task: {35021F32-78F4-4764-A350-F4497685FD2E} - System32\Tasks\GoogleUpdateTaskMachineCore1d000295cae05eb => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-20] (Google Inc.)
Task: {3F346BA3-5F46-4D62-A013-B2A1D1DF1DFD} - System32\Tasks\FaxArchive_CN2952334D05S1 => C:\Program Files\HP\HP Officejet 4620 series\Bin\FaxApplications.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {415E7819-7260-4DF6-A396-F89717308481} - System32\Tasks\{14DE4FC6-6344-4A52-9AF8-234972EBEA60} => C:\Users\Max-Uttendorfer\Desktop\SESSION\SESSION.EXE [1993-03-15] ()
Task: {524C2EBE-AFF2-48D6-93CC-47186D554297} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-20] (Google Inc.)
Task: {543436FA-9659-4FE9-A578-E03432A7BA63} - System32\Tasks\{8E5DD701-3732-4888-91A5-27D3484A0622} => pcalua.exe -a F:\SETUP.EXE -d F:\ -c /AUTORUN
Task: {67FB7233-92BF-4DB0-A788-D21AD193D73F} - System32\Tasks\{E8FE53EE-ADBD-4390-91BD-B36868F7B457} => C:\Users\Max-Uttendorfer\Desktop\SESSION\SESSION.EXE [1993-03-15] ()
Task: {6B11642C-0680-4240-A9B9-28875A4C5242} - System32\Tasks\{BF16772A-710B-4FAD-A429-275B8700F9FC} => C:\Users\Max-Uttendorfer\Desktop\SESSION\SESSION.EXE [1993-03-15] ()
Task: {9275DC2A-04C6-4A41-BF18-3CC2F847D193} - System32\Tasks\{131E3220-3F47-4B8C-A612-9EBCF15D804C} => pcalua.exe -a C:\Users\Max-Uttendorfer\AppData\Local\Temp\Temp2_ME_Win7-64_Win7_Vista64_Vista_XP64_XP(7.0.4.1197).zip\ME(7.0.4.1197)\setup.exe
Task: {981D8AED-6CCD-4382-B3E1-A98E9000E5EF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-12] (Adobe Systems Incorporated)
Task: {9CE9F07D-4C5B-45A5-AC9D-F49DA5CA6630} - System32\Tasks\{6ECB3F04-4F8B-4BB9-B16E-D2DCB1178A46} => C:\Users\Max-Uttendorfer\Desktop\SESSION\SESSION.EXE [1993-03-15] ()
Task: {A505EE19-DFDB-426F-84FC-48CEF17D344C} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {B78DBAD3-D782-42BA-B3F9-A92890B6D8E4} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-20] (Google Inc.)
Task: {B8D4DB47-8DF7-4F7B-A6A9-6842DC7BE994} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-11-21] (Piriform Ltd)
Task: {C81B3434-72BD-4D27-9F46-54E54814A4A5} - System32\Tasks\{40C25AE8-2B5C-4779-8222-056B9AF2F66E} => C:\Users\Max-Uttendorfer\Desktop\SESSION\SESSION.EXE [1993-03-15] ()
Task: {DB5193B6-A782-4108-8E0A-F0143507345E} - System32\Tasks\HPCustParticipation HP Officejet 4620 series => C:\Program Files\HP\HP Officejet 4620 series\Bin\HPCustPartic.exe
Task: {DBE1DBCB-2034-49BC-B86F-91826DBBF4C4} - System32\Tasks\{E9516B3F-4F48-424F-811B-956FD2CEFF4B} => C:\Users\Max-Uttendorfer\Desktop\SESSION\SESSION.EXE [1993-03-15] ()
Task: {E8D7C429-307B-4D7D-AF39-2628BDAF331A} - System32\Tasks\{DF04E1FB-8AB7-4495-95B1-D485B316DB3D} => C:\Users\Max-Uttendorfer\Desktop\SESSION\SESSION.EXE [1993-03-15] ()
Task: {ED3FAACF-4546-4846-A249-B72B466AC40F} - System32\Tasks\{ABD6480F-D822-4DD1-A7BE-0C3B75250E36} => C:\Users\Max-Uttendorfer\Desktop\SESSION\SESSION.EXE [1993-03-15] ()
Task: {FE1F006C-C9EC-4DA6-9242-22B674C6EA49} - System32\Tasks\{3802CBBA-F16E-44C9-A020-79BC4D4F769C} => C:\Users\Max-Uttendorfer\Desktop\SESSION\SESSION.EXE [1993-03-15] ()

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FaxApplications.exe_{305DACBE-2951-4848-A4A7-5F4033F9ED69}.job => C:\Program Files\HP\HP Officejet Pro 8620\Bin\FaxApplications.exe
Task: C:\Windows\Tasks\FaxArchive_CN2952334D05S1.job => C:\Program Files\HP\HP Officejet 4620 series\Bin\FaxApplications.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf89e2510c602a.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cfec85fbfacc4c.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d000295cae05eb.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\ScanToPCActivationApp.exe_{3331C88F-49C2-4AC0-875B-6C5C1BD1F338}.job => C:\Program Files\HP\HP Officejet Pro 8620\Bin\ScanToPCActivationApp.exe
Task: C:\Windows\Tasks\Toolbox.exe_{03AC45F7-9A1A-421C-B5EC-8FFD5B576B57}.job => C:\Program Files\HP\HP Officejet Pro 8620\Bin\Toolbox.exe

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2011-08-07 20:08 - 2006-02-23 11:35 - 00020480 _____ () C:\Windows\System32\FritzColorPort64.dll
2011-08-07 20:08 - 2006-02-22 10:39 - 00020480 _____ () C:\Windows\System32\FritzPort64.dll
2011-01-27 08:11 - 2011-01-27 08:11 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-11-22 02:03 - 2014-11-22 02:03 - 00053248 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2014-10-16 09:46 - 2014-10-16 09:46 - 00169472 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\93182e9779b8be0f688fd0784df6d7fb\IsdiInterop.ni.dll
2011-08-07 15:25 - 2010-11-05 23:50 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE trusted site: HKU\S-1-5-21-3038766165-3120518270-3538088492-1000\...\proximize.me -> hxxps://proximize.me


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-3038766165-3120518270-3538088492-1000\Control Panel\Desktop\\Wallpaper -> 
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)


==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [{2CCCEE97-2B71-4B17-874E-5CFCB319C2C4}] => (Allow) C:\Program Files (x86)\StarMoney 9.0 S-Edition\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{49A113FA-4685-482A-8267-2C72E27EDB29}] => (Allow) C:\Program Files (x86)\StarMoney 9.0 S-Edition\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{9324D686-5A22-4097-BB75-9C7CF551D19F}] => (Allow) C:\Program Files (x86)\StarMoney 9.0 S-Edition\app\StarMoney.exe
FirewallRules: [{78421933-82D7-4245-BFEA-6EF2A5F9FD57}] => (Allow) C:\Program Files (x86)\StarMoney 9.0 S-Edition\app\StarMoney.exe
FirewallRules: [{0980C3B4-6EB8-40DB-B948-F118F267F301}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8620\bin\FaxApplications.exe
FirewallRules: [{5073BE41-575E-4B90-96D4-D01EA3B100A7}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8620\bin\DigitalWizards.exe
FirewallRules: [{0C016400-BC3E-4E94-A10A-805C15F1E964}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8620\bin\SendAFax.exe
FirewallRules: [{4721BF95-C366-492F-99E9-545E84DA8AC5}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8620\Bin\DeviceSetup.exe
FirewallRules: [{89E9EA42-C6D4-4F8C-9E9D-02943D9D3948}] => (Allow) LPort=5357
FirewallRules: [{08561A69-8F98-450B-9E67-65CFA3E1C4C1}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8620\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [TCP Query User{7023581F-4C3D-4FDE-9D9C-0B6C42D4EC63}C:\users\max-uttendorfer\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\max-uttendorfer\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{C1AC8C53-E97E-4042-8881-94974593CB81}C:\users\max-uttendorfer\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\max-uttendorfer\appdata\roaming\spotify\spotify.exe
FirewallRules: [{E3D4F6A0-F0F5-404F-92A4-FBFADF812D16}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{2EC2A1CD-F70D-4FD0-B040-43DEF7412991}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{76F1F0B4-FBF1-4C2B-9FD0-FD72436BDE1D}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{8252278A-20F2-455D-BA4B-14E9034DB478}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{4C60CA18-1938-4E93-9922-B2488A5F4343}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Fehlerhafte Geräte im Gerätemanager =============

Name: Audiocontroller für Multimedia
Description: Audiocontroller für Multimedia
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (08/10/2015 04:47:00 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {499b7408-30d4-4fea-85ae-117784bc17dc}

Error: (08/10/2015 04:36:19 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.

Error: (08/10/2015 09:12:16 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: GWXUX.exe, Version: 6.3.9600.17923, Zeitstempel: 0x55945dbd
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18869, Zeitstempel: 0x556366f2
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000004ada4
ID des fehlerhaften Prozesses: 0xd40
Startzeit der fehlerhaften Anwendung: 0xGWXUX.exe0
Pfad der fehlerhaften Anwendung: GWXUX.exe1
Pfad des fehlerhaften Moduls: GWXUX.exe2
Berichtskennung: GWXUX.exe3

Error: (08/08/2015 09:08:45 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: GWXUX.exe, Version: 6.3.9600.17923, Zeitstempel: 0x55945dbd
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18869, Zeitstempel: 0x556366f2
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000004ada4
ID des fehlerhaften Prozesses: 0x12d8
Startzeit der fehlerhaften Anwendung: 0xGWXUX.exe0
Pfad der fehlerhaften Anwendung: GWXUX.exe1
Pfad des fehlerhaften Moduls: GWXUX.exe2
Berichtskennung: GWXUX.exe3

Error: (08/07/2015 05:02:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: winconfo.exe, Version: 0.0.0.0, Zeitstempel: 0x552e6a97
Name des fehlerhaften Moduls: winconfo.exe, Version: 0.0.0.0, Zeitstempel: 0x552e6a97
Ausnahmecode: 0xc0000409
Fehleroffset: 0x00002c33
ID des fehlerhaften Prozesses: 0x1288
Startzeit der fehlerhaften Anwendung: 0xwinconfo.exe0
Pfad der fehlerhaften Anwendung: winconfo.exe1
Pfad des fehlerhaften Moduls: winconfo.exe2
Berichtskennung: winconfo.exe3

Error: (07/24/2015 03:41:04 PM) (Source: System Restore) (EventID: 8211) (User: )
Description: Der geplante Wiederherstellungspunkt konnte nicht erstellt werden. Zusätzliche Informationen: (0x8004231f).

Error: (07/24/2015 03:41:04 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Beschreibung = Geplanter Prüfpunkt; Fehler = 0x8004231f).

Error: (07/24/2015 02:10:26 PM) (Source: ESENT) (EventID: 482) (User: )
Description: taskhost (1104) WebCacheLocal: Versuch, in Datei "C:\Users\Max-Uttendorfer\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs" bei Offset 0 (0x0000000000000000) für 393216 (0x00060000) Bytes zu schreiben, ist nach taskhost0 Sekunden mit Systemfehler 112 (0x00000070): "Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung. " fehlgeschlagen. Fehler -1808 (0xfffff8f0) bei Schreiboperation. Wenn dieser Zustand andauert, ist die Datei möglicherweise beschädigt und muss aus einer vorherigen Sicherung wiederhergestellt werden.

Error: (07/24/2015 02:05:38 PM) (Source: ESENT) (EventID: 482) (User: )
Description: taskhost (1104) WebCacheLocal: Versuch, in Datei "C:\Users\Max-Uttendorfer\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs" bei Offset 0 (0x0000000000000000) für 393216 (0x00060000) Bytes zu schreiben, ist nach taskhost0 Sekunden mit Systemfehler 112 (0x00000070): "Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung. " fehlgeschlagen. Fehler -1808 (0xfffff8f0) bei Schreiboperation. Wenn dieser Zustand andauert, ist die Datei möglicherweise beschädigt und muss aus einer vorherigen Sicherung wiederhergestellt werden.

Error: (07/24/2015 02:05:37 PM) (Source: ESENT) (EventID: 482) (User: )
Description: taskhost (1104) WebCacheLocal: Versuch, in Datei "C:\Users\Max-Uttendorfer\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs" bei Offset 0 (0x0000000000000000) für 393216 (0x00060000) Bytes zu schreiben, ist nach taskhost0 Sekunden mit Systemfehler 112 (0x00000070): "Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung. " fehlgeschlagen. Fehler -1808 (0xfffff8f0) bei Schreiboperation. Wenn dieser Zustand andauert, ist die Datei möglicherweise beschädigt und muss aus einer vorherigen Sicherung wiederhergestellt werden.


Systemfehler:
=============
Error: (08/12/2015 05:50:31 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (08/12/2015 05:49:51 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)

Error: (08/12/2015 05:48:51 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst StarMoney 9.0 OnlineUpdate erreicht.

Error: (08/12/2015 05:48:51 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst StarMoney 8.0 OnlineUpdate erreicht.

Error: (08/12/2015 05:38:52 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst StarMoney 9.0 OnlineUpdate erreicht.

Error: (08/12/2015 05:38:52 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst StarMoney 8.0 OnlineUpdate erreicht.

Error: (08/12/2015 05:35:04 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst StarMoney 9.0 OnlineUpdate erreicht.

Error: (08/12/2015 05:35:04 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst StarMoney 8.0 OnlineUpdate erreicht.

Error: (08/12/2015 05:33:52 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst StarMoney 9.0 OnlineUpdate erreicht.

Error: (08/12/2015 05:33:52 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst StarMoney 8.0 OnlineUpdate erreicht.


Microsoft Office:
=========================
Error: (08/10/2015 04:47:00 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {499b7408-30d4-4fea-85ae-117784bc17dc}

Error: (08/10/2015 04:36:19 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifestC:\Users\Max-Uttendorfer\Downloads\esetsmartinstaller_deu.exe

Error: (08/10/2015 09:12:16 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: GWXUX.exe6.3.9600.1792355945dbdntdll.dll6.1.7601.18869556366f2c0000005000000000004ada4d4001d0d33be1a8b544C:\Windows\System32\GWX\GWXUX.exeC:\Windows\SYSTEM32\ntdll.dll20c26c02-3f2f-11e5-a72a-404e57434401

Error: (08/08/2015 09:08:45 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: GWXUX.exe6.3.9600.1792355945dbdntdll.dll6.1.7601.18869556366f2c0000005000000000004ada412d801d0d1a90f26476aC:\Windows\System32\GWX\GWXUX.exeC:\Windows\SYSTEM32\ntdll.dll4e2bf720-3d9c-11e5-bc55-404e57434401

Error: (08/07/2015 05:02:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: winconfo.exe0.0.0.0552e6a97winconfo.exe0.0.0.0552e6a97c000040900002c33128801d0d121fc5eff06C:\Users\Max-Uttendorfer\winconfo.exeC:\Users\Max-Uttendorfer\winconfo.exe4da2d29c-3d15-11e5-94c5-404e57434401

Error: (07/24/2015 03:41:04 PM) (Source: System Restore) (EventID: 8211) (User: )
Description: 0x8004231f

Error: (07/24/2015 03:41:04 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreationGeplanter Prüfpunkt0x8004231f

Error: (07/24/2015 02:10:26 PM) (Source: ESENT) (EventID: 482) (User: )
Description: taskhost1104WebCacheLocal: C:\Users\Max-Uttendorfer\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs0 (0x0000000000000000)393216 (0x00060000)-1808 (0xfffff8f0)112 (0x00000070)Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung. 0

Error: (07/24/2015 02:05:38 PM) (Source: ESENT) (EventID: 482) (User: )
Description: taskhost1104WebCacheLocal: C:\Users\Max-Uttendorfer\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs0 (0x0000000000000000)393216 (0x00060000)-1808 (0xfffff8f0)112 (0x00000070)Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung. 0

Error: (07/24/2015 02:05:37 PM) (Source: ESENT) (EventID: 482) (User: )
Description: taskhost1104WebCacheLocal: C:\Users\Max-Uttendorfer\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs0 (0x0000000000000000)393216 (0x00060000)-1808 (0xfffff8f0)112 (0x00000070)Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung. 0


CodeIntegrity:
===================================
  Date: 2013-08-06 17:58:42.928
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-08-06 17:58:42.842
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Speicherinformationen =========================== 

Processor: Intel(R) Core(TM) i3-2100 CPU @ 3.10GHz
Prozentuale Nutzung des RAM: 18%
Installierter physikalischer RAM: 7912.67 MB
Verfügbarer physikalischer RAM: 6419.51 MB
Summe virtueller Speicher: 15823.55 MB
Verfügbarer virtueller Speicher: 14203.01 MB

==================== Laufwerke ================================

Drive c: () (Fixed) (Total:59.53 GB) (Free:10.47 GB) NTFS
Drive d: (Eigene Dateien) (Fixed) (Total:441.58 GB) (Free:294.47 GB) NTFS
Drive e: (STORE N GO) (Removable) (Total:1.82 GB) (Free:1.72 GB) FAT
Drive f: (GRMCHPXFREO_DE_DVD) (CDROM) (Total:2.97 GB) (Free:0 GB) UDF

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 59.6 GB) (Disk ID: B0FE9C2C)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=59.5 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 1267BE66)
Partition 1: (Not Active) - (Size=24.2 GB) - (Type=42)
Partition 2: (Active) - (Size=441.6 GB) - (Type=42)
Partition 3: (Not Active) - (Size=1048 KB) - (Type=42)

========================================================
Disk: 2 (MBR Code: Windows XP) (Size: 1.8 GB) (Disk ID: C3072E18)
Partition 1: (Not Active) - (Size=1.8 GB) - (Type=06)

==================== Ende von Ergebnis ============================

Code:

ATTFilter

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:11-08-2015 02
durchgeführt von Max-Uttendorfer (Administrator) auf PC (12-08-2015 05:50:46)
Gestartet von E:\Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:11-08-2015 02
durchgeführt von Max-Uttendorfer (2015-08-12 05:51:07)
Gestartet von E:\
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-3038766165-3120518270-3538088492-500 - Administrator - Disabled)
Gast (S-1-5-21-3038766165-3120518270-3538088492-501 - Limited - Disabled)
Max-Uttendorfer (S-1-5-21-3038766165-3120518270-3538088492-1000 - Administrator - Enabled) => C:\Users\Max-Uttendorfer
Netzbenutzer (S-1-5-21-3038766165-3120518270-3538088492-1001 - Administrator - Enabled)

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.12) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)
Audacity 1.2.6 (HKLM-x32\...\Audacity_is1) (Version:  - )
Audiograbber 1.83 SE  (HKLM-x32\...\Audiograbber) (Version: 1.83 SE  - Audiograbber)
Audiograbber MP3-Plugin (HKLM-x32\...\Audiograbber-Lame) (Version: 1.0 - AG)
Avira (HKLM-x32\...\{a5e00a72-db4a-4f77-8874-d1265b8fcd7e}) (Version: 1.1.42.10415 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.42.10415 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.12.408 - Avira Operations GmbH & Co. KG)
CCleaner (HKLM\...\CCleaner) (Version: 5.00 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.4.0.2838 - CDBurnerXP)
Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
EASEUS Data Recovery Wizard Professional 5.5.1 Demo (HKLM-x32\...\EASEUS Data Recovery Wizard Professional 5.5.1 Demo_is1) (Version:  - EASEUS)
Etron USB3.0 Host Controller (HKLM-x32\...\InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}) (Version: 0.96 - Etron Technology)
Etron USB3.0 Host Controller (x32 Version: 0.96 - Etron Technology) Hidden
Free YouTube to MP3 Converter version 3.12.50.1122 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.50.1122 - DVDVideoSoft Ltd.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 44.0.2403.130 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6710.2136 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.28.1 - Google Inc.) Hidden
Guitar Pro 5.2 (HKLM-x32\...\Guitar Pro 5_is1) (Version:  - Arobas Music)
Guitar Pro 6 (HKLM-x32\...\{14A487F2-1259-4E6C-AE3C-3C888DDBCB60}_is1) (Version:  - Arobas Music)
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Officejet 4620 series - Grundlegende Software für das Gerät (HKLM\...\{B16F9E6E-1388-472C-98C3-F32D397EF85D}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet 4620 series Hilfe (HKLM-x32\...\{72EDA2AC-2908-4BB3-97E5-4F9DDEBF9731}) (Version: 6.0.0 - Hewlett Packard)
HP Officejet Pro 8620 - Grundlegende Software für das Gerät (HKLM\...\{F6CE08BC-6929-412E-BB42-A9A7CD9721D7}) (Version: 32.3.198.49673 - Hewlett-Packard Co.)
HP Officejet Pro 8620 Hilfe (HKLM-x32\...\{F8E43C63-DFF2-4134-A46C-2A6F00517A35}) (Version: 32.0.0 - Hewlett Packard)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.0.1008 - Intel Corporation)
Intel® Chipsatz-Gerätesoftware (x32 Version: 10.0.13 - Intel(R) Corporation) Hidden
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM-x32\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 39.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 39.0.3 (x86 de)) (Version: 39.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.1.1 - Mozilla)
Nvu 1.0 (HKLM-x32\...\Nvu_is1) (Version: 1.0 - Thorsten Fritz)
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.23.623.2010 - Realtek)
Spotify (HKU\S-1-5-21-3038766165-3120518270-3538088492-1000\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)
StarMoney (x32 Version: 3.0.0.124 - StarFinanz) Hidden
StarMoney (x32 Version: 4.0.0.203 - StarFinanz) Hidden
StarMoney 8.0 S-Edition (HKLM-x32\...\{091A81E2-5385-4514-84AB-D361A869C152}) (Version: 8.0 - Star Finanz GmbH)
StarMoney 9.0 S-Edition (HKLM-x32\...\{4F2ED2F5-F812-4391-B2EF-A86780CCA2C1}) (Version: 9.0 - Star Finanz GmbH)
TAPI Services for FRITZ!Box (HKLM\...\{8505C641-422E-4E3C-B6B0-0F070E289FDD}) (Version: 1.0.6 - AVM Berlin)
TuxGuitar (HKLM-x32\...\{03534DA5-2F88-4B8E-A978-849B979E1B8F}) (Version: 1.2 - Herac)
VLC media player 1.1.11 (HKLM-x32\...\VLC media player) (Version: 1.1.11 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Wiederherstellungspunkte =========================

10-08-2015 23:46:13 Geplanter Prüfpunkt
11-08-2015 17:08:57 Wiederherstellungsvorgang

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2009-07-14 04:34 - 2013-08-06 17:59 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {08B0DE10-A0FB-45C4-B6DA-D78CC1EF2A8F} - System32\Tasks\{6D0A9B16-E462-4904-8F44-8E1BEA6AF4C7} => C:\Users\Max-Uttendorfer\Desktop\SESSION\SESSION.EXE [1993-03-15] ()
Task: {0BFFCF06-330A-4300-AAA2-27512A93B69B} - System32\Tasks\{15052B15-FFEC-4FCE-8A4C-E9B024E660BD} => pcalua.exe -a D:\Downloads\avira_antivir_personal_de.exe -d D:\Downloads
Task: {16FC7402-B700-4B23-A89F-66E72F596532} - System32\Tasks\{6F5CD08E-921D-4C12-B6C5-B64FC58E0657} => C:\Users\Max-Uttendorfer\Desktop\SESSION\SESSION.EXE [1993-03-15] ()
Task: {248E700F-267E-4048-AA0A-287404555228} - System32\Tasks\{5D002866-F188-4E6C-AFE7-D6E71FD64D16} => pcalua.exe -a C:\Users\Max-Uttendorfer\AppData\Local\Temp\Temp3_ME_Win7-64_Win7_Vista64_Vista_XP64_XP(7.0.4.1197).zip\ME(7.0.4.1197)\setup.exe
Task: {35021F32-78F4-4764-A350-F4497685FD2E} - System32\Tasks\GoogleUpdateTaskMachineCore1d000295cae05eb => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-20] (Google Inc.)
Task: {3F346BA3-5F46-4D62-A013-B2A1D1DF1DFD} - System32\Tasks\FaxArchive_CN2952334D05S1 => C:\Program Files\HP\HP Officejet 4620 series\Bin\FaxApplications.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {415E7819-7260-4DF6-A396-F89717308481} - System32\Tasks\{14DE4FC6-6344-4A52-9AF8-234972EBEA60} => C:\Users\Max-Uttendorfer\Desktop\SESSION\SESSION.EXE [1993-03-15] ()
Task: {524C2EBE-AFF2-48D6-93CC-47186D554297} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-20] (Google Inc.)
Task: {543436FA-9659-4FE9-A578-E03432A7BA63} - System32\Tasks\{8E5DD701-3732-4888-91A5-27D3484A0622} => pcalua.exe -a F:\SETUP.EXE -d F:\ -c /AUTORUN
Task: {67FB7233-92BF-4DB0-A788-D21AD193D73F} - System32\Tasks\{E8FE53EE-ADBD-4390-91BD-B36868F7B457} => C:\Users\Max-Uttendorfer\Desktop\SESSION\SESSION.EXE [1993-03-15] ()
Task: {6B11642C-0680-4240-A9B9-28875A4C5242} - System32\Tasks\{BF16772A-710B-4FAD-A429-275B8700F9FC} => C:\Users\Max-Uttendorfer\Desktop\SESSION\SESSION.EXE [1993-03-15] ()
Task: {9275DC2A-04C6-4A41-BF18-3CC2F847D193} - System32\Tasks\{131E3220-3F47-4B8C-A612-9EBCF15D804C} => pcalua.exe -a C:\Users\Max-Uttendorfer\AppData\Local\Temp\Temp2_ME_Win7-64_Win7_Vista64_Vista_XP64_XP(7.0.4.1197).zip\ME(7.0.4.1197)\setup.exe
Task: {981D8AED-6CCD-4382-B3E1-A98E9000E5EF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-12] (Adobe Systems Incorporated)
Task: {9CE9F07D-4C5B-45A5-AC9D-F49DA5CA6630} - System32\Tasks\{6ECB3F04-4F8B-4BB9-B16E-D2DCB1178A46} => C:\Users\Max-Uttendorfer\Desktop\SESSION\SESSION.EXE [1993-03-15] ()
Task: {A505EE19-DFDB-426F-84FC-48CEF17D344C} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {B78DBAD3-D782-42BA-B3F9-A92890B6D8E4} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-20] (Google Inc.)
Task: {B8D4DB47-8DF7-4F7B-A6A9-6842DC7BE994} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-11-21] (Piriform Ltd)
Task: {C81B3434-72BD-4D27-9F46-54E54814A4A5} - System32\Tasks\{40C25AE8-2B5C-4779-8222-056B9AF2F66E} => C:\Users\Max-Uttendorfer\Desktop\SESSION\SESSION.EXE [1993-03-15] ()
Task: {DB5193B6-A782-4108-8E0A-F0143507345E} - System32\Tasks\HPCustParticipation HP Officejet 4620 series => C:\Program Files\HP\HP Officejet 4620 series\Bin\HPCustPartic.exe
Task: {DBE1DBCB-2034-49BC-B86F-91826DBBF4C4} - System32\Tasks\{E9516B3F-4F48-424F-811B-956FD2CEFF4B} => C:\Users\Max-Uttendorfer\Desktop\SESSION\SESSION.EXE [1993-03-15] ()
Task: {E8D7C429-307B-4D7D-AF39-2628BDAF331A} - System32\Tasks\{DF04E1FB-8AB7-4495-95B1-D485B316DB3D} => C:\Users\Max-Uttendorfer\Desktop\SESSION\SESSION.EXE [1993-03-15] ()
Task: {ED3FAACF-4546-4846-A249-B72B466AC40F} - System32\Tasks\{ABD6480F-D822-4DD1-A7BE-0C3B75250E36} => C:\Users\Max-Uttendorfer\Desktop\SESSION\SESSION.EXE [1993-03-15] ()
Task: {FE1F006C-C9EC-4DA6-9242-22B674C6EA49} - System32\Tasks\{3802CBBA-F16E-44C9-A020-79BC4D4F769C} => C:\Users\Max-Uttendorfer\Desktop\SESSION\SESSION.EXE [1993-03-15] ()

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FaxApplications.exe_{305DACBE-2951-4848-A4A7-5F4033F9ED69}.job => C:\Program Files\HP\HP Officejet Pro 8620\Bin\FaxApplications.exe
Task: C:\Windows\Tasks\FaxArchive_CN2952334D05S1.job => C:\Program Files\HP\HP Officejet 4620 series\Bin\FaxApplications.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf89e2510c602a.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cfec85fbfacc4c.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d000295cae05eb.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\ScanToPCActivationApp.exe_{3331C88F-49C2-4AC0-875B-6C5C1BD1F338}.job => C:\Program Files\HP\HP Officejet Pro 8620\Bin\ScanToPCActivationApp.exe
Task: C:\Windows\Tasks\Toolbox.exe_{03AC45F7-9A1A-421C-B5EC-8FFD5B576B57}.job => C:\Program Files\HP\HP Officejet Pro 8620\Bin\Toolbox.exe

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2011-08-07 20:08 - 2006-02-23 11:35 - 00020480 _____ () C:\Windows\System32\FritzColorPort64.dll
2011-08-07 20:08 - 2006-02-22 10:39 - 00020480 _____ () C:\Windows\System32\FritzPort64.dll
2011-01-27 08:11 - 2011-01-27 08:11 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-11-22 02:03 - 2014-11-22 02:03 - 00053248 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2014-10-16 09:46 - 2014-10-16 09:46 - 00169472 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\93182e9779b8be0f688fd0784df6d7fb\IsdiInterop.ni.dll
2011-08-07 15:25 - 2010-11-05 23:50 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE trusted site: HKU\S-1-5-21-3038766165-3120518270-3538088492-1000\...\proximize.me -> hxxps://proximize.me


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-3038766165-3120518270-3538088492-1000\Control Panel\Desktop\\Wallpaper -> 
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)


==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [{2CCCEE97-2B71-4B17-874E-5CFCB319C2C4}] => (Allow) C:\Program Files (x86)\StarMoney 9.0 S-Edition\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{49A113FA-4685-482A-8267-2C72E27EDB29}] => (Allow) C:\Program Files (x86)\StarMoney 9.0 S-Edition\ouservice\StarMoneyOnlineUpdate.exe
FirewallRules: [{9324D686-5A22-4097-BB75-9C7CF551D19F}] => (Allow) C:\Program Files (x86)\StarMoney 9.0 S-Edition\app\StarMoney.exe
FirewallRules: [{78421933-82D7-4245-BFEA-6EF2A5F9FD57}] => (Allow) C:\Program Files (x86)\StarMoney 9.0 S-Edition\app\StarMoney.exe
FirewallRules: [{0980C3B4-6EB8-40DB-B948-F118F267F301}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8620\bin\FaxApplications.exe
FirewallRules: [{5073BE41-575E-4B90-96D4-D01EA3B100A7}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8620\bin\DigitalWizards.exe
FirewallRules: [{0C016400-BC3E-4E94-A10A-805C15F1E964}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8620\bin\SendAFax.exe
FirewallRules: [{4721BF95-C366-492F-99E9-545E84DA8AC5}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8620\Bin\DeviceSetup.exe
FirewallRules: [{89E9EA42-C6D4-4F8C-9E9D-02943D9D3948}] => (Allow) LPort=5357
FirewallRules: [{08561A69-8F98-450B-9E67-65CFA3E1C4C1}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8620\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [TCP Query User{7023581F-4C3D-4FDE-9D9C-0B6C42D4EC63}C:\users\max-uttendorfer\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\max-uttendorfer\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{C1AC8C53-E97E-4042-8881-94974593CB81}C:\users\max-uttendorfer\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\max-uttendorfer\appdata\roaming\spotify\spotify.exe
FirewallRules: [{E3D4F6A0-F0F5-404F-92A4-FBFADF812D16}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{2EC2A1CD-F70D-4FD0-B040-43DEF7412991}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{76F1F0B4-FBF1-4C2B-9FD0-FD72436BDE1D}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{8252278A-20F2-455D-BA4B-14E9034DB478}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{4C60CA18-1938-4E93-9922-B2488A5F4343}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Fehlerhafte Geräte im Gerätemanager =============

Name: Audiocontroller für Multimedia
Description: Audiocontroller für Multimedia
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (08/10/2015 04:47:00 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {499b7408-30d4-4fea-85ae-117784bc17dc}

Error: (08/10/2015 04:36:19 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.

Error: (08/10/2015 09:12:16 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: GWXUX.exe, Version: 6.3.9600.17923, Zeitstempel: 0x55945dbd
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18869, Zeitstempel: 0x556366f2
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000004ada4
ID des fehlerhaften Prozesses: 0xd40
Startzeit der fehlerhaften Anwendung: 0xGWXUX.exe0
Pfad der fehlerhaften Anwendung: GWXUX.exe1
Pfad des fehlerhaften Moduls: GWXUX.exe2
Berichtskennung: GWXUX.exe3

Error: (08/08/2015 09:08:45 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: GWXUX.exe, Version: 6.3.9600.17923, Zeitstempel: 0x55945dbd
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18869, Zeitstempel: 0x556366f2
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000004ada4
ID des fehlerhaften Prozesses: 0x12d8
Startzeit der fehlerhaften Anwendung: 0xGWXUX.exe0
Pfad der fehlerhaften Anwendung: GWXUX.exe1
Pfad des fehlerhaften Moduls: GWXUX.exe2
Berichtskennung: GWXUX.exe3

Error: (08/07/2015 05:02:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: winconfo.exe, Version: 0.0.0.0, Zeitstempel: 0x552e6a97
Name des fehlerhaften Moduls: winconfo.exe, Version: 0.0.0.0, Zeitstempel: 0x552e6a97
Ausnahmecode: 0xc0000409
Fehleroffset: 0x00002c33
ID des fehlerhaften Prozesses: 0x1288
Startzeit der fehlerhaften Anwendung: 0xwinconfo.exe0
Pfad der fehlerhaften Anwendung: winconfo.exe1
Pfad des fehlerhaften Moduls: winconfo.exe2
Berichtskennung: winconfo.exe3

Error: (07/24/2015 03:41:04 PM) (Source: System Restore) (EventID: 8211) (User: )
Description: Der geplante Wiederherstellungspunkt konnte nicht erstellt werden. Zusätzliche Informationen: (0x8004231f).

Error: (07/24/2015 03:41:04 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Beschreibung = Geplanter Prüfpunkt; Fehler = 0x8004231f).

Error: (07/24/2015 02:10:26 PM) (Source: ESENT) (EventID: 482) (User: )
Description: taskhost (1104) WebCacheLocal: Versuch, in Datei "C:\Users\Max-Uttendorfer\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs" bei Offset 0 (0x0000000000000000) für 393216 (0x00060000) Bytes zu schreiben, ist nach taskhost0 Sekunden mit Systemfehler 112 (0x00000070): "Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung. " fehlgeschlagen. Fehler -1808 (0xfffff8f0) bei Schreiboperation. Wenn dieser Zustand andauert, ist die Datei möglicherweise beschädigt und muss aus einer vorherigen Sicherung wiederhergestellt werden.

Error: (07/24/2015 02:05:38 PM) (Source: ESENT) (EventID: 482) (User: )
Description: taskhost (1104) WebCacheLocal: Versuch, in Datei "C:\Users\Max-Uttendorfer\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs" bei Offset 0 (0x0000000000000000) für 393216 (0x00060000) Bytes zu schreiben, ist nach taskhost0 Sekunden mit Systemfehler 112 (0x00000070): "Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung. " fehlgeschlagen. Fehler -1808 (0xfffff8f0) bei Schreiboperation. Wenn dieser Zustand andauert, ist die Datei möglicherweise beschädigt und muss aus einer vorherigen Sicherung wiederhergestellt werden.

Error: (07/24/2015 02:05:37 PM) (Source: ESENT) (EventID: 482) (User: )
Description: taskhost (1104) WebCacheLocal: Versuch, in Datei "C:\Users\Max-Uttendorfer\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs" bei Offset 0 (0x0000000000000000) für 393216 (0x00060000) Bytes zu schreiben, ist nach taskhost0 Sekunden mit Systemfehler 112 (0x00000070): "Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung. " fehlgeschlagen. Fehler -1808 (0xfffff8f0) bei Schreiboperation. Wenn dieser Zustand andauert, ist die Datei möglicherweise beschädigt und muss aus einer vorherigen Sicherung wiederhergestellt werden.


Systemfehler:
=============
Error: (08/12/2015 05:50:31 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (08/12/2015 05:49:51 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)

Error: (08/12/2015 05:48:51 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst StarMoney 9.0 OnlineUpdate erreicht.

Error: (08/12/2015 05:48:51 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst StarMoney 8.0 OnlineUpdate erreicht.

Error: (08/12/2015 05:38:52 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst StarMoney 9.0 OnlineUpdate erreicht.

Error: (08/12/2015 05:38:52 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst StarMoney 8.0 OnlineUpdate erreicht.

Error: (08/12/2015 05:35:04 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst StarMoney 9.0 OnlineUpdate erreicht.

Error: (08/12/2015 05:35:04 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst StarMoney 8.0 OnlineUpdate erreicht.

Error: (08/12/2015 05:33:52 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst StarMoney 9.0 OnlineUpdate erreicht.

Error: (08/12/2015 05:33:52 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst StarMoney 8.0 OnlineUpdate erreicht.


Microsoft Office:
=========================
Error: (08/10/2015 04:47:00 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {499b7408-30d4-4fea-85ae-117784bc17dc}

Error: (08/10/2015 04:36:19 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifestC:\Users\Max-Uttendorfer\Downloads\esetsmartinstaller_deu.exe

Error: (08/10/2015 09:12:16 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: GWXUX.exe6.3.9600.1792355945dbdntdll.dll6.1.7601.18869556366f2c0000005000000000004ada4d4001d0d33be1a8b544C:\Windows\System32\GWX\GWXUX.exeC:\Windows\SYSTEM32\ntdll.dll20c26c02-3f2f-11e5-a72a-404e57434401

Error: (08/08/2015 09:08:45 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: GWXUX.exe6.3.9600.1792355945dbdntdll.dll6.1.7601.18869556366f2c0000005000000000004ada412d801d0d1a90f26476aC:\Windows\System32\GWX\GWXUX.exeC:\Windows\SYSTEM32\ntdll.dll4e2bf720-3d9c-11e5-bc55-404e57434401

Error: (08/07/2015 05:02:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: winconfo.exe0.0.0.0552e6a97winconfo.exe0.0.0.0552e6a97c000040900002c33128801d0d121fc5eff06C:\Users\Max-Uttendorfer\winconfo.exeC:\Users\Max-Uttendorfer\winconfo.exe4da2d29c-3d15-11e5-94c5-404e57434401

Error: (07/24/2015 03:41:04 PM) (Source: System Restore) (EventID: 8211) (User: )
Description: 0x8004231f

Error: (07/24/2015 03:41:04 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreationGeplanter Prüfpunkt0x8004231f

Error: (07/24/2015 02:10:26 PM) (Source: ESENT) (EventID: 482) (User: )
Description: taskhost1104WebCacheLocal: C:\Users\Max-Uttendorfer\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs0 (0x0000000000000000)393216 (0x00060000)-1808 (0xfffff8f0)112 (0x00000070)Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung. 0

Error: (07/24/2015 02:05:38 PM) (Source: ESENT) (EventID: 482) (User: )
Description: taskhost1104WebCacheLocal: C:\Users\Max-Uttendorfer\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs0 (0x0000000000000000)393216 (0x00060000)-1808 (0xfffff8f0)112 (0x00000070)Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung. 0

Error: (07/24/2015 02:05:37 PM) (Source: ESENT) (EventID: 482) (User: )
Description: taskhost1104WebCacheLocal: C:\Users\Max-Uttendorfer\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs0 (0x0000000000000000)393216 (0x00060000)-1808 (0xfffff8f0)112 (0x00000070)Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung. 0


CodeIntegrity:
===================================
  Date: 2013-08-06 17:58:42.928
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-08-06 17:58:42.842
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Speicherinformationen =========================== 

Processor: Intel(R) Core(TM) i3-2100 CPU @ 3.10GHz
Prozentuale Nutzung des RAM: 18%
Installierter physikalischer RAM: 7912.67 MB
Verfügbarer physikalischer RAM: 6419.51 MB
Summe virtueller Speicher: 15823.55 MB
Verfügbarer virtueller Speicher: 14203.01 MB

==================== Laufwerke ================================

Drive c: () (Fixed) (Total:59.53 GB) (Free:10.47 GB) NTFS
Drive d: (Eigene Dateien) (Fixed) (Total:441.58 GB) (Free:294.47 GB) NTFS
Drive e: (STORE N GO) (Removable) (Total:1.82 GB) (Free:1.72 GB) FAT
Drive f: (GRMCHPXFREO_DE_DVD) (CDROM) (Total:2.97 GB) (Free:0 GB) UDF

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 59.6 GB) (Disk ID: B0FE9C2C)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=59.5 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 1267BE66)
Partition 1: (Not Active) - (Size=24.2 GB) - (Type=42)
Partition 2: (Active) - (Size=441.6 GB) - (Type=42)
Partition 3: (Not Active) - (Size=1048 KB) - (Type=42)

========================================================
Disk: 2 (MBR Code: Windows XP) (Size: 1.8 GB) (Disk ID: C3072E18)
Partition 1: (Not Active) - (Size=1.8 GB) - (Type=06)

==================== Ende von Ergebnis ============================
Geladene Profile: Max-Uttendorfer (Verfügbare Profile: Max-Uttendorfer)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 4620 series\Bin\FaxApplications.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Spotify Ltd) C:\Users\Max-Uttendorfer\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe


==================== Registry (Nicht auf der Ausnahmeliste) ==================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-05] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [782008 2015-07-30] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe [134368 2015-07-02] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3038766165-3120518270-3538088492-1000\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-09-03] (Google Inc.)
HKU\S-1-5-21-3038766165-3120518270-3538088492-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7063832 2014-11-21] (Piriform Ltd)
HKU\S-1-5-21-3038766165-3120518270-3538088492-1000\...\Run: [Spotify Web Helper] => C:\Users\Max-Uttendorfer\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2015-04-04] (Spotify Ltd)
Startup: C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\help-file-decrypt.enc [2015-08-07] ()
Startup: C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 4620 series.lnk [2013-04-01]
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 4620 series.lnk -> C:\Program Files\HP\HP Officejet 4620 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..)

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3038766165-3120518270-3538088492-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-15] (Google Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-11-27] (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-15] (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-27] (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-15] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-15] (Google Inc.)
DPF: HKLM-x32 {A8F2B9BD-A6A0-486A-9744-18920D898429} hxxp://www.sibelius.com/download/software/win/ActiveXPlugin.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{0BA395AF-0DC7-4713-8F94-7C2130148F68}: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-12] ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll [2013-08-06] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-12] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-27] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-27] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-12-01]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}.xpi [2015-08-09]
FF HKU\S-1-5-21-3038766165-3120518270-3538088492-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-12-01]

Chrome: 
=======
CHR Profile: C:\Users\Max-Uttendorfer\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Max-Uttendorfer\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-11]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Max-Uttendorfer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-11]

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [887128 2015-07-30] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [461672 2015-07-30] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [461672 2015-07-30] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1213072 2015-07-30] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [218816 2015-07-02] (Avira Operations GmbH & Co. KG)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S2 StarMoney 8.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 8.0 S-Edition\ouservice\StarMoneyOnlineUpdate.exe [699680 2012-12-21] (Star Finanz - Software Entwicklung und Vertriebs GmbH)
S2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0 S-Edition\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [162528 2015-07-30] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [141416 2015-07-30] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 AVMCOWAN; C:\Windows\System32\DRIVERS\AVMCOWAN.sys [79872 2009-06-10] (AVM GmbH)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-23] (Avira Operations GmbH & Co. KG)
S3 FUS2BASE; C:\Windows\System32\DRIVERS\fus2base.sys [696832 2009-06-10] (AVM Berlin)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-08-10] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
S3 MHIKEY10; C:\Windows\System32\Drivers\MHIKEY10x64.sys [60288 2010-09-15] (Generic USB smartcard reader)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 cmudaxp; system32\drivers\cmudaxp.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-08-10 17:11 - 2015-08-10 17:11 - 02248704 _____ C:\Users\Max-Uttendorfer\Downloads\AdwCleaner_4.208.exe
2015-08-10 17:10 - 2015-08-10 17:10 - 00001698 _____ C:\Users\Max-Uttendorfer\Desktop\JRT.txt
2015-08-10 17:07 - 2015-08-10 17:07 - 01797896 _____ (Malwarebytes Corporation) C:\Users\Max-Uttendorfer\Downloads\JRT(1).exe
2015-08-09 19:19 - 2015-08-09 19:19 - 11032736 _____ (SurfRight B.V.) C:\Users\Max-Uttendorfer\Downloads\HitmanPro_x64(1).exe
2015-08-09 19:15 - 2015-08-10 09:18 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-08-09 19:11 - 2015-08-10 09:18 - 00001326 _____ C:\Windows\PFRO.log
2015-08-09 18:54 - 2015-08-09 18:54 - 00000567 _____ C:\Users\Max-Uttendorfer\Desktop\help file.txt
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\Users\Max-Uttendorfer\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\Users\Max-Uttendorfer\AppData\Roaming\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\Users\Max-Uttendorfer\AppData\Local\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\Users\Max-Uttendorfer\AppData\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\Users\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\Users\Default\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\Users\Default\AppData\Local\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\Users\Default\AppData\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\Users\Default User\AppData\Local\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\Users\Default User\AppData\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\ProgramData\help-file-decrypt.enc
2015-08-07 17:01 - 2015-08-07 17:18 - 00000000 ____D C:\Users\Max-Uttendorfer\Documents\Christian Grunewald
2015-08-07 16:53 - 2015-08-07 16:53 - 00082299 _____ C:\Users\Max-Uttendorfer\Documents\Christian Grunewald.zip
2015-07-30 20:46 - 2015-07-30 20:47 - 00001120 _____ C:\Users\Public\Desktop\Avira.lnk
2015-07-30 20:46 - 2015-07-30 20:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-07-28 23:07 - 2015-07-25 20:07 - 00017856 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-07-28 23:07 - 2015-07-25 20:04 - 00765440 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-07-28 23:07 - 2015-07-25 20:04 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-07-28 23:07 - 2015-07-25 20:03 - 01085440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-07-28 23:07 - 2015-07-25 20:03 - 00433664 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-07-28 23:07 - 2015-07-25 20:03 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-07-28 23:07 - 2015-07-25 20:03 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-07-28 23:07 - 2015-07-25 19:55 - 01145856 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-07-28 02:53 - 2015-08-12 05:48 - 00003015 _____ C:\Windows\setupact.log
2015-07-28 02:53 - 2015-07-28 02:53 - 00000000 _____ C:\Windows\setuperr.log
2015-07-27 18:02 - 2015-07-27 18:02 - 00023140 _____ C:\Users\Max-Uttendorfer\Documents\cc_20150727_180156.reg
2015-07-21 06:14 - 2015-07-15 05:19 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-07-21 06:14 - 2015-07-15 05:19 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-07-21 06:14 - 2015-07-15 05:19 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-07-21 06:14 - 2015-07-15 05:19 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-07-21 06:14 - 2015-07-15 04:55 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-07-21 06:14 - 2015-07-15 04:55 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-07-21 06:14 - 2015-07-15 04:55 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-07-21 06:14 - 2015-07-15 04:54 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-07-21 06:14 - 2015-07-15 03:59 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-07-21 06:14 - 2015-07-15 03:52 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-07-16 13:54 - 2015-06-25 20:09 - 00389832 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-07-16 13:54 - 2015-06-25 19:43 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-07-16 13:54 - 2015-06-20 22:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-07-16 13:54 - 2015-06-20 21:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-07-16 13:54 - 2015-06-20 21:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-07-16 13:54 - 2015-06-20 21:49 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-07-16 13:54 - 2015-06-20 21:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-07-16 13:54 - 2015-06-20 21:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-07-16 13:54 - 2015-06-20 21:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-07-16 13:54 - 2015-06-20 21:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-07-16 13:54 - 2015-06-20 21:34 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-07-16 13:54 - 2015-06-20 21:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-07-16 13:54 - 2015-06-20 21:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-07-16 13:54 - 2015-06-20 21:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-07-16 13:54 - 2015-06-20 21:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-07-16 13:54 - 2015-06-20 21:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-07-16 13:54 - 2015-06-20 21:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-07-16 13:54 - 2015-06-20 21:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-07-16 13:54 - 2015-06-20 20:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-07-16 13:54 - 2015-06-20 20:48 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-07-16 13:54 - 2015-06-20 20:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-07-16 13:54 - 2015-06-20 20:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-07-16 13:54 - 2015-06-20 20:26 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-07-16 13:54 - 2015-06-20 20:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-07-16 13:54 - 2015-06-19 20:25 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-07-16 13:54 - 2015-06-19 20:25 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-07-16 13:54 - 2015-06-19 20:24 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-07-16 13:54 - 2015-06-19 20:24 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-07-16 13:54 - 2015-06-19 20:23 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-07-16 13:54 - 2015-06-19 20:17 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-07-16 13:54 - 2015-06-19 20:16 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-07-16 13:54 - 2015-06-19 20:13 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-07-16 13:54 - 2015-06-19 20:13 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-07-16 13:54 - 2015-06-19 20:03 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-07-16 13:54 - 2015-06-19 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-07-16 13:54 - 2015-06-19 19:53 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-07-16 13:54 - 2015-06-19 19:52 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-07-16 13:54 - 2015-06-19 19:51 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-07-16 13:54 - 2015-06-19 19:40 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-07-16 13:54 - 2015-06-19 19:40 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-07-16 13:54 - 2015-06-19 19:39 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-07-16 13:54 - 2015-06-19 19:15 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-07-16 13:54 - 2015-06-19 19:11 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-07-16 06:35 - 2015-07-04 20:07 - 02087424 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-16 06:35 - 2015-07-04 19:48 - 01414656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-07-16 06:35 - 2015-04-27 21:23 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-07-16 06:35 - 2015-04-27 21:23 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-07-16 06:35 - 2015-04-27 21:23 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-07-16 06:35 - 2015-04-27 21:23 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-07-16 06:35 - 2015-04-27 21:05 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-07-16 06:35 - 2015-04-27 21:04 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-07-16 06:35 - 2015-04-27 21:04 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-07-16 06:35 - 2015-04-27 21:04 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-07-15 05:01 - 2015-07-09 19:58 - 03154944 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-07-15 05:01 - 2015-07-09 19:58 - 02603008 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-07-15 05:01 - 2015-07-09 19:58 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-07-15 05:01 - 2015-07-09 19:58 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-07-15 05:01 - 2015-07-09 19:58 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-07-15 05:01 - 2015-07-09 19:58 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-07-15 05:01 - 2015-07-09 19:58 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-07-15 05:01 - 2015-07-09 19:58 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-07-15 05:01 - 2015-07-09 19:58 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-07-15 05:01 - 2015-07-09 19:58 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-07-15 05:01 - 2015-07-09 19:58 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-07-15 05:01 - 2015-07-09 19:43 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-07-15 05:01 - 2015-07-09 19:43 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-07-15 05:01 - 2015-07-09 19:43 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-07-15 05:01 - 2015-07-09 19:43 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-07-15 05:01 - 2015-07-09 19:42 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-07-15 05:01 - 2015-07-02 23:21 - 19877376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-07-15 05:01 - 2015-07-02 23:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-07-15 05:01 - 2015-07-02 22:50 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-07-15 05:01 - 2015-07-02 22:49 - 25193984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-07-15 05:01 - 2015-07-02 22:46 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-07-15 05:01 - 2015-07-02 22:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-07-15 05:01 - 2015-07-02 22:23 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-07-15 05:01 - 2015-07-02 22:19 - 12855296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-07-15 05:01 - 2015-07-02 22:12 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-07-15 05:01 - 2015-07-02 21:55 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-07-15 05:01 - 2015-07-02 21:20 - 14453248 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-07-15 05:01 - 2015-07-02 20:59 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-07-15 05:01 - 2015-06-27 04:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-07-15 05:01 - 2015-06-27 04:43 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-07-15 05:01 - 2015-06-27 03:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-07-15 05:01 - 2015-06-27 03:39 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-07-15 05:01 - 2015-06-25 10:57 - 03207168 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-07-15 05:01 - 2015-06-20 21:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-07-15 05:01 - 2015-06-17 19:47 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-15 05:01 - 2015-06-17 19:37 - 00312320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-07-15 05:01 - 2015-06-09 20:03 - 03180544 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-07-15 05:01 - 2015-06-09 20:03 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-07-15 05:01 - 2015-06-02 02:07 - 00254976 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll
2015-07-15 05:01 - 2015-06-02 01:47 - 00210432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cewmdm.dll
2015-07-15 05:00 - 2015-06-11 19:57 - 06131200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-07-15 05:00 - 2015-06-11 19:56 - 07077376 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-07-15 05:00 - 2015-06-11 15:15 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2015-07-15 04:59 - 2015-07-01 22:56 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-07-15 04:59 - 2015-07-01 22:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-07-15 04:59 - 2015-07-01 22:49 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-07-15 04:59 - 2015-07-01 22:49 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-07-15 04:59 - 2015-07-01 22:49 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-15 04:59 - 2015-07-01 22:49 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-07-15 04:59 - 2015-07-01 22:49 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-07-15 04:59 - 2015-07-01 22:49 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-07-15 04:59 - 2015-07-01 22:49 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-07-15 04:59 - 2015-07-01 22:49 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-07-15 04:59 - 2015-07-01 22:49 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-07-15 04:59 - 2015-07-01 22:49 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-07-15 04:59 - 2015-07-01 22:49 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-07-15 04:59 - 2015-07-01 22:48 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-07-15 04:59 - 2015-07-01 22:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-07-15 04:59 - 2015-07-01 22:47 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-07-15 04:59 - 2015-07-01 22:47 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-07-15 04:59 - 2015-07-01 22:43 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-07-15 04:59 - 2015-07-01 22:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-07-15 04:59 - 2015-07-01 22:39 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-07-15 04:59 - 2015-07-01 22:30 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-07-15 04:59 - 2015-07-01 22:30 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-07-15 04:59 - 2015-07-01 22:30 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-07-15 04:59 - 2015-07-01 22:30 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-07-15 04:59 - 2015-07-01 22:30 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-07-15 04:59 - 2015-07-01 22:30 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-07-15 04:59 - 2015-07-01 22:30 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-07-15 04:59 - 2015-07-01 22:30 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-07-15 04:59 - 2015-07-01 22:30 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-07-15 04:59 - 2015-07-01 22:29 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-07-15 04:59 - 2015-07-01 22:29 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-07-15 04:59 - 2015-07-01 22:29 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-07-15 04:59 - 2015-07-01 22:27 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-07-15 04:59 - 2015-07-01 22:26 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-07-15 04:59 - 2015-07-01 22:24 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-07-15 04:59 - 2015-07-01 21:27 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-07-15 04:59 - 2015-07-01 21:26 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-07-15 04:59 - 2015-07-01 21:26 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-07-15 04:59 - 2015-06-15 23:50 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-07-15 04:59 - 2015-06-15 23:45 - 03242496 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-15 04:59 - 2015-06-15 23:45 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-07-15 04:59 - 2015-06-15 23:45 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2015-07-15 04:59 - 2015-06-15 23:45 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-07-15 04:59 - 2015-06-15 23:44 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-15 04:59 - 2015-06-15 23:43 - 02364416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-07-15 04:59 - 2015-06-15 23:43 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-07-15 04:59 - 2015-06-15 23:43 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2015-07-15 04:59 - 2015-06-15 23:42 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-07-15 04:59 - 2015-06-15 23:42 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2015-07-15 04:59 - 2015-06-15 23:37 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2015-07-15 04:59 - 2015-06-11 19:57 - 00856064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2015-07-15 04:59 - 2015-06-11 19:57 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2015-07-15 04:59 - 2015-06-11 19:56 - 01057792 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2015-07-15 04:59 - 2015-06-11 19:56 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-08-12 05:50 - 2013-08-06 16:58 - 00000000 ____D C:\FRST
2015-08-12 05:50 - 2013-04-01 12:11 - 00000460 _____ C:\Windows\Tasks\FaxArchive_CN2952334D05S1.job
2015-08-12 05:49 - 2014-11-14 18:38 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d000295cae05eb.job
2015-08-12 05:48 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-08-12 05:39 - 2011-09-03 09:23 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-08-12 05:39 - 2009-07-14 06:45 - 00023376 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-08-12 05:39 - 2009-07-14 06:45 - 00023376 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-08-12 05:33 - 2014-11-18 18:11 - 00778440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-08-12 05:33 - 2014-11-18 18:11 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-08-12 05:33 - 2014-11-18 18:11 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-08-12 05:33 - 2013-03-13 17:14 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-08-11 17:46 - 2011-08-08 19:43 - 01154665 _____ C:\Windows\WindowsUpdate.log
2015-08-11 17:27 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-08-11 17:15 - 2009-07-14 19:58 - 00699432 _____ C:\Windows\system32\perfh007.dat
2015-08-11 17:15 - 2009-07-14 19:58 - 00149572 _____ C:\Windows\system32\perfc007.dat
2015-08-11 17:15 - 2009-07-14 07:13 - 01620684 _____ C:\Windows\system32\PerfStringBackup.INI
2015-08-11 17:10 - 2011-08-07 14:41 - 00000000 ____D C:\Users\Max-Uttendorfer
2015-08-11 17:09 - 2015-04-04 23:20 - 00000000 ___SD C:\Windows\system32\GWX
2015-08-11 17:09 - 2011-08-07 21:04 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\vlc
2015-08-11 17:09 - 2009-07-14 20:18 - 00000000 ___RD C:\Users\Public\Recorded TV
2015-08-11 17:09 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2015-08-11 13:03 - 2013-12-25 07:36 - 01033216 _____ C:\Users\Max-Uttendorfer\Desktop\anfragen 11.pst
2015-08-11 13:03 - 2012-08-01 11:39 - 00271360 _____ C:\Users\Max-Uttendorfer\Desktop\& Zimmerhansl.pst
2015-08-11 07:08 - 2011-08-07 17:12 - 01511424 _____ C:\Users\Max-Uttendorfer\Desktop\Job-Datei.mdb
2015-08-10 17:40 - 2014-09-10 19:07 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-08-10 17:17 - 2014-12-23 07:51 - 00000000 ____D C:\AdwCleaner
2015-08-10 13:51 - 2011-08-07 21:10 - 00003946 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{38348A84-1508-456E-8101-FBD1328B9944}
2015-08-10 12:02 - 2011-08-07 15:34 - 00000000 ____D C:\Windows\Panther
2015-08-10 09:18 - 2014-12-01 15:11 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-08-10 09:16 - 2011-08-07 15:01 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\ASUS
2015-08-10 09:16 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system
2015-08-09 19:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\Help
2015-08-09 18:55 - 2011-08-07 15:28 - 00000400 _____ C:\Windows\ODBC.INI
2015-08-09 18:55 - 2011-08-07 15:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2015-08-09 18:55 - 2009-07-14 04:34 - 00000499 _____ C:\Windows\win.ini
2015-08-07 17:02 - 2014-12-01 15:19 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Spotify
2015-08-07 17:02 - 2014-11-27 11:34 - 00000000 ____D C:\ProgramData\Oracle
2015-08-07 17:02 - 2014-10-31 19:54 - 00000000 ____D C:\ProgramData\Windows Genuine Advantage
2015-08-07 17:02 - 2014-10-31 19:54 - 00000000 ____D C:\ProgramData\RihyAncuz
2015-08-07 17:02 - 2013-10-15 09:04 - 00000000 ____D C:\ProgramData\StarMoney 9.0
2015-08-07 17:02 - 2013-08-07 13:35 - 00000000 ____D C:\ProgramData\HitmanPro
2015-08-07 17:02 - 2013-08-06 17:47 - 00000000 ____D C:\Qoobox
2015-08-07 17:02 - 2013-08-06 10:38 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Malwarebytes
2015-08-07 17:02 - 2013-08-06 10:38 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-08-07 17:02 - 2013-05-10 16:21 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Uhgi
2015-08-07 17:02 - 2013-05-10 16:21 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Ucynon
2015-08-07 17:02 - 2013-05-10 16:21 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Osver
2015-08-07 17:02 - 2013-03-16 08:18 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\HpUpdate
2015-08-07 17:02 - 2013-03-13 17:11 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\TeamViewer
2015-08-07 17:02 - 2013-02-23 08:41 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Avira
2015-08-07 17:02 - 2013-02-23 03:54 - 00000000 ____D C:\ProgramData\Avira
2015-08-07 17:02 - 2013-02-01 12:27 - 00000000 ____D C:\ProgramData\HP
2015-08-07 17:02 - 2012-05-04 12:50 - 00000000 ____D C:\ProgramData\Mozilla
2015-08-07 17:02 - 2012-02-06 14:23 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Nvu
2015-08-07 17:02 - 2012-01-02 08:29 - 00000000 ____D C:\Users\Max-Uttendorfer\.tuxguitar-1.2
2015-08-07 17:02 - 2012-01-02 08:29 - 00000000 ____D C:\ProgramData\Sun
2015-08-07 17:02 - 2012-01-01 17:33 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Guitar Pro 6
2015-08-07 17:02 - 2012-01-01 17:33 - 00000000 ____D C:\ProgramData\Guitar Pro 6
2015-08-07 17:02 - 2011-12-27 14:06 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\DVDVideoSoft
2015-08-07 17:02 - 2011-10-24 12:27 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\FRITZ!fax für FRITZ!Box
2015-08-07 17:02 - 2011-10-24 12:27 - 00000000 ____D C:\ProgramData\ISDNWatch
2015-08-07 17:02 - 2011-09-04 14:53 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Windows Live Writer
2015-08-07 17:02 - 2011-09-03 09:26 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Google
2015-08-07 17:02 - 2011-09-02 16:23 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla
2015-08-07 17:02 - 2011-08-08 14:29 - 00000000 ____D C:\ProgramData\StarMoney 8.0
2015-08-07 17:02 - 2011-08-07 21:50 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Local\Adobe
2015-08-07 17:02 - 2011-08-07 21:50 - 00000000 ____D C:\ProgramData\Adobe
2015-08-07 17:02 - 2011-08-07 21:11 - 00000000 ____D C:\NST
2015-08-07 17:02 - 2011-08-07 20:59 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Canneverbe Limited
2015-08-07 17:02 - 2011-08-07 20:59 - 00000000 ____D C:\ProgramData\Canneverbe Limited
2015-08-07 17:02 - 2011-08-07 20:08 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\FRITZ!
2015-08-07 17:02 - 2011-08-07 15:30 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Intel Corporation
2015-08-07 17:02 - 2011-08-07 14:58 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Macromedia
2015-08-07 17:02 - 2011-08-07 14:58 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe
2015-08-07 17:02 - 2011-08-07 14:48 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\InstallShield
2015-08-07 17:02 - 2011-08-07 14:48 - 00000000 ____D C:\Intel
2015-08-07 17:02 - 2011-08-07 14:41 - 00000000 ___RD C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-08-07 17:02 - 2011-08-07 14:41 - 00000000 ___RD C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-08-07 17:02 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2015-08-07 09:13 - 2013-10-15 09:02 - 00000000 ____D C:\Program Files (x86)\StarMoney 9.0 S-Edition
2015-08-07 05:39 - 2013-04-15 06:19 - 00002175 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-07-30 20:47 - 2014-09-10 18:46 - 00000000 ____D C:\ProgramData\Package Cache
2015-07-30 20:46 - 2013-02-23 03:54 - 00000000 ____D C:\Program Files (x86)\Avira
2015-07-30 20:45 - 2013-03-28 07:51 - 00162528 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-07-30 20:45 - 2013-03-28 07:51 - 00141416 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-07-29 00:36 - 2014-05-07 01:25 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-07-22 06:30 - 2009-07-14 06:45 - 00291704 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-18 03:41 - 2011-08-07 17:12 - 00655360 _____ C:\Users\Max-Uttendorfer\Desktop\Wirte-Datei.mdb
2015-07-17 10:38 - 2014-11-15 07:28 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-07-17 05:18 - 2015-04-04 23:20 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-07-16 06:34 - 2015-02-07 15:22 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore1d000295cae05eb
2015-07-16 06:34 - 2011-09-03 09:23 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-07-16 06:28 - 2014-12-11 08:21 - 00000000 ____D C:\Windows\system32\appraiser
2015-07-16 06:28 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-07-15 22:05 - 2013-08-05 21:11 - 00000000 ____D C:\Windows\system32\MRT
2015-07-14 10:48 - 2014-12-26 09:18 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2015-08-07 17:02 - 2015-08-07 17:02 - 0000555 _____ () C:\Users\Max-Uttendorfer\AppData\Roaming\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 0000555 _____ () C:\Users\Max-Uttendorfer\AppData\Local\help-file-decrypt.enc
2013-01-16 13:35 - 2013-12-03 14:16 - 0004096 ____H () C:\Users\Max-Uttendorfer\AppData\Local\keyfile3.drm
2013-03-16 08:18 - 2013-03-16 08:18 - 0000057 _____ () C:\ProgramData\Ament.ini
2015-08-07 17:02 - 2015-08-07 17:02 - 0000555 _____ () C:\ProgramData\help-file-decrypt.enc

Einige Dateien in TEMP:
====================
C:\Users\Max-Uttendorfer\AppData\Local\Temp\avgnt.exe
C:\Users\Max-Uttendorfer\AppData\Local\Temp\Quarantine.exe
C:\Users\Max-Uttendorfer\AppData\Local\Temp\repair4.exe
C:\Users\Max-Uttendorfer\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-08-02 08:31

==================== Ende von Ergebnis ============================

Ich habe frst über das Laufwerk E:\ durchgeführt

Über BootManager und Windows CD funktionierte es nicht.

schrauber · 12.08.2015, 11:38

Edit:

ok, du hast sie in einander gemischt.

Zitat:

Desktop\help file.txt

den Inhalt der Datei bitte posten. Sind irgendwelche DAteien von dir verschlüsselt?

uttella · 12.08.2015, 12:00

contact safefiles32@mail.rur

\winconf?xå§5Lî±¡ó?`n¨Ò¦ãÃðÒSFü[%½—OY< "€Á¥–ðØ»Å²dÑœƒ‡qÌL*ä¹•¨´½XÝî;½Ö“Òú”Ì°_ÙfÒ'xP*ªÖâwv9ó‚só\Î“¦„Ò,“´=1þ€˜à¤n*ã¤_ø<#ê–ùÃÌ]8õ´uúÞ™8`»b¨1½ÞÚºÔ–¶4ÉFQæBÔÑ2±îAþ±<=ý‹‚?ÇÖQûîíêß™ßþàÿË}›1R^¤e¢iµz*Ýl;œZã€ç" É,Uµ¥uär=PÊJF¼ "{¸:[1Y:A¼•Ê»¹}É÷/{2YhV„<áNB´€tÀ“1’""Bà›M©Ä=È!ª>0°Pæô3Vœ«ÝM25:Å pîÏ>ÕiÕ‚îD9M®´€çTóÄ~Í_ðf"
"¦\ìØ¬Ç?J3UUúšòÏ'+¨áb‡ïx‘gïî®¶›UCÀû—š¸$”ºm1–„²—”1:1jBwu³§±'ÏèÄ¹Î‚›¢™*LUâç‡+Æ_ëNè¿ß3%§'†ãŸ21¶dúÏåý`N¨¸&ÙÛ&Å‚Úï3ÛKþ?€ç""ôË©rlH6o£ÔmUüÃ“é-„£"

Nein, es sind keine Dateien verschlüsselt.
Der Inhalt von dieser help file Datei erscheint auch beim Öffnen von EXcel Start.

schrauber · 13.08.2015, 08:15

hi,

Downloade dir bitte

Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

Starte bitte die mbar.exe.
Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
Klicke auf den CleanUp Button und erlaube den Neustart.
Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut.
Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

uttella · 14.08.2015, 10:46

Code:

ATTFilter

Malwarebytes Anti-Rootkit BETA 1.09.1.1004
www.malwarebytes.org

Database version:
  main:    v2015.08.14.02
  rootkit: v2015.08.06.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.17959
Max-Uttendorfer :: PC [administrator]

14.08.2015 11:19:09
mbar-log-2015-08-14 (11-19-09).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 372712
Time elapsed: 6 minute(s), 41 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

Code:

ATTFilter

11:28:34.0588 0x0fd0  TDSS rootkit removing tool 3.1.0.5 Jul 24 2015 12:29:57
11:28:39.0680 0x0fd0  ============================================================
11:28:39.0680 0x0fd0  Current date / time: 2015/08/14 11:28:39.0680
11:28:39.0680 0x0fd0  SystemInfo:
11:28:39.0680 0x0fd0  
11:28:39.0680 0x0fd0  OS Version: 6.1.7601 ServicePack: 1.0
11:28:39.0680 0x0fd0  Product type: Workstation
11:28:39.0680 0x0fd0  ComputerName: PC
11:28:39.0680 0x0fd0  UserName: Max-Uttendorfer
11:28:39.0680 0x0fd0  Windows directory: C:\Windows
11:28:39.0680 0x0fd0  System windows directory: C:\Windows
11:28:39.0680 0x0fd0  Running under WOW64Malwarebytes Anti-Rootkit BETA 1.09.1.1004
www.malwarebytes.org

Database version:
  main:    v2015.08.14.02
  rootkit: v2015.08.06.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.17959
Max-Uttendorfer :: PC [administrator]

14.08.2015 11:19:09
mbar-log-2015-08-14 (11-19-09).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 372712
Time elapsed: 6 minute(s), 41 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

11:28:39.0680 0x0fd0  Processor architecture: Intel x64
11:28:39.0680 0x0fd0  Number of processors: 4
11:28:39.0681 0x0fd0  Page size: 0x1000
11:28:39.0681 0x0fd0  Boot type: Normal boot
11:28:39.0681 0x0fd0  ============================================================
11:28:39.0803 0x0fd0  KLMD registered as C:\Windows\system32\drivers\05280150.sys
11:28:40.0094 0x0fd0  System UUID: {022C3144-EF85-5E46-30DB-B07B65D9E3B9}
11:28:40.0867 0x0fd0  Drive \Device\Harddisk0\DR0 - Size: 0xEE8156000 ( 59.63 Gb ), SectorSize: 0x200, Cylinders: 0x1E67, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
11:28:40.0868 0x0fd0  Drive \Device\Harddisk1\DR1 - Size: 0x7470C06000 ( 465.76 Gb ), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
11:28:40.0870 0x0fd0  ============================================================
11:28:40.0870 0x0fd0  \Device\Harddisk0\DR0:
11:28:40.0870 0x0fd0  MBR partitions:
11:28:40.0870 0x0fd0  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
11:28:40.0870 0x0fd0  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x770D800
11:28:40.0870 0x0fd0  \Device\Harddisk1\DR1:
11:28:40.0870 0x0fd0  MBR partitions:
11:28:40.0870 0x0fd0  ============================================================
11:28:40.0872 0x0fd0  C: <-> \Device\Harddisk0\DR0\Partition2
11:28:40.0873 0x0fd0  ============================================================
11:28:40.0873 0x0fd0  Initialize success
11:28:40.0873 0x0fd0  ============================================================
11:28:53.0286 0x09b8  ============================================================
11:28:53.0286 0x09b8  Scan started
11:28:53.0286 0x09b8  Mode: Manual; 
11:28:53.0286 0x09b8  ============================================================
11:28:53.0286 0x09b8  KSN ping started
11:28:55.0606 0x09b8  KSN ping finished: true
11:28:56.0092 0x09b8  ================ Scan system memory ========================
11:28:56.0092 0x09b8  System memory - ok
11:28:56.0092 0x09b8  ================ Scan services =============================
11:28:56.0134 0x09b8  [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
11:28:56.0141 0x09b8  1394ohci - ok
11:28:56.0160 0x09b8  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
11:28:56.0167 0x09b8  ACPI - ok
11:28:56.0171 0x09b8  [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys
11:28:56.0172 0x09b8  AcpiPmi - ok
11:28:56.0179 0x09b8  [ 013697369EAFFA675D0671607F036020, 65611C775AC4681E46A6565E5A7A4FF3363C66EBDC98C4C58AFB365D40BE23B6 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
11:28:56.0181 0x09b8  AdobeARMservice - ok
11:28:56.0210 0x09b8  [ 368290D0A612D62DA6F3D798B1BB8FE7, D573BF8543F37BC51B88A2473EDFD28AFBCCC446E8CADD54A90FA48D8739D222 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
11:28:56.0217 0x09b8  AdobeFlashPlayerUpdateSvc - ok
11:28:56.0231 0x09b8  [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx         C:\Windows\system32\DRIVERS\adp94xx.sys
11:28:56.0243 0x09b8  adp94xx - ok
11:28:56.0253 0x09b8  [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci         C:\Windows\system32\DRIVERS\adpahci.sys
11:28:56.0260 0x09b8  adpahci - ok
11:28:56.0267 0x09b8  [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320         C:\Windows\system32\DRIVERS\adpu320.sys
11:28:56.0272 0x09b8  adpu320 - ok
11:28:56.0277 0x09b8  [ 83BFCCAC53795E8A5055A93672D0C46C, B2B03473D950A5BA9DE59D81E7B14C1FAFF17B2A4D8A5808588F5CC21D63B291 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
11:28:56.0279 0x09b8  AeLookupSvc - ok
11:28:56.0292 0x09b8  [ FA886682CFC5D36718D3E436AACF10B9, F80AB4F91AA6B5C7ECCB000D8E1BC2CF776DC3D69B3D9EBC2558C19035A6B3AB ] AFD             C:\Windows\system32\drivers\afd.sys
11:28:56.0303 0x09b8  AFD - ok
11:28:56.0307 0x09b8  [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440          C:\Windows\system32\drivers\agp440.sys
11:28:56.0309 0x09b8  agp440 - ok
11:28:56.0313 0x09b8  [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG             C:\Windows\System32\alg.exe
11:28:56.0316 0x09b8  ALG - ok
11:28:56.0319 0x09b8  [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide          C:\Windows\system32\drivers\aliide.sys
11:28:56.0320 0x09b8  aliide - ok
11:28:56.0323 0x09b8  [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide          C:\Windows\system32\drivers\amdide.sys
11:28:56.0325 0x09b8  amdide - ok
11:28:56.0329 0x09b8  [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys
11:28:56.0331 0x09b8  AmdK8 - ok
11:28:56.0335 0x09b8  [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
11:28:56.0337 0x09b8  AmdPPM - ok
11:28:56.0342 0x09b8  [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
11:28:56.0345 0x09b8  amdsata - ok
11:28:56.0351 0x09b8  [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
11:28:56.0356 0x09b8  amdsbs - ok
11:28:56.0359 0x09b8  [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata         C:\Windows\system32\drivers\amdxata.sys
11:28:56.0361 0x09b8  amdxata - ok
11:28:56.0364 0x09b8  [ 4DE0D5D747A73797C95A97DCCE5018B5, 17EC669675C2E43515EFE2D8BCC9DDFFBE64F99EBFB9A6DAB429F65A2B504560 ] androidusb      C:\Windows\system32\Drivers\ssadadb.sys
11:28:56.0366 0x09b8  androidusb - ok
11:28:56.0395 0x09b8  [ 9FE1AC875A7AD7B7FF28FEC8B754968D, EEE04D4073E49332C85028B62E8A035EAA2284526A3F3820133492C8F8CBA3D5 ] AntiVirMailService C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
11:28:56.0414 0x09b8  AntiVirMailService - ok
11:28:56.0428 0x09b8  [ 58FB167B287CAA05F7DD5AA1018FD52C, D9EB68E1C2B99E5F59A0DA4C9FA46E15C6E470F7445E232C03C82790F546A6AA ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
11:28:56.0436 0x09b8  AntiVirSchedulerService - ok
11:28:56.0450 0x09b8  [ 58FB167B287CAA05F7DD5AA1018FD52C, D9EB68E1C2B99E5F59A0DA4C9FA46E15C6E470F7445E232C03C82790F546A6AA ] AntiVirService  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
11:28:56.0458 0x09b8  AntiVirService - ok
11:28:56.0489 0x09b8  [ F857D22CEC14854D310C5596C8CE6006, 67448C506D3171D327A6CE3952E41BDC65587FEB45F510160A1DAFCA9491711E ] AntiVirWebService C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
11:28:56.0515 0x09b8  AntiVirWebService - ok
11:28:56.0520 0x09b8  [ 90C53BD47979FB8814F465A08B885102, 5EDFC1909FC1FF9133A534DFCC5408CF3A777AC41FB21FAD375436E3D86C02EC ] AppID           C:\Windows\system32\drivers\appid.sys
11:28:56.0522 0x09b8  AppID - ok
11:28:56.0525 0x09b8  [ 72D4757510FDA69D729169C00AFC211E, FB9686D0D94EE7C19A3994C29E8331A6EC3020B2980B2CC75F72F3AB25512C15 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
11:28:56.0527 0x09b8  AppIDSvc - ok
11:28:56.0531 0x09b8  [ 978DC0A1FBE9CC91B21B40AF66CB396A, 90BAFF81D98F5AFD743D8BD65F716666A7A7BD2DA612492E03C79B29E9A0F8C2 ] Appinfo         C:\Windows\System32\appinfo.dll
11:28:56.0533 0x09b8  Appinfo - ok
11:28:56.0540 0x09b8  [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc             C:\Windows\system32\DRIVERS\arc.sys
11:28:56.0542 0x09b8  arc - ok
11:28:56.0547 0x09b8  [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
11:28:56.0550 0x09b8  arcsas - ok
11:28:56.0573 0x09b8  [ F15AB80B867D3332D5DDFB0A05B9CE04, 5A16577106246AB5DCC04FE0A0B00B7C5702557B75F958721E4C00383AB99809 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
11:28:56.0578 0x09b8  aspnet_state - ok
11:28:56.0581 0x09b8  [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
11:28:56.0582 0x09b8  AsyncMac - ok
11:28:56.0585 0x09b8  [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi           C:\Windows\system32\drivers\atapi.sys
11:28:56.0587 0x09b8  atapi - ok
11:28:56.0604 0x09b8  [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
11:28:56.0618 0x09b8  AudioEndpointBuilder - ok
11:28:56.0634 0x09b8  [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioSrv        C:\Windows\System32\Audiosrv.dll
11:28:56.0645 0x09b8  AudioSrv - ok
11:28:56.0652 0x09b8  [ 24843902369DC82B4691F816F08F2938, 330E22C6007B10FE9C232BBCA2F388ADA17DEDBAA11BEC2A70377A4466DFB6FA ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
11:28:56.0656 0x09b8  avgntflt - ok
11:28:56.0662 0x09b8  [ 043E5F34C3878C844568658B79B3E55C, D13D8FC5205562E02F252C0EE1AB2236C9212445D6EC3715041EBDF993CB467F ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
11:28:56.0666 0x09b8  avipbb - ok
11:28:56.0674 0x09b8  [ 4B3DBF1CEBE1B2346BF2F8D2251F641A, CDC5BCA35BE658007E29E94E7FBFAA499B50929E738A12904397D16268C6FBAE ] Avira.ServiceHost C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
11:28:56.0678 0x09b8  Avira.ServiceHost - ok
11:28:56.0682 0x09b8  [ 390184FAD8FCC1B6DA25AEBAE928C3B6, 537B0E0FAE080B55D70E990BBA0F7F22903CA340F6A42039BAD617A8ECF59119 ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
11:28:56.0683 0x09b8  avkmgr - ok
11:28:56.0688 0x09b8  [ 43744F1D3CDE20F3925F10927C9036C2, 47374A71D1A38572B8C247E924C0F3F063A6281743C9B7D818D63CA576B5D289 ] AVMCOWAN        C:\Windows\system32\DRIVERS\AVMCOWAN.sys
11:28:56.0690 0x09b8  AVMCOWAN - ok
11:28:56.0695 0x09b8  [ 13253E5E3B6BDF945B63B336A8C9489B, 671C716E43F89D4BDDAA2BE045CDEBBB569C85BC2BA334E1F550187B79A7740D ] avnetflt        C:\Windows\system32\DRIVERS\avnetflt.sys
11:28:56.0697 0x09b8  avnetflt - ok
11:28:56.0703 0x09b8  [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV        C:\Windows\System32\AxInstSV.dll
11:28:56.0706 0x09b8  AxInstSV - ok
11:28:56.0719 0x09b8  [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv         C:\Windows\system32\DRIVERS\bxvbda.sys
11:28:56.0729 0x09b8  b06bdrv - ok
11:28:56.0737 0x09b8  [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
11:28:56.0744 0x09b8  b57nd60a - ok
11:28:56.0750 0x09b8  [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC          C:\Windows\System32\bdesvc.dll
11:28:56.0753 0x09b8  BDESVC - ok
11:28:56.0756 0x09b8  [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep            C:\Windows\system32\drivers\Beep.sys
11:28:56.0757 0x09b8  Beep - ok
11:28:56.0775 0x09b8  [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE             C:\Windows\System32\bfe.dll
11:28:56.0790 0x09b8  BFE - ok
11:28:56.0810 0x09b8  [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS            C:\Windows\system32\qmgr.dll
11:28:56.0828 0x09b8  BITS - ok
11:28:56.0832 0x09b8  [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
11:28:56.0833 0x09b8  blbdrive - ok
11:28:56.0838 0x09b8  [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
11:28:56.0841 0x09b8  bowser - ok
11:28:56.0844 0x09b8  [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
11:28:56.0845 0x09b8  BrFiltLo - ok
11:28:56.0848 0x09b8  [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
11:28:56.0849 0x09b8  BrFiltUp - ok
11:28:56.0855 0x09b8  [ 5C2F352A4E961D72518261257AAE204B, 9EE1001E1D46A414A7A86FE1DBBE232203E26F54D9EF43ED31ED8EACD4D09853 ] BridgeMP        C:\Windows\system32\DRIVERS\bridge.sys
11:28:56.0857 0x09b8  BridgeMP - ok
11:28:56.0863 0x09b8  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser         C:\Windows\System32\browser.dll
11:28:56.0867 0x09b8  Browser - ok
11:28:56.0876 0x09b8  [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
11:28:56.0882 0x09b8  Brserid - ok
11:28:56.0887 0x09b8  [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
11:28:56.0888 0x09b8  BrSerWdm - ok
11:28:56.0891 0x09b8  [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
11:28:56.0892 0x09b8  BrUsbMdm - ok
11:28:56.0895 0x09b8  [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
11:28:56.0896 0x09b8  BrUsbSer - ok
11:28:56.0901 0x09b8  [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
11:28:56.0903 0x09b8  BTHMODEM - ok
11:28:56.0909 0x09b8  [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv         C:\Windows\system32\bthserv.dll
11:28:56.0911 0x09b8  bthserv - ok
11:28:56.0914 0x09b8  catchme - ok
11:28:56.0919 0x09b8  [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
11:28:56.0922 0x09b8  cdfs - ok
11:28:56.0927 0x09b8  [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys
11:28:56.0930 0x09b8  cdrom - ok
11:28:56.0935 0x09b8  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc     C:\Windows\System32\certprop.dll
11:28:56.0937 0x09b8  CertPropSvc - ok
11:28:56.0941 0x09b8  [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
11:28:56.0943 0x09b8  circlass - ok
11:28:56.0953 0x09b8  [ 404B7DF9CA4D1CB675045AF220FF3285, 91FFADE2ABE5C48849E63134D5FFD20671FE0D1720F7D486F904391B3D142C96 ] CLFS            C:\Windows\system32\CLFS.sys
11:28:56.0961 0x09b8  CLFS - ok
11:28:56.0969 0x09b8  [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
11:28:56.0971 0x09b8  clr_optimization_v2.0.50727_32 - ok
11:28:56.0979 0x09b8  [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
11:28:56.0984 0x09b8  clr_optimization_v2.0.50727_64 - ok
11:28:56.0996 0x09b8  [ F5AB4D2E36625F355E81539239765107, 48E6AD65EEFD6C54F938F5753EF58377CDA77ADBB41CD8635F0040D61EFB92A4 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
11:28:56.0999 0x09b8  clr_optimization_v4.0.30319_32 - ok
11:28:57.0004 0x09b8  [ 9ACBE5EC13C2CC95833BFB7636CA8B1A, 6224DA9FB335D2A8374C60B8DEA539DD3A0E43230DB888B137B71A56EC57D6AF ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
11:28:57.0009 0x09b8  clr_optimization_v4.0.30319_64 - ok
11:28:57.0012 0x09b8  [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
11:28:57.0014 0x09b8  CmBatt - ok
11:28:57.0017 0x09b8  [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide          C:\Windows\system32\drivers\cmdide.sys
11:28:57.0018 0x09b8  cmdide - ok
11:28:57.0020 0x09b8  cmudaxp - ok
11:28:57.0033 0x09b8  [ 27667A788130A7F7A5858DE27572E6D7, 5501D80BCCB7A811ECCED3828DFD0A5D948BBED8504E9BCC4A3BFB840DD41CBC ] CNG             C:\Windows\system32\Drivers\cng.sys
11:28:57.0043 0x09b8  CNG - ok
11:28:57.0047 0x09b8  [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
11:28:57.0048 0x09b8  Compbatt - ok
11:28:57.0052 0x09b8  [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
11:28:57.0054 0x09b8  CompositeBus - ok
11:28:57.0056 0x09b8  COMSysApp - ok
11:28:57.0085 0x09b8  [ 08F934092E0429BADF88E9F91DB0F61E, 6E9091C006FFFF261DC61C8E9A45219E47C351296E5355FC4B7242F30E1DDFE3 ] cphs            C:\Windows\SysWow64\IntelCpHeciSvc.exe
11:28:57.0092 0x09b8  cphs - ok
11:28:57.0096 0x09b8  [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk         C:\Windows\system32\DRIVERS\crcdisk.sys
11:28:57.0098 0x09b8  crcdisk - ok
11:28:57.0116 0x09b8  [ 7BC3E861F7E8EB543A630090FAE779E0, 52A538F25C853AAC9706CD0D4EBF80B1963391AA175895CFD9D44C8ABBFCFB74 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
11:28:57.0121 0x09b8  CryptSvc - ok
11:28:57.0136 0x09b8  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch      C:\Windows\system32\rpcss.dll
11:28:57.0148 0x09b8  DcomLaunch - ok
11:28:57.0157 0x09b8  [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc       C:\Windows\System32\defragsvc.dll
11:28:57.0164 0x09b8  defragsvc - ok
11:28:57.0169 0x09b8  [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
11:28:57.0172 0x09b8  DfsC - ok
11:28:57.0182 0x09b8  [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp            C:\Windows\system32\dhcpcore.dll
11:28:57.0190 0x09b8  Dhcp - ok
11:28:57.0269 0x09b8  [ AA5319FA8602676B5D3A2B4A1355896D, 57532E16FF0DDE3D62B6B6DC35E2598DD453140E9277247965A1E835645E588A ] DiagTrack       C:\Windows\system32\diagtrack.dll
11:28:57.0304 0x09b8  DiagTrack - ok
11:28:57.0309 0x09b8  [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache        C:\Windows\system32\drivers\discache.sys
11:28:57.0311 0x09b8  discache - ok
11:28:57.0316 0x09b8  [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk            C:\Windows\system32\DRIVERS\disk.sys
11:28:57.0318 0x09b8  Disk - ok
11:28:57.0325 0x09b8  [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
11:28:57.0330 0x09b8  Dnscache - ok
11:28:57.0338 0x09b8  [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc         C:\Windows\System32\dot3svc.dll
11:28:57.0344 0x09b8  dot3svc - ok
11:28:57.0351 0x09b8  [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS             C:\Windows\system32\dps.dll
11:28:57.0355 0x09b8  DPS - ok
11:28:57.0358 0x09b8  [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
11:28:57.0359 0x09b8  drmkaud - ok
11:28:57.0382 0x09b8  [ 87CE5C8965E101CCCED1F4675557E868, 077D98F0F130B2FC710208BA34016EF2B2506EE2BD71740B228145E34A3046F1 ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
11:28:57.0402 0x09b8 Malwarebytes Anti-Rootkit BETA 1.09.1.1004
www.malwarebytes.org

Database version:
  main:    v2015.08.14.02
  rootkit: v2015.08.06.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.17959
Max-Uttendorfer :: PC [administrator]

14.08.2015 11:19:09
mbar-log-2015-08-14 (11-19-09).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 372712
Time elapsed: 6 minute(s), 41 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
 DXGKrnl - ok
11:28:57.0408 0x09b8  [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost         C:\Windows\System32\eapsvc.dll
11:28:57.0411 0x09b8  EapHost - ok
11:28:57.0478 0x09b8  [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv           C:\Windows\system32\DRIVERS\evbda.sys
11:28:57.0542 0x09b8  ebdrv - ok
11:28:57.0548 0x09b8  [ 0D48E93C6BE3143C0198CB252B992D16, AF34A41BAAE967045C8078E80B070E66ED60FDA0945FA752F715E49FD43373A4 ] EFS             C:\Windows\System32\lsass.exe
11:28:57.0549 0x09b8  EFS - ok
11:28:57.0567 0x09b8  [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
11:28:57.0582 0x09b8  ehRecvr - ok
11:28:57.0587 0x09b8  [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched         C:\Windows\ehome\ehsched.exe
11:28:57.0590 0x09b8  ehSched - ok
11:28:57.0603 0x09b8  [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor         C:\Windows\system32\DRIVERS\elxstor.sys
11:28:57.0615 0x09b8  elxstor - ok
11:28:57.0618 0x09b8  [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
11:28:57.0619 0x09b8  ErrDev - ok
11:28:57.0624 0x09b8  [ DF2F6C1E55F6E81CFC7F688380D85816, D9085466AA9D98AA01CD8ADEBD798CB326D4FD53A07BD199C3E6E500B4619355 ] EtronHub3       C:\Windows\system32\Drivers\EtronHub3.sys
11:28:57.0626 0x09b8  EtronHub3 - ok
11:28:57.0630 0x09b8  [ E093ABFB67A4B9D94F80611A7D0A8BB9, A23D58767F58CBDFAA4AD25779BBBC4FAD51CBD8FEB9C89284635631E4F084A6 ] EtronXHCI       C:\Windows\system32\Drivers\EtronXHCI.sys
11:28:57.0632 0x09b8  EtronXHCI - ok
11:28:57.0644 0x09b8  [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem     C:\Windows\system32\es.dll
11:28:57.0653 0x09b8  EventSystem - ok
11:28:57.0660 0x09b8  [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat           C:\Windows\system32\drivers\exfat.sys
11:28:57.0663 0x09b8  exfat - ok
11:28:57.0670 0x09b8  [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat         C:\Windows\system32\drivers\fastfat.sys
11:28:57.0674 0x09b8  fastfat - ok
11:28:57.0690 0x09b8  [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax             C:\Windows\system32\fxssvc.exe
11:28:57.0705 0x09b8  Fax - ok
11:28:57.0709 0x09b8  [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc             C:\Windows\system32\DRIVERS\fdc.sys
11:28:57.0710 0x09b8  fdc - ok
11:28:57.0713 0x09b8  [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost         C:\Windows\system32\fdPHost.dll
11:28:57.0715 0x09b8  fdPHost - ok
11:28:57.0718 0x09b8  [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub        C:\Windows\system32\fdrespub.dll
11:28:57.0719 0x09b8  FDResPub - ok
11:28:57.0724 0x09b8  [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
11:28:57.0726 0x09b8  FileInfo - ok
11:28:57.0729 0x09b8  [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
11:28:57.0731 0x09b8  Filetrace - ok
11:28:57.0734 0x09b8  [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
11:28:57.0735 0x09b8  flpydisk - ok
11:28:57.0744 0x09b8  [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
11:28:57.0751 0x09b8  FltMgr - ok
11:28:57.0777 0x09b8  [ D5A775990A7C202A037378FDBCDB6141, 27AD242914FAFB7A27B3045C0F0F6AFE6873FE331A51D8BB29A63B5D84C72EFB ] FontCache       C:\Windows\system32\FntCache.dll
11:28:57.0801 0x09b8  FontCache - ok
11:28:57.0806 0x09b8  [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
11:28:57.0808 0x09b8  FontCache3.0.0.0 - ok
11:28:57.0812 0x09b8  [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
11:28:57.0814 0x09b8  FsDepends - ok
11:28:57.0818 0x09b8  [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
11:28:57.0818 0x09b8  Fs_Rec - ok
11:28:57.0835 0x09b8  [ 3D0F2C8B86BCAB9A2BC5D5A725F45DCC, 45ABA7D6B08803D59D6F56698223E1B8A6365471EDAA041FA6434BE9FE140260 ] FUS2BASE        C:\Windows\system32\DRIVERS\fus2base.sys
11:28:57.0850 0x09b8  FUS2BASE - ok
11:28:57.0857 0x09b8  [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
11:28:57.0863 0x09b8  fvevol - ok
11:28:57.0867 0x09b8  [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
11:28:57.0869 0x09b8  gagp30kx - ok
11:28:57.0887 0x09b8  [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc           C:\Windows\System32\gpsvc.dll
11:28:57.0903 0x09b8  gpsvc - ok
11:28:57.0911 0x09b8  [ 51508F0C2476177E50C31B0BBFBF1BDB, 3F62A05181D54711180C8727AC66D624AFA7FC816A4ACC4DC0CFCF2D2DBE7F87 ] gupdate         C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
11:28:57.0914 0x09b8  gupdate - ok
11:28:57.0918 0x09b8  [ 51508F0C2476177E50C31B0BBFBF1BDB, 3F62A05181D54711180C8727AC66D624AFA7FC816A4ACC4DC0CFCF2D2DBE7F87 ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
11:28:57.0920 0x09b8  gupdatem - ok
11:28:57.0927 0x09b8  [ 5D4BC124FAAE6730AC002CDB67BF1A1C, 00294F4DC7D17F6DD2A22B9C3299BED40146BA45C972367154D20DB502472551 ] gusvc           C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
11:28:57.0932 0x09b8  gusvc - ok
11:28:57.0936 0x09b8  [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
11:28:57.0937 0x09b8  hcw85cir - ok
11:28:57.0942 0x09b8  [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys
11:28:57.0945 0x09b8  HDAudBus - ok
11:28:57.0949 0x09b8  [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt         C:\Windows\system32\DRIVERS\HidBatt.sys
11:28:57.0950 0x09b8  HidBatt - ok
11:28:57.0955 0x09b8  [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
11:28:57.0958 0x09b8  HidBth - ok
11:28:57.0962 0x09b8  [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr           C:\Windows\system32\DRIVERS\hidir.sys
11:28:57.0963 0x09b8  HidIr - ok
11:28:57.0967 0x09b8  [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv         C:\Windows\System32\hidserv.dll
11:28:57.0969 0x09b8  hidserv - ok
11:28:57.0973 0x09b8  [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
11:28:57.0974 0x09b8  HidUsb - ok
11:28:57.0979 0x09b8  [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc          C:\Windows\system32\kmsvc.dll
11:28:57.0982 0x09b8  hkmsvc - ok
11:28:57.0990 0x09b8  [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
11:28:57.0996 0x09b8  HomeGroupListener - ok
11:28:58.0002 0x09b8  [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
11:28:58.0008 0x09b8  HomeGroupProvider - ok
11:28:58.0012 0x09b8  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
11:28:58.0014 0x09b8  HpSAMD - ok
11:28:58.0032 0x09b8  [ F61634BEC53F73702A10DE69F6DCAF57, BBA7344CF3AB96A46D1A6F1D50F2758EA8D097FE558C38B4EF45C8C334AF96E1 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
11:28:58.0048 0x09b8  HTTP - ok
11:28:58.0052 0x09b8  [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
11:28:58.0053 0x09b8  hwpolicy - ok
11:28:58.0058 0x09b8  [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
11:28:58.0061 0x09b8  i8042prt - ok
11:28:58.0074 0x09b8  [ D7921D5A870B11CC1ADAB198A519D50A, 5DF99EB5D5504E9D9EB21658E8B4A58DEE2AD143A1875DB7F9B7BF4877FCB57F ] iaStor          C:\Windows\system32\DRIVERS\iaStor.sys
11:28:58.0081 0x09b8  iaStor - ok
11:28:58.0085 0x09b8  [ 8FFF9083252C16FE3960173722605E9E, 6546FDA34B9AF94C5E86E5269BBC2F02F1E78D6D4BE5B5EC01F4B284CC934994 ] IAStorDataMgrSvc C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
11:28:58.0086 0x09b8  IAStorDataMgrSvc - ok
11:28:58.0097 0x09b8  [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
11:28:58.0106 0x09b8  iaStorV - ok
11:28:58.0126 0x09b8  [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
11:28:58.0144 0x09b8  idsvc - ok
11:28:58.0148 0x09b8  IEEtwCollectorService - ok
11:28:58.0258 0x09b8  [ 8C44E6B688790E2AD3846C97661C54F1, CB487D167EDA3C1E30BD5FB8F98C15EB9E75A6FB793009C2F1BBCAAB4285F772 ] igfx            C:\Windows\system32\DRIVERS\igdkmd64.sys
11:28:58.0363 0x09b8  igfx - ok
11:28:58.0371 0x09b8  [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp           C:\Windows\system32\DRIVERS\iirsp.sys
11:28:58.0373 0x09b8  iirsp - ok
11:28:58.0393 0x09b8  [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT          C:\Windows\System32\ikeext.dll
11:28:58.0411 0x09b8  IKEEXT - ok
11:28:58.0415 0x09b8  [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide        C:\Windows\system32\drivers\intelide.sys
11:28:58.0417 0x09b8  intelide - ok
11:28:58.0421 0x09b8  [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
11:28:58.0422 0x09b8  intelppm - ok
11:28:58.0427 0x09b8  [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
11:28:58.0430 0x09b8  IPBusEnum - ok
11:28:58.0434 0x09b8  [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
11:28:58.0437 0x09b8  IpFilterDriver - ok
11:28:58.0452 0x09b8  [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] IpHlpSvc        C:\Windows\System32\iphlpsvc.dll
11:28:58.0464 0x09b8  IpHlpSvc - ok
11:28:58.0469 0x09b8  [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys
11:28:58.0472 0x09b8  IPMIDRV - ok
11:28:58.0477 0x09b8  [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
11:28:58.0480 0x09b8  IPNAT - ok
11:28:58.0483 0x09b8  [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM          C:\Windows\system32\drivers\irenum.sys
11:28:58.0484 0x09b8  IRENUM - ok
11:28:58.0488 0x09b8  [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
11:28:58.0489 0x09b8  isapnp - ok
11:28:58.0497 0x09b8  [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
11:28:58.0504 0x09b8  iScsiPrt - ok
11:28:58.0508 0x09b8  [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
11:28:58.0510 0x09b8  kbdclass - ok
11:28:58.0513 0x09b8  [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
11:28:58.0515 0x09b8  kbdhid - ok
11:28:58.0518 0x09b8  [ 0D48E93C6BE3143C0198CB252B992D16, AF34A41BAAE967045C8078E80B070E66ED60FDA0945FA752F715E49FD43373A4 ] KeyIso          C:\Windows\system32\lsass.exe
11:28:58.0519 0x09b8  KeyIso - ok
11:28:58.0524 0x09b8  [ 67A1743377EBB5D9A370A8C2086CFDCC, 2F0FD6C1969B1EEEEFFC1A8F972E1E90F1AD9558FF00EC159BC19ED927FD4BF5 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
11:28:58.0526 0x09b8  KSecDD - ok
11:28:58.0532 0x09b8  [ 522A1595D5701800DD41B2D472F5AAED, B62924AE94A5AC454AD6057BC133D717BB1C6445BE36D6BECAB76E1600F60C33 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
11:28:58.0537 0x09b8  KSecPkg - ok
11:28:58.0540 0x09b8  [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys
11:28:58.0541 0x09b8  ksthunk - ok
11:28:58.0551 0x09b8  [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm           C:\Windows\system32\msdtckrm.dll
11:28:58.0560 0x09b8  KtmRm - ok
11:28:58.0569 0x09b8  [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer    C:\Windows\System32\srvsvc.dll
11:28:58.0575 0x09b8  LanmanServer - ok
11:28:58.0580 0x09b8  [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
11:28:58.0584 0x09b8  LanmanWorkstation - ok
11:28:58.0589 0x09b8  [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
11:28:58.0591 0x09b8  lltdio - ok
11:28:58.0600 0x09b8  [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc         C:\Windows\System32\lltdsvc.dll
11:28:58.0607 0x09b8  lltdsvc - ok
11:28:58.0610 0x09b8  [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts         C:\Windows\System32\lmhsvc.dll
11:28:58.0612 0x09b8  lmhosts - ok
11:28:58.0622 0x09b8  [ 98B16E756243BEA9410E32025B19C06F, C4F8663FF4C2F1123CC92D88004090AD06ED12FCD07706AE168333A33B269A53 ] LMS             C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
11:28:58.0627 0x09b8  LMS - ok
11:28:58.0633 0x09b8  [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
11:28:58.0636 0x09b8  LSI_FC - ok
11:28:58.0641 0x09b8  [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS         C:\Windows\system32\DRIVERS\lsi_sas.sys
11:28:58.0644 0x09b8  LSI_SAS - ok
11:28:58.0648 0x09b8  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
11:28:58.0650 0x09b8  LSI_SAS2 - ok
11:28:58.0655 0x09b8  [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
11:28:58.0658 0x09b8  LSI_SCSI - ok
11:28:58.0664 0x09b8  [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv           C:\Windows\system32\drivers\luafv.sys
11:28:58.0667 0x09b8  luafv - ok
11:28:58.0671 0x09b8  [ 1E9E32AEC3E1EB1B31B8169F33168B56, 39114585E1FDBBA31E1F781C6A627281907183F94626EB347B08D1F78992ED2A ] MBAMProtector   C:\Windows\system32\drivers\mbam.sys
11:28:58.0672 0x09b8  MBAMProtector - ok
11:28:58.0697 0x09b8  [ 2B983F067AEE3F9EB4DF5E97F45D21D1, 0B9ED0E91FF01A5445927650113E320C3C0EA16F1401AA55A509DDBF704DF22F ] MBAMService     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
11:28:58.0719 0x09b8  MBAMService - ok
11:28:58.0724 0x09b8  [ F49FB3C88E263AE9A246593B0BB29294, FB53D6FA4A98B98334DCFF81E40712265256D31A9E9FF36022887BABD50F39EB ] MBAMWebAccessControl C:\Windows\system32\drivers\mwac.sys
11:28:58.0726 0x09b8  MBAMWebAccessControl - ok
11:28:58.0731 0x09b8  [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
11:28:58.0734 0x09b8  Mcx2Svc - ok
11:28:58.0737 0x09b8  [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas         C:\Windows\system32\DRIVERS\megasas.sys
11:28:58.0739 0x09b8  megasas - ok
11:28:58.0747 0x09b8  [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
11:28:58.0754 0x09b8  MegaSR - ok
11:28:58.0757 0x09b8  [ A6518DCC42F7A6E999BB3BEA8FD87567, 8A9AE992F93F37E0723761EA271A7E1AA8172702C471041A17324474FC96B9BC ] MEIx64          C:\Windows\system32\DRIVERS\HECIx64.sys
11:28:58.0759 0x09b8  MEIx64 - ok
11:28:58.0764 0x09b8  [ BA7E071E855D4C502916164A31B05D4D, 11B250AA98EAAB4A15A8796CABAFCFC20B8E049513BF66FFAA0F6C2BEED958A5 ] MHIKEY10        C:\Windows\system32\Drivers\MHIKEY10x64.sys
11:28:58.0766 0x09b8  MHIKEY10 - ok
11:28:58.0769 0x09b8  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS           C:\Windows\system32\mmcss.dll
11:28:58.0772 0x09b8  MMCSS - ok
11:28:58.0775 0x09b8  [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem           C:\Windows\system32\drivers\modem.sys
11:28:58.0776 0x09b8  Modem - ok
11:28:58.0780 0x09b8  [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
11:28:58.0780 0x09b8  monitor - ok
11:28:58.0784 0x09b8  [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
11:28:58.0786 0x09b8  mouclass - ok
11:28:58.0790 0x09b8  [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
11:28:58.0791 0x09b8  mouhid - ok
11:28:58.0796 0x09b8  [ 67050452C0118BAF2883928E6FCCFE47, 335FC0AEB7B47DCC7CE0CF3F424EB60ACB1327D2FF6515F04D9AC03A10FF1E31 ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
11:28:58.0799 0x09b8  mountmgr - ok
11:28:58.0805 0x09b8  [ 906DD5FE29BC912A87F66C9ACD87C720, 599CEE2D3AF0E52607C6984CE7F745C52BBBE6AE407E817AC25AD4D742098035 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
11:28:58.0809 0x09b8  MozillaMaintenance - ok
11:28:58.0815 0x09b8  [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio            C:\Windows\system32\drivers\mpio.sys
11:28:58.0819 0x09b8  mpio - ok
11:28:58.0823 0x09b8  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
11:28:58.0825 0x09b8  mpsdrv - ok
11:28:58.0846 0x09b8  [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc          C:\Windows\system32\mpssvc.dll
11:28:58.0864 0x09b8  MpsSvc - ok
11:28:58.0870 0x09b8  [ AE3334958D8F631FF14A0AEB3D7EFB3A, F5FD6B61F896104C20DFC43FEE2FCE6930B73F78DF876BD19A333EABB9139C6D ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
11:28:58.0875 0x09b8  MRxDAV - ok
11:28:58.0881 0x09b8  [ B2081803D510DCE174992BA880EDCA70, 37DB53C9756EC03EB7165DEB58251615D70B7C86DF32A54DE25ADAF30A04D792 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
11:28:58.0885 0x09b8  mrxsmb - ok
11:28:58.0894 0x09b8  [ 552FA62B0EFECD22D8D52499324BCA4F, C3A02C9C30C36928AC7B1025496544967187A05BEF5D100B54F2C0155E47145C ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
11:28:58.0900 0x09b8  mrxsmb10 - ok
11:28:58.0906 0x09b8  [ 97687971F9CB30E2633DE0F1296B9F61, 865DA87523E4C32D65D55D5475A5CDDFA10699780DA500E6D606384FB3BEB1BE ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
11:28:58.0909 0x09b8  mrxsmb20 - ok
11:28:58.0912 0x09b8  [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci          C:\Windows\system32\drivers\msahci.sys
11:28:58.0914 0x09b8  msahci - ok
11:28:58.0920 0x09b8  [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
11:28:58.0924 0x09b8  msdsm - ok
11:28:58.0929 0x09b8  [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC           C:\Windows\System32\msdtc.exe
11:28:58.0934 0x09b8  MSDTC - ok
11:28:58.0939 0x09b8  [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
11:28:58.0940 0x09b8  Msfs - ok
11:28:58.0943 0x09b8  [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
11:28:58.0944 0x09b8  mshidkmdf - ok
11:28:58.0947 0x09b8  [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
11:28:58.0948 0x09b8  msisadrv - ok
11:28:58.0954 0x09b8  [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
11:28:58.0959 0x09b8  MSiSCSI - ok
11:28:58.0961 0x09b8  msiserver - ok
11:28:58.0964 0x09b8  [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
11:28:58.0965 0x09b8  MSKSSRV - ok
11:28:58.0968 0x09b8  [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
11:28:58.0969 0x09b8  MSPCLOCK - ok
11:28:58.0972 0x09b8  [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
11:28:58.0973 0x09b8  MSPQM - ok
11:28:58.0983 0x09b8  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
11:28:58.0989 0x09b8  MsRPC - ok
11:28:58.0993 0x09b8  [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
11:28:58.0994 0x09b8  mssmbios - ok
11:28:58.0997 0x09b8  [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
11:28:58.0998 0x09b8  MSTEE - ok
11:28:59.0001 0x09b8  [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
11:28:59.0003 0x09b8  MTConfig - ok
11:28:59.0006 0x09b8  [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup             C:\Windows\system32\Drivers\mup.sys
11:28:59.0008 0x09b8  Mup - ok
11:28:59.0021 0x09b8  [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent        C:\Windows\system32\qagentRT.dll
11:28:59.0031 0x09b8  napagent - ok
11:28:59.0041 0x09b8  [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
11:28:59.0048 0x09b8  NativeWifiP - ok
11:28:59.0070 0x09b8  [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS            C:\Windows\system32\drivers\ndis.sys
11:28:59.0089 0x09b8  NDIS - ok
11:28:59.0093 0x09b8  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
11:28:59.0094 0x09b8  NdisCap - ok
11:28:59.0097 0x09b8  [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
11:28:59.0099 0x09b8  NdisTapi - ok
11:28:59.0103 0x09b8  [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
11:28:59.0105 0x09b8  Ndisuio - ok
11:28:59.0111 0x09b8  [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
11:28:59.0115 0x09b8  NdisWan - ok
11:28:59.0119 0x09b8  [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
11:28:59.0121 0x09b8  NDProxy - ok
11:28:59.0124 0x09b8  [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
11:28:59.0126 0x09b8  NetBIOS - ok
11:28:59.0134 0x09b8  [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
11:28:59.0140 0x09b8  NetBT - ok
11:28:59.0144 0x09b8  [ 0D48E93C6BE3143C0198CB252B992D16, AF34A41BAAE967045C8078E80B070E66ED60FDA0945FA752F715E49FD43373A4 ] Netlogon        C:\Windows\system32\lsass.exe
11:28:59.0145 0x09b8  Netlogon - ok
11:28:59.0155 0x09b8  [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman          C:\Windows\System32\netman.dll
11:28:59.0164 0x09b8  Netman - ok
11:28:59.0177 0x09b8  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
11:28:59.0181 0x09b8  NetMsmqActivator - ok
11:28:59.0187 0x09b8  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
11:28:59.0189 0x09b8  NetPipeActivator - ok
11:28:59.0201 0x09b8  [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm        C:\Windows\System32\netprofm.dll
11:28:59.0212 0x09b8  netprofm - ok
11:28:59.0217 0x09b8  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
11:28:59.0220 0x09b8  NetTcpActivator - ok
11:28:59.0225 0x09b8  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
11:28:59.0227 0x09b8  NetTcpPortSharing - ok
11:28:59.0231 0x09b8  [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960         C:\Windows\system32\DRIVERS\nfrd960.sys
11:28:59.0233 0x09b8  nfrd960 - ok
11:28:59.0242 0x09b8  [ 8B301D474B478E9A92823BAB50A7BC49, 8181816035F41B1DABEC05E65E4F67BCD785F56760A61F1049E91BA39D42F01D ] NlaSvc          C:\Windows\System32\nlasvc.dll
11:28:59.0249 0x09b8  NlaSvc - ok
11:28:59.0255 0x09b8  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs            C:\Windows\system32\drivers\Npfs.sys
11:28:59.0256 0x09b8  Npfs - ok
11:28:59.0259 0x09b8  [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi             C:\Windows\system32\nsisvc.dll
11:28:59.0261 0x09b8  nsi - ok
11:28:59.0264 0x09b8  [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
11:28:59.0265 0x09b8  nsiproxy - ok
11:28:59.0302 0x09b8  [ 1A29A59A4C5BA6F8C85062A613B7E2B2, CC137F499A12C724D4166C2D85E9F447413419A0683DAC6F1A802B7F210C77F1 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
11:28:59.0328 0x09b8  Ntfs - ok
11:28:59.0332 0x09b8  [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null            C:\Windows\system32\drivers\Null.sys
11:28:59.0333 0x09b8  Null - ok
11:28:59.0339 0x09b8  [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
11:28:59.0343 0x09b8  nvraid - ok
11:28:59.0349 0x09b8  [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
11:28:59.0353 0x09b8  nvstor - ok
11:28:59.0358 0x09b8  [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
11:28:59.0362 0x09b8  nv_agp - ok
11:28:59.0366 0x09b8  [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
11:28:59.0368 0x09b8  ohci1394 - ok
11:28:59.0373 0x09b8  [ 7A56CF3E3F12E8AF599963B16F50FB6A, 882C82BAE96D263138D4C0D6C425458B770B7B9C8E9C1D28AC918BF6BE94A5C2 ] ose             C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
11:28:59.0375 0x09b8  ose - ok
11:28:59.0386 0x09b8  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
11:28:59.0394 0x09b8  p2pimsvc - ok
11:28:59.0405 0x09b8  [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc          C:\Windows\system32\p2psvc.dll
11:28:59.0416 0x09b8  p2psvc - ok
11:28:59.0421 0x09b8  [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport         C:\Windows\system32\DRIVERS\parport.sys
11:28:59.0423 0x09b8  Parport - ok
11:28:59.0428 0x09b8  [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
11:28:59.0430 0x09b8  partmgr - ok
11:28:59.0437 0x09b8  [ DB2D62AA2DF6B1F3D690A9EC9701AA2C, BEAC55E1AA0494565F1547DF5E6FE20FCEA66461764C016FCB68D8BFF0F0C375 ] PcaSvc          C:\Windows\System32\pcasvc.dll
11:28:59.0442 0x09b8  PcaSvc - ok
11:28:59.0449 0x09b8  [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci             C:\Windows\system32\drivers\pci.sys
11:28:59.0454 0x09b8  pci - ok
11:28:59.0457 0x09b8  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide          C:\Windows\system32\drivers\pciide.sys
11:28:59.0458 0x09b8  pciide - ok
11:28:59.0465 0x09b8  [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
11:28:59.0471 0x09b8  pcmcia - ok
11:28:59.0475 0x09b8  [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw             C:\Windows\system32\drivers\pcw.sys
11:28:59.0476 0x09b8  pcw - ok
11:28:59.0492 0x09b8  [ ED6E75158D28D33A2E2A020AC5B2B59D, 0F364D9A88304C45F31318605C417A70A9D0E4CF087D73E949B42C12CC76CD6C ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
11:28:59.0506 0x09b8  PEAUTH - ok
11:28:59.0531 0x09b8  [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost        C:\Windows\SysWow64\perfhost.exe
11:28:59.0532 0x09b8  PerfHost - ok
11:28:59.0567 0x09b8  [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla             C:\Windows\system32\pla.dll
11:28:59.0596 0x09b8  pla - ok
11:28:59.0609 0x09b8  [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
11:28:59.0618 0x09b8  PlugPlay - ok
11:28:59.0622 0x09b8  [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
11:28:59.0624 0x09b8  PNRPAutoReg - ok
11:28:59.0633 0x09b8  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
11:28:59.0639 0x09b8  PNRPsvc - ok
11:28:59.0652 0x09b8  [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
11:28:59.0663 0x09b8  PolicyAgent - ok
11:28:59.0671 0x09b8  [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power           C:\Windows\system32\umpo.dll
11:28:59.0676 0x09b8  Power - ok
11:28:59.0680 0x09b8  [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
11:28:59.0684 0x09b8  PptpMiniport - ok
11:28:59.0687 0x09b8  [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor       C:\Windows\system32\DRIVERS\processr.sys
11:28:59.0690 0x09b8  Processor - ok
11:28:59.0697 0x09b8  [ B6A58491307B4CADA572583D863DC602, 5C44936605E52C9533E4CE22F18FAB8211475877F71EFD88DA4D02FD608C90A3 ] ProfSvc         C:\Windows\system32\profsvc.dll
11:28:59.0702 0x09b8  ProfSvc - ok
11:28:59.0706 0x09b8  [ 0D48E93C6BE3143C0198CB252B992D16, AF34A41BAAE967045C8078E80B070E66ED60FDA0945FA752F715E49FD43373A4 ] ProtectedStorage C:\Windows\system32\lsass.exe
11:28:59.0707 0x09b8  ProtectedStorage - ok
11:28:59.0713 0x09b8  [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
11:28:59.0716 0x09b8  Psched - ok
11:28:59.0749 0x09b8  [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
11:28:59.0779 0x09b8  ql2300 - ok
11:28:59.0785 0x09b8  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
11:28:59.0789 0x09b8  ql40xx - ok
11:28:59.0796 0x09b8  [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE           C:\Windows\system32\qwave.dll
11:28:59.0802 0x09b8  QWAVE - ok
11:28:59.0806 0x09b8  [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
11:28:59.0808 0x09b8  QWAVEdrv - ok
11:28:59.0810 0x09b8  [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
11:28:59.0812 0x09b8  RasAcd - ok
11:28:59.0816 0x09b8  [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
11:28:59.0818 0x09b8  RasAgileVpn - ok
11:28:59.0823 0x09b8  [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto         C:\Windows\System32\rasauto.dll
11:28:59.0826 0x09b8  RasAuto - ok
11:28:59.0831 0x09b8  [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
11:28:59.0834 0x09b8  Rasl2tp - ok
11:28:59.0844 0x09b8  [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan          C:\Windows\System32\rasmans.dll
11:28:59.0853 0x09b8  RasMan - ok
11:28:59.0857 0x09b8  [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
11:28:59.0860 0x09b8  RasPppoe - ok
11:28:59.0864 0x09b8  [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
11:28:59.0867 0x09b8  RasSstp - ok
11:28:59.0876 0x09b8  [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
11:28:59.0884 0x09b8  rdbss - ok
11:28:59.0888 0x09b8  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
11:28:59.0889 0x09b8  rdpbus - ok
11:28:59.0892 0x09b8  [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
11:28:59.0893 0x09b8  RDPCDD - ok
11:28:59.0897 0x09b8  [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
11:28:59.0898 0x09b8  RDPENCDD - ok
11:28:59.0902 0x09b8  [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
11:28:59.0903 0x09b8  RDPREFMP - ok
11:28:59.0909 0x09b8  [ 313F68E1A3E6345A4F47A36B07062F34, B8318A0AE06BDE278931CA52F960B9FE226FD9894B076858DDB755AE26E1E66F ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
11:28:59.0910 0x09b8  RdpVideoMiniport - ok
11:28:59.0917 0x09b8  [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
11:28:59.0921 0x09b8  RDPWD - ok
11:28:59.0928 0x09b8  [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
11:28:59.0934 0x09b8  rdyboost - ok
11:28:59.0939 0x09b8  [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess    C:\Windows\System32\mprdim.dll
11:28:59.0942 0x09b8  RemoteAccess - ok
11:28:59.0948 0x09b8  [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
11:28:59.0952 0x09b8  RemoteRegistry - ok
11:28:59.0957 0x09b8  [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
11:28:59.0959 0x09b8  RpcEptMapper - ok
11:28:59.0962 0x09b8  [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator      C:\Windows\system32\locator.exe
11:28:59.0964 0x09b8  RpcLocator - ok
11:28:59.0976 0x09b8  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs           C:\Windows\system32\rpcss.dll
11:28:59.0985 0x09b8  RpcSs - ok
11:28:59.0990 0x09b8  [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
11:28:59.0992 0x09b8  rspndr - ok
11:29:00.0003 0x09b8  [ 4B42BC58294E83A6A92EC8B88C14C4A3, 80885CFF021F7BC85647224863A83D444EA7848CBB4F06DFDFADE58F47307D21 ] RTL8167         C:\Windows\system32\DRIVERS\Rt64win7.sys
11:29:00.0010 0x09b8  RTL8167 - ok
11:29:00.0014 0x09b8  [ 0D48E93C6BE3143C0198CB252B992D16, AF34A41BAAE967045C8078E80B070E66ED60FDA0945FA752F715E49FD43373A4 ] SamSs           C:\Windows\system32\lsass.exe
11:29:00.0015 0x09b8  SamSs - ok
11:29:00.0020 0x09b8  [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
11:29:00.0022 0x09b8  sbp2port - ok
11:29:00.0029 0x09b8  [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
11:29:00.0035 0x09b8  SCardSvr - ok
11:29:00.0038 0x09b8  [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
11:29:00.0040 0x09b8  scfilter - ok
11:29:00.0064 0x09b8  [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule        C:\Windows\system32\schedsvc.dll
11:29:00.0087 0x09b8  Schedule - ok
11:29:00.0094 0x09b8  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc     C:\Windows\System32\certprop.dll
11:29:00.0095 0x09b8  SCPolicySvc - ok
11:29:00.0102 0x09b8  [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
11:29:00.0107 0x09b8  SDRSVC - ok
11:29:00.0111 0x09b8  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\Windows\system32\drivers\secdrv.sys
11:29:00.0112 0x09b8  secdrv - ok
11:29:00.0115 0x09b8  [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon        C:\Windows\system32\seclogon.dll
11:29:00.0117 0x09b8  seclogon - ok
11:29:00.0121 0x09b8  [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS            C:\Windows\system32\sens.dll
11:29:00.0124 0x09b8  SENS - ok
11:29:00.0127 0x09b8  [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc        C:\Windows\system32\sensrsvc.dll
11:29:00.0129 0x09b8  SensrSvc - ok
11:29:00.0132 0x09b8  [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
11:29:00.0134 0x09b8  Serenum - ok
11:29:00.0138 0x09b8  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial          C:\Windows\system32\DRIVERS\serial.sys
11:29:00.0141 0x09b8  Serial - ok
11:29:00.0144 0x09b8  [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
11:29:00.0146 0x09b8  sermouse - ok
11:29:00.0154 0x09b8  [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv      C:\Windows\system32\sessenv.dll
11:29:00.0158 0x09b8  SessionEnv - ok
11:29:00.0161 0x09b8  [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
11:29:00.0162 0x09b8  sffdisk - ok
11:29:00.0165 0x09b8  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
11:29:00.0166 0x09b8  sffp_mmc - ok
11:29:00.0169 0x09b8  [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
11:29:00.0170 0x09b8  sffp_sd - ok
11:29:00.0173 0x09b8  [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy         C:\Windows\system32\DRIVERS\sfloppy.sys
11:29:00.0174 0x09b8  sfloppy - ok
11:29:00.0185 0x09b8  [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
11:29:00.0193 0x09b8  SharedAccess - ok
11:29:00.0204 0x09b8  [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
11:29:00.0212 0x09b8  ShellHWDetection - ok
11:29:00.0216 0x09b8  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
11:29:00.0218 0x09b8  SiSRaid2 - ok
11:29:00.0222 0x09b8  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
11:29:00.0224 0x09b8  SiSRaid4 - ok
11:29:00.0229 0x09b8  [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
11:29:00.0232 0x09b8  Smb - ok
11:29:00.0237 0x09b8  [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
11:29:00.0239 0x09b8  SNMPTRAP - ok
11:29:00.0242 0x09b8  [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr           C:\Windows\system32\drivers\spldr.sys
11:29:00.0243 0x09b8  spldr - ok
11:29:00.0257 0x09b8  [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler         C:\Windows\System32\spoolsv.exe
11:29:00.0269 0x09b8  Spooler - ok
11:29:00.0342 0x09b8  [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc          C:\Windows\system32\sppsvc.exe
11:29:00.0411 0x09b8  sppsvc - ok
11:29:00.0424 0x09b8  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify     C:\Windows\system32\sppuinotify.dll
11:29:00.0427 0x09b8  sppuinotify - ok
11:29:00.0439 0x09b8  [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv             C:\Windows\system32\DRIVERS\srv.sys
11:29:00.0449 0x09b8  srv - ok
11:29:00.0460 0x09b8  [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
11:29:00.0469 0x09b8  srv2 - ok
11:29:00.0476 0x09b8  [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
11:29:00.0481 0x09b8  srvnet - ok
11:29:00.0488 0x09b8  [ 8F8324ED1DE63FFC7B1A02CD2D963C72, E58603F81DEAFF1D45CB83FB6E625E6A13868741B833B1C9E60D672179D18EE0 ] ssadbus         C:\Windows\system32\DRIVERS\ssadbus.sys
11:29:00.0492 0x09b8  ssadbus - ok
11:29:00.0495 0x09b8  [ 58221EFCB74167B73667F0024C661CE0, D9B67A8897B4DC3E4729187F17ABEB4710CF57440D718E17ED828439198D34DB ] ssadmdfl        C:\Windows\system32\DRIVERS\ssadmdfl.sys
11:29:00.0497 0x09b8  ssadmdfl - ok
11:29:00.0503 0x09b8  [ 4DA7C71BFAC5AD71255B7E4CAB980163, 4CC0F9C8E96ECEF36EEB021E448A9734B63512D030516DC38B1A2EEAA1043AEC ] ssadmdm         C:\Windows\system32\DRIVERS\ssadmdm.sys
11:29:00.0507 0x09b8  ssadmdm - ok
11:29:00.0513 0x09b8  [ D33D1BD3EC0E766211A234F56A12726D, 53EEAA94865554F8422D111D717B548DF553B5B8647D2A45F3718BF4AEEBEC27 ] ssadserd        C:\Windows\system32\DRIVERS\ssadserd.sys
11:29:00.0517 0x09b8  ssadserd - ok
11:29:00.0524 0x09b8  [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
11:29:00.0530 0x09b8  SSDPSRV - ok
11:29:00.0534 0x09b8  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc         C:\Windows\system32\sstpsvc.dll
11:29:00.0537 0x09b8  SstpSvc - ok
11:29:00.0558 0x09b8  [ 3BF022F8064A83A23DF90971DD78CA83, 85754DF1C6DE745ADF9A0BAB1948AFF2CA16C4569128DA90AF610D199E621BF4 ] StarMoney 9.0 OnlineUpdate C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
11:29:00.0569 0x09b8  StarMoney 9.0 OnlineUpdate - ok
11:29:00.0572 0x09b8  [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
11:29:00.0574 0x09b8  stexstor - ok
11:29:00.0577 0x09b8  [ DECACB6921DED1A38642642685D77DAC, 1633711CE973F818EBCCCA28538772431167C33ECDD44D1E846A9436598B52DC ] StillCam        C:\Windows\system32\DRIVERS\serscan.sys
11:29:00.0578 0x09b8  StillCam - ok
11:29:00.0593 0x09b8  [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc          C:\Windows\System32\wiaservc.dll
11:29:00.0605 0x09b8  stisvc - ok
11:29:00.0609 0x09b8  [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum          C:\Windows\system32\drivers\swenum.sys
11:29:00.0610 0x09b8  swenum - ok
11:29:00.0623 0x09b8  [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv           C:\Windows\System32\swprv.dll
11:29:00.0635 0x09b8  swprv - ok
11:29:00.0673 0x09b8  [ 2E730941CC5BF6200A4F56D1E9C24AAD, 758836D55DC84F3EBE9917DC6FAB8E6170A5B238FEDBCFDB6D7C5C6EA98E08B2 ] SysMain         C:\Windows\system32\sysmain.dll
11:29:00.0708 0x09b8  SysMain - ok
11:29:00.0715 0x09b8  [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
11:29:00.0719 0x09b8  TabletInputService - ok
11:29:00.0728 0x09b8  [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv         C:\Windows\System32\tapisrv.dll
11:29:00.0736 0x09b8  TapiSrv - ok
11:29:00.0741 0x09b8  [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS             C:\Windows\System32\tbssvc.dll
11:29:00.0743 0x09b8  TBS - ok
11:29:00.0784 0x09b8  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
11:29:00.0822 0x09b8  Tcpip - ok
11:29:00.0863 0x09b8  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
11:29:00.0892 0x09b8  TCPIP6 - ok
11:29:00.0899 0x09b8  [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
11:29:00.0901 0x09b8  tcpipreg - ok
11:29:00.0905 0x09b8  [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
11:29:00.0906 0x09b8  TDPIPE - ok
11:29:00.0910 0x09b8  [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
11:29:00.0911 0x09b8  TDTCP - ok
11:29:00.0916 0x09b8  [ 70988118145F5F10EF24720B97F35F65, F80C806417A68047FFB3D63214BC4AE5445315219AC594E043293006B704A63D ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
11:29:00.0919 0x09b8  tdx - ok
11:29:00.0923 0x09b8  [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD          C:\Windows\system32\drivers\termdd.sys
11:29:00.0925 0x09b8  TermDD - ok
11:29:00.0942 0x09b8  [ 008CD4EBFABCF78D0F19B3778492648C, 9050490EEE0AD86E73F0A82D83E4FC29DF84F6B6FDB389AE135FD712B5F425BE ] TermService     C:\Windows\System32\termsrv.dll
11:29:00.0953 0x09b8  TermService - ok
11:29:00.0957 0x09b8  [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes          C:\Windows\system32\themeservice.dll
11:29:00.0960 0x09b8  Themes - ok
11:29:00.0964 0x09b8  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER     C:\Windows\system32\mmcss.dll
11:29:00.0965 0x09b8  THREADORDER - ok
11:29:00.0970 0x09b8  [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks          C:\Windows\System32\trkwks.dll
11:29:00.0974 0x09b8  TrkWks - ok
11:29:00.0981 0x09b8  [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
11:29:00.0986 0x09b8  TrustedInstaller - ok
11:29:00.0990 0x09b8  [ E232A3B43A894BB327FC161529BD9ED1, F2673DA8C920F21ACCECC25F7C59A05822E5E577D47F126EDF9C94FEB4B30C5F ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
11:29:00.0992 0x09b8  tssecsrv - ok
11:29:00.0997 0x09b8  [ E9981ECE8D894CEF7038FD1D040EB426, DCDDCE933CAECE8180A3447199B07F2F0413704EEC1A09606EE357901A84A7CF ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
11:29:00.0999 0x09b8  TsUsbFlt - ok
11:29:01.0004 0x09b8  [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
11:29:01.0007 0x09b8  tunnel - ok
11:29:01.0011 0x09b8  [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
11:29:01.0013 0x09b8  uagp35 - ok
11:29:01.0023 0x09b8  [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
11:29:01.0030 0x09b8  udfs - ok
11:29:01.0036 0x09b8  [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect       C:\Windows\system32\UI0Detect.exe
11:29:01.0039 0x09b8  UI0Detect - ok
11:29:01.0042 0x09b8  [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
11:29:01.0045 0x09b8  uliagpkx - ok
11:29:01.0048 0x09b8  [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus           C:\Windows\system32\DRIVERS\umbus.sys
11:29:01.0050 0x09b8  umbus - ok
11:29:01.0053 0x09b8  [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
11:29:01.0054 0x09b8  UmPass - ok
11:29:01.0110 0x09b8  [ 7A78ED1088890114DFDE2C4AB038D6B6, B52357594A90A8BCF5F96FA630F52BB1274A2FE814AF0270D21C892871D076FC ] UNS             C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
11:29:01.0151 0x09b8  UNS - ok
11:29:01.0164 0x09b8  [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost        C:\Windows\System32\upnphost.dll
11:29:01.0172 0x09b8  upnphost - ok
11:29:01.0177 0x09b8  [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys
11:29:01.0180 0x09b8  usbccgp - ok
11:29:01.0185 0x09b8  [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir          C:\Windows\system32\drivers\usbcir.sys
11:29:01.0188 0x09b8  usbcir - ok
11:29:01.0191 0x09b8  [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci         C:\Windows\system32\DRIVERS\usbehci.sys
11:29:01.0193 0x09b8  usbehci - ok
11:29:01.0203 0x09b8  [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
11:29:01.0211 0x09b8  usbhub - ok
11:29:01.0214 0x09b8  [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci         C:\Windows\system32\drivers\usbohci.sys
11:29:01.0216 0x09b8  usbohci - ok
11:29:01.0219 0x09b8  [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
11:29:01.0220 0x09b8  usbprint - ok
11:29:01.0224 0x09b8  [ 9661DA76B4531B2DA272ECCE25A8AF24, FEA93254A21E71A7EB8AD35FCCAD2C1E41F7329EC33B1734F5B41307A34D8637 ] usbscan         C:\Windows\system32\DRIVERS\usbscan.sys
11:29:01.0226 0x09b8  usbscan - ok
11:29:01.0230 0x09b8  [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
11:29:01.0233 0x09b8  USBSTOR - ok
11:29:01.0237 0x09b8  [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys
11:29:01.0238 0x09b8  usbuhci - ok
11:29:01.0242 0x09b8  [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms           C:\Windows\System32\uxsms.dll
11:29:01.0244 0x09b8  UxSms - ok
11:29:01.0247 0x09b8  [ 0D48E93C6BE3143C0198CB252B992D16, AF34A41BAAE967045C8078E80B070E66ED60FDA0945FA752F715E49FD43373A4 ] VaultSvc        C:\Windows\system32\lsass.exe
11:29:01.0248 0x09b8  VaultSvc - ok
11:29:01.0252 0x09b8  [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
11:29:01.0253 0x09b8  vdrvroot - ok
11:29:01.0267 0x09b8  [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds             C:\Windows\System32\vds.exe
11:29:01.0279 0x09b8  vds - ok
11:29:01.0283 0x09b8  [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
11:29:01.0284 0x09b8  vga - ok
11:29:01.0287 0x09b8  [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave         C:\Windows\System32\drivers\vga.sys
11:29:01.0289 0x09b8  VgaSave - ok
11:29:01.0296 0x09b8  [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys
11:29:01.0301 0x09b8  vhdmp - ok
11:29:01.0305 0x09b8  [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide          C:\Windows\system32\drivers\viaide.sys
11:29:01.0306 0x09b8  viaide - ok
11:29:01.0310 0x09b8  [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
11:29:01.0312 0x09b8  volmgr - ok
11:29:01.0322 0x09b8  [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
11:29:01.0330 0x09b8  volmgrx - ok
11:29:01.0339 0x09b8  [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap         C:\Windows\system32\drivers\volsnap.sys
11:29:01.0346 0x09b8  volsnap - ok
11:29:01.0353 0x09b8  [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid         C:\Windows\system32\DRIVERS\vsmraid.sys
11:29:01.0357 0x09b8  vsmraid - ok
11:29:01.0392 0x09b8  [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS             C:\Windows\system32\vssvc.exe
11:29:01.0424 0x09b8  VSS - ok
11:29:01.0428 0x09b8  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
11:29:01.0430 0x09b8  vwifibus - ok
11:29:01.0440 0x09b8  [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time         C:\Windows\system32\w32time.dll
11:29:01.0449 0x09b8  W32Time - ok
11:29:01.0454 0x09b8  [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
11:29:01.0456 0x09b8  WacomPen - ok
11:29:01.0460 0x09b8  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
11:29:01.0463 0x09b8  WANARP - ok
11:29:01.0467 0x09b8  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
11:29:01.0469 0x09b8  Wanarpv6 - ok
11:29:01.0497 0x09b8  [ 3CEC96DE223E49EAAE3651FCF8FAEA6C, 4150DAB33E8D61076F1D4767BCAFC9B4ECCCCBD58FD4FB3CFE5B8D27DCDCAB61 ] WatAdminSvc     C:\Windows\system32\Wat\WatAdminSvc.exe
11:29:01.0522 0x09b8  WatAdminSvc - ok
11:29:01.0556 0x09b8  [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine        C:\Windows\system32\wbengine.exe
11:29:01.0586 0x09b8  wbengine - ok
11:29:01.0594 0x09b8  [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
11:29:01.0600 0x09b8  WbioSrvc - ok
11:29:01.0610 0x09b8  [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc         C:\Windows\System32\wcncsvc.dll
11:29:01.0619 0x09b8  wcncsvc - ok
11:29:01.0623 0x09b8  [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
11:29:01.0625 0x09b8  WcsPlugInService - ok
11:29:01.0628 0x09b8  [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd              C:\Windows\system32\DRIVERS\wd.sys
11:29:01.0629 0x09b8  Wd - ok
11:29:01.0648 0x09b8  [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
11:29:01.0664 0x09b8  Wdf01000 - ok
11:29:01.0669 0x09b8  [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiServiceHost  C:\Windows\system32\wdi.dll
11:29:01.0672 0x09b8  WdiServiceHost - ok
11:29:01.0676 0x09b8  [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiSystemHost   C:\Windows\system32\wdi.dll
11:29:01.0679 0x09b8  WdiSystemHost - ok
11:29:01.0687 0x09b8  [ 4E89FC53493704BF835F0300DC201C34, FB3080725E144D93512DED81047D21C0582BC3412250EFF37E039108D7351F53 ] WebClient       C:\Windows\System32\webclnt.dll
11:29:01.0694 0x09b8  WebClient - ok
11:29:01.0701 0x09b8  [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc          C:\Windows\system32\wecsvc.dll
11:29:01.0707 0x09b8  Wecsvc - ok
11:29:01.0712 0x09b8  [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
11:29:01.0715 0x09b8  wercplsupport - ok
11:29:01.0720 0x09b8  [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc          C:\Windows\System32\WerSvc.dll
11:29:01.0722 0x09b8  WerSvc - ok
11:29:01.0726 0x09b8  [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
11:29:01.0727 0x09b8  WfpLwf - ok
11:29:01.0730 0x09b8  [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
11:29:01.0732 0x09b8  WIMMount - ok
11:29:01.0735 0x09b8  WinDefend - ok
11:29:01.0739 0x09b8  WinHttpAutoProxySvc - ok
11:29:01.0752 0x09b8  [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
11:29:01.0758 0x09b8  Winmgmt - ok
11:29:01.0802 0x09b8  [ D929ABD465A2DED963DA8B30946A8D5C, DE8DBFB01C11D2AE903CBD6A974D6F995E9813CE2D6484B7DA06EAE4C545842A ] WinRM           C:\Windows\system32\WsmSvc.dll
11:29:01.0843 0x09b8  WinRM - ok
11:29:01.0850 0x09b8  [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb          C:\Windows\system32\drivers\WinUsb.sys
11:29:01.0852 0x09b8  WinUsb - ok
11:29:01.0872 0x09b8  [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc         C:\Windows\System32\wlansvc.dll
11:29:01.0891 0x09b8  Wlansvc - ok
11:29:01.0940 0x09b8  [ 2BACD71123F42CEA603F4E205E1AE337, 1FEF20554110371D738F462ECFFA999158EFEED02062414C58C1B61C422BF0B9 ] wlidsvc         C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
11:29:01.0976 0x09b8  wlidsvc - ok
11:29:01.0982 0x09b8  [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys
11:29:01.0984 0x09b8  WmiAcpi - ok
11:29:01.0992 0x09b8  [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
11:29:01.0997 0x09b8  wmiApSrv - ok
11:29:01.0999 0x09b8  WMPNetworkSvc - ok
11:29:02.0002 0x09b8  [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc          C:\Windows\System32\wpcsvc.dll
11:29:02.0004 0x09b8  WPCSvc - ok
11:29:02.0009 0x09b8  [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
11:29:02.0013 0x09b8  WPDBusEnum - ok
11:29:02.0016 0x09b8  [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
11:29:02.0017 0x09b8  ws2ifsl - ok
11:29:02.0022 0x09b8  [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc          C:\Windows\system32\wscsvc.dll
11:29:02.0025 0x09b8  wscsvc - ok
11:29:02.0030 0x09b8  [ 8D918B1DB190A4D9B1753A66FA8C96E8, DB7D2714DC04D2D6999A207D7399A5647C8653E5A1AD80856A65C5B6065AEDFE ] WSDPrintDevice  C:\Windows\system32\DRIVERS\WSDPrint.sys
11:29:02.0031 0x09b8  WSDPrintDevice - ok
11:29:02.0035 0x09b8  [ 4A2A5C50DD1A63577D3ACA94269FBC7F, F75C1906D431CF871AD954218DF32A0F206E45FF49332DEF9F13C0A36A407047 ] WSDScan         C:\Windows\system32\DRIVERS\WSDScan.sys
11:29:02.0036 0x09b8  WSDScan - ok
11:29:02.0038 0x09b8  WSearch - ok
11:29:02.0094 0x09b8  [ 499034D7F1F6AF49F9EE12F8822793CB, 55D591C4861AF66C6B9201BF78808B2ECE7B79D95C6BB07FF0ED87EFE63DD99E ] wuauserv        C:\Windows\system32\wuaueng.dll
11:29:02.0145 0x09b8  wuauserv - ok
11:29:02.0152 0x09b8  [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
11:29:02.0155 0x09b8  WudfPf - ok
11:29:02.0162 0x09b8  [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
11:29:02.0167 0x09b8  WUDFRd - ok
11:29:02.0172 0x09b8  [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
11:29:02.0175 0x09b8  wudfsvc - ok
11:29:02.0183 0x09b8  [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc         C:\Windows\System32\wwansvc.dll
11:29:02.0189 0x09b8  WwanSvc - ok
11:29:02.0192 0x09b8  ================ Scan global ===============================
11:29:02.0195 0x09b8  [ 168EA9CD9BD6056BB6F60B57D5304BBE, 5A2F98754F042A7D80E7483842967EB362F01D57CE9720B24C7EDAA047F24C6F ] C:\Windows\system32\basesrv.dll
11:29:02.0202 0x09b8  [ E80CA72FA43BF258E72C408CEF9839BE, 06482E80F43AD91F4B9E5919A0C50219382213D59EACF9FBAE7AFD7A321F30D2 ] C:\Windows\system32\winsrv.dll
11:29:02.0212 0x09b8  [ E80CA72FA43BF258E72C408CEF9839BE, 06482E80F43AD91F4B9E5919A0C50219382213D59EACF9FBAE7AFD7A321F30D2 ] C:\Windows\system32\winsrv.dll
11:29:02.0219 0x09b8  [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
11:29:02.0228 0x09b8  [ 71C85477DF9347FE8E7BC55768473FCA, A86D6A6D1F5A0EFCD649792A06F3AE9B37158D48493D2ECA7F52DCC1CB9B6536 ] C:\Windows\system32\services.exe
11:29:02.0236 0x09b8  [ Global ] - ok
11:29:02.0236 0x09b8  ================ Scan MBR ==================================
11:29:02.0238 0x09b8  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
11:29:02.0303 0x09b8  \Device\Harddisk0\DR0 - ok
11:29:02.0305 0x09b8  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk1\DR1
11:29:02.0384 0x09b8  \Device\Harddisk1\DR1 - ok
11:29:02.0384 0x09b8  ================ Scan VBR ==================================
11:29:02.0387 0x09b8  [ 711AE08453A1A2160326204565602095 ] \Device\Harddisk0\DR0\Partition1
11:29:02.0389 0x09b8  \Device\Harddisk0\DR0\Partition1 - ok
11:29:02.0392 0x09b8  [ 6A7D517A36DD041273BF3FB45B146C5E ] \Device\Harddisk0\DR0\Partition2
11:29:02.0395 0x09b8  \Device\Harddisk0\DR0\Partition2 - ok
11:29:02.0395 0x09b8  ================ Scan generic autorun ======================
11:29:02.0402 0x09b8  [ 28062B17191C9450BF6C6C3EF8C7EB27, 4859C5708DFD119021F7B7FFB38F0B316675E1E4D5D51A10D4265F712CF8CDB6 ] C:\Windows\system32\igfxtray.exe
11:29:02.0408 0x09b8  IgfxTray - ok
11:29:02.0421 0x09b8  [ 28FC280487F0BAAE5E8119257C4EEF8C, F574BC70B79B77912FC683B3EB0BE6929E7758284ED5B47008E18B0E4A4A09FD ] C:\Windows\system32\hkcmd.exe
11:29:02.0428 0x09b8  HotKeysCmds - ok
11:29:02.0439 0x09b8  [ F29BEA821C753E4F00177690F70CDC13, 0EDB40F4A4C23553C0288E6E3AD65E7B523F6764C87C6C36C3ECB0C1940C5176 ] C:\Windows\system32\igfxpers.exe
11:29:02.0446 0x09b8  Persistence - ok
11:29:02.0455 0x09b8  [ 4A73AB8412D3AA6CFAD24051FF9DBFA7, 7C1F6BDECE92F2A58E88FC603F1BEE9B0F72130136AE9A368892323A9A327FD1 ] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
11:29:02.0460 0x09b8  IAStorIcon - ok
11:29:02.0489 0x09b8  [ 28DEF0EFB36D172EAA5A08EB09CF75DF, 62D07A28167AEBFB9511830BFBBEAAB17CC24D57FF8D07F1414D921135BC9024 ] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
11:29:02.0501 0x09b8  avgnt - ok
11:29:02.0506 0x09b8  [ 34D296AFC913E302953C70463EF09A48, BC413307CBC56C039EE8A05B51A56E14EF59678FBB33815AEB320078056C8CE7 ] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
11:29:02.0507 0x09b8  HP Software Update - ok
11:29:02.0511 0x09b8  [ 5D61BE7DB55B026A5D61A3EED09D0EAD, D32CC7B31A6F98C60ABC313ABC7D1143681F72DE2BB2604711A0BA20710CAAAE ] C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
11:29:02.0513 0x09b8  swg - ok
11:29:02.0690 0x09b8  [ 18EE6C694976C4D205AF24D6CCE3B660, 262F8B929CBBC8BFDD465826A27625ED9508A7C325C45F1964A4EFAC36D60056 ] C:\Program Files\CCleaner\CCleaner64.exe
11:29:02.0795 0x09b8  CCleaner Monitoring - ok
11:29:02.0839 0x09b8  [ 08DFA176E4FC0E63ACD8EC854449D2B0, B8CA204C3F318CD9D12F61CDDA5C66184A48D6206F019AD11DB2605FDBEB288D ] C:\Users\Max-Uttendorfer\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
11:29:02.0865 0x09b8  Spotify Web Helper - ok
11:29:02.0866 0x09b8  Waiting for KSN requests completion. In queue: 250
11:29:03.0866 0x09b8  Waiting for KSN requests completion. In queue: 250
11:29:04.0866 0x09b8  Waiting for KSN requests completion. In queue: 250
11:29:05.0897 0x09b8  AV detected via SS2: Avira Antivirus, C:\Program Files (x86)\Avira\AntiVir Desktop\wsctool.exe ( 15.0.12.402 ), 0x41000 ( enabled : updated )
11:29:05.0907 0x09b8  Win FW state via NFP2: enabled ( trusted )
11:29:08.0265 0x09b8  ============================================================
11:29:08.0265 0x09b8  Scan finished
11:29:08.0265 0x09b8  ============================================================
11:29:08.0274 0x0984  Detected object count: 0
11:29:08.0274 0x0984  Actual detected object count: 0
11:41:11.0474 0x0918  Deinitialize success

Beide nichts gefunden. Problem weiter vorhanden.

schrauber · 15.08.2015, 06:03

Ok, wenn keine Dateien vetschlüsselt sind hast Du anscheind nochmal Glück gehabt. Poste bitte ein frisches FRST Log, dann fixen wir den Kram raus.

uttella · 15.08.2015, 20:07

Code:

ATTFilter

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:14-08-2015 01
durchgeführt von Max-Uttendorfer (Administrator) auf PC (15-08-2015 21:07:04)
Gestartet von C:\Users\Max-Uttendorfer\Downloads
Geladene Profile: Max-Uttendorfer (Verfügbare Profile: Max-Uttendorfer)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 4620 series\Bin\FaxApplications.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Spotify Ltd) C:\Users\Max-Uttendorfer\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Farbar) C:\Users\Max-Uttendorfer\Downloads\FRST64(2).exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-05] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [782008 2015-07-30] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe [134368 2015-07-02] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3038766165-3120518270-3538088492-1000\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-09-03] (Google Inc.)
HKU\S-1-5-21-3038766165-3120518270-3538088492-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7063832 2014-11-21] (Piriform Ltd)
HKU\S-1-5-21-3038766165-3120518270-3538088492-1000\...\Run: [Spotify Web Helper] => C:\Users\Max-Uttendorfer\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2015-04-04] (Spotify Ltd)
Startup: C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\help-file-decrypt.enc [2015-08-07] ()
Startup: C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 4620 series.lnk [2013-04-01]
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 4620 series.lnk -> C:\Program Files\HP\HP Officejet 4620 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..)

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3038766165-3120518270-3538088492-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-15] (Google Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-11-27] (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-15] (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-27] (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-15] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-15] (Google Inc.)
DPF: HKLM-x32 {A8F2B9BD-A6A0-486A-9744-18920D898429} hxxp://www.sibelius.com/download/software/win/ActiveXPlugin.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{0BA395AF-0DC7-4713-8F94-7C2130148F68}: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-12] ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll [2013-08-06] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-12] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-27] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-27] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-12-01]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}.xpi [2015-08-12]
FF HKU\S-1-5-21-3038766165-3120518270-3538088492-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-12-01]

Chrome: 
=======
CHR Profile: C:\Users\Max-Uttendorfer\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Max-Uttendorfer\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-11]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Max-Uttendorfer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-11]

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [887128 2015-07-30] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [461672 2015-07-30] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [461672 2015-07-30] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1213072 2015-07-30] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [218816 2015-07-02] (Avira Operations GmbH & Co. KG)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [162528 2015-07-30] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [141416 2015-07-30] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 AVMCOWAN; C:\Windows\System32\DRIVERS\AVMCOWAN.sys [79872 2009-06-10] (AVM GmbH)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-23] (Avira Operations GmbH & Co. KG)
S3 FUS2BASE; C:\Windows\System32\DRIVERS\fus2base.sys [696832 2009-06-10] (AVM Berlin)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
S3 MHIKEY10; C:\Windows\System32\Drivers\MHIKEY10x64.sys [60288 2010-09-15] (Generic USB smartcard reader)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 cmudaxp; system32\drivers\cmudaxp.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-08-15 21:06 - 2015-08-15 21:06 - 02173952 _____ (Farbar) C:\Users\Max-Uttendorfer\Downloads\FRST64(2).exe
2015-08-14 11:28 - 2015-08-14 11:28 - 04404952 _____ (Kaspersky Lab ZAO) C:\Users\Max-Uttendorfer\Downloads\tdsskiller(1).exe
2015-08-14 11:00 - 2015-08-14 11:26 - 00000000 ____D C:\Users\Max-Uttendorfer\Desktop\mbar
2015-08-14 10:58 - 2015-08-14 11:26 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-08-14 10:57 - 2015-08-14 10:57 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Max-Uttendorfer\Downloads\mbar-1.09.1.1004.exe
2015-08-13 11:33 - 2015-08-13 11:33 - 00000000 ____D C:\Windows\rescache
2015-08-13 09:14 - 2015-08-13 09:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarMoney 9.0
2015-08-13 09:13 - 2015-08-14 14:02 - 00000000 ____D C:\Program Files (x86)\StarMoney 9.0
2015-08-13 09:11 - 2015-08-13 09:13 - 189410056 _____ C:\Users\Max-Uttendorfer\Downloads\smoney.exe
2015-08-13 09:09 - 2015-08-13 09:09 - 00000000 ____D C:\ProgramData\StarMoney 10
2015-08-12 22:49 - 2015-07-30 15:13 - 00124624 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-08-12 22:49 - 2015-07-30 15:13 - 00103120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-08-12 14:43 - 2015-07-28 22:09 - 00017344 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-08-12 14:43 - 2015-07-28 22:05 - 01116672 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-08-12 14:43 - 2015-07-28 22:05 - 00774656 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-08-12 14:43 - 2015-07-28 22:05 - 00743424 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-08-12 14:43 - 2015-07-28 22:05 - 00437760 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-08-12 14:43 - 2015-07-28 22:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-08-12 14:43 - 2015-07-28 22:05 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-08-12 14:43 - 2015-07-28 21:55 - 01148416 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-08-12 14:43 - 2015-07-16 21:12 - 06131200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-08-12 14:43 - 2015-07-16 21:12 - 00856064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2015-08-12 14:43 - 2015-07-16 21:12 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2015-08-12 14:43 - 2015-07-16 21:11 - 07077376 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-08-12 14:43 - 2015-07-16 21:11 - 01057792 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2015-08-12 14:43 - 2015-07-16 21:11 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2015-08-12 14:43 - 2015-07-15 20:15 - 05568960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-08-12 14:43 - 2015-07-15 20:15 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-08-12 14:43 - 2015-07-15 20:15 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-08-12 14:43 - 2015-07-15 20:15 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-08-12 14:43 - 2015-07-15 20:12 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-08-12 14:43 - 2015-07-15 20:11 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-08-12 14:43 - 2015-07-15 20:11 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-08-12 14:43 - 2015-07-15 20:11 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-08-12 14:43 - 2015-07-15 20:11 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-08-12 14:43 - 2015-07-15 20:11 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-08-12 14:43 - 2015-07-15 20:10 - 01743360 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2015-08-12 14:43 - 2015-07-15 20:10 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-08-12 14:43 - 2015-07-15 20:10 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-08-12 14:43 - 2015-07-15 20:10 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-08-12 14:43 - 2015-07-15 20:10 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-08-12 14:43 - 2015-07-15 20:10 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-08-12 14:43 - 2015-07-15 20:10 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-08-12 14:43 - 2015-07-15 20:10 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-08-12 14:43 - 2015-07-15 20:10 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-08-12 14:43 - 2015-07-15 20:10 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-08-12 14:43 - 2015-07-15 20:10 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-08-12 14:43 - 2015-07-15 20:10 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-08-12 14:43 - 2015-07-15 20:10 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-08-12 14:43 - 2015-07-15 20:10 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-08-12 14:43 - 2015-07-15 20:10 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-08-12 14:43 - 2015-07-15 20:10 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-08-12 14:43 - 2015-07-15 20:10 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-08-12 14:43 - 2015-07-15 20:10 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-08-12 14:43 - 2015-07-15 20:10 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-08-12 14:43 - 2015-07-15 20:10 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-08-12 14:43 - 2015-07-15 20:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-08-12 14:43 - 2015-07-15 20:10 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-08-12 14:43 - 2015-07-15 20:10 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-08-12 14:43 - 2015-07-15 20:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-08-12 14:43 - 2015-07-15 20:09 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-08-12 14:43 - 2015-07-15 20:05 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-08-12 14:43 - 2015-07-15 20:05 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:59 - 03989952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-08-12 14:43 - 2015-07-15 19:59 - 03934656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-08-12 14:43 - 2015-07-15 19:56 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-08-12 14:43 - 2015-07-15 19:55 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-08-12 14:43 - 2015-07-15 19:55 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-08-12 14:43 - 2015-07-15 19:55 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-08-12 14:43 - 2015-07-15 19:55 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-08-12 14:43 - 2015-07-15 19:55 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-08-12 14:43 - 2015-07-15 19:54 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-08-12 14:43 - 2015-07-15 19:54 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-08-12 14:43 - 2015-07-15 19:54 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-08-12 14:43 - 2015-07-15 19:54 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-08-12 14:43 - 2015-07-15 19:54 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-08-12 14:43 - 2015-07-15 19:54 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-08-12 14:43 - 2015-07-15 19:54 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-08-12 14:43 - 2015-07-15 19:53 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-08-12 14:43 - 2015-07-15 19:53 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-08-12 14:43 - 2015-07-15 19:53 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-08-12 14:43 - 2015-07-15 19:53 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-08-12 14:43 - 2015-07-15 19:53 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-08-12 14:43 - 2015-07-15 19:53 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-08-12 14:43 - 2015-07-15 19:49 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-08-12 14:43 - 2015-07-15 19:48 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 18:46 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-08-12 14:43 - 2015-07-15 18:46 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-08-12 14:43 - 2015-07-15 18:46 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-08-12 14:43 - 2015-07-15 18:37 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-08-12 14:43 - 2015-07-15 18:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-08-12 14:43 - 2015-07-15 18:34 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 18:34 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 18:34 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-08-12 14:43 - 2015-07-15 18:34 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-08-12 14:43 - 2015-07-11 15:15 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2015-08-12 14:42 - 2015-07-30 20:06 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2015-08-12 14:42 - 2015-07-30 20:06 - 01648128 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-08-12 14:42 - 2015-07-30 20:06 - 01180160 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-08-12 14:42 - 2015-07-30 20:06 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-08-12 14:42 - 2015-07-30 20:06 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-08-12 14:42 - 2015-07-30 20:06 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-08-12 14:42 - 2015-07-30 20:06 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-08-12 14:42 - 2015-07-30 19:57 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2015-08-12 14:42 - 2015-07-30 19:57 - 01251328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-08-12 14:42 - 2015-07-30 19:57 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-08-12 14:42 - 2015-07-30 19:57 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-08-12 14:42 - 2015-07-30 19:57 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-08-12 14:42 - 2015-07-30 19:55 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-08-12 14:42 - 2015-07-30 18:56 - 03208192 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-08-12 14:42 - 2015-07-30 18:52 - 00372736 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-08-12 14:42 - 2015-07-30 18:49 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-08-12 14:42 - 2015-07-21 02:39 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-08-12 14:42 - 2015-07-21 02:12 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-08-12 14:42 - 2015-07-20 20:12 - 03154944 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-08-12 14:42 - 2015-07-20 20:12 - 02606080 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-08-12 14:42 - 2015-07-20 20:12 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-08-12 14:42 - 2015-07-20 20:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-08-12 14:42 - 2015-07-20 20:12 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-08-12 14:42 - 2015-07-20 20:12 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-08-12 14:42 - 2015-07-20 20:12 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-08-12 14:42 - 2015-07-20 20:12 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-08-12 14:42 - 2015-07-20 20:12 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-08-12 14:42 - 2015-07-20 20:12 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-08-12 14:42 - 2015-07-20 20:12 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-08-12 14:42 - 2015-07-20 19:56 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-08-12 14:42 - 2015-07-20 19:56 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-08-12 14:42 - 2015-07-20 19:56 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-08-12 14:42 - 2015-07-20 19:56 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-08-12 14:42 - 2015-07-20 19:56 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-08-12 14:42 - 2015-07-16 23:14 - 25192448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-08-12 14:42 - 2015-07-16 22:54 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-08-12 14:42 - 2015-07-16 22:54 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-08-12 14:42 - 2015-07-16 22:37 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-08-12 14:42 - 2015-07-16 22:36 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-08-12 14:42 - 2015-07-16 22:36 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-08-12 14:42 - 2015-07-16 22:36 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-08-12 14:42 - 2015-07-16 22:35 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-08-12 14:42 - 2015-07-16 22:35 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-08-12 14:42 - 2015-07-16 22:27 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-08-12 14:42 - 2015-07-16 22:26 - 05923328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-08-12 14:42 - 2015-07-16 22:26 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-08-12 14:42 - 2015-07-16 22:23 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-08-12 14:42 - 2015-07-16 22:21 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-08-12 14:42 - 2015-07-16 22:21 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-08-12 14:42 - 2015-07-16 22:21 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-08-12 14:42 - 2015-07-16 22:21 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-08-12 14:42 - 2015-07-16 22:20 - 19870208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-08-12 14:42 - 2015-07-16 22:12 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-08-12 14:42 - 2015-07-16 22:08 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-08-12 14:42 - 2015-07-16 22:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-08-12 14:42 - 2015-07-16 22:00 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-08-12 14:42 - 2015-07-16 21:55 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-08-12 14:42 - 2015-07-16 21:54 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-08-12 14:42 - 2015-07-16 21:51 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-08-12 14:42 - 2015-07-16 21:51 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-08-12 14:42 - 2015-07-16 21:51 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-08-12 14:42 - 2015-07-16 21:50 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-08-12 14:42 - 2015-07-16 21:50 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-08-12 14:42 - 2015-07-16 21:49 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-08-12 14:42 - 2015-07-16 21:45 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-08-12 14:42 - 2015-07-16 21:43 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-08-12 14:42 - 2015-07-16 21:43 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-08-12 14:42 - 2015-07-16 21:41 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-08-12 14:42 - 2015-07-16 21:39 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-08-12 14:42 - 2015-07-16 21:39 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-08-12 14:42 - 2015-07-16 21:38 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-08-12 14:42 - 2015-07-16 21:36 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-08-12 14:42 - 2015-07-16 21:35 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-08-12 14:42 - 2015-07-16 21:34 - 14451200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-08-12 14:42 - 2015-07-16 21:33 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-08-12 14:42 - 2015-07-16 21:32 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-08-12 14:42 - 2015-07-16 21:29 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-08-12 14:42 - 2015-07-16 21:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-08-12 14:42 - 2015-07-16 21:20 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-08-12 14:42 - 2015-07-16 21:19 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-08-12 14:42 - 2015-07-16 21:17 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-08-12 14:42 - 2015-07-16 21:12 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-08-12 14:42 - 2015-07-16 21:12 - 02427904 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-08-12 14:42 - 2015-07-16 21:10 - 12856832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-08-12 14:42 - 2015-07-16 21:06 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-08-12 14:42 - 2015-07-16 21:06 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-08-12 14:42 - 2015-07-16 21:05 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-08-12 14:42 - 2015-07-16 21:01 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-08-12 14:42 - 2015-07-16 20:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-08-12 14:42 - 2015-07-16 20:42 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-08-12 14:42 - 2015-07-16 20:38 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-08-12 14:42 - 2015-07-16 20:37 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-08-12 14:42 - 2015-07-15 05:19 - 02004992 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2015-08-12 14:42 - 2015-07-15 05:19 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-08-12 14:42 - 2015-07-15 05:19 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\basesrv.dll
2015-08-12 14:42 - 2015-07-15 05:14 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2015-08-12 14:42 - 2015-07-15 05:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-08-12 14:42 - 2015-07-15 04:55 - 01390592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2015-08-12 14:42 - 2015-07-15 04:55 - 01241088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-08-12 14:42 - 2015-07-15 04:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2015-08-12 14:42 - 2015-07-15 04:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-08-12 14:42 - 2015-07-10 19:51 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-08-12 14:42 - 2015-07-10 19:34 - 12875776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-08-12 14:42 - 2015-07-09 19:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\notepad.exe
2015-08-12 14:42 - 2015-07-09 19:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\notepad.exe
2015-08-12 14:42 - 2015-07-09 19:42 - 00179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
2015-08-12 14:42 - 2015-07-01 22:49 - 00260096 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2015-08-12 14:42 - 2015-07-01 22:48 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2015-08-12 14:42 - 2015-07-01 22:30 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2015-08-12 14:42 - 2015-07-01 22:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2015-08-12 14:42 - 2015-05-09 20:26 - 00493504 _____ (Microsoft Corporation) C:\Windows\system32\mcupdate_GenuineIntel.dll
2015-08-12 13:55 - 2015-08-12 13:55 - 00319488 _____ (Realtek Semiconductor Corp.) C:\Windows\HideWin.exe
2015-08-12 13:55 - 2008-05-20 16:38 - 00524288 _____ (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll
2015-08-12 13:54 - 2015-08-12 13:54 - 01199392 _____ C:\Users\Max-Uttendorfer\Downloads\Realtek AC 97 Audio Codecs - CHIP-Installer.exe
2015-08-12 13:44 - 2002-11-27 18:46 - 00730700 ____R (Realtek Semiconductor Corp.) C:\Windows\SysWOW64\Drivers\alcxwdm.sys
2015-08-12 13:44 - 2002-11-27 17:59 - 01577984 ____R (Realtek Semiconductor Corp.) C:\Windows\SysWOW64\alsndmgr.cpl
2015-08-12 13:44 - 2002-11-20 01:01 - 00046592 ____R (Realtek Semiconductor Corp.) C:\Windows\soundman.exe
2015-08-12 13:44 - 2002-10-21 17:33 - 00208896 ____R (Realtek Semiconductor Corp.) C:\Windows\alcupd.exe
2015-08-12 13:44 - 2002-10-17 16:54 - 00131072 ____R (Realtek Semiconductor Corp.) C:\Windows\alcrmv.exe
2015-08-12 13:44 - 2002-02-05 17:54 - 00141016 ____R C:\Windows\SysWOW64\alsndmgr.wav
2015-08-12 13:42 - 2015-08-12 13:42 - 31126033 _____ C:\Users\Max-Uttendorfer\Downloads\6305_Vista_Win7_PG537.zip
2015-08-12 13:27 - 2015-08-12 13:27 - 00254408 _____ C:\Users\Max-Uttendorfer\Downloads\DriverTurboSetup.exe
2015-08-12 13:19 - 2015-08-12 13:19 - 00316080 _____ C:\Users\Max-Uttendorfer\Downloads\DriverFinder_Setup.exe
2015-08-12 06:55 - 2015-08-12 13:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-08-10 17:11 - 2015-08-10 17:11 - 02248704 _____ C:\Users\Max-Uttendorfer\Downloads\AdwCleaner_4.208.exe
2015-08-10 17:10 - 2015-08-10 17:10 - 00001698 _____ C:\Users\Max-Uttendorfer\Desktop\JRT.txt
2015-08-10 17:07 - 2015-08-10 17:07 - 01797896 _____ (Malwarebytes Corporation) C:\Users\Max-Uttendorfer\Downloads\JRT(1).exe
2015-08-09 19:19 - 2015-08-09 19:19 - 11032736 _____ (SurfRight B.V.) C:\Users\Max-Uttendorfer\Downloads\HitmanPro_x64(1).exe
2015-08-09 19:11 - 2015-08-12 14:06 - 00002280 _____ C:\Windows\PFRO.log
2015-08-09 18:54 - 2015-08-09 18:54 - 00000567 _____ C:\Users\Max-Uttendorfer\Desktop\help file.txt
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\Users\Max-Uttendorfer\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\Users\Max-Uttendorfer\AppData\Roaming\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\Users\Max-Uttendorfer\AppData\Local\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\Users\Max-Uttendorfer\AppData\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\Users\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\Users\Default\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\Users\Default\AppData\Local\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\Users\Default\AppData\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\Users\Default User\AppData\Local\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\Users\Default User\AppData\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 00000555 _____ C:\ProgramData\help-file-decrypt.enc
2015-08-07 17:01 - 2015-08-07 17:18 - 00000000 ____D C:\Users\Max-Uttendorfer\Documents\Christian Grunewald
2015-08-07 16:53 - 2015-08-07 16:53 - 00082299 _____ C:\Users\Max-Uttendorfer\Documents\Christian Grunewald.zip
2015-07-30 20:46 - 2015-07-30 20:47 - 00001120 _____ C:\Users\Public\Desktop\Avira.lnk
2015-07-30 20:46 - 2015-07-30 20:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-07-28 02:53 - 2015-08-15 20:57 - 00003519 _____ C:\Windows\setupact.log
2015-07-28 02:53 - 2015-07-28 02:53 - 00000000 _____ C:\Windows\setuperr.log
2015-07-27 18:02 - 2015-07-27 18:02 - 00023140 _____ C:\Users\Max-Uttendorfer\Documents\cc_20150727_180156.reg
2015-07-16 06:35 - 2015-07-04 20:07 - 02087424 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-16 06:35 - 2015-07-04 19:48 - 01414656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-07-16 06:35 - 2015-04-27 21:23 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-07-16 06:35 - 2015-04-27 21:23 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-07-16 06:35 - 2015-04-27 21:23 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-07-16 06:35 - 2015-04-27 21:23 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-07-16 06:35 - 2015-04-27 21:05 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-07-16 06:35 - 2015-04-27 21:04 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-07-16 06:35 - 2015-04-27 21:04 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-07-16 06:35 - 2015-04-27 21:04 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-08-15 21:07 - 2013-08-07 13:52 - 00012923 _____ C:\Users\Max-Uttendorfer\Downloads\FRST.txt
2015-08-15 21:07 - 2013-08-06 16:58 - 00000000 ____D C:\FRST
2015-08-15 21:05 - 2013-04-01 12:11 - 00000460 _____ C:\Windows\Tasks\FaxArchive_CN2952334D05S1.job
2015-08-15 21:04 - 2014-11-14 18:38 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d000295cae05eb.job
2015-08-15 21:01 - 2011-08-08 19:43 - 01496392 _____ C:\Windows\WindowsUpdate.log
2015-08-15 21:01 - 2009-07-14 19:58 - 00699432 _____ C:\Windows\system32\perfh007.dat
2015-08-15 21:01 - 2009-07-14 19:58 - 00149572 _____ C:\Windows\system32\perfc007.dat
2015-08-15 21:01 - 2009-07-14 07:13 - 01620684 _____ C:\Windows\system32\PerfStringBackup.INI
2015-08-15 20:57 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-08-15 10:44 - 2014-11-18 18:11 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-08-15 10:44 - 2013-12-25 07:36 - 01033216 _____ C:\Users\Max-Uttendorfer\Desktop\anfragen 11.pst
2015-08-15 10:44 - 2012-08-01 11:39 - 00271360 _____ C:\Users\Max-Uttendorfer\Desktop\& Zimmerhansl.pst
2015-08-15 10:44 - 2011-09-03 09:23 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-08-15 10:44 - 2009-07-14 06:45 - 00023376 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-08-15 10:44 - 2009-07-14 06:45 - 00023376 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-08-14 11:18 - 2014-09-10 19:07 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-08-14 11:18 - 2014-09-10 19:07 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-08-14 08:52 - 2011-08-07 21:10 - 00003946 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{38348A84-1508-456E-8101-FBD1328B9944}
2015-08-14 06:19 - 2009-07-14 06:45 - 00291704 _____ C:\Windows\system32\FNTCACHE.DAT
2015-08-13 09:39 - 2013-10-15 09:04 - 00000000 ____D C:\ProgramData\StarMoney 9.0
2015-08-13 09:19 - 2011-08-07 15:01 - 00065184 _____ C:\Users\Max-Uttendorfer\AppData\Local\GDIPFONTCACHEV1.DAT
2015-08-13 09:13 - 2011-08-07 14:48 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-08-13 09:13 - 2009-07-14 04:34 - 00017486 _____ C:\Windows\system32\Drivers\etc\services
2015-08-13 08:33 - 2011-08-07 17:12 - 01511424 _____ C:\Users\Max-Uttendorfer\Desktop\Job-Datei.mdb
2015-08-13 08:04 - 2014-12-11 08:21 - 00000000 ____D C:\Windows\system32\appraiser
2015-08-13 08:04 - 2014-05-07 01:25 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-08-12 22:48 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2015-08-12 22:46 - 2013-08-05 21:11 - 00000000 ____D C:\Windows\system32\MRT
2015-08-12 22:43 - 2011-08-07 16:24 - 132483416 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-08-12 16:27 - 2013-04-15 06:19 - 00002175 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-08-12 13:49 - 2014-12-01 15:11 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-08-12 13:32 - 2014-03-18 21:56 - 01594028 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2015-08-12 12:56 - 2013-03-16 08:18 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\HpUpdate
2015-08-12 05:33 - 2014-11-18 18:11 - 00778440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-08-12 05:33 - 2014-11-18 18:11 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-08-12 05:33 - 2013-03-13 17:14 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-08-11 17:27 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-08-11 17:10 - 2011-08-07 14:41 - 00000000 ____D C:\Users\Max-Uttendorfer
2015-08-11 17:09 - 2015-04-04 23:20 - 00000000 ___SD C:\Windows\system32\GWX
2015-08-11 17:09 - 2011-08-07 21:04 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\vlc
2015-08-11 17:09 - 2009-07-14 20:18 - 00000000 ___RD C:\Users\Public\Recorded TV
2015-08-11 17:09 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2015-08-10 17:17 - 2014-12-23 07:51 - 00000000 ____D C:\AdwCleaner
2015-08-10 12:02 - 2011-08-07 15:34 - 00000000 ____D C:\Windows\Panther
2015-08-10 09:16 - 2011-08-07 15:01 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\ASUS
2015-08-10 09:16 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system
2015-08-09 19:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\Help
2015-08-09 18:55 - 2011-08-07 15:28 - 00000400 _____ C:\Windows\ODBC.INI
2015-08-09 18:55 - 2011-08-07 15:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2015-08-09 18:55 - 2009-07-14 04:34 - 00000499 _____ C:\Windows\win.ini
2015-08-07 17:02 - 2014-12-01 15:19 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Spotify
2015-08-07 17:02 - 2014-11-27 11:34 - 00000000 ____D C:\ProgramData\Oracle
2015-08-07 17:02 - 2014-10-31 19:54 - 00000000 ____D C:\ProgramData\Windows Genuine Advantage
2015-08-07 17:02 - 2014-10-31 19:54 - 00000000 ____D C:\ProgramData\RihyAncuz
2015-08-07 17:02 - 2013-08-07 13:35 - 00000000 ____D C:\ProgramData\HitmanPro
2015-08-07 17:02 - 2013-08-06 17:47 - 00000000 ____D C:\Qoobox
2015-08-07 17:02 - 2013-08-06 10:38 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Malwarebytes
2015-08-07 17:02 - 2013-08-06 10:38 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-08-07 17:02 - 2013-05-10 16:21 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Uhgi
2015-08-07 17:02 - 2013-05-10 16:21 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Ucynon
2015-08-07 17:02 - 2013-05-10 16:21 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Osver
2015-08-07 17:02 - 2013-03-13 17:11 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\TeamViewer
2015-08-07 17:02 - 2013-02-23 08:41 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Avira
2015-08-07 17:02 - 2013-02-23 03:54 - 00000000 ____D C:\ProgramData\Avira
2015-08-07 17:02 - 2013-02-01 12:27 - 00000000 ____D C:\ProgramData\HP
2015-08-07 17:02 - 2012-05-04 12:50 - 00000000 ____D C:\ProgramData\Mozilla
2015-08-07 17:02 - 2012-02-06 14:23 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Nvu
2015-08-07 17:02 - 2012-01-02 08:29 - 00000000 ____D C:\Users\Max-Uttendorfer\.tuxguitar-1.2
2015-08-07 17:02 - 2012-01-02 08:29 - 00000000 ____D C:\ProgramData\Sun
2015-08-07 17:02 - 2012-01-01 17:33 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Guitar Pro 6
2015-08-07 17:02 - 2012-01-01 17:33 - 00000000 ____D C:\ProgramData\Guitar Pro 6
2015-08-07 17:02 - 2011-12-27 14:06 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\DVDVideoSoft
2015-08-07 17:02 - 2011-10-24 12:27 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\FRITZ!fax für FRITZ!Box
2015-08-07 17:02 - 2011-10-24 12:27 - 00000000 ____D C:\ProgramData\ISDNWatch
2015-08-07 17:02 - 2011-09-04 14:53 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Windows Live Writer
2015-08-07 17:02 - 2011-09-03 09:26 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Google
2015-08-07 17:02 - 2011-09-02 16:23 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla
2015-08-07 17:02 - 2011-08-08 14:29 - 00000000 ____D C:\ProgramData\StarMoney 8.0
2015-08-07 17:02 - 2011-08-07 21:50 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Local\Adobe
2015-08-07 17:02 - 2011-08-07 21:50 - 00000000 ____D C:\ProgramData\Adobe
2015-08-07 17:02 - 2011-08-07 21:11 - 00000000 ____D C:\NST
2015-08-07 17:02 - 2011-08-07 20:59 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Canneverbe Limited
2015-08-07 17:02 - 2011-08-07 20:59 - 00000000 ____D C:\ProgramData\Canneverbe Limited
2015-08-07 17:02 - 2011-08-07 20:08 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\FRITZ!
2015-08-07 17:02 - 2011-08-07 15:30 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Intel Corporation
2015-08-07 17:02 - 2011-08-07 14:58 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Macromedia
2015-08-07 17:02 - 2011-08-07 14:58 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe
2015-08-07 17:02 - 2011-08-07 14:48 - 00000000 ____D C:\Users\Max-Uttendorfer\AppData\Roaming\InstallShield
2015-08-07 17:02 - 2011-08-07 14:48 - 00000000 ____D C:\Intel
2015-08-07 17:02 - 2011-08-07 14:41 - 00000000 ___RD C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-08-07 17:02 - 2011-08-07 14:41 - 00000000 ___RD C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-08-07 17:02 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2015-07-30 20:47 - 2014-09-10 18:46 - 00000000 ____D C:\ProgramData\Package Cache
2015-07-30 20:46 - 2013-02-23 03:54 - 00000000 ____D C:\Program Files (x86)\Avira
2015-07-30 20:45 - 2013-03-28 07:51 - 00162528 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-07-30 20:45 - 2013-03-28 07:51 - 00141416 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-07-18 03:41 - 2011-08-07 17:12 - 00655360 _____ C:\Users\Max-Uttendorfer\Desktop\Wirte-Datei.mdb
2015-07-17 10:38 - 2014-11-15 07:28 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-07-17 05:18 - 2015-04-04 23:20 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-07-16 06:34 - 2015-02-07 15:22 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore1d000295cae05eb
2015-07-16 06:34 - 2011-09-03 09:23 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-07-16 06:28 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2015-08-07 17:02 - 2015-08-07 17:02 - 0000555 _____ () C:\Users\Max-Uttendorfer\AppData\Roaming\help-file-decrypt.enc
2015-08-07 17:02 - 2015-08-07 17:02 - 0000555 _____ () C:\Users\Max-Uttendorfer\AppData\Local\help-file-decrypt.enc
2013-01-16 13:35 - 2013-12-03 14:16 - 0004096 ____H () C:\Users\Max-Uttendorfer\AppData\Local\keyfile3.drm
2013-03-16 08:18 - 2013-03-16 08:18 - 0000057 _____ () C:\ProgramData\Ament.ini
2015-08-07 17:02 - 2015-08-07 17:02 - 0000555 _____ () C:\ProgramData\help-file-decrypt.enc

Einige Dateien in TEMP:
====================
C:\Users\Max-Uttendorfer\AppData\Local\Temp\avgnt.exe
C:\Users\Max-Uttendorfer\AppData\Local\Temp\Quarantine.exe
C:\Users\Max-Uttendorfer\AppData\Local\Temp\repair4.exe
C:\Users\Max-Uttendorfer\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-08-12 14:57

==================== Ende von Ergebnis ============================

schrauber · 16.08.2015, 06:49

FRST öffnen, in das Suchfeld

help-file-decrypt.enc

kopieren und auf Suche DAteien klicken.

uttella · 16.08.2015, 10:32

Code:

ATTFilter

Farbar Recovery Scan Tool (x64) Version:14-08-2015 01
durchgeführt von Max-Uttendorfer (2015-08-16 11:26:47)
Gestartet von C:\Users\Max-Uttendorfer\Downloads
Start-Modus: Normal

================== Search Files: "help-file-decrypt.enc" =============

C:\Users\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Windows Live Writer\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Windows Live Writer\LinkGlossary\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\vlc\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Uhgi\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Ucynon\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\TeamViewer\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Spotify\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Spotify\Users\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Spotify\Users\1122109091-user\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Spotify\Users\1122109091-user\Cookies\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Spotify\Users\1122109091-user\Apps\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Spotify\Users\1122109091-user\Apps\suggest\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Spotify\Users\1122109091-user\Apps\playlist-header\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Spotify\Users\1122109091-user\Apps\notification-center\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Spotify\Users\1122109091-user\Apps\feed\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Spotify\Users\1122109091-user\Apps\browse\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Spotify\Users\1122109091-user\Apps\artist\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Spotify\Data\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Spotify\Data\locales\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Osver\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Nvu\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Nvu\Profiles\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Nvu\Profiles\7wwt79fz.default\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Nvu\Profiles\7wwt79fz.default\US\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Nvu\Profiles\7wwt79fz.default\extensions\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Nvu\Profiles\7wwt79fz.default\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Nvu\Profiles\7wwt79fz.default\chrome\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\webapps\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\storage\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\storage\permanent\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\storage\permanent\moz-safe-about+home\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\storage\permanent\moz-safe-about+home\idb\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.files\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\storage\default\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\sessionstore-backups\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\healthreport\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\gmp-gmpopenh264\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\gmp-gmpopenh264\1.4\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\gmp-gmpopenh264\1.3\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\gmp-gmpopenh264\1.1\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\gmp-eme-adobe\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\gmp-eme-adobe\12\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\gmp\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\extensions\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}\skin\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}\chrome\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}\chrome\locale\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}\chrome\locale\ru-RU\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}\chrome\locale\jp-JP\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}\chrome\locale\it-IT\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}\chrome\locale\fr-FR\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}\chrome\locale\es-ES\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}\chrome\locale\en-US\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}\chrome\locale\en\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}\chrome\locale\de-DE\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}\chrome\content\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\datareporting\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\crashes\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\crashes\events\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Profiles\gajegzyu.default-1414851537482\bookmarkbackups\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Crash Reports\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Crash Reports\submitted\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Mozilla\Extensions\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Word\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Word\STARTUP\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Themes\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Templates\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\SendTo\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Recent\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\PrivacIE\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\PrivacIE\Low\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Network Shortcuts\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Network Shortcuts\Meine Websites auf MSN\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Libraries\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\IETldCache\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\IETldCache\Low\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\IEDownloadHistory\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\IECompatUACache\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\IECompatCache\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\IECompatCache\Low\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\DNTException\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\DNTException\Low\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Cookies\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Windows\Cookies\Low\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Vorlagen\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Vault\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Templates\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\SystemCertificates\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\SystemCertificates\My\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Sticky Notes\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Spelling\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Spelling\de-DE\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Speech\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Speech\Files\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Signatures\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Protect\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Protect\S-1-5-21-3038766165-3120518270-3538088492-1000\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Proof\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Outlook\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\OIS\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Office\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Office\Zuletzt verwendet\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Network\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Network\Connections\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Network\Connections\Pbk\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\MMC\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Internet Explorer\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Internet Explorer\UserData\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Internet Explorer\UserData\G1HP4TT8\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Internet Explorer\UserData\FLKBPYH8\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Internet Explorer\UserData\99AGFBA7\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Internet Explorer\UserData\7245KLSI\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\7e4dca80246863e3\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Installer\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Installer\{B6465A32-8BE9-4B38-ADC5-4B4BDDC10B0D}\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Installer\{8505C641-422E-4E3C-B6B0-0F070E289FDD}\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\IMJP9_0\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\IMJP8_1\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\IMJP12\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\IMJP10\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\IME12\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\IdentityCRL\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\IdentityCRL\temp\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\HTML Help\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Excel\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Excel\XLSTART\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\eHome\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Crypto\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Crypto\RSA\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3038766165-3120518270-3538088492-1000\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Credentials\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\CLR Security Config\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\64bit\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Clip Organizer\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Briefpapier\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\AddIns\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Microsoft\Access\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Media Center Programs\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Malwarebytes\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Macromedia\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Macromedia\Flash Player\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Macromedia\Flash Player\macromedia.com\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s79.research.de.com\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#cdn.stickyadstv.com\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AT2PN9MV\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AT2PN9MV\s79.research.de.com\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AT2PN9MV\cdn.stickyadstv.com\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Intel Corporation\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Intel Corporation\IAStorUtil\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\InstallShield\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\InstallShield\ISEngine12.0\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Identities\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Identities\{83D6F4A9-7F10-4ABB-B9DE-0C9D18DE3F9D}\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\HpUpdate\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Guitar Pro 6\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Guitar Pro 6\My Templates\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Guitar Pro 6\My Styles\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Guitar Pro 6\My Presets\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Google\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Google\Local Search History\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\FRITZ!fax für FRITZ!Box\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\FRITZ!fax für FRITZ!Box\Vox\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\FRITZ!fax für FRITZ!Box\Fax\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\FRITZ!\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\FRITZ!\Fax\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\DVDVideoSoft\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\DVDVideoSoft\Stat\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\DVDVideoSoft\Stat\storage\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\DVDVideoSoft\Stat\logstorage\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\DVDVideoSoft\Stat\cfg\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\DVDVideoSoft\setup\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\DVDVideoSoft\logs\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\DVDVideoSoft\logs\FreeYouTubeToMP3Converter\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\DVDVideoSoft\FreeYouTubeToMP3Converter\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\DVDVideoSoft\FreeYouTubeToMP3Converter\Themes\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\DVDVideoSoft\FreeYouTubeToMP3Converter\History\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\DVDVideoSoft\backup\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\DVDVideoSoft\backup\FreeYouTubeToMP3Converter\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Canneverbe Limited\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Canneverbe Limited\CDBurnerXP\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Canneverbe Limited\CDBurnerXP\4.4.0.2838\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Canneverbe Limited\CDBurnerXP\4.3.8.2631\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Canneverbe Limited\CDBurnerXP\4.3.8.2568\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Avira\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Avira\Antivirus\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Avira\Antivirus\JOBS\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Avira\AntiVir Desktop\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Avira\AntiVir Desktop\JOBS\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\ASUS\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\ASUS\Xonar D1 Audio Center\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\LogTransport2\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Linguistics\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Linguistics\Dictionaries\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Headlights\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Flash Player\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Flash Player\NativeCache\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Flash Player\Icon Cache\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Flash Player\AssetCache\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Flash Player\AssetCache\ZQBX8XBJ\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Flash Player\APSPrivateData2\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Flash Player\AFCache\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\AcroExt\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\AcroExt\Reader\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\AcroExt\Reader\11.0\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\AcroExt\Reader\11.0\cache\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Acrobat\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Acrobat\11.0\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Acrobat\11.0\Stamps\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Acrobat\11.0\Security\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Acrobat\11.0\Security\CRLCache\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Acrobat\11.0\JSCache\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Acrobat\11.0\Forms\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Acrobat\11.0\Collab\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Acrobat\10.0\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Acrobat\10.0\Security\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Acrobat\10.0\Security\CRLCache\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Acrobat\10.0\JSCache\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Acrobat\10.0\JavaScripts\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Acrobat\10.0\Forms\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Roaming\Adobe\Acrobat\10.0\Collab\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Local\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Local\Adobe\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Local\Adobe\Color\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Local\Adobe\Color\Profiles\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Local\Adobe\Acrobat\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Local\Adobe\Acrobat\11.0\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Local\Adobe\Acrobat\11.0\ProtectedView\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Local\Adobe\Acrobat\11.0\ProtectedView\Cache\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Local\Adobe\Acrobat\11.0\Cache\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Local\Adobe\Acrobat\10.0\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\AppData\Local\Adobe\Acrobat\10.0\Cache\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\.tuxguitar-1.2\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Max-Uttendorfer\.tuxguitar-1.2\plugins\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Default\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Default\AppData\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Default\AppData\Local\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Users\Default\AppData\Local\temp\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Qoobox\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Qoobox\Quarantine\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Qoobox\Quarantine\Registry_backups\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Qoobox\Quarantine\C\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Qoobox\Quarantine\C\Windows\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Qoobox\Quarantine\C\Users\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Qoobox\Quarantine\C\Users\MAX-UT~1\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Qoobox\Quarantine\C\Users\MAX-UT~1\AppData\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Qoobox\Quarantine\C\Users\MAX-UT~1\AppData\Local\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Qoobox\Quarantine\C\Users\MAX-UT~1\AppData\Local\Temp\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Qoobox\Quarantine\C\Users\MAX-UT~1\AppData\Local\Temp\7zS6ACE\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Qoobox\Quarantine\C\Program Files (x86)\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Qoobox\Quarantine\C\Program Files (x86)\AVM\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Qoobox\Quarantine\C\Program Files (x86)\AVM\FRITZ!\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Qoobox\Quarantine\C\Program Files (x86)\AVM\FRITZ!\Ports\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Qoobox\Quarantine\C\Program Files (x86)\AVM\FRITZ!\Fax_sw\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Qoobox\Quarantine\C\Program Files (x86)\AVM\FRITZ!\Fax_col\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Windows Genuine Advantage\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Windows Genuine Advantage\{962C5993-828A-4DD7-A716-0348BC096229}\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Sun\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Sun\Java\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Sun\Java\Java Update\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 9.0\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 9.0\profil_{D48457AF-02E2-4086-99DA-3822E36A6C41}\restore\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 9.0\profil_{D48457AF-02E2-4086-99DA-3822E36A6C41}\restore\Max_Uttendorfer\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 9.0\profil_{D48457AF-02E2-4086-99DA-3822E36A6C41}\restore\Max_Uttendorfer\20150807151753\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 9.0\profil_{D48457AF-02E2-4086-99DA-3822E36A6C41}\restore\Max_Uttendorfer\20150806191916\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 9.0\profil_{D48457AF-02E2-4086-99DA-3822E36A6C41}\restore\Max_Uttendorfer\20150806080739\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 9.0\profil_{D48457AF-02E2-4086-99DA-3822E36A6C41}\restore\Max_Uttendorfer\20150805091747\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 9.0\profil_{D48457AF-02E2-4086-99DA-3822E36A6C41}\restore\Max_Uttendorfer\20150803093816\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 9.0\profil_{D48457AF-02E2-4086-99DA-3822E36A6C41}\Reports\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 9.0\profil_{D48457AF-02E2-4086-99DA-3822E36A6C41}\Protocol\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 9.0\profil_{D48457AF-02E2-4086-99DA-3822E36A6C41}\Protocol\max_utte\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 9.0\profil_{D48457AF-02E2-4086-99DA-3822E36A6C41}\export\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 9.0\profil_{D48457AF-02E2-4086-99DA-3822E36A6C41}\document\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 9.0\profil_{D48457AF-02E2-4086-99DA-3822E36A6C41}\bpd\hbci\280\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 9.0\profil\bpd\hbci\280\help-file-decrypt.enc
[2015-08-13 09:14][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 9.0\Datensicherung StarMoney\restore\help-file-decrypt.enc
[2015-08-13 09:01][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 9.0\Datensicherung StarMoney\restore\Max_Uttendorfer\help-file-decrypt.enc
[2015-08-13 09:01][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 9.0\Datensicherung StarMoney\restore\Max_Uttendorfer\20150807151753\help-file-decrypt.enc
[2015-08-13 09:01][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 9.0\Datensicherung StarMoney\restore\Max_Uttendorfer\20150806191916\help-file-decrypt.enc
[2015-08-13 09:01][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 9.0\Datensicherung StarMoney\restore\Max_Uttendorfer\20150806080739\help-file-decrypt.enc
[2015-08-13 09:01][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 9.0\Datensicherung StarMoney\restore\Max_Uttendorfer\20150805091747\help-file-decrypt.enc
[2015-08-13 09:01][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 9.0\Datensicherung StarMoney\restore\Max_Uttendorfer\20150803093816\help-file-decrypt.enc
[2015-08-13 09:01][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 9.0\Datensicherung StarMoney\document\help-file-decrypt.enc
[2015-08-13 09:01][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 8.0\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 8.0\profil\restore\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 8.0\profil\restore\MAX_UTTENDORFER\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 8.0\profil\restore\MAX_UTTENDORFER\20140820133211\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 8.0\profil\restore\MAX_UTTENDORFER\20140106234001\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 8.0\profil\restore\MAX_UTTENDORFER\20131203142452\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 8.0\profil\restore\MAX_UTTENDORFER\20131202114433\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 8.0\profil\restore\MAX_UTTENDORFER\20131201203114\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 8.0\profil\Reports\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 8.0\profil\Protocol\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 8.0\profil\Protocol\max_utte\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 8.0\profil\export\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 8.0\profil\document\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\StarMoney 8.0\profil\bpd\hbci\280\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\RihyAncuz\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Oracle\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Oracle\Java\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Oracle\Java\javapath\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Oracle\Java\installcache\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Mozilla\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Mozilla\logs\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Microsoft\Windows\DRM\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Microsoft\Windows\DRM\Cache\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Microsoft\Windows\DRM\Cache\Indiv_SID_S-1-5-21-3038766165-3120518270-3538088492-1000\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Microsoft\User Account Pictures\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Microsoft\RAC\Temp\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Microsoft\RAC\PublishedData\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Microsoft\OFFICE\DATA\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Microsoft\MSDAIPP\OFFLINE\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Microsoft\MSDAIPP\OFFLINE\f\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Microsoft\eHome\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Microsoft\eHome\SharedSBE\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Microsoft\eHome\RecoveryTasks\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Microsoft\eHome\mcepg2-0\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Microsoft\eHome\logs\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Microsoft\DeviceSync\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Microsoft\Crypto\DSS\MachineKeys\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Malwarebytes\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \Quarantine\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \Logs\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \Configuration\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \Configuration\Restore\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\ISDNWatch\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\Temp\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\Temp\NetworkDevices\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\NCCOM\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\NCCOM\TypeLib\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\NCCOM\TypeLib\2.0\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\NCCOM\TypeLib\1.0\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\XmlFileCache\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\NetworkDevices\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\2052\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\1055\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\1053\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\1049\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\1046\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\1045\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\1044\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\1043\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\1042\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\1041\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\1040\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\1038\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\1037\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\1036\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\1035\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\1034\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\1033\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\1032\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\1031\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\1030\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\1029\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\1028\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Installer\Help\1025\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\HPUDC\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\HPUDC\HP Officejet Pro 8620 (Netzwerk)\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\HPUDC\HP Officejet Pro 8620\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\HPCustPartic\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\HPCustPartic\CN44NB610W\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\HP Officejet Pro 8620 (USB)\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\HP Officejet Pro 8620 (USB)\XmlFileCache\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\HP Officejet Pro 8620 (USB)\XmlFileCache\CN44NB610W\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\HP Officejet Pro 8620 (USB)\XmlFileCache\CN44NB610W\WalkupScanToComp\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\HP Officejet Pro 8620 (USB)\XmlFileCache\CN44NB610W\Scan\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\HP Officejet Pro 8620 (USB)\XmlFileCache\CN44NB610W\DevMgmt\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\images\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\graphics\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\graphics\online\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\flash\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\accessory\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\accessory\images\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\2074\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\2052\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1087\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1063\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1062\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1061\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1060\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1058\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1057\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1055\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1054\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1053\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1051\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1050\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1049\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1048\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1046\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1045\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1044\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1043\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1042\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1041\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1040\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1038\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1037\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1036\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1035\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1034\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1033\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1032\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1031\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1030\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1029\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1028\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1026\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\Help\1025\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\CN44NB610W\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet Pro 8620\ARProgram\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\XmlFileCache\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\XmlFileCache\CN2952334D05S1\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\XmlFileCache\CN2952334D05S1\WalkupScanToComp\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\XmlFileCache\CN2952334D05S1\Scan\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\XmlFileCache\CN2952334D05S1\IoMgmt\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\XmlFileCache\CN2952334D05S1\ePrint\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\XmlFileCache\CN2952334D05S1\DevMgmt\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\XmlFileCache\CN2952334D05S1\Calibration\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\2052\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\1055\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\1053\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\1049\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\1046\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\1045\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\1044\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\1043\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\1042\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\1041\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\1040\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\1038\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\1037\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\1036\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\1035\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\1034\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\1033\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\1032\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\1031\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\1030\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\1029\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\1028\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Installer\Help\1025\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\HPUDC\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\HPUDC\HP Officejet 4620 series\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\HPUDC\CN2952334D05S1\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\HP Officejet 4620 series (USB)\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\HP Officejet 4620 series (USB)\XmlFileCache\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\HP Officejet 4620 series (USB)\XmlFileCache\CN2952334D05S1\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\HP Officejet 4620 series (USB)\XmlFileCache\CN2952334D05S1\WalkupScanToComp\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\HP Officejet 4620 series (USB)\XmlFileCache\CN2952334D05S1\Scan\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\HP Officejet 4620 series (USB)\XmlFileCache\CN2952334D05S1\DevMgmt\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\images\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\graphics\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\graphics\online\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\flash\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\Accessory\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\Accessory\images\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\2074\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\2052\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1087\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1063\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1062\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1061\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1060\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1058\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1057\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1055\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1054\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1053\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1051\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1050\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1049\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1048\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1046\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1045\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1044\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1043\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1042\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1041\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1040\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1038\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1037\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1036\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1035\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1034\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1033\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1032\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1031\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1031\SearchIndex\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1031\GeneratedFiles\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1030\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1029\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1028\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1026\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Help\1025\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\FaxArchive\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\FaxArchive\CN2952334D05S1\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Fax\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\Fax\CN2952334D05S1\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HP\HP Officejet 4620 series\CN2952334D05S1\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HitmanPro\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\HitmanPro\Logs\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Guitar Pro 6\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Canneverbe Limited\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Canneverbe Limited\CDBurnerXP\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Canneverbe Limited\CDBurnerXP\4.4.0.2838\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Canneverbe Limited\CDBurnerXP\4.3.8.2631\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Canneverbe Limited\CDBurnerXP\4.3.8.2568\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\Launcher\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\Launcher\Temp\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\Launcher\Logfiles\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\Launcher\apps\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\Launcher\apps\icons\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\Antivirus\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\Antivirus\WEBGUARD\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\Antivirus\TEMP\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\Antivirus\TEMP\WEBGUARD\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\Antivirus\TEMP\SELFUPDATE\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\Antivirus\TEMP\SELFUPDATE\57\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\Antivirus\TEMP\AVESVC\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\Antivirus\SYSSAFE\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\Antivirus\SETTINGS\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\Antivirus\REPORTS\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\Antivirus\PROFILES\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\Antivirus\LOGFILES\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\Antivirus\IPM\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\Antivirus\INFECTED\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\Antivirus\IDX\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\Antivirus\EVENTS\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\Antivirus\BACKUP\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\AntiVir Desktop\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Avira\AntiVir Desktop\REPORTS\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\Setup\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1031-7B44-AB0000000001}\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\S\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_11.0.12\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_11.0.11\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_11.0.10\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_11.0.09\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_11.0.09\7952\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_11.0.08\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_11.0.08\11712\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_11.0.07\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_11.0.06\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_11.0.05\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_11.0.04\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_11.0.03\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_10.1.7\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_10.1.6\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_10.1.6\20475\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_10.1.6\10242\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_10.1.5\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_10.1.4\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_10.1.4\21025\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_10.1.4\11909\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_10.1.3\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_10.1.2\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_10.1.1\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_10.1.1\31592\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_10.1.1\30063\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_10.1.1\23319\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\ARM\Reader_10.1.1\13820\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\Acrobat\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\Acrobat\11.0\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\Acrobat\11.0\Replicate\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\ProgramData\Adobe\Acrobat\11.0\Replicate\Security\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Program Files (x86)\Guitar Pro 5\tmp\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Program Files (x86)\Guitar Pro 5\Demo Files\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Program Files (x86)\Guitar Pro 5\Demo Files\Wah-Wah\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Program Files (x86)\Guitar Pro 5\Demo Files\Rock\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Program Files (x86)\Guitar Pro 5\Demo Files\Jazz\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Program Files (x86)\Guitar Pro 5\Demo Files\Hard\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Program Files (x86)\Guitar Pro 5\Demo Files\Blues\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Program Files (x86)\Guitar Pro 5\Demo Files\Acoustic\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Program Files (x86)\Business Objects\Common\3.5\bin\Cache\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\NST\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Intel\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Intel\Logs\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Intel\ExtremeGraphics\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Intel\ExtremeGraphics\CUI\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\Intel\ExtremeGraphics\CUI\Resource\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\FRST\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\FRST\Quarantine\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\FRST\Logs\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\FRST\Hives\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\FRST\Hives\Users\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\FRST\Hives\Users\00000002\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\FRST\Hives\Users\00000001\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\AdwCleaner\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\AdwCleaner\Quarantine\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\AdwCleaner\Quarantine\C\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\AdwCleaner\Quarantine\C\Windows\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\AdwCleaner\Quarantine\C\Windows\System32\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\AdwCleaner\Quarantine\C\ProgramData\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\AdwCleaner\Quarantine\C\ProgramData\FileCure\help-file-decrypt.enc
[2015-08-07 17:02][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\$RECYCLE.BIN\S-1-5-21-3038766165-3120518270-3538088492-1000\help-file-decrypt.enc
[2015-08-07 17:01][2015-08-07 17:01] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\$RECYCLE.BIN\S-1-5-21-3038766165-3120518270-3538088492-1000\$RZZH21R\help-file-decrypt.enc
[2015-08-13 09:20][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\$RECYCLE.BIN\S-1-5-21-3038766165-3120518270-3538088492-1000\$RP46K2Y\help-file-decrypt.enc
[2015-08-13 09:20][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\$RECYCLE.BIN\S-1-5-21-3038766165-3120518270-3538088492-1000\$RM3M5NB\help-file-decrypt.enc
[2015-08-13 09:20][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\$RECYCLE.BIN\S-1-5-21-3038766165-3120518270-3538088492-1000\$R2SWVD1\help-file-decrypt.enc
[2015-08-13 09:20][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

C:\$RECYCLE.BIN\S-1-5-21-3038766165-3120518270-3538088492-1000\$R1JKUMN\help-file-decrypt.enc
[2015-08-13 09:20][2015-08-07 17:02] 0000555 ____A () 9CE3A3EB6FD190AAA1AFF5BE3F10F802

====== Ende von Suche ======

Problem leider immer noch vorhanden. Bei Start Excel und Start PC.

schrauber · 17.08.2015, 06:55

Die daraus enstandene Search.txt bitte in fixlist.txt umbenennen, FRST starten und Fix drücken.

uttella · 17.08.2015, 15:51

also auf entfernen drücken oder?

Es kommt dann die Warnung: Es scheint so aldss Sie nicht wüßten was sie tun.
Programm wird nun beendet

16.08.2015, 06:49	#12
schrauber /// the machine /// TB-Ausbilder	Meldung help file decrypt bei Start des Computers FRST öffnen, in das Suchfeld help-file-decrypt.enc kopieren und auf Suche DAteien klicken. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

17.08.2015, 06:55	#14
schrauber /// the machine /// TB-Ausbilder	Meldung help file decrypt bei Start des Computers Die daraus enstandene Search.txt bitte in fixlist.txt umbenennen, FRST starten und Fix drücken. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Meldung help file decrypt bei Start des Computers

Plagegeister aller Art und deren Bekämpfung: Meldung help file decrypt bei Start des Computers