Guten Tag, ich vermute mein Pc ist gehackt/mit Malware infiziert, ich würde ihn gerne mit den Entsprechenden Programmen auswerten lassen, leider fehlt mir die Erfahrung wäre Super wenn mir jemand dabei helfen könnte.


lg kranich

Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.


Bitte beachte folgende Hinweise:

• Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support unterbrechen bis jegliche Art von illegaler Software vom Rechner entfernt wurde.
• Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
• Solltest du mir nicht innerhalb von 3 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo. Solltest du einmal länger abwesend sein, so gib mir bitte Bescheid!
• Während der Bereinigung bitte nichts installieren oder deinstallieren, außer ich bitte dich darum!
• Bitte beachten: Download bei filepony.de: So ladet Ihr unsere Tools richtig!
• Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort als Administrator zu starten!
• Einige Programme, die wir hier verwenden, können unter Umständen von deinem Antiviren- oder Anti-Malwareprogramm fälschlicherweise als Bedrohung eingestuft werden. Die Sicherheitsprogramme können aufgrund eines bestimmten Programmverhaltens nicht zwischen "gut" oder "böse" unterscheiden und schlagen Alarm. Dabei handelt es sich um Fehlalarme, welche du getrost ignorieren kannst. Gegebenenfalls musst du deine Sicherheitssoftware vor der Ausführung eines Programms deaktivieren, damit unsere Bereinigungsvorgänge nicht beeinträchtigt werden.

Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags:

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke aauf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Danke für deine Mitarbeit!




Wieso denkst du, dass du infiziert bist??


Zur ersten Analyse bitte FRST und TDSS-Killer ausführen:


Schritt 1
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Schritt 2
Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop

• Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
• Drücke Start Scan
  
• Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
  TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
  Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.







Bitte poste mit deiner nächsten Antwort

• die Logdatei von TDSS-Killer,
• die beiden neuen Logdateien von FRST.

Der Grund warum ich denke das ich Infiziert bin ist Kompliziert, und ich möchte da auch nicht zutief ins Detail gehen, jedenfalls wurden Daten von mir veröffentlicht, die nicht viele Wege offen lassen wie man dazu kam.

FRST Log

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 08-01-2017
durchgeführt von habob (Administrator) auf DESKTOP-PNO8QHG (10-01-2017 17:29:58)
Gestartet von C:\Users\habob\Desktop\troja
Geladene Profile: habob (Verfügbare Profile: defaultuser0 & habob)
Platform: Windows 10 Pro Version 1607 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Razer Inc.) C:\Program Files (x86)\Razer\RzWizard\RzWizardService.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Nota Inc.) C:\Program Files (x86)\Gyazo\GyStation.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Blizzard Entertainment) C:\Program Files (x86)\Battle.net\Battle.net.8180\Battle.net.exe
(Blizzard Entertainment) C:\ProgramData\Battle.net\Agent\Agent.5342\Agent.exe
() C:\Program Files (x86)\Battle.net\Battle.net.8180\Battle.net Helper.exe
() C:\Program Files (x86)\Battle.net\Battle.net.8180\Battle.net Helper.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(ROCCAT GmbH) C:\Program Files (x86)\ROCCAT\Kone Pure Optical Black Edition\KoneBlackMonitor.exe
(Corsair Components, Inc.) C:\Program Files (x86)\Corsair\Corsair Utility Engine\CUE.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\SpeedFan\speedfan.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_24_0_0_186.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_24_0_0_186.exe

==================== Registry (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [163800 2016-07-30] (IvoSoft)
HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [60136 2016-11-15] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [917576 2016-12-13] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [RzWizard] => C:\Program Files (x86)\Razer\RzWizard\RzWizard.exe [263112 2016-03-23] (Razer Inc.)
HKLM-x32\...\Run: [RoccatKoneBulk] => C:\Program Files (x86)\ROCCAT\Kone Pure Optical Black Edition\KoneBlackMonitor.exe [561152 2015-02-11] (ROCCAT GmbH)
HKLM-x32\...\Run: [Corsair Utility Engine] => C:\Program Files (x86)\Corsair\Corsair Utility Engine\CUE.exe [11054800 2016-09-14] (Corsair Components, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-09-22] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\Run: [Gyazo] => C:\Program Files (x86)\Gyazo\GyStation.exe [3582240 2016-08-03] (Nota Inc.)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2876704 2016-12-20] (Valve Corporation)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27230168 2016-11-15] (Skype Technologies S.A.)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9288408 2016-12-06] (Piriform Ltd)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\Run: [Unified Remote V3] => C:\Program Files (x86)\Unified Remote 3\RemoteServerWin.exe [4340992 2016-07-06] (Unified Intents AB)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [4299968 2016-08-29] (Disc Soft Ltd)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\MountPoints2: {1d27f743-8b37-11e6-a112-bc5ff4e4f83a} - "D:\startme.exe" 
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\MountPoints2: {a824682a-b701-11e6-a13c-bc5ff4e4f83a} - "L:\setup.exe" 
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\MountPoints2: {d4d7dc7a-82ef-11e6-a10f-bc5ff4e4f83a} - "H:\setup.exe" 
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Users\habob\Documents\DyingLight\out\settings\video.scr [1245 2016-11-18] ()
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{9c987ca3-7649-4efe-a371-28237f661719}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://de.yahoo.com/?fr=yset_ie_syc_oracle&type=orcl_hpset
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001 -> {A533EB44-EA74-44B5-8922-E1AE8B9E23D7} URL = hxxps://de.search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2016-07-30] (IvoSoft)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\ssv.dll [2016-10-21] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\jp2ssv.dll [2016-10-21] (Oracle Corporation)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2016-07-30] (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)

FireFox:
========
FF DefaultProfile: rv2x1vd2.default
FF ProfilePath: C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default [2017-01-10]
FF Extension: (Avira Browser Safety) - C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\Extensions\abs@avira.com.xpi [2016-11-22]
FF Extension: (Roomy Bookmarks Toolbar) - C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\Extensions\ALone-live@ya.ru.xpi [2017-01-09]
FF Extension: (German Dictionary) - C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\Extensions\de-DE@dictionaries.addons.mozilla.org [2016-12-03]
FF Extension: (Media Keys) - C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\Extensions\jid1-4GP7z3tkUd3Tzg@jetpack.xpi [2016-10-24]
FF Extension: (YouTube Auto Replay) - C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\Extensions\YouTubeAutoReplay@arikv.com.xpi [2016-12-27]
FF Extension: (NoScript) - C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2016-11-29]
FF Extension: (WOT) - C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2016-08-23]
FF Extension: (Adblock Plus) - C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-24]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_24_0_0_186.dll [2016-12-14] ()
FF Plugin: @videolan.org/vlc,version=2.2.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWoW64\Macromed\Flash\NPSWF32_24_0_0_186.dll [2016-12-14] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.111.2 -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\dtplugin\npDeployJava1.dll [2016-10-21] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.111.2 -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\plugin2\npjp2.dll [2016-10-21] (Oracle Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [1089592 2016-12-13] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\Antivirus\sched.exe [476736 2016-12-13] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [476736 2016-12-13] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [1490296 2016-12-13] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [350528 2016-11-24] (Avira Operations GmbH & Co. KG)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1404936 2016-08-01] ()
R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe [1467072 2016-08-29] (Disc Soft Ltd)
R2 RzWizardService; C:\Program Files (x86)\Razer\RzWizard\RzWizardService.exe [376272 2016-03-23] (Razer Inc.)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-09-15] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [49448 2016-08-18] (Advanced Micro Devices, Inc.)
R3 amdkmdag; C:\Windows\System32\DriverStore\FileRepository\c0309270.inf_amd64_47c09dd18e1ee4c5\atikmdag.sys [28729240 2016-12-07] (Advanced Micro Devices, Inc.)
R3 amdkmdap; C:\Windows\System32\DriverStore\FileRepository\c0309270.inf_amd64_47c09dd18e1ee4c5\atikmpag.sys [530328 2016-12-07] (Advanced Micro Devices, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWT6.sys [110104 2016-09-28] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [151352 2016-12-13] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [153904 2016-12-13] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [35488 2016-07-18] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [78208 2016-07-18] (Avira Operations GmbH & Co. KG)
R3 CorsairVBusDriver; C:\Windows\System32\drivers\CorsairVBusDriver.sys [45056 2016-09-09] (Corsair)
R3 CorsairVHidDriver; C:\Windows\System32\drivers\CorsairVHidDriver.sys [22520 2016-09-09] (Corsair)
R3 dtlitescsibus; C:\Windows\System32\drivers\dtlitescsibus.sys [30264 2016-09-25] (Disc Soft Ltd)
R3 dtliteusbbus; C:\Windows\System32\drivers\dtliteusbbus.sys [47672 2016-09-25] (Disc Soft Ltd)
S3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [45680 2016-10-07] (LogMeIn Inc.)
S3 NetAdapterCx; C:\Windows\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [589824 2016-07-16] (Realtek                                            )
S3 tap-tb-0901; C:\Windows\System32\drivers\tap-tb-0901.sys [38656 2015-08-10] (The OpenVPN Project)
R3 uvhid; C:\Windows\System32\drivers\uvhid.sys [27064 2016-07-06] (Windows (R) Win 7 DDK provider)
R1 VBoxUSBMon; C:\Windows\system32\DRIVERS\VBoxUSBMon.sys [127432 2016-12-05] (BigNox Corporation)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
S3 wod0205; C:\Windows\System32\drivers\wod0205.sys [33160 2011-04-23] (WeOnlyDo Software)

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-01-10 17:29 - 2017-01-10 17:29 - 00000000 ____D C:\FRST
2017-01-10 17:18 - 2017-01-10 17:29 - 00000000 ____D C:\Users\habob\Desktop\troja
2016-12-27 13:51 - 2016-12-27 13:51 - 00000000 _____ C:\Windows\setuperr.log
2016-12-27 13:51 - 2016-12-27 13:51 - 00000000 _____ C:\Windows\setupact.log
2016-12-27 03:59 - 2017-01-10 16:29 - 00000275 _____ C:\Windows\WindowsUpdate.log
2016-12-25 16:42 - 2016-12-25 16:42 - 00049240 _____ C:\Users\habob\Desktop\flixbus.png
2016-12-24 22:26 - 2016-12-24 22:26 - 00082934 _____ C:\Users\habob\Desktop\dasdwa.cueprofile
2016-12-24 22:24 - 2016-12-24 22:24 - 00095155 _____ C:\Users\habob\Desktop\RAINbu.cueprofile
2016-12-24 22:23 - 2016-12-24 22:23 - 00090269 _____ C:\Users\habob\Desktop\blue wshite wave.cueprofile
2016-12-24 19:23 - 2016-12-24 19:23 - 00000219 _____ C:\Users\habob\Desktop\Left 4 Dead 2.url
2016-12-21 19:36 - 2016-12-26 12:04 - 00000000 ____D C:\Windows\Minidump
2016-12-21 17:10 - 2016-12-21 17:10 - 00000000 _____ C:\Users\habob\Desktop\Neues Textdokument (3).txt
2016-12-21 02:16 - 2016-12-21 02:16 - 00000000 ____D C:\Users\habob\Documents\Telltale Games
2016-12-20 23:57 - 2016-12-20 23:57 - 00000856 _____ C:\Users\Public\Desktop\The Walking Dead A New Frontier.lnk
2016-12-20 23:57 - 2016-12-20 23:57 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Walking Dead A New Frontier
2016-12-20 17:38 - 2016-12-20 17:38 - 00000000 ____D C:\Users\habob\AppData\Roaming\ATI
2016-12-20 17:38 - 2016-12-20 17:38 - 00000000 ____D C:\Users\habob\AppData\Local\ATI
2016-12-20 17:38 - 2016-12-20 17:38 - 00000000 ____D C:\ProgramData\ATI
2016-12-20 17:37 - 2016-12-20 17:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Settings
2016-12-20 17:37 - 2016-12-20 17:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Problem Report Wizard
2016-12-20 17:37 - 2016-12-20 17:37 - 00000000 ____D C:\Program Files (x86)\AMD
2016-12-20 17:36 - 2016-12-20 17:36 - 00000000 ____D C:\Program Files (x86)\VulkanRT
2016-12-20 17:34 - 2016-12-20 17:37 - 00000000 ____D C:\Program Files\AMD
2016-12-20 17:01 - 2016-12-23 15:46 - 00000000 ____D C:\Users\habob\AppData\Local\AMD
2016-12-20 17:00 - 2016-12-20 17:00 - 00000000 ____D C:\Program Files\Common Files\ATI Technologies
2016-12-20 16:59 - 2016-09-09 19:25 - 00269600 _____ C:\Windows\SysWOW64\vulkan-1.dll
2016-12-20 16:59 - 2016-09-09 19:25 - 00261920 _____ C:\Windows\system32\vulkan-1.dll
2016-12-20 16:59 - 2016-09-09 19:25 - 00110880 _____ C:\Windows\SysWOW64\vulkaninfo.exe
2016-12-20 16:59 - 2016-09-09 19:24 - 00125216 _____ C:\Windows\system32\vulkaninfo.exe
2016-12-20 16:43 - 2016-12-20 17:02 - 00000000 ____D C:\Windows\LastGood
2016-12-20 16:39 - 2016-12-20 16:40 - 00000000 ____D C:\Windows\LastGood.Tmp
2016-12-17 16:12 - 2016-12-17 16:12 - 00539384 _____ C:\Windows\system32\Drivers\EasyAntiCheat.sys
2016-12-17 16:12 - 2016-12-17 16:12 - 00000000 ____D C:\Users\habob\AppData\Local\DeadByDaylight
2016-12-17 16:03 - 2016-12-18 23:12 - 00000000 ____D C:\Users\habob\AppData\Roaming\TS3Client
2016-12-17 16:03 - 2016-12-17 16:03 - 00001008 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2016-12-17 16:03 - 2016-12-17 16:03 - 00000970 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client.lnk
2016-12-17 16:03 - 2016-12-17 16:03 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2016-12-17 08:22 - 2016-12-18 00:38 - 00000123 _____ C:\Users\habob\Desktop\sounds list.txt
2016-12-17 08:07 - 2016-12-17 08:07 - 00894354 _____ C:\Users\habob\Desktop\SOUNDS SETTINGS.jpg
2016-12-17 05:44 - 2016-12-17 05:44 - 00001924 _____ C:\Users\habob\Desktop\Virtual Audio Cable - Verknüpfung.lnk
2016-12-17 05:39 - 2016-12-17 05:39 - 00098464 _____ (Eugene V. Muzychenko) C:\Windows\system32\Drivers\vrtaucbl.sys
2016-12-17 05:39 - 2016-12-17 05:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Virtual Audio Cable
2016-12-17 05:39 - 2016-12-17 05:39 - 00000000 ____D C:\Program Files\Virtual Audio Cable
2016-12-17 05:29 - 2016-12-17 05:33 - 00000000 ____D C:\Users\habob\Desktop\vac
2016-12-17 04:39 - 2016-12-17 19:27 - 00000000 ____D C:\Users\habob\Desktop\audio keybinds
2016-12-17 04:37 - 2016-12-17 04:36 - 05501972 _____ C:\Users\habob\Desktop\Linkin Park-In The End Lyrics (360p_30fps_H264-96kbit_AAC).mp4
2016-12-16 05:14 - 2016-12-16 05:14 - 00000000 ____D C:\Users\habob\AppData\Local\Chromium
2016-12-14 13:28 - 2016-12-09 11:42 - 01637728 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-12-14 13:28 - 2016-12-09 11:42 - 00137568 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-12-14 13:28 - 2016-12-09 11:34 - 01051112 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2016-12-14 13:28 - 2016-12-09 11:34 - 00894096 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2016-12-14 13:28 - 2016-12-09 11:33 - 01354320 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2016-12-14 13:28 - 2016-12-09 11:33 - 01173496 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2016-12-14 13:28 - 2016-12-09 11:32 - 07816032 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-12-14 13:28 - 2016-12-09 11:30 - 00377184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
2016-12-14 13:28 - 2016-12-09 11:29 - 02681200 _____ C:\Windows\system32\CoreUIComponents.dll
2016-12-14 13:28 - 2016-12-09 11:28 - 00764392 _____ (Microsoft Corporation) C:\Windows\system32\CoreMessaging.dll
2016-12-14 13:28 - 2016-12-09 11:27 - 00172528 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-12-14 13:28 - 2016-12-09 11:20 - 02677544 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2016-12-14 13:28 - 2016-12-09 11:20 - 02189664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2016-12-14 13:28 - 2016-12-09 11:20 - 01738560 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2016-12-14 13:28 - 2016-12-09 11:20 - 00658784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms2.sys
2016-12-14 13:28 - 2016-12-09 11:20 - 00402272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2016-12-14 13:28 - 2016-12-09 11:19 - 01293152 _____ (Microsoft Corporation) C:\Windows\system32\LicenseManager.dll
2016-12-14 13:28 - 2016-12-09 11:19 - 00168424 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2016-12-14 13:28 - 2016-12-09 11:18 - 02913144 _____ (Microsoft Corporation) C:\Windows\system32\combase.dll
2016-12-14 13:28 - 2016-12-09 11:18 - 01267512 _____ (Microsoft Corporation) C:\Windows\system32\WinTypes.dll
2016-12-14 13:28 - 2016-12-09 11:18 - 01100128 _____ (Microsoft Corporation) C:\Windows\system32\hvix64.exe
2016-12-14 13:28 - 2016-12-09 11:18 - 00989024 _____ (Microsoft Corporation) C:\Windows\system32\hvax64.exe
2016-12-14 13:28 - 2016-12-09 11:18 - 00947552 _____ (Microsoft Corporation) C:\Windows\system32\hvloader.efi
2016-12-14 13:28 - 2016-12-09 11:18 - 00811872 _____ (Microsoft Corporation) C:\Windows\system32\hvloader.exe
2016-12-14 13:28 - 2016-12-09 11:18 - 00624048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2016-12-14 13:28 - 2016-12-09 11:15 - 08168000 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.Protection.PlayReady.dll
2016-12-14 13:28 - 2016-12-09 11:15 - 01988560 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4srcsnk.dll
2016-12-14 13:28 - 2016-12-09 11:14 - 01274712 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2016-12-14 13:28 - 2016-12-09 11:14 - 00241504 _____ (Microsoft Corporation) C:\Windows\system32\CloudExperienceHost.dll
2016-12-14 13:28 - 2016-12-09 11:11 - 02048496 _____ C:\Windows\SysWOW64\CoreUIComponents.dll
2016-12-14 13:28 - 2016-12-09 11:10 - 01572768 _____ (Microsoft Corporation) C:\Windows\system32\gdi32full.dll
2016-12-14 13:28 - 2016-12-09 11:10 - 01461200 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2016-12-14 13:28 - 2016-12-09 11:09 - 00455520 _____ (Microsoft Corporation) C:\Windows\system32\securekernel.exe
2016-12-14 13:28 - 2016-12-09 11:01 - 02323728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2016-12-14 13:28 - 2016-12-09 11:01 - 01503544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2016-12-14 13:28 - 2016-12-09 11:01 - 00861024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LicenseManager.dll
2016-12-14 13:28 - 2016-12-09 11:00 - 00106896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2016-12-14 13:28 - 2016-12-09 10:59 - 02166752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\combase.dll
2016-12-14 13:28 - 2016-12-09 10:59 - 00846560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinTypes.dll
2016-12-14 13:28 - 2016-12-09 10:57 - 06668040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.Protection.PlayReady.dll
2016-12-14 13:28 - 2016-12-09 10:57 - 01852720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll
2016-12-14 13:28 - 2016-12-09 10:56 - 00959112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2016-12-14 13:28 - 2016-12-09 10:52 - 01435896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2016-12-14 13:28 - 2016-12-09 10:52 - 01415752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32full.dll
2016-12-14 13:28 - 2016-12-09 10:51 - 00117240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2016-12-14 13:28 - 2016-12-09 10:47 - 22563328 _____ (Microsoft Corporation) C:\Windows\system32\edgehtml.dll
2016-12-14 13:28 - 2016-12-09 10:45 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-12-14 13:28 - 2016-12-09 10:45 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\WordBreakers.dll
2016-12-14 13:28 - 2016-12-09 10:42 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2016-12-14 13:28 - 2016-12-09 10:41 - 00380928 _____ (Microsoft Corporation) C:\Windows\system32\wincorlib.dll
2016-12-14 13:28 - 2016-12-09 10:41 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WordBreakers.dll
2016-12-14 13:28 - 2016-12-09 10:40 - 00147968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32k.sys
2016-12-14 13:28 - 2016-12-09 10:38 - 00324608 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.LockScreen.dll
2016-12-14 13:28 - 2016-12-09 10:37 - 00411136 _____ (Microsoft Corporation) C:\Windows\system32\facecredentialprovider.dll
2016-12-14 13:28 - 2016-12-09 10:37 - 00261632 _____ (Microsoft Corporation) C:\Windows\system32\indexeddbserver.dll
2016-12-14 13:28 - 2016-12-09 10:37 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Shell.dll
2016-12-14 13:28 - 2016-12-09 10:36 - 06285312 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.dll
2016-12-14 13:28 - 2016-12-09 10:36 - 03059200 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2016-12-14 13:28 - 2016-12-09 10:36 - 00425984 _____ (Microsoft Corporation) C:\Windows\system32\aadcloudap.dll
2016-12-14 13:28 - 2016-12-09 10:36 - 00410112 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentClient.dll
2016-12-14 13:28 - 2016-12-09 10:36 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2016-12-14 13:28 - 2016-12-09 10:34 - 00822784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakradiag.dll
2016-12-14 13:28 - 2016-12-09 10:34 - 00288768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincorlib.dll
2016-12-14 13:28 - 2016-12-09 10:33 - 03777536 _____ (Microsoft Corporation) C:\Windows\system32\MFMediaEngine.dll
2016-12-14 13:28 - 2016-12-09 10:33 - 01589760 _____ (Microsoft Corporation) C:\Windows\system32\msdtctm.dll
2016-12-14 13:28 - 2016-12-09 10:32 - 00635904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2016-12-14 13:28 - 2016-12-09 10:31 - 03689984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2016-12-14 13:28 - 2016-12-09 10:31 - 00313856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppXDeploymentClient.dll
2016-12-14 13:28 - 2016-12-09 10:31 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\indexeddbserver.dll
2016-12-14 13:28 - 2016-12-09 10:30 - 23677952 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-12-14 13:28 - 2016-12-09 10:30 - 19413504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgehtml.dll
2016-12-14 13:28 - 2016-12-09 10:30 - 04612608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.dll
2016-12-14 13:28 - 2016-12-09 10:29 - 04749312 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_nt.dll
2016-12-14 13:28 - 2016-12-09 10:28 - 03306496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFMediaEngine.dll
2016-12-14 13:28 - 2016-12-09 10:28 - 01004544 _____ (Microsoft Corporation) C:\Windows\system32\enterprisecsps.dll
2016-12-14 13:28 - 2016-12-09 10:27 - 19417088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-12-14 13:28 - 2016-12-09 10:27 - 13084160 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-12-14 13:28 - 2016-12-09 10:27 - 05114368 _____ (Microsoft Corporation) C:\Windows\system32\cdp.dll
2016-12-14 13:28 - 2016-12-09 10:27 - 00981504 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Security.Authentication.OnlineId.dll
2016-12-14 13:28 - 2016-12-09 10:26 - 08129536 _____ (Microsoft Corporation) C:\Windows\system32\Chakra.dll
2016-12-14 13:28 - 2016-12-09 10:26 - 01692672 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.onecore.dll
2016-12-14 13:28 - 2016-12-09 10:25 - 00376832 _____ (Microsoft Corporation) C:\Windows\system32\CryptoWinRT.dll
2016-12-14 13:28 - 2016-12-09 10:24 - 02275840 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentServer.dll
2016-12-14 13:28 - 2016-12-09 10:23 - 12177920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-12-14 13:28 - 2016-12-09 10:22 - 02820096 _____ (Microsoft Corporation) C:\Windows\system32\InputService.dll
2016-12-14 13:28 - 2016-12-09 10:22 - 02688512 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Logon.dll
2016-12-14 13:28 - 2016-12-09 10:22 - 01490944 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-12-14 13:28 - 2016-12-09 10:21 - 04746752 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-12-14 13:28 - 2016-12-09 10:21 - 03616768 _____ (Microsoft Corporation) C:\Windows\system32\win32kfull.sys
2016-12-14 13:28 - 2016-12-09 10:21 - 01512960 _____ (Microsoft Corporation) C:\Windows\system32\win32kbase.sys
2016-12-14 13:28 - 2016-12-09 10:21 - 00716800 _____ (Microsoft Corporation) C:\Windows\system32\ShareHost.dll
2016-12-14 13:28 - 2016-12-09 10:20 - 06044160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakra.dll
2016-12-14 13:28 - 2016-12-09 10:20 - 03198464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdp.dll
2016-12-14 13:28 - 2016-12-09 10:20 - 00730624 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll
2016-12-14 13:28 - 2016-12-09 10:20 - 00187392 _____ (Microsoft Corporation) C:\Windows\system32\mdmregistration.dll
2016-12-14 13:28 - 2016-12-09 10:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\DeviceEnroller.exe
2016-12-14 13:28 - 2016-12-09 10:19 - 01121280 _____ (Microsoft Corporation) C:\Windows\system32\aadtb.dll
2016-12-14 13:28 - 2016-12-09 10:19 - 00433664 _____ (Microsoft Corporation) C:\Windows\system32\TextInputFramework.dll
2016-12-14 13:28 - 2016-12-09 10:19 - 00261120 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Core.TextInput.dll
2016-12-14 13:28 - 2016-12-09 10:19 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\InputLocaleManager.dll
2016-12-14 13:28 - 2016-12-09 10:19 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\EditBufferTestHook.dll
2016-12-14 13:28 - 2016-12-09 10:18 - 03666432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-12-14 13:28 - 2016-12-09 10:18 - 02138112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InputService.dll
2016-12-14 13:28 - 2016-12-09 10:18 - 00165376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mdmregistration.dll
2016-12-14 13:28 - 2016-12-09 10:17 - 00886272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aadtb.dll
2016-12-14 13:28 - 2016-12-09 10:17 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ShareHost.dll
2016-12-14 13:28 - 2016-12-09 10:16 - 02998272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32kfull.sys
2016-12-14 13:28 - 2016-12-09 10:16 - 01880576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Logon.dll
2016-12-14 13:28 - 2016-12-09 10:16 - 00353280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TextInputFramework.dll
2016-12-14 13:28 - 2016-12-09 10:15 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Core.TextInput.dll
2016-12-14 13:28 - 2016-12-09 10:15 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InputLocaleManager.dll
2016-12-14 13:28 - 2016-12-09 10:15 - 00068096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EditBufferTestHook.dll
2016-12-14 13:28 - 2016-12-09 09:54 - 00483840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CoreMessaging.dll
2016-12-14 13:28 - 2016-11-02 11:28 - 00807424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Security.Authentication.OnlineId.dll
2016-12-14 13:28 - 2016-11-02 11:25 - 00956416 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.desktop.dll
2016-12-14 13:28 - 2016-09-15 17:36 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\fveapibase.dll
2016-12-13 20:57 - 2016-12-13 20:57 - 00003290 _____ C:\Windows\System32\Tasks\OneDrive Standalone Update Task v2

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-01-10 17:26 - 2016-08-24 20:56 - 00000000 ____D C:\Users\habob\AppData\Roaming\Skype
2017-01-10 17:26 - 2016-08-23 21:05 - 00000000 ____D C:\Users\habob\AppData\Local\Battle.net
2017-01-10 16:43 - 2016-11-18 08:39 - 00000000 ____D C:\Users\habob\AppData\LocalLow\Mozilla
2017-01-10 16:36 - 2016-08-23 21:09 - 00000000 ____D C:\Program Files (x86)\SpeedFan
2017-01-10 16:32 - 2016-08-23 20:57 - 03740442 _____ C:\Windows\system32\PerfStringBackup.INI
2017-01-10 16:32 - 2016-07-16 23:51 - 01729230 _____ C:\Windows\system32\perfh007.dat
2017-01-10 16:32 - 2016-07-16 23:51 - 00446294 _____ C:\Windows\system32\perfc007.dat
2017-01-10 16:26 - 2016-08-25 19:13 - 00000000 ____D C:\Program Files (x86)\Steam
2017-01-10 16:26 - 2016-08-23 21:04 - 00000000 ____D C:\Program Files (x86)\Battle.net
2017-01-10 16:26 - 2016-08-23 20:54 - 00000000 ____D C:\Users\habob
2017-01-10 16:26 - 2016-08-23 20:51 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-01-10 16:26 - 2016-08-23 20:51 - 00000000 ____D C:\Windows\system32\SleepStudy
2017-01-10 16:07 - 2016-08-24 19:11 - 00000000 ____D C:\Users\habob\AppData\Local\ClassicShell
2017-01-09 22:43 - 2016-10-24 13:10 - 00000000 ____D C:\Users\habob\Desktop\p64
2017-01-09 22:17 - 2016-08-23 22:07 - 00000000 ____D C:\Program Files (x86)\Overwatch
2017-01-09 21:57 - 2016-12-06 13:08 - 00000000 ____D C:\Users\habob\AppData\Local\ElevatedDiagnostics
2017-01-09 21:49 - 2016-07-16 12:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-01-09 21:49 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\AppReadiness
2017-01-09 21:45 - 2016-09-03 05:11 - 00000000 ____D C:\ProgramData\Unified Remote
2016-12-28 08:31 - 2016-08-24 12:12 - 00074546 ____H C:\Users\habob\AppData\Local\IconCache.db
2016-12-28 08:31 - 2016-08-23 20:54 - 02359296 ____H C:\Users\habob\NTUSER.DAT
2016-12-28 08:31 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\LiveKernelReports
2016-12-27 11:51 - 2016-09-07 18:18 - 00065536 _____ C:\Windows\system32\spu_storage.bin
2016-12-27 11:51 - 2016-07-16 07:04 - 72351744 _____ C:\Windows\system32\config\SOFTWARE
2016-12-27 11:51 - 2016-07-16 07:04 - 15204352 _____ C:\Windows\system32\config\SYSTEM
2016-12-27 11:51 - 2016-07-16 07:04 - 00524288 _____ C:\Windows\system32\config\DEFAULT
2016-12-27 11:51 - 2016-07-16 07:04 - 00524288 _____ C:\Windows\system32\config\BBI
2016-12-27 11:51 - 2016-07-16 07:04 - 00065536 _____ C:\Windows\system32\config\SECURITY
2016-12-27 03:59 - 2016-08-23 20:52 - 00000000 ____D C:\Windows\SoftwareDistribution
2016-12-27 00:47 - 2016-08-23 20:55 - 00000000 ____D C:\Users\habob\AppData\Local\Packages
2016-12-27 00:46 - 2016-09-07 17:57 - 00000000 __SHD C:\Config.Msi
2016-12-27 00:46 - 2016-08-25 19:16 - 00000000 ____D C:\Users\habob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2016-12-27 00:46 - 2016-08-23 20:54 - 00000000 ____D C:\Users\habob\AppData\Local
2016-12-27 00:46 - 2016-07-16 12:47 - 00000000 __SHD C:\Windows\Installer
2016-12-27 00:46 - 2016-07-16 12:47 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs
2016-12-27 00:46 - 2016-07-16 12:45 - 00000000 ____D C:\Windows\INF
2016-12-27 00:46 - 2016-07-16 07:04 - 00000000 ___RD C:\Program Files (x86)
2016-12-26 12:04 - 2016-09-25 10:30 - 00000000 ____D C:\Users\habob\AppData\Roaming\DAEMON Tools Lite
2016-12-25 14:01 - 2016-09-01 10:53 - 00000000 ____D C:\Users\habob\AppData\Roaming\vlc
2016-12-24 22:20 - 2016-08-25 19:20 - 00000000 ____D C:\Users\habob\Documents\My Games
2016-12-23 15:46 - 2016-08-23 20:54 - 00000000 ___RD C:\Users\habob\Videos
2016-12-23 15:46 - 2016-07-16 07:04 - 00000000 ____D C:\Windows\SysWOW64
2016-12-22 11:03 - 2016-07-16 07:04 - 00000000 ____D C:\Windows\system32\config
2016-12-21 19:37 - 2016-10-10 23:10 - 00000000 ____D C:\Users\habob\Desktop\bitcch
2016-12-21 17:51 - 2016-10-21 20:10 - 00000000 ____D C:\AdwCleaner
2016-12-21 17:51 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\catroot2
2016-12-21 17:51 - 2016-07-16 07:04 - 00000000 ____D C:\Windows\system32\CatRoot
2016-12-21 02:16 - 2016-08-23 20:54 - 00000000 ___RD C:\Users\habob\Documents
2016-12-20 23:57 - 2016-07-16 12:47 - 00000000 __RHD C:\Users\Public\Desktop
2016-12-20 19:45 - 2016-09-23 14:30 - 00000000 ____D C:\Users\habob\AppData\LocalLow\AMD
2016-12-20 17:38 - 2016-08-23 20:54 - 00000000 ____D C:\Users\habob\AppData\Roaming
2016-12-20 17:38 - 2016-07-16 12:47 - 00000000 ___HD C:\ProgramData
2016-12-20 17:36 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\drivers
2016-12-20 17:36 - 2016-07-16 07:04 - 00000000 ____D C:\Windows\system32\DriverStore
2016-12-20 17:34 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\Tasks
2016-12-20 17:34 - 2016-07-16 07:04 - 00000000 ___RD C:\Program Files
2016-12-20 17:31 - 2016-08-23 20:56 - 00000000 ____D C:\AMD
2016-12-20 17:00 - 2016-07-16 07:04 - 00000000 ____D C:\Program Files\Common Files
2016-12-20 15:03 - 2016-08-23 20:52 - 00524288 ___SH C:\Windows\system32\config\COMPONENTS{f5b135e6-4b48-11e6-80cb-e41d2d012050}.TMContainer00000000000000000001.regtrans-ms
2016-12-20 15:03 - 2016-08-23 20:52 - 00065536 ___SH C:\Windows\system32\config\COMPONENTS{f5b135e6-4b48-11e6-80cb-e41d2d012050}.TM.blf
2016-12-20 15:03 - 2016-07-16 07:04 - 44564480 _____ C:\Windows\system32\config\COMPONENTS
2016-12-19 08:36 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\rescache
2016-12-18 23:12 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\debug
2016-12-18 23:12 - 2016-07-16 07:04 - 00000000 ____D C:\Windows\Logs
2016-12-18 23:10 - 2016-10-21 20:29 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-12-18 23:06 - 2016-08-30 19:09 - 00000863 _____ C:\Users\Public\Desktop\CCleaner.lnk
2016-12-18 23:06 - 2016-08-30 19:08 - 00000000 ____D C:\Program Files\CCleaner
2016-12-18 23:06 - 2016-08-23 20:52 - 00262144 ____H C:\Users\defaultuser0\NTUSER.DAT
2016-12-17 16:12 - 2016-11-17 21:08 - 00000000 ____D C:\Users\habob\AppData\Local\UnrealEngine
2016-12-17 15:32 - 2016-08-23 20:52 - 00524288 ___SH C:\Windows\system32\config\COMPONENTS{f5b135e6-4b48-11e6-80cb-e41d2d012050}.TMContainer00000000000000000002.regtrans-ms
2016-12-17 15:20 - 2016-07-16 07:04 - 00000000 ____D C:\Windows\WinSxS
2016-12-16 05:14 - 2016-08-25 19:14 - 00000000 ____D C:\Users\habob\AppData\Local\Steam
2016-12-16 05:13 - 2016-08-25 01:04 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-12-16 05:13 - 2016-08-23 20:51 - 00194296 _____ C:\Windows\system32\FNTCACHE.DAT
2016-12-16 05:12 - 2016-12-01 02:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-12-16 05:12 - 2016-08-23 20:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-12-16 05:12 - 2016-08-23 20:50 - 00524288 ___SH C:\Windows\system32\config\DRIVERS{f5b135f1-4b48-11e6-80cb-e41d2d012050}.TMContainer00000000000000000001.regtrans-ms
2016-12-16 05:12 - 2016-08-23 20:50 - 00065536 ___SH C:\Windows\system32\config\DRIVERS{f5b135f1-4b48-11e6-80cb-e41d2d012050}.TM.blf
2016-12-16 05:12 - 2016-07-16 12:47 - 00000666 ___SH C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini
2016-12-16 05:12 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\SysWOW64\de-DE
2016-12-16 05:12 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\de-DE
2016-12-16 05:12 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\Boot
2016-12-16 05:12 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\ShellExperiences
2016-12-16 05:12 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\AppPatch
2016-12-16 05:10 - 2016-08-23 20:54 - 00524288 ___SH C:\Users\habob\NTUSER.DAT{f5b13604-4b48-11e6-80cb-e41d2d012050}.TMContainer00000000000000000002.regtrans-ms
2016-12-16 05:10 - 2016-08-23 20:54 - 00524288 ___SH C:\Users\habob\NTUSER.DAT{f5b13604-4b48-11e6-80cb-e41d2d012050}.TMContainer00000000000000000001.regtrans-ms
2016-12-16 05:10 - 2016-08-23 20:54 - 00065536 ___SH C:\Users\habob\NTUSER.DAT{f5b13604-4b48-11e6-80cb-e41d2d012050}.TM.blf
2016-12-14 14:48 - 2016-07-16 12:36 - 00000000 ____D C:\Windows\CbsTemp
2016-12-14 14:46 - 2016-08-24 00:26 - 00000000 ____D C:\Windows\system32\MRT
2016-12-14 14:45 - 2016-08-24 00:26 - 135632432 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-12-14 08:13 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2016-12-14 08:13 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\Macromed
2016-12-13 20:57 - 2016-08-23 20:56 - 00002387 _____ C:\Users\habob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2016-12-13 20:57 - 2016-08-23 20:56 - 00000000 ___RD C:\Users\habob\OneDrive
2016-12-13 20:57 - 2016-08-23 20:54 - 00000000 ___RD C:\Users\habob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
2016-12-13 20:45 - 2016-08-23 22:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2016-12-13 20:44 - 2016-10-06 22:33 - 00028272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avusbflt.sys
2016-12-13 20:44 - 2016-08-23 22:12 - 00153904 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2016-12-13 20:44 - 2016-08-23 22:12 - 00151352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2016-12-12 11:57 - 2016-08-23 20:55 - 00000402 ___SH C:\Users\habob\Documents\desktop.ini
2016-12-12 11:57 - 2016-08-23 20:55 - 00000282 ___SH C:\Users\habob\Downloads\desktop.ini
2016-12-12 11:57 - 2016-08-23 20:55 - 00000282 ___SH C:\Users\habob\Desktop\desktop.ini
2016-12-12 11:57 - 2016-08-23 20:55 - 00000174 ___SH C:\Users\habob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
2016-12-12 11:57 - 2016-08-23 20:55 - 00000174 ___SH C:\Users\habob\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
2016-12-12 11:57 - 2016-08-23 20:55 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-12-12 11:57 - 2016-08-23 20:55 - 00000000 ___RD C:\Users\habob\Searches
2016-12-12 11:57 - 2016-08-23 20:55 - 00000000 ___RD C:\Users\habob\Contacts
2016-12-12 11:57 - 2016-08-23 20:55 - 00000000 ___RD C:\Users\habob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2016-12-12 11:57 - 2016-08-23 20:55 - 00000000 ___RD C:\Users\habob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2016-12-12 11:57 - 2016-08-23 20:54 - 00000000 ___RD C:\Users\habob\Saved Games
2016-12-12 11:57 - 2016-08-23 20:54 - 00000000 ___RD C:\Users\habob\Pictures
2016-12-12 11:57 - 2016-08-23 20:54 - 00000000 ___RD C:\Users\habob\Music
2016-12-12 11:57 - 2016-08-23 20:54 - 00000000 ___RD C:\Users\habob\Links
2016-12-12 11:57 - 2016-08-23 20:54 - 00000000 ___RD C:\Users\habob\Favorites
2016-12-12 11:57 - 2016-08-23 20:54 - 00000000 ___RD C:\Users\habob\Downloads
2016-12-12 11:57 - 2016-07-16 07:04 - 00262144 _____ C:\Users\Default\NTUSER.DAT
2016-12-12 11:55 - 2016-07-16 12:47 - 00000000 ___RD C:\Windows\ImmersiveControlPanel
2016-12-12 11:55 - 2016-07-16 12:47 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2016-12-12 11:55 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\SysWOW64\oobe
2016-12-12 11:55 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\WinBioPlugIns
2016-12-12 11:55 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\wbem
2016-12-12 11:55 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\sr-Latn-CS
2016-12-12 11:55 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\oobe
2016-12-12 11:55 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\bcastdvr
2016-12-12 11:55 - 2016-07-16 12:47 - 00000000 ____D C:\Program Files\Internet Explorer
2016-12-12 11:55 - 2016-07-16 12:47 - 00000000 ____D C:\Program Files (x86)\Internet Explorer
2016-12-12 11:55 - 2016-07-16 07:04 - 00000000 ____D C:\Windows\SysWOW64\Dism
2016-12-12 11:55 - 2016-07-16 07:04 - 00000000 ____D C:\Windows\system32\Sysprep
2016-12-12 11:55 - 2016-07-16 07:04 - 00000000 ____D C:\Windows\system32\Dism
2016-12-12 11:55 - 2016-07-16 07:04 - 00000000 ____D C:\Windows\servicing
2016-12-12 00:56 - 2016-07-16 12:49 - 00835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-12-12 00:56 - 2016-07-16 12:49 - 00177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2016-10-17 20:38 - 2016-10-17 20:38 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Einige Dateien in TEMP:
====================
C:\Users\habob\AppData\Local\Temp\proxy_vole3566938020834228.dll
C:\Users\habob\AppData\Local\Temp\proxy_vole4229924891294842844.dll
C:\Users\habob\AppData\Local\Temp\proxy_vole8267566524826979010.dll
C:\Users\habob\AppData\Local\Temp\sfamcc00001.dll
C:\Users\habob\AppData\Local\Temp\sfareca00001.dll


==================== Bamital & volsnap ======================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert

LastRegBack: 2017-01-09 21:57

==================== Ende von FRST.txt ============================
         

Addition Log

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 08-01-2017
durchgeführt von habob (10-01-2017 17:30:21)
Gestartet von C:\Users\habob\Desktop\troja
Windows 10 Pro Version 1607 (X64) (2016-08-23 19:53:56)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-1200777665-2148727873-1026762903-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1200777665-2148727873-1026762903-503 - Limited - Disabled)
defaultuser0 (S-1-5-21-1200777665-2148727873-1026762903-1000 - Limited - Disabled) => C:\Users\defaultuser0
Gast (S-1-5-21-1200777665-2148727873-1026762903-501 - Limited - Disabled)
habob (S-1-5-21-1200777665-2148727873-1026762903-1001 - Administrator - Enabled) => C:\Users\habob

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.020.20042 - Adobe Systems Incorporated)
Adobe Flash Player 24 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 24.0.0.186 - Adobe Systems Incorporated)
AMD Software (HKLM\...\AMD Catalyst Install Manager) (Version: 9.0.000.8 - Advanced Micro Devices, Inc.)
Attack on Titan Wings of Freedom MULTi3 - ElAmigos Version 1.0 (HKLM-x32\...\{EAC7611D-5F72-40A3-9AF6-9552FD21054A}_is1) (Version: 1.0 - KOEI TECMO GAMES)
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.24.146 - Avira Operations GmbH & Co. KG)
Avira Connect (HKLM-x32\...\{707e8edf-9482-4417-ae39-c9b5fe605e87}) (Version: 1.2.76.27124 - Avira Operations GmbH & Co. KG)
Avira Connect (x32 Version: 1.2.76.27124 - Avira Operations GmbH & Co. KG) Hidden
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Catalyst Control Center Next Localization BR (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.25 - Piriform)
Classic Shell (HKLM\...\{383BB30A-B4A7-4666-9A83-22CFA8640097}) (Version: 4.3.0 - IvoSoft)
Corsair Utility Engine (HKLM-x32\...\{84BE2927-A017-4DDC-9706-8D1051C23141}) (Version: 2.5.66 - Corsair)
DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 10.4.0.0195 - Disc Soft Ltd)
Dark Souls III Deluxe Edition MULTi12 - ElAmigos Version 1.08 reg. 1.21 (HKLM-x32\...\{C21D00A3-8A5B-489A-801C-DB8388811C16}_is1) (Version: 1.08 reg. 1.21 - FromSoftware)
Dying Light The Following Enhanced Edition Incl. Update 4 MULTi2 1.11.2 (HKLM-x32\...\Dying Light The Following Enhanced Edition Incl. Update 4 MULTi2 1.11.2) (Version:  - )
Fraps (HKLM-x32\...\Fraps) (Version:  - )
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
Heroes of the Storm (HKLM-x32\...\Heroes of the Storm) (Version:  - Blizzard Entertainment)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.4229 - Intel Corporation)
Java 8 Update 111 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180111F0}) (Version: 8.0.1110.14 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
JDownloader 2 (HKLM\...\jdownloader2-1) (Version: 2.0 - AppWork GmbH)
League of Legends (HKLM-x32\...\League of Legends 4.1.2) (Version: 4.1.2 - Riot Games)
League of Legends (x32 Version: 4.1.2 - Riot Games) Hidden
Left 4 Dead 2 (HKLM\...\Steam App 550) (Version:  - Valve)
Livestreamer 1.12.2 (HKLM-x32\...\Livestreamer) (Version:  - )
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft OneDrive (HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\OneDriveSetup.exe) (Version: 17.3.6720.1207 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24210 (HKLM-x32\...\{f144e08f-9cbe-4f09-9a8c-f2b858b7ee7f}) (Version: 14.0.24210.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24210 (HKLM-x32\...\{23658c02-145e-483d-ba6b-1eb82c580529}) (Version: 14.0.24210.0 - Microsoft Corporation)
Mozilla Firefox 50.1.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 50.1.0 (x86 de)) (Version: 50.1.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 50.1.0.6186 - Mozilla)
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version:  - )
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
Overwatch (HKLM-x32\...\Overwatch) (Version:  - Blizzard Entertainment)
Overwatch Test (HKLM-x32\...\Overwatch Test) (Version:  - Blizzard Entertainment)
Project64 Version 2.2 (HKLM-x32\...\{BEB5FB69-4080-466F-96C4-F15DF271718B}_is1) (Version: 2.2 - Henryxs87)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7541 - Realtek Semiconductor Corp.)
ROCCAT Kone Pure Optical Black Edition Driver (HKLM-x32\...\{B39826A3-8B08-40FB-8FCD-AB68A0F2AF4A}) (Version:  - Roccat GmbH)
Rocket League (HKLM\...\Steam App 252950) (Version:  - Psyonix, Inc.)
Shadow Warrior 2 Deluxe Edition Incl. Update 2 MULTi7 1.0 (HKLM-x32\...\Shadow Warrior 2 Deluxe Edition Incl. Update 2 MULTi7 1.0) (Version:  - )
Skype™ 7.30 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.30.105 - Skype Technologies S.A.)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.19 - TeamSpeak Systems GmbH)
The Walking Dead A New Frontier MULTi9 - ElAmigos Version 1.0 (HKLM-x32\...\{519AAAF0-6BA4-4130-9BD8-C3A295811CE5}_is1) (Version: 1.0 - Telltale Games)
Track-o-Bot version 0.8.5 (HKLM-x32\...\Track-o-Bot_is1) (Version: 0.8.5 - spidy.ch)
Virtual Audio Cable 4.13 (HKLM\...\Virtual Audio Cable 4.13) (Version:  - )
VLC media player (HKLM\...\VLC media player) (Version: 2.2.4 - VideoLAN)
Vulkan Run Time Libraries 1.0.26.0 (HKLM\...\VulkanRT1.0.26.0-2) (Version: 1.0.26.0 - LunarG, Inc.)
Vulkan Run Time Libraries 1.0.26.0 (Version: 1.0.26.0 - LunarG, Inc.) Hidden
WinRAR 5.40 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001_Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001_Classes\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001_Classes\CLSID\{00020422-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001_Classes\CLSID\{00020423-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001_Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001_Classes\CLSID\{00020425-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {0B58CFE7-C727-4EC0-A469-4B1AFF49B3D6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-12-06] (Piriform Ltd)
Task: {12A892D1-B78A-4636-9C7E-92F89674DB61} - System32\Tasks\GyazoUpdateTaskMachineDaily => C:\Program Files (x86)\Gyazo\GyazoUpdate.exe [2016-08-03] ()
Task: {87A42A4B-04D3-4050-B533-C90234CF19DC} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-10-21] (Adobe Systems Incorporated)
Task: {925C8AAE-D23C-40A2-8B7F-66164ACB0CD6} - System32\Tasks\GyazoUpdateTaskMachine => C:\Program Files (x86)\Gyazo\GyazoUpdate.exe [2016-08-03] ()
Task: {C433EE6C-77DF-4FCB-85E9-72F9C83BD0A6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWoW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-12-14] (Adobe Systems Incorporated)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWoW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2016-07-16 12:42 - 2016-07-16 12:42 - 00231424 _____ () C:\Windows\SYSTEM32\ism32k.dll
2016-12-14 13:28 - 2016-12-09 11:29 - 02681200 _____ () C:\Windows\system32\CoreUIComponents.dll
2016-12-14 13:28 - 2016-12-09 11:29 - 02681200 _____ () C:\Windows\SYSTEM32\CoreUIComponents.dll
2016-12-13 20:57 - 2016-12-13 20:57 - 01678560 _____ () C:\Users\habob\AppData\Local\Microsoft\OneDrive\17.3.6720.1207\amd64\ClientTelemetry.dll
2016-09-17 00:40 - 2016-09-07 05:56 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2016-12-14 13:28 - 2016-12-09 10:41 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2016-11-08 22:32 - 2016-11-02 11:21 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-11-08 22:32 - 2016-11-02 11:15 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-11-08 22:32 - 2016-11-02 11:14 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2016-11-08 22:32 - 2016-11-02 11:15 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2016-11-08 22:32 - 2016-11-02 11:16 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-11-08 22:32 - 2016-11-02 11:17 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-06-01 20:00 - 2015-06-01 20:00 - 00102912 _____ () C:\Windows\System32\IccLibDll_x64.dll
2016-11-30 20:01 - 2016-11-30 20:01 - 01484776 _____ () C:\Program Files (x86)\Battle.net\Battle.net.8180\Battle.net Helper.exe
2016-01-06 17:41 - 2016-01-06 17:41 - 00062168 _____ () C:\Program Files\CCleaner\branding.dll
2016-12-06 15:09 - 2016-12-06 15:09 - 00061440 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2016-06-29 19:01 - 2016-06-29 19:01 - 08166536 _____ () C:\Program Files (x86)\SpeedFan\speedfan.exe
2016-12-13 20:57 - 2016-12-13 20:57 - 01244376 _____ () C:\Users\habob\AppData\Local\Microsoft\OneDrive\17.3.6720.1207\ClientTelemetry.dll
2016-11-30 20:02 - 2016-11-30 20:02 - 37247976 _____ () C:\Program Files (x86)\Battle.net\Battle.net.8180\libcef.dll
2016-11-30 20:02 - 2016-11-30 20:02 - 00540336 _____ () C:\Program Files (x86)\Battle.net\Battle.net.8180\ortp.dll
2016-11-30 20:01 - 2016-11-30 20:01 - 06402560 _____ () C:\Program Files (x86)\Battle.net\Battle.net.8180\battle.net.dll
2016-11-30 20:02 - 2016-11-30 20:02 - 00133632 _____ () C:\Program Files (x86)\Battle.net\Battle.net.8180\libEGL.dll
2016-11-30 20:02 - 2016-11-30 20:02 - 03384832 _____ () C:\Program Files (x86)\Battle.net\Battle.net.8180\libGLESv2.dll
2016-11-30 20:02 - 2016-11-30 20:02 - 03384832 _____ () C:\Program Files (x86)\Battle.net\Battle.net.8180\libglesv2.dll
2016-11-30 20:02 - 2016-11-30 20:02 - 00133632 _____ () C:\Program Files (x86)\Battle.net\Battle.net.8180\libegl.dll
2016-11-30 20:01 - 2016-11-30 20:01 - 00990696 _____ () C:\Program Files (x86)\Battle.net\Battle.net.8180\ffmpegsumo.dll
2016-10-12 03:46 - 2015-01-14 07:20 - 00061440 _____ () C:\Program Files (x86)\ROCCAT\Kone Pure Optical Black Edition\hiddriverB.dll
2016-09-14 16:35 - 2016-09-14 16:35 - 00037376 _____ () C:\Program Files (x86)\Corsair\Corsair Utility Engine\MacroRecording.dll
2016-09-14 16:37 - 2016-09-14 16:37 - 00211456 _____ () C:\Program Files (x86)\Corsair\Corsair Utility Engine\quazip.dll
2016-09-14 16:35 - 2016-09-14 16:35 - 00093184 _____ () C:\Program Files (x86)\Corsair\Corsair Utility Engine\zlib.dll
2016-06-10 09:19 - 2016-06-10 09:19 - 00011264 _____ () C:\Program Files (x86)\Corsair\Corsair Utility Engine\libEGL.DLL
2016-06-10 09:19 - 2016-06-10 09:19 - 01990144 _____ () C:\Program Files (x86)\Corsair\Corsair Utility Engine\libGLESv2.dll
2016-12-25 09:43 - 2017-01-10 16:36 - 00158720 _____ () C:\Users\habob\AppData\Local\Temp\sfareca00001.dll
2016-08-23 21:10 - 2017-01-10 16:36 - 00192512 _____ () C:\Users\habob\AppData\Local\Temp\sfamcc00001.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PAexec => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PAexec => ""="Service"

==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)


==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2016-07-16 12:47 - 2016-07-16 12:45 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\StartupApproved\Run: => "Spotify"
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\StartupApproved\Run: => "Spotify Web Helper"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [{538982AA-0771-4CB1-B518-68E7DC9E97D2}] => C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{B6F4FFF3-081B-432B-9849-59F87CCA4978}] => C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [TCP Query User{C4AE1BB5-5002-4AE3-86C1-C48330ACD0DE}C:\program files (x86)\skype\phone\skype.exe] => C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{BFA4A1D3-5A4D-4125-B344-3C4969D41A44}C:\program files (x86)\skype\phone\skype.exe] => C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{48873A9C-466F-4B8D-93B7-768518FE7960}C:\program files (x86)\unified remote 3\remoteserverwin.exe] => C:\program files (x86)\unified remote 3\remoteserverwin.exe
FirewallRules: [UDP Query User{0FB9B621-C39F-4B0E-89F5-1514DE288B6E}C:\program files (x86)\unified remote 3\remoteserverwin.exe] => C:\program files (x86)\unified remote 3\remoteserverwin.exe
FirewallRules: [TCP Query User{EC7CBB32-4D88-476A-A196-8E9070A1F422}C:\program files (x86)\hearthstone\hearthstone.exe] => C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [UDP Query User{DCCEF48A-7E45-4679-B270-C7229497BD3F}C:\program files (x86)\hearthstone\hearthstone.exe] => C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [TCP Query User{1404913B-AC51-4014-BD9D-2579C3C45051}C:\program files (x86)\overwatch\overwatch.exe] => C:\program files (x86)\overwatch\overwatch.exe
FirewallRules: [UDP Query User{3E374C1F-F73F-42AA-8EA3-9A14BAADC0E0}C:\program files (x86)\overwatch\overwatch.exe] => C:\program files (x86)\overwatch\overwatch.exe
FirewallRules: [{4A4F8D0E-8EEC-418A-B5A5-3B8DD4DAD6C9}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{FBF9A9DA-1DE9-499E-80C5-69500C57A2E3}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{FBF05581-30BA-42AB-AAB0-021737BB73C8}C:\program files (x86)\dying light\dyinglightgame.exe] => C:\program files (x86)\dying light\dyinglightgame.exe
FirewallRules: [UDP Query User{E8A651E8-F059-4067-98B5-B23D6FB227F6}C:\program files (x86)\dying light\dyinglightgame.exe] => C:\program files (x86)\dying light\dyinglightgame.exe
FirewallRules: [{D2CA2C98-1166-495D-B246-FE3D98CFA57B}] => C:\program files (x86)\dying light\dyinglightgame.exe
FirewallRules: [{488839D0-2D48-4CBF-B859-1B4F00D02337}] => C:\program files (x86)\dying light\dyinglightgame.exe
FirewallRules: [TCP Query User{6BA9BA64-7997-4C15-9B25-9D4140E4B3DC}E:\hoes\overwatch test\overwatch.exe] => E:\hoes\overwatch test\overwatch.exe
FirewallRules: [UDP Query User{ABB54D8F-227E-44B3-A637-796D5FBB01A7}E:\hoes\overwatch test\overwatch.exe] => E:\hoes\overwatch test\overwatch.exe
FirewallRules: [{72EE8AAB-9AF7-47A7-BB1F-F27728E13CC3}] => E:\hoes\overwatch test\overwatch.exe
FirewallRules: [{E6D3E91C-A0CC-45AF-AC28-BE3844BE824D}] => E:\hoes\overwatch test\overwatch.exe
FirewallRules: [{4BF707C7-4C94-4C70-A310-329DDE4EE036}] => C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{4F698D4D-774A-4D72-AE5B-DE8AB863561A}] => C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{A02BCDF6-2946-44C5-8522-3D3BF81B5F16}] => C:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{4C6FF824-CDA1-4E66-A21E-04E61B39F23A}] => C:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{8BB81C65-F69B-4383-B327-4BB0549095B0}] => E:\steam\steamapps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [{9A317F47-39C5-42B6-B986-A95AA2E970C0}] => E:\steam\steamapps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [TCP Query User{867007AC-A62A-4170-8C42-C8A5C8C60AF2}E:\hoes\heroes of the storm\versions\base49008\heroesofthestorm_x64.exe] => E:\hoes\heroes of the storm\versions\base49008\heroesofthestorm_x64.exe
FirewallRules: [UDP Query User{1A1925E8-DFBA-4A18-AB86-ED32CE81B315}E:\hoes\heroes of the storm\versions\base49008\heroesofthestorm_x64.exe] => E:\hoes\heroes of the storm\versions\base49008\heroesofthestorm_x64.exe
FirewallRules: [{46E4A4E6-0EAF-4B28-87FF-5B9F6679E5C3}] => C:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{3C09D7DE-2485-4694-886D-8967420BC2D9}] => C:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe

==================== Wiederherstellungspunkte =========================

27-12-2016 00:46:42 Removed LogMeIn Hamachi
10-01-2017 11:14:15 Geplanter Prüfpunkt

==================== Fehlerhafte Geräte im Gerätemanager =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (01/10/2017 04:26:53 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RzWizard.exe, Version: 1.0.6.1000, Zeitstempel: 0x56f20403
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 10.0.14393.479, Zeitstempel: 0x58256d37
Ausnahmecode: 0xe0434352
Fehleroffset: 0x000da832
ID des fehlerhaften Prozesses: 0x1d50
Startzeit der fehlerhaften Anwendung: 0x01d26b55f7329262
Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Razer\RzWizard\RzWizard.exe
Pfad des fehlerhaften Moduls: C:\Windows\System32\KERNELBASE.dll
Berichtskennung: e86f18dc-1646-4eb6-ae42-51ea1051e5b4
Vollständiger Name des fehlerhaften Pakets: 
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (01/10/2017 04:26:52 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: RzWizard.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.Xml.XmlException
   bei System.Xml.XmlTextReaderImpl.Throw(System.Exception)
   bei System.Xml.XmlTextReaderImpl.Throw(System.String, System.String[])
   bei System.Xml.XmlTextReaderImpl.ParseText(Int32 ByRef, Int32 ByRef, Int32 ByRef)
   bei System.Xml.XmlTextReaderImpl.ParseText()
   bei System.Xml.XmlTextReaderImpl.ParseElementContent()
   bei System.Xml.XmlTextReaderImpl.Read()
   bei System.Xml.XmlTextReader.Read()
   bei System.Configuration.XmlUtil.StrictReadToNextElement(System.Configuration.ExceptionAction)
   bei System.Configuration.BaseConfigurationRecord.ScanSectionsRecursive(System.Configuration.XmlUtil, System.String, Boolean, System.String, System.Configuration.OverrideModeSetting, Boolean)
   bei System.Configuration.BaseConfigurationRecord.ScanSectionsRecursive(System.Configuration.XmlUtil, System.String, Boolean, System.String, System.Configuration.OverrideModeSetting, Boolean)
   bei System.Configuration.BaseConfigurationRecord.ScanSections(System.Configuration.XmlUtil)
   bei System.Configuration.BaseConfigurationRecord.InitConfigFromFile()

Ausnahmeinformationen: System.Configuration.ConfigurationErrorsException
   bei System.Configuration.ConfigurationSchemaErrors.ThrowIfErrors(Boolean)
   bei System.Configuration.BaseConfigurationRecord.ThrowIfParseErrors(System.Configuration.ConfigurationSchemaErrors)
   bei System.Configuration.BaseConfigurationRecord.ThrowIfInitErrors()
   bei System.Configuration.ClientConfigurationSystem.OnConfigRemoved(System.Object, System.Configuration.Internal.InternalConfigEventArgs)

Ausnahmeinformationen: System.Configuration.ConfigurationErrorsException
   bei System.Configuration.ClientConfigurationSystem.OnConfigRemoved(System.Object, System.Configuration.Internal.InternalConfigEventArgs)
   bei System.Configuration.Internal.InternalConfigRoot.OnConfigRemoved(System.Configuration.Internal.InternalConfigEventArgs)
   bei System.Configuration.Internal.InternalConfigRoot.RemoveConfigImpl(System.String, System.Configuration.BaseConfigurationRecord)
   bei System.Configuration.BaseConfigurationRecord.GetSectionRecursive(System.String, Boolean, Boolean, Boolean, Boolean, System.Object ByRef, System.Object ByRef)
   bei System.Configuration.BaseConfigurationRecord.GetSection(System.String)
   bei System.Configuration.ClientConfigurationSystem.System.Configuration.Internal.IInternalConfigSystem.GetSection(System.String)
   bei System.Configuration.ConfigurationManager.GetSection(System.String)
   bei System.Configuration.ClientSettingsStore.ReadSettings(System.String, Boolean)
   bei System.Configuration.LocalFileSettingsProvider.GetPropertyValues(System.Configuration.SettingsContext, System.Configuration.SettingsPropertyCollection)
   bei System.Configuration.SettingsBase.GetPropertiesFromProvider(System.Configuration.SettingsProvider)
   bei System.Configuration.SettingsBase.GetPropertyValueByName(System.String)
   bei System.Configuration.SettingsBase.get_Item(System.String)
   bei System.Configuration.ApplicationSettingsBase.GetPropertyValue(System.String)
   bei System.Configuration.ApplicationSettingsBase.get_Item(System.String)
   bei Razer.UpdateNInstallManagerUI.Properties.Settings.get_PopupWay()
   bei Razer.UpdateNInstallManagerUI.MiniInstallerUI.MiniInstallerUI_Controller()
   bei Razer.UpdateNInstallManagerUI.MiniInstallerUI..ctor(Boolean)
   bei Razer.MiniInstaller.MiniInstallerVIewModel..ctor()
   bei Razer.MiniInstaller.App.OnStartup(System.Windows.StartupEventArgs)
   bei System.Windows.Application.<.ctor>b__1_0(System.Object)
   bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   bei System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   bei System.Windows.Threading.DispatcherOperation.InvokeImpl()
   bei System.Windows.Threading.DispatcherOperation.InvokeInSecurityContext(System.Object)
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   bei MS.Internal.CulturePreservingExecutionContext.Run(MS.Internal.CulturePreservingExecutionContext, System.Threading.ContextCallback, System.Object)
   bei System.Windows.Threading.DispatcherOperation.Invoke()
   bei System.Windows.Threading.Dispatcher.ProcessQueue()
   bei System.Windows.Threading.Dispatcher.WndProcHook(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
   bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   bei System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   bei System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
   bei MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
   bei MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
   bei System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
   bei System.Windows.Threading.Dispatcher.PushFrame(System.Windows.Threading.DispatcherFrame)
   bei System.Windows.Application.RunDispatcher(System.Object)
   bei System.Windows.Application.RunInternal(System.Windows.Window)
   bei System.Windows.Application.Run(System.Windows.Window)
   bei Razer.MiniInstaller.App.Main()

Error: (01/10/2017 11:14:16 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.

System Error:
Zugriff verweigert
.

Error: (01/09/2017 09:45:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RzWizard.exe, Version: 1.0.6.1000, Zeitstempel: 0x56f20403
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 10.0.14393.479, Zeitstempel: 0x58256d37
Ausnahmecode: 0xe0434352
Fehleroffset: 0x000da832
ID des fehlerhaften Prozesses: 0x2028
Startzeit der fehlerhaften Anwendung: 0x01d26ab9428384a6
Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Razer\RzWizard\RzWizard.exe
Pfad des fehlerhaften Moduls: C:\Windows\System32\KERNELBASE.dll
Berichtskennung: a1a732c1-48c8-48e1-ab9b-f8523e4e2f2f
Vollständiger Name des fehlerhaften Pakets: 
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (01/09/2017 09:45:08 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: RzWizard.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.Xml.XmlException
   bei System.Xml.XmlTextReaderImpl.Throw(System.Exception)
   bei System.Xml.XmlTextReaderImpl.Throw(System.String, System.String[])
   bei System.Xml.XmlTextReaderImpl.ParseText(Int32 ByRef, Int32 ByRef, Int32 ByRef)
   bei System.Xml.XmlTextReaderImpl.ParseText()
   bei System.Xml.XmlTextReaderImpl.ParseElementContent()
   bei System.Xml.XmlTextReaderImpl.Read()
   bei System.Xml.XmlTextReader.Read()
   bei System.Configuration.XmlUtil.StrictReadToNextElement(System.Configuration.ExceptionAction)
   bei System.Configuration.BaseConfigurationRecord.ScanSectionsRecursive(System.Configuration.XmlUtil, System.String, Boolean, System.String, System.Configuration.OverrideModeSetting, Boolean)
   bei System.Configuration.BaseConfigurationRecord.ScanSectionsRecursive(System.Configuration.XmlUtil, System.String, Boolean, System.String, System.Configuration.OverrideModeSetting, Boolean)
   bei System.Configuration.BaseConfigurationRecord.ScanSections(System.Configuration.XmlUtil)
   bei System.Configuration.BaseConfigurationRecord.InitConfigFromFile()

Ausnahmeinformationen: System.Configuration.ConfigurationErrorsException
   bei System.Configuration.ConfigurationSchemaErrors.ThrowIfErrors(Boolean)
   bei System.Configuration.BaseConfigurationRecord.ThrowIfParseErrors(System.Configuration.ConfigurationSchemaErrors)
   bei System.Configuration.BaseConfigurationRecord.ThrowIfInitErrors()
   bei System.Configuration.ClientConfigurationSystem.OnConfigRemoved(System.Object, System.Configuration.Internal.InternalConfigEventArgs)

Ausnahmeinformationen: System.Configuration.ConfigurationErrorsException
   bei System.Configuration.ClientConfigurationSystem.OnConfigRemoved(System.Object, System.Configuration.Internal.InternalConfigEventArgs)
   bei System.Configuration.Internal.InternalConfigRoot.OnConfigRemoved(System.Configuration.Internal.InternalConfigEventArgs)
   bei System.Configuration.Internal.InternalConfigRoot.RemoveConfigImpl(System.String, System.Configuration.BaseConfigurationRecord)
   bei System.Configuration.BaseConfigurationRecord.GetSectionRecursive(System.String, Boolean, Boolean, Boolean, Boolean, System.Object ByRef, System.Object ByRef)
   bei System.Configuration.BaseConfigurationRecord.GetSection(System.String)
   bei System.Configuration.ClientConfigurationSystem.System.Configuration.Internal.IInternalConfigSystem.GetSection(System.String)
   bei System.Configuration.ConfigurationManager.GetSection(System.String)
   bei System.Configuration.ClientSettingsStore.ReadSettings(System.String, Boolean)
   bei System.Configuration.LocalFileSettingsProvider.GetPropertyValues(System.Configuration.SettingsContext, System.Configuration.SettingsPropertyCollection)
   bei System.Configuration.SettingsBase.GetPropertiesFromProvider(System.Configuration.SettingsProvider)
   bei System.Configuration.SettingsBase.GetPropertyValueByName(System.String)
   bei System.Configuration.SettingsBase.get_Item(System.String)
   bei System.Configuration.ApplicationSettingsBase.GetPropertyValue(System.String)
   bei System.Configuration.ApplicationSettingsBase.get_Item(System.String)
   bei Razer.UpdateNInstallManagerUI.Properties.Settings.get_PopupWay()
   bei Razer.UpdateNInstallManagerUI.MiniInstallerUI.MiniInstallerUI_Controller()
   bei Razer.UpdateNInstallManagerUI.MiniInstallerUI..ctor(Boolean)
   bei Razer.MiniInstaller.MiniInstallerVIewModel..ctor()
   bei Razer.MiniInstaller.App.OnStartup(System.Windows.StartupEventArgs)
   bei System.Windows.Application.<.ctor>b__1_0(System.Object)
   bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   bei System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   bei System.Windows.Threading.DispatcherOperation.InvokeImpl()
   bei System.Windows.Threading.DispatcherOperation.InvokeInSecurityContext(System.Object)
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   bei MS.Internal.CulturePreservingExecutionContext.Run(MS.Internal.CulturePreservingExecutionContext, System.Threading.ContextCallback, System.Object)
   bei System.Windows.Threading.DispatcherOperation.Invoke()
   bei System.Windows.Threading.Dispatcher.ProcessQueue()
   bei System.Windows.Threading.Dispatcher.WndProcHook(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
   bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   bei System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   bei System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
   bei MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
   bei MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
   bei System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
   bei System.Windows.Threading.Dispatcher.PushFrame(System.Windows.Threading.DispatcherFrame)
   bei System.Windows.Application.RunDispatcher(System.Object)
   bei System.Windows.Application.RunInternal(System.Windows.Window)
   bei System.Windows.Application.Run(System.Windows.Window)
   bei Razer.MiniInstaller.App.Main()

Error: (12/27/2016 05:13:58 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm firefox.exe, Version 50.1.0.6186 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Systemsteuerung "Sicherheit und Wartung", um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 22ac

Startzeit: 01d26041516248cc

Beendigungszeit: 6

Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Berichts-ID: 76265bf3-cc4f-11e6-a154-bc5ff4e4f83a

Vollständiger Name des fehlerhaften Pakets: 

Auf das fehlerhafte Paket bezogene Anwendungs-ID:

Error: (12/27/2016 05:13:57 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 50.1.0.6186, Zeitstempel: 0x584a057c
Name des fehlerhaften Moduls: mozglue.dll, Version: 50.1.0.6186, Zeitstempel: 0x5849ff8b
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000ec79
ID des fehlerhaften Prozesses: 0x1c24
Startzeit der fehlerhaften Anwendung: 0x01d260506da83438
Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
Pfad des fehlerhaften Moduls: C:\Program Files (x86)\Mozilla Firefox\mozglue.dll
Berichtskennung: 004b26ad-4fe5-4138-b144-47995b373f73
Vollständiger Name des fehlerhaften Pakets: 
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (12/27/2016 11:52:17 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RzWizard.exe, Version: 1.0.6.1000, Zeitstempel: 0x56f20403
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 10.0.14393.479, Zeitstempel: 0x58256d37
Ausnahmecode: 0xe0434352
Fehleroffset: 0x000da832
ID des fehlerhaften Prozesses: 0xf54
Startzeit der fehlerhaften Anwendung: 0x01d2602f49f368b8
Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Razer\RzWizard\RzWizard.exe
Pfad des fehlerhaften Moduls: C:\Windows\System32\KERNELBASE.dll
Berichtskennung: dc3d6d5f-4c7f-4fc7-893b-24994db8114d
Vollständiger Name des fehlerhaften Pakets: 
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (12/27/2016 11:52:17 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: RzWizard.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.Xml.XmlException
   bei System.Xml.XmlTextReaderImpl.Throw(System.Exception)
   bei System.Xml.XmlTextReaderImpl.Throw(System.String, System.String[])
   bei System.Xml.XmlTextReaderImpl.ParseText(Int32 ByRef, Int32 ByRef, Int32 ByRef)
   bei System.Xml.XmlTextReaderImpl.ParseText()
   bei System.Xml.XmlTextReaderImpl.ParseElementContent()
   bei System.Xml.XmlTextReaderImpl.Read()
   bei System.Xml.XmlTextReader.Read()
   bei System.Configuration.XmlUtil.StrictReadToNextElement(System.Configuration.ExceptionAction)
   bei System.Configuration.BaseConfigurationRecord.ScanSectionsRecursive(System.Configuration.XmlUtil, System.String, Boolean, System.String, System.Configuration.OverrideModeSetting, Boolean)
   bei System.Configuration.BaseConfigurationRecord.ScanSectionsRecursive(System.Configuration.XmlUtil, System.String, Boolean, System.String, System.Configuration.OverrideModeSetting, Boolean)
   bei System.Configuration.BaseConfigurationRecord.ScanSections(System.Configuration.XmlUtil)
   bei System.Configuration.BaseConfigurationRecord.InitConfigFromFile()

Ausnahmeinformationen: System.Configuration.ConfigurationErrorsException
   bei System.Configuration.ConfigurationSchemaErrors.ThrowIfErrors(Boolean)
   bei System.Configuration.BaseConfigurationRecord.ThrowIfParseErrors(System.Configuration.ConfigurationSchemaErrors)
   bei System.Configuration.BaseConfigurationRecord.ThrowIfInitErrors()
   bei System.Configuration.ClientConfigurationSystem.OnConfigRemoved(System.Object, System.Configuration.Internal.InternalConfigEventArgs)

Ausnahmeinformationen: System.Configuration.ConfigurationErrorsException
   bei System.Configuration.ClientConfigurationSystem.OnConfigRemoved(System.Object, System.Configuration.Internal.InternalConfigEventArgs)
   bei System.Configuration.Internal.InternalConfigRoot.OnConfigRemoved(System.Configuration.Internal.InternalConfigEventArgs)
   bei System.Configuration.Internal.InternalConfigRoot.RemoveConfigImpl(System.String, System.Configuration.BaseConfigurationRecord)
   bei System.Configuration.BaseConfigurationRecord.GetSectionRecursive(System.String, Boolean, Boolean, Boolean, Boolean, System.Object ByRef, System.Object ByRef)
   bei System.Configuration.BaseConfigurationRecord.GetSection(System.String)
   bei System.Configuration.ClientConfigurationSystem.System.Configuration.Internal.IInternalConfigSystem.GetSection(System.String)
   bei System.Configuration.ConfigurationManager.GetSection(System.String)
   bei System.Configuration.ClientSettingsStore.ReadSettings(System.String, Boolean)
   bei System.Configuration.LocalFileSettingsProvider.GetPropertyValues(System.Configuration.SettingsContext, System.Configuration.SettingsPropertyCollection)
   bei System.Configuration.SettingsBase.GetPropertiesFromProvider(System.Configuration.SettingsProvider)
   bei System.Configuration.SettingsBase.GetPropertyValueByName(System.String)
   bei System.Configuration.SettingsBase.get_Item(System.String)
   bei System.Configuration.ApplicationSettingsBase.GetPropertyValue(System.String)
   bei System.Configuration.ApplicationSettingsBase.get_Item(System.String)
   bei Razer.UpdateNInstallManagerUI.Properties.Settings.get_PopupWay()
   bei Razer.UpdateNInstallManagerUI.MiniInstallerUI.MiniInstallerUI_Controller()
   bei Razer.UpdateNInstallManagerUI.MiniInstallerUI..ctor(Boolean)
   bei Razer.MiniInstaller.MiniInstallerVIewModel..ctor()
   bei Razer.MiniInstaller.App.OnStartup(System.Windows.StartupEventArgs)
   bei System.Windows.Application.<.ctor>b__1_0(System.Object)
   bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   bei System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   bei System.Windows.Threading.DispatcherOperation.InvokeImpl()
   bei System.Windows.Threading.DispatcherOperation.InvokeInSecurityContext(System.Object)
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   bei MS.Internal.CulturePreservingExecutionContext.Run(MS.Internal.CulturePreservingExecutionContext, System.Threading.ContextCallback, System.Object)
   bei System.Windows.Threading.DispatcherOperation.Invoke()
   bei System.Windows.Threading.Dispatcher.ProcessQueue()
   bei System.Windows.Threading.Dispatcher.WndProcHook(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
   bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   bei System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   bei System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
   bei MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
   bei MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
   bei System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
   bei System.Windows.Threading.Dispatcher.PushFrame(System.Windows.Threading.DispatcherFrame)
   bei System.Windows.Application.RunDispatcher(System.Object)
   bei System.Windows.Application.RunInternal(System.Windows.Window)
   bei System.Windows.Application.Run(System.Windows.Window)
   bei Razer.MiniInstaller.App.Main()

Error: (12/27/2016 12:46:43 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.

System Error:
Zugriff verweigert
.


Systemfehler:
=============
Error: (01/10/2017 04:28:55 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-PNO8QHG)
Description: Der Server "{37998346-3765-45B1-8C66-AA88CA6B20B8}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (01/10/2017 04:28:37 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Plattformdienst für verbundene Geräte" wurde mit folgendem Fehler beendet: 
Unbekannter Fehler

Error: (01/10/2017 04:26:55 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Plattformdienst für verbundene Geräte" wurde mit folgendem Fehler beendet: 
Unbekannter Fehler

Error: (01/10/2017 04:26:37 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 und der APPID 
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (01/10/2017 04:26:23 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎10.‎01.‎2017 um 16:23:42 unerwartet heruntergefahren.

Error: (01/09/2017 09:44:40 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 und der APPID 
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (12/27/2016 11:54:21 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-PNO8QHG)
Description: Der Server "{37998346-3765-45B1-8C66-AA88CA6B20B8}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (12/27/2016 11:54:03 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Plattformdienst für verbundene Geräte" wurde mit folgendem Fehler beendet: 
Unbekannter Fehler

Error: (12/27/2016 11:52:03 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 und der APPID 
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (12/26/2016 09:23:29 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-PNO8QHG)
Description: Der Server "{37998346-3765-45B1-8C66-AA88CA6B20B8}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.


CodeIntegrity:
===================================
  Date: 2016-10-09 20:27:10.775
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-10-09 17:08:27.981
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-10-09 16:58:20.059
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-09-30 22:53:14.118
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-09-25 20:08:55.098
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-09-25 11:48:03.984
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-09-25 01:22:30.224
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-09-24 09:11:03.969
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-09-23 15:19:31.243
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-09-23 15:05:26.305
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Speicherinformationen =========================== 

Prozessor: Intel(R) Core(TM) i7-2600K CPU @ 3.40GHz
Prozentuale Nutzung des RAM: 41%
Installierter physikalischer RAM: 8074.74 MB
Verfügbarer physikalischer RAM: 4762.07 MB
Summe virtueller Speicher: 9354.74 MB
Verfügbarer virtueller Speicher: 5312.35 MB

==================== Laufwerke ================================

Drive c: () (Fixed) (Total:111.3 GB) (Free:9.77 GB) NTFS
Drive e: (TOSHIBA EXT) (Fixed) (Total:931.51 GB) (Free:96.65 GB) NTFS
Drive h: (NewFrontier) (CDROM) (Total:5.9 GB) (Free:0 GB) UDF

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: EAE69DB8)
Partition 1: (Active) - (Size=500 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=111.3 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 931.5 GB) (Disk ID: 97F01B21)
Partition 1: (Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== Ende von Addition.txt ============================
         

TDSSKiller Teil 1

17:43:07.0478 0x1978  TDSS rootkit removing tool 3.1.0.12 Nov  7 2016 07:10:01
17:43:10.0469 0x1978  ============================================================
17:43:10.0469 0x1978  Current date / time: 2017/01/10 17:43:10.0469
17:43:10.0469 0x1978  SystemInfo:
17:43:10.0469 0x1978  
17:43:10.0469 0x1978  OS Version: 10.0.14393 ServicePack: 0.0
17:43:10.0469 0x1978  Product type: Workstation
17:43:10.0469 0x1978  ComputerName: DESKTOP-PNO8QHG
17:43:10.0470 0x1978  UserName: habob
17:43:10.0470 0x1978  Windows directory: C:\Windows
17:43:10.0470 0x1978  System windows directory: C:\Windows
17:43:10.0470 0x1978  Running under WOW64
17:43:10.0470 0x1978  Processor architecture: Intel x64
17:43:10.0470 0x1978  Number of processors: 8
17:43:10.0470 0x1978  Page size: 0x1000
17:43:10.0470 0x1978  Boot type: Normal boot
17:43:10.0470 0x1978  CodeIntegrityOptions = 0x00000001
17:43:10.0470 0x1978  ============================================================
17:43:10.0627 0x1978  KLMD registered as C:\Windows\system32\drivers\82571551.sys
17:43:10.0627 0x1978  KLMD ARK init status: drvProperties = 0xFFF00, osBuild = 14393.576, osProperties = 0x19
17:43:10.0683 0x1978  System UUID: {1C057379-D81E-6647-CD29-4CD357AF7C76}
17:43:10.0894 0x1978  Drive \Device\Harddisk0\DR0 - Size: 0x1BF2976000 ( 111.79 Gb ), SectorSize: 0x200, Cylinders: 0x3901, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
17:43:10.0898 0x1978  Drive \Device\Harddisk1\DR1 - Size: 0xE8E0DB5800 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
17:43:11.0200 0x1978  ============================================================
17:43:11.0200 0x1978  \Device\Harddisk0\DR0:
17:43:11.0200 0x1978  MBR partitions:
17:43:11.0200 0x1978  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0xFA000
17:43:11.0200 0x1978  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0xFA800, BlocksNum 0xDE98000
17:43:11.0200 0x1978  \Device\Harddisk1\DR1:
17:43:11.0200 0x1978  MBR partitions:
17:43:11.0200 0x1978  \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x74705CB0
17:43:11.0200 0x1978  ============================================================
17:43:11.0201 0x1978  C: <-> \Device\Harddisk0\DR0\Partition2
17:43:11.0260 0x1978  E: <-> \Device\Harddisk1\DR1\Partition1
17:43:11.0260 0x1978  ============================================================
17:43:11.0260 0x1978  Initialize success
17:43:11.0260 0x1978  ============================================================
17:43:53.0994 0x0cdc  ============================================================
17:43:53.0994 0x0cdc  Scan started
17:43:53.0994 0x0cdc  Mode: Manual; SigCheck; TDLFS; 
17:43:53.0994 0x0cdc  ============================================================
17:43:53.0994 0x0cdc  KSN ping started
17:43:54.0099 0x0cdc  KSN ping finished: true
17:43:55.0170 0x0cdc  ================ Scan system memory ========================
17:43:55.0170 0x0cdc  System memory - ok
17:43:55.0171 0x0cdc  ================ Scan services =============================
17:43:55.0217 0x0cdc  [ A7901875F89D011C38CF52C98ACF5B29, 782141AB1DD7ACDE6EA08B5BAFDE8BADD05B81D38C18E097D6D9C46102056EB1 ] 1394ohci        C:\Windows\System32\drivers\1394ohci.sys
17:43:55.0249 0x0cdc  1394ohci - ok
17:43:55.0257 0x0cdc  [ EE1CCC54F75C24727A218F98FC5349DA, 0B0D26640BFA0F551B7087027E572D0BF2C5EAF50A4187C5A7D839180B7FF589 ] 3ware           C:\Windows\system32\drivers\3ware.sys
17:43:55.0267 0x0cdc  3ware - ok
17:43:55.0281 0x0cdc  [ 73C73E1AA0D4D727A04AAAB120B7F56A, 5D311F11022994410DF5C67914D38B1F0D813EFD181EA234750286A272D67A1A ] ACPI            C:\Windows\system32\drivers\ACPI.sys
17:43:55.0303 0x0cdc  ACPI - ok
17:43:55.0307 0x0cdc  [ 0935496EF9624B46B935CB35ECE1F205, A22A2A29195505A65E8626D60B00C86C23E0CABC1EB8345EA5ED523516CC21C0 ] AcpiDev         C:\Windows\System32\drivers\AcpiDev.sys
17:43:55.0317 0x0cdc  AcpiDev - ok
17:43:55.0321 0x0cdc  [ D6794C31F4077B71433988787BAA926E, F16365C2F195AAE94D4740E6C3DF4C0CECEC6393CAD65425DCCD28CDBA6EC51A ] acpiex          C:\Windows\system32\Drivers\acpiex.sys
17:43:55.0331 0x0cdc  acpiex - ok
17:43:55.0334 0x0cdc  [ FE5F656D6B35089DA39112E74EC6A85A, 5D81EE63998232A5B36DE47FE15B9D04D5BD02234CA133A2462AECA8C60A22ED ] acpipagr        C:\Windows\System32\drivers\acpipagr.sys
17:43:55.0342 0x0cdc  acpipagr - ok
17:43:55.0345 0x0cdc  [ 2F242941E4DFF69B883D77A16F039557, 45C388365317C720654A659A9326B2BC0E9D84929C704654985597D5D620101C ] AcpiPmi         C:\Windows\System32\drivers\acpipmi.sys
17:43:55.0354 0x0cdc  AcpiPmi - ok
17:43:55.0357 0x0cdc  [ C247E35A21682DA8D0DC3AF9F025FCC5, 455415EE3166B3043AD8A4DD50B688DB74242267FB555642441251EFA823E971 ] acpitime        C:\Windows\System32\drivers\acpitime.sys
17:43:55.0366 0x0cdc  acpitime - ok
17:43:55.0371 0x0cdc  [ C92B0A0957ACAD3CEEF502A2CA10ACB8, 78BF46318B69D9479ECDC83446DD8D454AA2A9A9D94B33C5FC68933DB18AFA3B ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
17:43:55.0377 0x0cdc  AdobeARMservice - ok
17:43:55.0392 0x0cdc  [ B79750091FC0842182FE49D263791294, 32FC260A74C9C45CD1E8998523642C285866378FCD9478FEFD15A0CC42EC0E0B ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWoW64\Macromed\Flash\FlashPlayerUpdateService.exe
17:43:55.0402 0x0cdc  AdobeFlashPlayerUpdateSvc - ok
17:43:55.0427 0x0cdc  [ 49B9DB97AFC85DCCBDACDAB2E90085B7, 2A6C2A09F74EA15044F442CCFB54A0F24F105ADB915E5C78F02F59652DC29152 ] ADP80XX         C:\Windows\system32\drivers\ADP80XX.SYS
17:43:55.0454 0x0cdc  ADP80XX - ok
17:43:55.0474 0x0cdc  [ 323AA1953ED9C01E23F740FA891FE064, 4CED6E3D61749316CDE28965C913E7ED462539DAAD637A29484F62AF47AD650D ] AFD             C:\Windows\system32\drivers\afd.sys
17:43:55.0493 0x0cdc  AFD - ok
17:43:55.0508 0x0cdc  [ 23522E5D581F7722B1B5B86737CAE39C, FB81ABD304376A1E87B65F5E1B34477B628CEDB2091C5D754DE97464B6050C5B ] ahcache         C:\Windows\system32\DRIVERS\ahcache.sys
17:43:55.0523 0x0cdc  ahcache - ok
17:43:55.0528 0x0cdc  [ D0905D4A945D01D4B28DB9E1BD5985F7, CF389CBCD3B99D1BAE34A42F723F1005C32213A394F691978076D3DF1727715C ] AJRouter        C:\Windows\System32\AJRouter.dll
17:43:55.0537 0x0cdc  AJRouter - ok
17:43:55.0542 0x0cdc  [ 8FD51B3B35707A66080D7C8CB05E792D, FE52F3DC280D208FDDC75F6E3294B8D601E0D86F9BD3DB1ACC8FC296AC74C23B ] ALG             C:\Windows\System32\alg.exe
17:43:55.0553 0x0cdc  ALG - ok
17:43:55.0565 0x0cdc  [ A439FE56B96C01FAC673F855C946CAEB, F587FCC988918EC25D87B0CAD6BEE74C1965BC65A8F950369DD0FBB795C61EBE ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
17:43:55.0578 0x0cdc  AMD External Events Utility - ok
17:43:55.0584 0x0cdc  [ DF21E05E41E5AC3F13F304D91457649A, 7F48F2AD1DBE89A261113C76D7C23AD7D87D5599BCC31F8A558A8A10B81BF521 ] AmdK8           C:\Windows\System32\drivers\amdk8.sys
17:43:55.0596 0x0cdc  AmdK8 - ok
17:43:55.0600 0x0cdc  [ 275B6F698CBEC36C42D3ABD7EE049BA1, C6CE3514947F67410B34E8973C87996A14FF485A2E5C7E5BA4FE276FB893D51C ] amdkmafd        C:\Windows\system32\drivers\amdkmafd.sys
17:43:55.0607 0x0cdc  amdkmafd - ok
17:43:55.0620 0x0cdc  amdkmdag - ok
17:43:55.0634 0x0cdc  [ 8D691C56E4FD4B08BFD4E9CDBCD5060D, 4E97995F69BA8817E89B31AE5ABACEA707EF62C0C9F9D4DB2488203F6E8918E6 ] amdkmdap        C:\Windows\System32\DriverStore\FileRepository\c0309270.inf_amd64_47c09dd18e1ee4c5\atikmpag.sys
17:43:55.0647 0x0cdc  amdkmdap - ok
17:43:55.0657 0x0cdc  [ 45D0AA4BB90B821DF92E8F19ABED0C5E, EA87A6E98DB3C5A88A844C04C6934E870B7004E783AA5211722115382A211B90 ] AmdPPM          C:\Windows\System32\drivers\amdppm.sys
17:43:55.0668 0x0cdc  AmdPPM - ok
17:43:55.0673 0x0cdc  [ 74FFBC43B4B899C9A8CA06A892F2CE73, 8D599363C7F3D373F1859BAA4D06DD0F40BE78B56BE52B74DE6EA6EF99452004 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
17:43:55.0681 0x0cdc  amdsata - ok
17:43:55.0690 0x0cdc  [ AAB0F1D8D7E54761ABAB13AF161F1680, CF847990EFFA2828F5B1DB1A68F08A6C2C918E9612EDFFCF95C36BCABBBEA272 ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys
17:43:55.0702 0x0cdc  amdsbs - ok
17:43:55.0708 0x0cdc  [ F91BAAC4237C40352A807000F3B716F9, F7EFA08E5067C3D419C9D21EDB880BA08883A80DDF35F8B42EC3AB293FE5E03E ] amdxata         C:\Windows\system32\drivers\amdxata.sys
17:43:55.0715 0x0cdc  amdxata - ok
17:43:55.0765 0x0cdc  [ 98D7647EF729503A60EF870DA5C21D0D, 7E36E8E3D9D0BD940DC225E1DB7EFD90F76F7BE8DCAD9782255556C31D6FD476 ] AntiVirMailService C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe
17:43:55.0788 0x0cdc  AntiVirMailService - ok
17:43:55.0799 0x0cdc  [ 229E752A26B53E155524D6530B95CDD4, B4D3DEA52860143D16A57EBA31CD3394B8B4FEA642EB3A736C8388447AB7E0E9 ] AntiVirSchedulerService C:\Program Files (x86)\Avira\Antivirus\sched.exe
17:43:55.0811 0x0cdc  AntiVirSchedulerService - ok
17:43:55.0822 0x0cdc  [ 229E752A26B53E155524D6530B95CDD4, B4D3DEA52860143D16A57EBA31CD3394B8B4FEA642EB3A736C8388447AB7E0E9 ] AntiVirService  C:\Program Files (x86)\Avira\Antivirus\avguard.exe
17:43:55.0834 0x0cdc  AntiVirService - ok
17:43:55.0861 0x0cdc  [ F2B26CD2305E917B1EA1BF49E0C59E31, 8CCE64C68B80D56C7604DB6ABD187F66C624462328F4886C607F0A46D8E9DE92 ] AntiVirWebService C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe
17:43:55.0889 0x0cdc  AntiVirWebService - ok
17:43:55.0895 0x0cdc  [ BC121C099C6C659126AD2102AFDFF8CF, 42B5EE293BDD7ADCE48173A01B30D8452564B9DA225EAF25E9292FE77C0FCF3E ] AppID           C:\Windows\system32\drivers\appid.sys
17:43:55.0905 0x0cdc  AppID - ok
17:43:55.0911 0x0cdc  [ 74A24CF946279111D7F203B36569EC02, FD67D36804744B4FE3E20BA891852575E6C2DA6515643B2F4B4210118B0FCCDA ] AppIDSvc        C:\Windows\System32\appidsvc.dll
17:43:55.0925 0x0cdc  AppIDSvc - ok
17:43:55.0930 0x0cdc  [ 73FAA5517CCD1332F00192A303CF2026, 75636222BFF381A3EECA010752DF7DC1603A395B91FF7FBF92127B5CA8EFFEE5 ] Appinfo         C:\Windows\System32\appinfo.dll
17:43:55.0941 0x0cdc  Appinfo - ok
17:43:55.0945 0x0cdc  [ 68190E2BADF23BD782344970E5B5DE9E, 95D30EC12C7FDF5822CED8BC2F17669A6687A2FB262B4F0D15C8DCFF4E9AB33D ] applockerfltr   C:\Windows\system32\drivers\applockerfltr.sys
17:43:55.0957 0x0cdc  applockerfltr - ok
17:43:55.0963 0x0cdc  [ 76A12AC673B0F8A607ACDD0583C247D4, CBC6C0EB82C7A8E3998344280BBB5A697AFA7206CA2BADFDA7ED6E7DD20E3DAC ] AppMgmt         C:\Windows\System32\appmgmts.dll
17:43:55.0977 0x0cdc  AppMgmt - ok
17:43:55.0989 0x0cdc  [ A0746EF6C5AB7A17A67BC167167499C1, 1D2154D3AFC5219293EDD508C7726E7756FB72BF04F73861C575D1FE5C553411 ] AppReadiness    C:\Windows\system32\AppReadiness.dll
17:43:56.0012 0x0cdc  AppReadiness - ok
17:43:56.0031 0x0cdc  [ 6010A920FDE5BFE4EA056F9736FBDC06, F55F68D5AD1F272BC285E716E02090C62FC87476DD6CE7ABA6BE7EF8EF6178DE ] AppVClient      C:\Windows\system32\AppVClient.exe
17:43:56.0054 0x0cdc  AppVClient - ok
17:43:56.0061 0x0cdc  [ B66ED2CB37F7E4696A51612AFBA08834, 70BA67AF7F1290E3145B873B53516F138E50D8AAC80CD00CBA66467ABC6643CB ] AppvStrm        C:\Windows\system32\drivers\AppvStrm.sys
17:43:56.0070 0x0cdc  AppvStrm - ok
17:43:56.0076 0x0cdc  [ 8DC924848E20F890BEFC6B31136D46BE, B7603425B4970F505B5A3EB0F6652A9CDD188059BDC945D6DF2BADC2DF8F4B5D ] AppvVemgr       C:\Windows\system32\drivers\AppvVemgr.sys
17:43:56.0087 0x0cdc  AppvVemgr - ok
17:43:56.0095 0x0cdc  [ 9ADC5A8BEE10E174F95349E9232D8E76, F322991323DCDC51199BB3AB0DA20F6C3CC7EE6E804400B473C610FDB895F0AE ] AppvVfs         C:\Windows\system32\drivers\AppvVfs.sys
17:43:56.0104 0x0cdc  AppvVfs - ok
17:43:56.0142 0x0cdc  [ 2C1CEC25F6D92871F38960E2E84CC3EE, 979DB74192644A71F3031EB29480ECEFE014B916636D85AACD64292CB58494A5 ] AppXSvc         C:\Windows\system32\appxdeploymentserver.dll
17:43:56.0207 0x0cdc  AppXSvc - ok
17:43:56.0215 0x0cdc  [ E6AB1F0B4C3D4E0D2A88332D76FECD03, 0D3003EB979DA4546DCDD055011E24F13E34F683F02C9801CAC564D1809F11D2 ] arcsas          C:\Windows\system32\drivers\arcsas.sys
17:43:56.0225 0x0cdc  arcsas - ok
17:43:56.0228 0x0cdc  [ 61C5A480C43E7E8E49C42869F49D0D3E, E610F0E4315ABA1D90AD4A1D7A68ABA2ACBB7FCA89E9D1798470365D52592D55 ] AsyncMac        C:\Windows\System32\drivers\asyncmac.sys
17:43:56.0238 0x0cdc  AsyncMac - ok
17:43:56.0242 0x0cdc  [ A10F989A812B57B9695F6C305907C9C6, E2B292610079AA1A10696138DE8130905A8A834B75A8DED7EBF8B6732B77A0F4 ] atapi           C:\Windows\system32\drivers\atapi.sys
17:43:56.0250 0x0cdc  atapi - ok
17:43:56.0258 0x0cdc  [ 5903F7756DE3D71DF5094262B4FAAB3C, 78832A7438BCC910FC571CCC62EC03F5F54A6238544F3305CCB1295006F35859 ] AtiHDAudioService C:\Windows\system32\drivers\AtihdWT6.sys
17:43:56.0267 0x0cdc  AtiHDAudioService - ok
17:43:56.0278 0x0cdc  [ 59F44051BCD479E70446506B7E4E78BB, CB58E55196EC702DC85916F963A3C16D429C141391F9AA7F415BD63E7328C4C6 ] AudioEndpointBuilder C:\Windows\System32\AudioEndpointBuilder.dll
17:43:56.0298 0x0cdc  AudioEndpointBuilder - ok
17:43:56.0328 0x0cdc  [ 1C986DC8F4FDA1B040AC1176FB24467F, DEDA2FF4D0369348C2A74D29FB08AC86219BBCFDF44C59339BC39A25AE0727EB ] Audiosrv        C:\Windows\System32\Audiosrv.dll
17:43:56.0358 0x0cdc  Audiosrv - ok
17:43:56.0364 0x0cdc  [ 19A629CC661BBB49E25203B9626354F9, 9FDE67E19CE0B5973441A11EB0D5CD8187C1B47B3A2C866FD6BD939D31F42924 ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
17:43:56.0372 0x0cdc  avgntflt - ok
17:43:56.0378 0x0cdc  [ B34C86461D03F33E9B1A57699DCABED3, 127A63A3AEC796DDF7E19432CAF523CA23051058752B9772244655797B3B4CDB ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
17:43:56.0384 0x0cdc  avipbb - ok
17:43:56.0401 0x0cdc  [ 14FCA1D1720A68C2D586940ABBE2DB3C, 274DB01CFD3024357602748FE36882ACE6BB3764A9FB62B2B40F9232B84A9B3E ] Avira.ServiceHost C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
17:43:56.0412 0x0cdc  Avira.ServiceHost - ok
17:43:56.0415 0x0cdc  [ 79F7741A773FF194EEC64A8161AE26D5, 3DDEA5FBDCB74A2BACC895A44C8C2A947F09E2649ED61D781E99DD61DBFACA5D ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
17:43:56.0421 0x0cdc  avkmgr - ok
17:43:56.0425 0x0cdc  [ 899D89FDF015BBAF628076987D74C295, 7534A10F652FBE559431B9B1C6BC13874E8BC7438D7AFD7553F96811FD3E59BD ] avnetflt        C:\Windows\system32\DRIVERS\avnetflt.sys
17:43:56.0431 0x0cdc  avnetflt - ok
17:43:56.0436 0x0cdc  [ 6D90FDA2DC364B8EA1420F2F81585CC3, 10E6F23A213CFE49BE04BB7D366ADD4028D61D7114FEC67C30B5467DF6B36D4F ] AxInstSV        C:\Windows\System32\AxInstSV.dll
17:43:56.0448 0x0cdc  AxInstSV - ok
17:43:56.0460 0x0cdc  [ 61BAC67048CA5C1D08C48FCC8012B613, 71B2A466FC38DA1029B471FBD2541D8FE359751A7B212AE0F420DB3645916450 ] b06bdrv         C:\Windows\system32\drivers\bxvbda.sys
17:43:56.0476 0x0cdc  b06bdrv - ok
17:43:56.0480 0x0cdc  [ 68F72B05EBC6D1779C0D60A147C7CA0B, AA1C857BEE34865C6B901157FC22570D4CF45D950708BAD7AA333F120F2B474C ] BasicDisplay    C:\Windows\System32\drivers\BasicDisplay.sys
17:43:56.0489 0x0cdc  BasicDisplay - ok
17:43:56.0493 0x0cdc  [ 23156E7EDAF613D839E2839746B168D3, CAEF8F9C7D3A338BD747AC9D5BFBE730D77B911E87BCF532EBB75E1F80916AFA ] BasicRender     C:\Windows\System32\drivers\BasicRender.sys
17:43:56.0503 0x0cdc  BasicRender - ok
17:43:56.0507 0x0cdc  [ 3F5523DCEFE42B385659C5CB46A6B810, CA24A3DF002B19E7BDEDE9B5EB60623F299D0E78B2E4F58DCFC028D76DEFE52D ] bcmfn           C:\Windows\System32\drivers\bcmfn.sys
17:43:56.0516 0x0cdc  bcmfn - ok
17:43:56.0520 0x0cdc  [ 0B750A6A6D847E73CA48ADD7A0F5A393, 6A43020F23846EFB1AFA3C070465B0059E9DF60DEB16899E09559462DF30939F ] bcmfn2          C:\Windows\System32\drivers\bcmfn2.sys
17:43:56.0528 0x0cdc  bcmfn2 - ok
17:43:56.0537 0x0cdc  [ 2B4D3AEAAD02954F8C191BC2D67949AD, 8237C9AD556CFAF7442FF60F78608104BC17CE3134C89D986D49C38CC60B1518 ] BDESVC          C:\Windows\System32\bdesvc.dll
17:43:56.0554 0x0cdc  BDESVC - ok
17:43:56.0558 0x0cdc  [ 0A508274355745EEF01C6BE3198D02C4, E2DB08AEE2368FA95FDB357BB31EA4EBF31679C3E72E109DB3D7CD1B5F7B828E ] Beep            C:\Windows\system32\drivers\Beep.sys
17:43:56.0566 0x0cdc  Beep - ok
17:43:56.0590 0x0cdc  [ E543472B75FC78B3205273AE1E8CFE5F, 97CCA65B2BD59DF45B069DE66522E768968CD03B377F797691429E14D448BE9F ] BEService       C:\Program Files (x86)\Common Files\BattlEye\BEService.exe
17:43:56.0619 0x0cdc  BEService - ok
17:43:56.0636 0x0cdc  [ 5125CBB61AC81168366BEB290399CB8E, B2A3095D45E2114DE2BD0E5A3AE20B3CE95EE517A35B9E1EAD05E231F38DBDCF ] BFE             C:\Windows\System32\bfe.dll
17:43:56.0663 0x0cdc  BFE - ok
17:43:56.0685 0x0cdc  [ D876C567AB767258036F05E4766189FD, DE8BA67325CB64495BD454B8F9DDCAE82636253844FC68B360C7E1CF5D51DD0E ] BITS            C:\Windows\System32\qmgr.dll
17:43:56.0720 0x0cdc  BITS - ok
17:43:56.0726 0x0cdc  [ 9CD2A4821DE379305CACB2E99AD8953A, 89D700DFC3C59ACBBADB48954A28C0EBF8D6A11A9E63837689DD891868E43188 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
17:43:56.0737 0x0cdc  bowser - ok
17:43:56.0752 0x0cdc  [ 2447BD15B41298622CC662249CD0F496, 013A326D2E3BF68D654BBABE2F1E5DF0FF0A153A4B95D570EE28F9BC0F5A78C3 ] BrokerInfrastructure C:\Windows\System32\bisrv.dll
17:43:56.0779 0x0cdc  BrokerInfrastructure - ok
17:43:56.0785 0x0cdc  [ B3F32C630DD3F2F6A6091B89CFF13641, 7A9C53EF9AB9FF1DC392FD711B194A101DB36CA5BC799E817BEB446741089B76 ] Browser         C:\Windows\System32\browser.dll
17:43:56.0796 0x0cdc  Browser - ok
17:43:56.0801 0x0cdc  [ 722036C26D2C4E50EC2A2EC5FD678846, 999468038AE01F0FF6881F4B2A2CB67BC636641188E95F10729E08ADBC3CB3DE ] BthAvrcpTg      C:\Windows\System32\drivers\BthAvrcpTg.sys
17:43:56.0810 0x0cdc  BthAvrcpTg - ok
17:43:56.0814 0x0cdc  [ C2E31BE025D46D189E38DD1EDF07837A, 656528DCAAAF485EC57EE5C3021E96736634DE3B9C39CBCD2728E055ABD4C0A5 ] BthHFEnum       C:\Windows\System32\drivers\bthhfenum.sys
17:43:56.0823 0x0cdc  BthHFEnum - ok
17:43:56.0832 0x0cdc  [ F7CD605FC0B0B22F3F6F247595E3A655, 1CD9140DE5415DDBEACD8667E63E5C95FD64D693B56302A0474E693E578BEAB0 ] bthhfhid        C:\Windows\System32\drivers\BthHFHid.sys
17:43:56.0841 0x0cdc  bthhfhid - ok
17:43:56.0857 0x0cdc  [ B157D72BDA6A6DD6E9DC6BF338CD0CF8, B2AC26AE214151E5AD93DED78256BC0295DBF0133C854E7DEE4CD776D9C9A349 ] BthHFSrv        C:\Windows\System32\BthHFSrv.dll
17:43:56.0872 0x0cdc  BthHFSrv - ok
17:43:56.0882 0x0cdc  [ 535DC41A33630AE4C262406F9E981C03, 599332589AA28D04189E19B87A4AE6FEEB60B40A7BC6E3B11240DA363A981C29 ] BTHMODEM        C:\Windows\System32\drivers\bthmodem.sys
17:43:56.0892 0x0cdc  BTHMODEM - ok
17:43:56.0902 0x0cdc  [ 96932F631F5CB9F5D1C8F99A71568EF3, 5E4C8955A2EE9DC76B4EBC383653EB753D76D6B017E1A5DD553AC16094D7F12A ] bthserv         C:\Windows\system32\bthserv.dll
17:43:56.0914 0x0cdc  bthserv - ok
17:43:56.0919 0x0cdc  [ 23F9EF739F685E07482116425E7879AA, 0EBDF96A49A319C0BCF6F51FB6C8C392C017E1738B950C19C91FF43E14D73143 ] buttonconverter C:\Windows\System32\drivers\buttonconverter.sys
17:43:56.0928 0x0cdc  buttonconverter - ok
17:43:56.0934 0x0cdc  [ 60EB6A4CE3E21887D302350631C16F26, 4270EFA22285C1A9336CF1220761E416950D2DA9C6A40D1D8452686CD5040DAB ] CapImg          C:\Windows\System32\drivers\capimg.sys
17:43:56.0946 0x0cdc  CapImg - ok
17:43:56.0950 0x0cdc  [ F8FB51B9EF6372610E9B31A1D86B62FC, 7461584A8B39AC549AD7BAFFA509D4CD81EEE542808BC8EFC285863A0AE6432D ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
17:43:56.0961 0x0cdc  cdfs - ok
17:43:56.0979 0x0cdc  [ 2E6612376D257F74781F2EF1F869D8C3, 908B0DECB9F098F7F11B029A03C06C67FB52E5E8BEA42033A2B579D3B3686AB8 ] CDPSvc          C:\Windows\System32\CDPSvc.dll
17:43:56.0998 0x0cdc  CDPSvc - ok
17:43:57.0006 0x0cdc  [ A93C9B9EBE2FDE5A536000D72CC17F7F, 9793CFAE8BE8C6B5B39A1D276577965FBB2CE131325A410B7C68BD23492ADAAF ] CDPUserSvc      C:\Windows\System32\CDPUserSvc.dll
17:43:57.0022 0x0cdc  CDPUserSvc - ok
17:43:57.0030 0x0cdc  [ 613D0137C269187FA298A157E3D14A18, 84BC268525F14BB27202CE242BF94D9E83BC91B50A0335908574F31B29A2F04D ] cdrom           C:\Windows\System32\drivers\cdrom.sys
17:43:57.0042 0x0cdc  cdrom - ok
17:43:57.0049 0x0cdc  [ 9450FA11E9DE6715FCB71A519A8FF90B, B7E341C6E4CE967FCDD0D17A497C07E8A1C6B0AACE8A6E8E5D6C21EF73F13E16 ] CertPropSvc     C:\Windows\System32\certprop.dll
17:43:57.0063 0x0cdc  CertPropSvc - ok
17:43:57.0072 0x0cdc  [ 0AED948DA8D5F08B3D6F12E4E2089736, 95E538E81DDBC83492C5F3820C82C78F050B4D74ACF12D7970EC84F93581AE29 ] cht4iscsi       C:\Windows\system32\drivers\cht4sx64.sys
17:43:57.0085 0x0cdc  cht4iscsi - ok
17:43:57.0120 0x0cdc  [ 0002A0FDE087C1657AB31CE73077539C, 4DD6210B67E9633AB3240371590869DC833A4C986C74FC12A5D4FFFFD361848A ] cht4vbd         C:\Windows\System32\drivers\cht4vx64.sys
17:43:57.0164 0x0cdc  cht4vbd - ok
17:43:57.0171 0x0cdc  [ 6B4F90A287D75CCD78694F6790C911B2, 73D7C31E9F475FA3FD568FCA9A953F968729AA114F63C06F38BF5198DAD67BD8 ] circlass        C:\Windows\System32\drivers\circlass.sys
17:43:57.0180 0x0cdc  circlass - ok
17:43:57.0189 0x0cdc  [ B72D26074E72A757D788FB1BEF8B2F2E, 36847C5315AFB9A5EC66AD3EF2A09C24C0FAF669FDF0831F78600F4609352CB4 ] CLFS            C:\Windows\system32\drivers\CLFS.sys
17:43:57.0203 0x0cdc  CLFS - ok
17:43:57.0220 0x0cdc  [ E133CFCBFABB3CB517BE9F42FEA5887C, DA699CDD5F3CC427354540C907BD24CCA7BAC3112C53918EB611CB4EEC7611DA ] ClipSVC         C:\Windows\System32\ClipSVC.dll
17:43:57.0241 0x0cdc  ClipSVC - ok
17:43:57.0246 0x0cdc  [ EEC3A4A98AE1A337E3CD1483AD6F2E15, 764DA329984A95E092F5C15116DA34FA7FC27216C0862365D4BF10ADC97EC5C5 ] clreg           C:\Windows\System32\drivers\registry.sys
17:43:57.0256 0x0cdc  clreg - ok
17:43:57.0261 0x0cdc  [ 429623E266EF067A44E8CF148E9DFB9B, A48AA85ACC52C7AD73DB2D6148B3F9FB5EAC33C8F8C5BB6D7D0A9D84B7C08E11 ] CmBatt          C:\Windows\System32\drivers\CmBatt.sys
17:43:57.0270 0x0cdc  CmBatt - ok
17:43:57.0283 0x0cdc  [ B0D9B87B795B7833C9152441CBD55CC4, D86C0FE8BF03D6F3330E16728FE6645AE910F95D23A9EFBDF3A50F45AB5D525B ] CNG             C:\Windows\system32\Drivers\cng.sys
17:43:57.0301 0x0cdc  CNG - ok
17:43:57.0305 0x0cdc  [ 3DB10C59405931E2C72EFB82C1AF97D1, 100B5450A70988DB1C1F8A5FDBB3553AF1A0D47B42A5AC71460DB92E26010CE6 ] cnghwassist     C:\Windows\system32\DRIVERS\cnghwassist.sys
17:43:57.0313 0x0cdc  cnghwassist - ok
17:43:57.0317 0x0cdc  [ 34C935AF2A414572B412B3556586D783, 912981B88B0796576ECCD5EBE0C4728EC02D5D6A96B039447DCBA59B2583F25E ] CompositeBus    C:\Windows\System32\DriverStore\FileRepository\compositebus.inf_amd64_a140581a8f8b58b7\CompositeBus.sys
17:43:57.0326 0x0cdc  CompositeBus - ok
17:43:57.0329 0x0cdc  COMSysApp - ok
17:43:57.0332 0x0cdc  [ 44EEEB2382F566999287E13F2067693C, 53A4A0C85EAD38030FF2078C67465E3710ECD03A08FF34E1E67B2E3E1CC70043 ] condrv          C:\Windows\system32\drivers\condrv.sys
17:43:57.0341 0x0cdc  condrv - ok
17:43:57.0356 0x0cdc  [ 5DE2049D5F57C1D142F36FA9CE443693, E6C2807C0B1EF90C11EB39634693B76EACE6CC675777776112835212A334F328 ] CoreMessagingRegistrar C:\Windows\system32\coremessaging.dll
17:43:57.0377 0x0cdc  CoreMessagingRegistrar - ok
17:43:57.0382 0x0cdc  [ 7A74D92CC29D12041C8D0B1918FED04F, 771C8011B2F60656EFC4CC65DE738B1380244793A02872BC8FE9FC26A2DBB7AD ] CorsairVBusDriver C:\Windows\System32\drivers\CorsairVBusDriver.sys
17:43:57.0390 0x0cdc  CorsairVBusDriver - ok
17:43:57.0394 0x0cdc  [ E5732664EDA5B5A84967FEA6E5D2FABD, 0C36DC697B566785685F4C9AD63CBC429BC983703DA70F393F39E6E9384AF8B1 ] CorsairVHidDriver C:\Windows\System32\drivers\CorsairVHidDriver.sys
17:43:57.0401 0x0cdc  CorsairVHidDriver - ok
17:43:57.0415 0x0cdc  [ B18D590BC5220FDB4A747BC16D78ABC7, D46F8B43BAC22E55DE9AFC19CF371B1C4E8D3707163598B2F9884BB31D730C09 ] cphs            C:\Windows\SysWow64\IntelCpHeciSvc.exe
17:43:57.0428 0x0cdc  cphs - ok
17:43:57.0434 0x0cdc  [ 5F06CAC4B09250CDDDD0180A08162924, A2EB0A57225E65FC264CFC9FAD858D8B54A015CDAE3DC904B1C4E9AAB40B1F06 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
17:43:57.0446 0x0cdc  CryptSvc - ok
17:43:57.0457 0x0cdc  [ 03214883D52FAD46573233852344C72C, 63DCCDD895EB804D205ABB8EA381B34FB0879D09E4D0EB0B28F9B2BB1024BAB7 ] CSC             C:\Windows\system32\drivers\csc.sys
17:43:57.0479 0x0cdc  CSC - ok
17:43:57.0495 0x0cdc  [ BE35D1BAC3F18C9EB1C1CFBA31ED95E3, 4255475D173868A0E5583E844A1884E819E229838C4DEACAC47F1A4DEF388C9D ] CscService      C:\Windows\System32\cscsvc.dll
17:43:57.0522 0x0cdc  CscService - ok
17:43:57.0526 0x0cdc  [ 039B5A8CBD5C75D1C46DF15F7C74D136, A5C8A41F2D406D37E147939F2058373ED091BFCC00CA7E829F887638CD3A2F64 ] dam             C:\Windows\system32\drivers\dam.sys
17:43:57.0535 0x0cdc  dam - ok
17:43:57.0554 0x0cdc  [ 7BD259FC59CF9C2AE1B979564B374CC6, 299832FCE304A85080C80ABFE820A6093AC15A7C1E7C89D8C946708E955A2909 ] DcomLaunch      C:\Windows\system32\rpcss.dll
17:43:57.0586 0x0cdc  DcomLaunch - ok
17:43:57.0593 0x0cdc  [ AE9F09F87755C18904656CB4F59F351D, B352A43B3B68B497D87B49C302AF3F37F36D56D49878AE3785C3D43597E5DC57 ] DcpSvc          C:\Windows\system32\dcpsvc.dll
17:43:57.0610 0x0cdc  DcpSvc - ok
17:43:57.0623 0x0cdc  [ ABBD3EE724117242E28D31F19FBCFF03, 68EA91A969DD80A5DE28B0A8EAEB308837183713559C2C2FAEF991858C971393 ] defragsvc       C:\Windows\System32\defragsvc.dll
17:43:57.0649 0x0cdc  defragsvc - ok
17:43:57.0663 0x0cdc  [ DD74F18227ACC837D9856E24282D446D, 6A760E44CD897952538CDFA8895FE11263D51AAA79CFF24C01F3862E919DA478 ] DeviceAssociationService C:\Windows\system32\das.dll
17:43:57.0681 0x0cdc  DeviceAssociationService - ok
17:43:57.0687 0x0cdc  [ FEA494AC3A1BAE63C1F2AF267D49F1DB, 0722FEA2481740B53EF26B1CA59166C63C157A5C708AC93DF3FBB74A27266C9C ] DeviceInstall   C:\Windows\system32\umpnpmgr.dll
17:43:57.0704 0x0cdc  DeviceInstall - ok
17:43:57.0708 0x0cdc  [ CDF1B1B5C5951111791C236B2696C7F8, BF6C4BA545C8827B40DB69890DB4D2B2F9C583C5E3CFBDFD370B05891141458D ] DevQueryBroker  C:\Windows\system32\DevQueryBroker.dll
17:43:57.0717 0x0cdc  DevQueryBroker - ok
17:43:57.0723 0x0cdc  [ 0D1D392ED2597F295956D058D33BD7C3, 2F7FE5A06D880F9E2A46C9803DD249DC40C2898C04E946D14E7EECCCC9F2B24F ] Dfsc            C:\Windows\system32\Drivers\dfsc.sys
17:43:57.0736 0x0cdc  Dfsc - ok
17:43:57.0746 0x0cdc  [ F0D4400BA0F08610D9A551B15BF10B76, 83EB8FB272FC2DD2CC0659C2FB90AD0DAE88A88AB3951E03BCD933A25B601E10 ] Dhcp            C:\Windows\system32\dhcpcore.dll
17:43:57.0765 0x0cdc  Dhcp - ok
17:43:57.0770 0x0cdc  [ CA7FEDDFCF61EF15A09C54DA2C07C49F, 346EF7709BA9E6BD48592B86FA46F9D956C847EF91F4980EEAD98269D0F0EF67 ] diagnosticshub.standardcollector.service C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
17:43:57.0781 0x0cdc  diagnosticshub.standardcollector.service - ok
17:43:57.0815 0x0cdc  [ CAD14E0AD1F03397E9B1C8733D76BEF4, 0035EF35F6520B1DF0E599C8A06D4163C52576BCE0976BF729B44DECDC506627 ] DiagTrack       C:\Windows\system32\diagtrack.dll
17:43:57.0869 0x0cdc  DiagTrack - ok
17:43:57.0913 0x0cdc  [ 64F6A6B21B25528F7368928C0171C8E3, B9D56EA97E57501D567D71965C1CD57C85DA1C7EAF958B38F3D199457DD4D2E3 ] Disc Soft Lite Bus Service C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe
17:43:57.0946 0x0cdc  Disc Soft Lite Bus Service - ok
17:43:57.0954 0x0cdc  [ 35B9D46560339A5A7F0CAC6ED702C817, F70480B01533B7029F90E2DE297E9E829660300DDE7A7D009B0AC2684E7691A7 ] disk            C:\Windows\system32\drivers\disk.sys
17:43:57.0962 0x0cdc  disk - ok
17:43:57.0977 0x0cdc  [ 09CF47A74BFB480B8262FCEE222004B6, F5CD0ACA04BCB95984595CC2E17BC9E92865091A0A3BCAD4B06438A1570E7696 ] DmEnrollmentSvc C:\Windows\system32\Windows.Internal.Management.dll
17:43:57.0996 0x0cdc  DmEnrollmentSvc - ok
17:43:58.0002 0x0cdc  [ 815F45161A4571C2C44491564F3D5968, 32E7AE8414A178CE429C0CDFCF718E3C11C705FB3155EA5CA0EAD48AAE507B01 ] dmvsc           C:\Windows\System32\drivers\dmvsc.sys
17:43:58.0010 0x0cdc  dmvsc - ok
17:43:58.0014 0x0cdc  [ 6E5EE6E420FECD64DE463C5F01CBFE71, F173C56895E80AA03D70CD78B3AB659C2EEAACFF43BE3B6EF3939D6F4AD4F62D ] dmwappushservice C:\Windows\system32\dmwappushsvc.dll
17:43:58.0028 0x0cdc  dmwappushservice - ok
17:43:58.0036 0x0cdc  [ 7F8A3ABF7750326E18CE953CCE262670, 5DBD159E8A455A42764FC73CF7DCAC849B5896848C5589B00BD36697804C0A3B ] Dnscache        C:\Windows\System32\dnsrslvr.dll
17:43:58.0051 0x0cdc  Dnscache - ok
17:43:58.0059 0x0cdc  [ 8F46B4C3F9BA19C26A26D0A11137B20B, BA0A66DBA98D77FD85A7CD2D4593F2B2A1A3B4D32BBECBCFFBEB5A54DCB0D8ED ] dot3svc         C:\Windows\System32\dot3svc.dll
17:43:58.0073 0x0cdc  dot3svc - ok
17:43:58.0079 0x0cdc  [ CA09EAEE92C6FDDC6B05057F11A0372D, 14DB5C186B69644AA93C445BF31CC9670204F95A47B77B6EACB19B4A316378AD ] DPS             C:\Windows\system32\dps.dll
17:43:58.0092 0x0cdc  DPS - ok
17:43:58.0095 0x0cdc  [ AE6BD4C879A8C849E53947C92DF3B3A0, 8C29774CB2D30D901C54AAC0C8ACE709351EE40E5C8FB9951B2A18B4A03F28B7 ] drmkaud         C:\Windows\system32\DRIVERS\drmkaud.sys
17:43:58.0103 0x0cdc  drmkaud - ok
17:43:58.0109 0x0cdc  [ 7433474BE77F065D2FA628671FE31A3E, 063ADDC68F48036749E6EC7B2F66284DB29F90F62E9468D16B4EF5A0FDC45E35 ] DsmSvc          C:\Windows\System32\DeviceSetupManager.dll
17:43:58.0125 0x0cdc  DsmSvc - ok
17:43:58.0130 0x0cdc  [ 5FCA45C24501DA7390065D3706A9FC3F, 093FD840F1502ECC6F05B9723CA523B3F15CF39A5D2B9106E1267739B3F2C52C ] DsSvc           C:\Windows\System32\DsSvc.dll
17:43:58.0145 0x0cdc  DsSvc - ok
17:43:58.0148 0x0cdc  [ 679FF716052109392D870F6A6C4A3535, BEF1784448CCA4AF1D67ED68BD0C7CFE01A7719E98CACF92C2DCBFAA916DC57E ] dtlitescsibus   C:\Windows\System32\drivers\dtlitescsibus.sys
17:43:58.0153 0x0cdc  dtlitescsibus - ok
17:43:58.0157 0x0cdc  [ E23FDD696839A4790682CA66C48D3F2F, F5F0721BDA751968224E52E75D0C309A3E084C430CD98E85A55AF622D16B9A44 ] dtliteusbbus    C:\Windows\System32\drivers\dtliteusbbus.sys
17:43:58.0162 0x0cdc  dtliteusbbus - ok
17:43:58.0197 0x0cdc  [ 19F2B54EE8861D90579BD0E3AE5182F9, FDD4F091C61C8C20550C8F68375ABD7ED718A733F680F0F0367D4796C302BA14 ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
17:43:58.0243 0x0cdc  DXGKrnl - ok
17:43:58.0251 0x0cdc  [ 9FCE4EF7D5E274F862D9A2526B5F4779, 81D42D5475C2801C8E0C233A0BA827569D8A70590017C91C665C8B232D9BFAA9 ] EapHost         C:\Windows\System32\eapsvc.dll
17:43:58.0266 0x0cdc  EapHost - ok
17:43:58.0326 0x0cdc  [ 7EC6FC0266D74BD47ABB130A328B70EC, 3856790AF967AB03B1A89F97328DC4D5A6854ACDA6169681A9AFB03D7CF791F9 ] ebdrv           C:\Windows\system32\drivers\evbda.sys
17:43:58.0392 0x0cdc  ebdrv - ok
17:43:58.0401 0x0cdc  [ 6F8E95716C1A27FF2FE96D30B147F1C1, 9403E9FE8B13EE294CFBBD96649BBD54CF723CF5872E3E03DA4380379D677983 ] EFS             C:\Windows\System32\lsass.exe
17:43:58.0410 0x0cdc  EFS - ok
17:43:58.0416 0x0cdc  [ 8D74B8B5D6F7C5BC4C525BAF2B083FF1, DA5656F745B3911F96871887FDFDC40F4D9C820622A0AA27EFE4BA93662833CA ] EhStorClass     C:\Windows\system32\drivers\EhStorClass.sys
17:43:58.0424 0x0cdc  EhStorClass - ok
17:43:58.0432 0x0cdc  [ 2A9817B5A9260D8F60D52E36BEF10443, AC1A0203221AFAF584C71317FA07AA1B6E61BE619E918B3B1E4AD57CCED1CF03 ] EhStorTcgDrv    C:\Windows\system32\drivers\EhStorTcgDrv.sys
17:43:58.0441 0x0cdc  EhStorTcgDrv - ok
17:43:58.0447 0x0cdc  [ 80A7999DE02CE678B865832E1CE78CD6, 2576EBB6E4D630A906DE724F125099E52A962B5B68B9F9BCA849A7B29D8C8689 ] embeddedmode    C:\Windows\System32\embeddedmodesvc.dll
17:43:58.0461 0x0cdc  embeddedmode - ok
17:43:58.0469 0x0cdc  [ 3CE2B6AECB9AF8BC159299EEC46A35CA, E933B28BB6E4D01FCCDF8FBBB134C244B28DA3ECBDFA13333F0D4C24B2551780 ] EntAppSvc       C:\Windows\system32\EnterpriseAppMgmtSvc.dll
17:43:58.0484 0x0cdc  EntAppSvc - ok
17:43:58.0488 0x0cdc  [ 77B60DEC7DCB4233E4A69D3F52E5DB24, 3A5C905E37A93899051497C90E5BA8E1D003B56C6906CADFD2F1CDF52052D248 ] ErrDev          C:\Windows\System32\drivers\errdev.sys
17:43:58.0496 0x0cdc  ErrDev - ok
17:43:58.0502 0x0cdc  [ D0542D4590A83339F4AAAC58DF6AF43C, 3C65BB35506384190D94B3F91308BF178D2CA162DC9025CB91AD32F8DB1F46CE ] EuMusDesignVirtualAudioCableWdm C:\Windows\system32\DRIVERS\vrtaucbl.sys
17:43:58.0508 0x0cdc  EuMusDesignVirtualAudioCableWdm - ok
17:43:58.0519 0x0cdc  [ F89083AB8B9F51C0031C1CBD0A9A7E35, 9EE973A25134960E62D1A6A1E34AD9B3F7690E71C1AD31A23FA2081A73438754 ] EventSystem     C:\Windows\system32\es.dll
17:43:58.0539 0x0cdc  EventSystem - ok
17:43:58.0547 0x0cdc  [ FCD2C63754C2E739A8EEAD9BC63F9DDC, C57A72ABA4C0BD71F914B9C8FF965DCFF585A205498F19A4584A4BAF7674839D ] exfat           C:\Windows\system32\drivers\exfat.sys
17:43:58.0564 0x0cdc  exfat - ok
17:43:58.0573 0x0cdc  [ FA918EC296EB410FF02867D008D02421, 23D164A24CB0D212778FA9592A046B6BA1F3628003E04181744A1F891B5B3E5A ] fastfat         C:\Windows\system32\drivers\fastfat.sys
17:43:58.0586 0x0cdc  fastfat - ok
17:43:58.0598 0x0cdc  [ 77CE56471AF984800F318F3734D768C7, 72D540072374A56C2C497F0532A50705D3F0637F2C0C96B1D715F2EDFCA3AA2D ] Fax             C:\Windows\system32\fxssvc.exe
17:43:58.0623 0x0cdc  Fax - ok
17:43:58.0627 0x0cdc  [ 99598ECA5E41996E005D5B9D9FF1EFA2, 91345CD50EF02431B69093505C1C5F5DC6A1AA6BF192EE9392ED4D5626B60462 ] fdc             C:\Windows\System32\drivers\fdc.sys
17:43:58.0636 0x0cdc  fdc - ok
17:43:58.0639 0x0cdc  [ EF0DD43A4CBAB367BCA1AFBDC9971E4F, 73E161C45D63FDDE71EE2438137913724DC513860539D1E7F6BD861F5D1B33F3 ] fdPHost         C:\Windows\system32\fdPHost.dll
17:43:58.0651 0x0cdc  fdPHost - ok
17:43:58.0654 0x0cdc  [ 34DAC585994CD3B4E910DE11C584EF3D, A6C6A4CB5413EA61F1A54E2D3AD71A311CEA2C26218544D2D2D4A5CFEC52DE8C ] FDResPub        C:\Windows\system32\fdrespub.dll
17:43:58.0667 0x0cdc  FDResPub - ok
17:43:58.0671 0x0cdc  [ B68DA1FE3CA2311AFD38DD6905CA7F71, 4B395DFB1B47D2507CA4D9DC996A70D0A3BDB1A245CD6DA6C42B2A299AFCCF37 ] fhsvc           C:\Windows\system32\fhsvc.dll
17:43:58.0683 0x0cdc  fhsvc - ok
17:43:58.0687 0x0cdc  [ F44F666B0EACC3181544FFCF8CA0FFC7, 83F771CF9DAE1C504B30731EEC55355EA1253174252DA2192ADF1D228B3735C3 ] FileCrypt       C:\Windows\system32\drivers\filecrypt.sys
17:43:58.0698 0x0cdc  FileCrypt - ok
17:43:58.0705 0x0cdc  [ 78A210DDFDF2C9EC884631D2DAA573F0, 5D39C6EF4AC690A9749EEDBE2478FFF15A22877A2861EDA103C7BF1607B0C1BD ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
17:43:58.0713 0x0cdc  FileInfo - ok
17:43:58.0717 0x0cdc  [ 1A97DB5E701A186989F3795223C3BE39, F7982220D4DF7E104955E63CACE352394E2577DEF49506EA126127F820EB62DF ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
17:43:58.0728 0x0cdc  Filetrace - ok
17:43:58.0732 0x0cdc  [ 46626665F0E5906E45619B4EFD6186B8, 37FDD3B8AD49FD29E54DA5567EA77F28A53498AE56348F7A2628E5E5549D638B ] flpydisk        C:\Windows\System32\drivers\flpydisk.sys
17:43:58.0741 0x0cdc  flpydisk - ok
17:43:58.0749 0x0cdc  [ FDA72ACA14D516D18C33AFCD0FD9260F, 6509612DEC82EA74614B5C9A7B432305A1A468C97B88BED9E141DF2929B621B1 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
17:43:58.0764 0x0cdc  FltMgr - ok
17:43:58.0800 0x0cdc  [ 49BF5C8182C3D2D6CD9F7EEDF1CFDB66, 0977EBE86B57FC370D27CA69D58122397D5D5369AF0C8DBCC492AE7AD55CBA2B ] FontCache       C:\Windows\system32\FntCache.dll
17:43:58.0851 0x0cdc  FontCache - ok
17:43:58.0870 0x0cdc  [ 8B52024D3A5C3A12F1C4D75D30A976C5, 982F1C783966C9A6D255AA7DBAB6D225EBE0050A36176B8DE85E8ADBFE17FDF1 ] FrameServer     C:\Windows\system32\FrameServer.dll
17:43:58.0897 0x0cdc  FrameServer - ok
17:43:58.0902 0x0cdc  [ D152CCBFC8251670BF0AAFE00D6BC782, 9DE82D8FC4E1DAF8FF23EE08C0B7CB5051A9224E64544D262CFA4996A41B04E1 ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
17:43:58.0910 0x0cdc  FsDepends - ok
17:43:58.0913 0x0cdc  [ 6D6BB5C7363CD35FA715E826F3D029EE, C214F791EB39E8B25CE57ED9D6C1D56EE1AF6021BCB380980BD42A6338A6C9F7 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
17:43:58.0921 0x0cdc  Fs_Rec - ok
17:43:58.0935 0x0cdc  [ 8EEC4925C03E375C4EC496E45C44139A, 06C5C7BCC28D3E435675F0759A09CAB726E971DF4BFC1DC3DCF503EABCDCCCC6 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
17:43:58.0954 0x0cdc  fvevol - ok
17:43:58.0958 0x0cdc  [ EF78034773CE506323655A868C949144, DF195BEEE6704FBCC6D2D9E1BF6723E52ED502A1459F495B7D18481E6A79B5BC ] gencounter      C:\Windows\System32\drivers\vmgencounter.sys
17:43:58.0968 0x0cdc  gencounter - ok
17:43:58.0971 0x0cdc  [ B55FEBC6A00DAA1FE074F020B6907516, 67071FBAC2ABA47AB71358A5F08E92E034A55343878F00137E90B3B1F7362976 ] genericusbfn    C:\Windows\System32\drivers\genericusbfn.sys
17:43:58.0980 0x0cdc  genericusbfn - ok
17:43:58.0986 0x0cdc  [ DDD8A8CDDC7F13EF57D1DAAE71865936, 9D472A8689F72F24D40D5B94849690F53C67849FDF6162A94EF4FB330A3DA566 ] GPIOClx0101     C:\Windows\system32\Drivers\msgpioclx.sys
17:43:58.0996 0x0cdc  GPIOClx0101 - ok
17:43:59.0018 0x0cdc  [ 713A176494CEC107E663CAD6C2B27F77, 76871D8CFBA8FCD8CFF96208AE84C658EBEC60270D978898B90EE9451AA1BCE1 ] gpsvc           C:\Windows\System32\gpsvc.dll
17:43:59.0059 0x0cdc  gpsvc - ok
17:43:59.0063 0x0cdc  [ 7ACD8F69B5D6EC97E6D2C006E19BED88, FC69214C9308EA64B88EF4C3C95800586DDBB44C8540846B79A161BAD8203B6E ] GpuEnergyDrv    C:\Windows\system32\drivers\gpuenergydrv.sys
17:43:59.0072 0x0cdc  GpuEnergyDrv - ok
17:43:59.0076 0x0cdc  [ 7F79205B4EFA98F0767309479C8C01C6, 4B576903A83F33A8CF31D3887144A3D51C56D1187115C83AC99C0E9F6B4BF128 ] Hamachi         C:\Windows\system32\DRIVERS\Hamdrv.sys
17:43:59.0085 0x0cdc  Hamachi - ok
17:43:59.0095 0x0cdc  [ 217230B984AB2954E2FA5E36578D7B08, BB7B79EA7501A28EB2A0303FDF66FB9D59D567994C25A1523CD6D2081C403AF6 ] HdAudAddService C:\Windows\system32\DRIVERS\HdAudio.sys
17:43:59.0113 0x0cdc  HdAudAddService - ok
17:43:59.0117 0x0cdc  [ 10E3515FE5DBA6656FA62C29342EC4A1, 2051F10F74ED712B1766EB61E87FADE25AB3D0970BABFD320600D1B0D6377F26 ] HDAudBus        C:\Windows\System32\drivers\HDAudBus.sys
17:43:59.0128 0x0cdc  HDAudBus - ok
17:43:59.0131 0x0cdc  [ B90D284B97CD4CA9DE7430AAAD887A56, 2F14F985C39B7801ED64590979CF2114924E9547F5B11D2B37A74DBFFDD9E7C5 ] HidBatt         C:\Windows\System32\drivers\HidBatt.sys
17:43:59.0138 0x0cdc  HidBatt - ok
17:43:59.0143 0x0cdc  [ B2FE11643CC6ACDEE6C247DD36018FDB, 5796613C7DBF8B2A9E860E006FF1A245B6BE7D10E3F6685AD142B48E5C237B8C ] HidBth          C:\Windows\System32\drivers\hidbth.sys
17:43:59.0155 0x0cdc  HidBth - ok
17:43:59.0159 0x0cdc  [ D24355488A2D4D2323518EC1AC7A6D9E, ED2176A2093726087EDDA25B86E9CDD4BA35F4E748E3A6DE0B15C4C97646B5C7 ] hidi2c          C:\Windows\System32\drivers\hidi2c.sys
17:43:59.0168 0x0cdc  hidi2c - ok
17:43:59.0172 0x0cdc  [ 0AF9ABBA4F3F55C6C803890D64BC3C29, D3DE6FA308F8E7CD4F16387F46AE4B2F7EC9BBA07BF87652B660A0D645710571 ] hidinterrupt    C:\Windows\System32\drivers\hidinterrupt.sys
17:43:59.0180 0x0cdc  hidinterrupt - ok
17:43:59.0183 0x0cdc  [ CDBCF8E9AB06D88A1E1191D32F320C5D, F76963AB7CF2BAB3A220013879AECD3976BFD851CFB66B5A69A9EA2541048861 ] HidIr           C:\Windows\System32\drivers\hidir.sys
17:43:59.0192 0x0cdc  HidIr - ok
17:43:59.0195 0x0cdc  [ C900FE0DD6A1E2220084B8F1C427790C, 802194EBEDA1A50EDA300078B0888AAC1F17A42E67147B7B3B9C50AD8D4E5C89 ] hidserv         C:\Windows\system32\hidserv.dll
17:43:59.0206 0x0cdc  hidserv - ok
17:43:59.0209 0x0cdc  [ D8536CB438CC4CCDAE047B768EED22B2, 4F666BFA3554F9ACA6B9D436BFA64474D5F30FB3E78F4E66068CCDF283D9867F ] HidUsb          C:\Windows\System32\drivers\hidusb.sys
17:43:59.0218 0x0cdc  HidUsb - ok
17:43:59.0226 0x0cdc  [ 0AC1BD5A28FAA371EF34859FE703E515, 1DD1C33AF8D6EBE7C36FCD051F066E4039D2B47ABAECF7C68BC3933D567930B2 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
17:43:59.0242 0x0cdc  HomeGroupListener - ok
17:43:59.0252 0x0cdc  [ 86161A89F16851728802590EC7C92608, 3A3B05BB4E115410D27063B30C0EF3F18295F542050F329F1E466C81A9E23A46 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
17:43:59.0272 0x0cdc  HomeGroupProvider - ok
17:43:59.0277 0x0cdc  [ F5CA18197B4646E04DB9EB2D6642CC4D, 5BA3342DDF1BCB67E4156169FE9A33E7BC2641C729E9F1A80C0E80953C6AB114 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
17:43:59.0285 0x0cdc  HpSAMD - ok
17:43:59.0305 0x0cdc  [ A10C7C1E69FC90620C7BF2E51302A01F, D725AEAE38255CED73F4922A10F226215528706580B06D01C228488F93AC0397 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
17:43:59.0332 0x0cdc  HTTP - ok
17:43:59.0338 0x0cdc  [ 0C84C250F80EAEC2C9768464CC1A9626, 212E1003B78F9B98FEB084FD1FDB59B26A9DE4C9120F24D4361FBBF0F3C035E7 ] HvHost          C:\Windows\System32\hvhostsvc.dll
17:43:59.0348 0x0cdc  HvHost - ok
17:43:59.0353 0x0cdc  [ 74FC79C52395B10FFD0B55CF22CF88FC, 94D977DA2092EE8C2A598AC48758A84BB22CB6378BD114C2D3B4172A07A9CACC ] hvservice       C:\Windows\system32\drivers\hvservice.sys
17:43:59.0361 0x0cdc  hvservice - ok
17:43:59.0364 0x0cdc  [ 771EDDA9830A3079F996F34D681FB6E5, F452AD656872A1C8B2D6DCE232CE01EBD456C46F4934A7601E78470F2A2CBF38 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
17:43:59.0371 0x0cdc  hwpolicy - ok
17:43:59.0374 0x0cdc  [ 3B9F315E7FA72CC25228EB097DD9C694, B26F1E494428EF197A0C97645C05BB3CA093827A005D35C987F1D6778BC4E52C ] hyperkbd        C:\Windows\System32\drivers\hyperkbd.sys
17:43:59.0383 0x0cdc  hyperkbd - ok
17:43:59.0387 0x0cdc  [ B54B30992620C97230013A74461C8517, CAF09BDCDD6DE2A39CB8AE2C65E6F8FE12D8E93D84BBEF6C6A98F872BF54A4E3 ] i8042prt        C:\Windows\System32\drivers\i8042prt.sys
17:43:59.0398 0x0cdc  i8042prt - ok
17:43:59.0402 0x0cdc  [ C6B8743B213F06AA60943D8366FE968F, 758954F70B810063914B243115B2C753B2BCE40190F95C30ACBA0BF04EBD5B33 ] iagpio          C:\Windows\System32\drivers\iagpio.sys
17:43:59.0411 0x0cdc  iagpio - ok
17:43:59.0415 0x0cdc  [ 9A2A2F3C69B9A30B6E78536F6D258BAD, 5E28E132A7300E6F5E0C6439D6BA00F1AEF66D729FF671FDA91274A25A921463 ] iai2c           C:\Windows\System32\drivers\iai2c.sys
17:43:59.0425 0x0cdc  iai2c - ok
17:43:59.0429 0x0cdc  [ 5A0E850F8CD17791A3E6A3CF81D0CA28, 10A965A49D53360DD250E0758B6BB142872298A21C732EB026ACB93492C5C6CF ] iaLPSS2i_GPIO2  C:\Windows\System32\drivers\iaLPSS2i_GPIO2.sys
17:43:59.0440 0x0cdc  iaLPSS2i_GPIO2 - ok
17:43:59.0446 0x0cdc  [ 7508F1096803385D6376BFD0BD473AC4, 1F32EC23CDC94DCB9710E6663B5C3BD83568545DDC2C741CFC13550A4E4DD2BE ] iaLPSS2i_I2C    C:\Windows\System32\drivers\iaLPSS2i_I2C.sys
17:43:59.0453 0x0cdc  iaLPSS2i_I2C - ok
17:43:59.0458 0x0cdc  [ 16A10CCEDCF5AC4CAAE43DC9FC40392F, F77696AE55B992154A3B35F7660BD73E0AB35A6ECEEC1931C0D35748CFA605C0 ] iaLPSSi_GPIO    C:\Windows\System32\drivers\iaLPSSi_GPIO.sys
17:43:59.0463 0x0cdc  iaLPSSi_GPIO - ok
17:43:59.0468 0x0cdc  [ EB82A11613326691508D9ED9A4FE29E7, 8445E41BAB21964C7F014742795E462BDDC6C37A261990B3D6BF4E637A719547 ] iaLPSSi_I2C     C:\Windows\System32\drivers\iaLPSSi_I2C.sys
17:43:59.0478 0x0cdc  iaLPSSi_I2C - ok
17:43:59.0492 0x0cdc  [ 97E553D03219D3D51705C7235D9EAEBD, 5D4578C8804AF32D1DC0868E34D6538138DC15F9568CA7E21051B1C82C0D8D55 ] iaStorAV        C:\Windows\system32\drivers\iaStorAV.sys
17:43:59.0511 0x0cdc  iaStorAV - ok
17:43:59.0522 0x0cdc  [ 8350FE3BCDE3428BC040877BB7E9EAEB, 77F9456351CA640C6B7862907C0580627E761EC807B551976A95657EB4D6CC20 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
17:43:59.0536 0x0cdc  iaStorV - ok
17:43:59.0547 0x0cdc  [ 3BA03F7C7700DDF4C383DDE9252F5817, 3E90F69D0010E7764349D9AE865D577E431FEBC67DA554B400BC808DD286E203 ] ibbus           C:\Windows\System32\drivers\ibbus.sys
17:43:59.0563 0x0cdc  ibbus - ok
17:43:59.0571 0x0cdc  [ 937AC47F7356554DA05D9722C356EB55, 9EABC9F19B4E1193B669D2674967F5C6F03FAD348EDF0615E3F78554FF9A83CC ] icssvc          C:\Windows\System32\tetheringservice.dll
17:43:59.0586 0x0cdc  icssvc - ok
17:43:59.0670 0x0cdc  [ 79AE3CC82CA1563A4B392207997ACE7C, A1E4A1DA95CA2FA197EF5975657822F0F813F6C33DA38E1FA5A840194034D071 ] igfx            C:\Windows\system32\DRIVERS\igdkmd64.sys
17:43:59.0776 0x0cdc  igfx - ok
17:43:59.0804 0x0cdc  [ F2934208C0E50C0B971A7981AB90BED2, B936BFBBD71E731CC2CDB8B47D262F2EF09726FF921C2DA0841910CA2401423D ] IKEEXT          C:\Windows\System32\ikeext.dll
17:43:59.0836 0x0cdc  IKEEXT - ok
17:43:59.0840 0x0cdc  [ 2A01C96DF5802D3434634E55C91232D8, A3ABEF36E2FD2CF5C371ADBF92566A09669A1D990ABE4677370F57F2EEAF8121 ] IndirectKmd     C:\Windows\System32\drivers\IndirectKmd.sys
17:43:59.0848 0x0cdc  IndirectKmd - ok
17:43:59.0924 0x0cdc  [ 3A2D6740F51BE48C0FD01AD907329DEE, 4FD899CD6E3B3D5C9803E52CB72F002B6CFC144D524FAF6845CF6D115EC6E059 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
17:43:59.0998 0x0cdc  IntcAzAudAddService - ok
17:44:00.0011 0x0cdc  [ 9F7E87F6595D065A8A200A291043045E, 6944F72F73EADC6C9B7691F2C1C6DF1898F22C88EFA78EC0BA8CB5FFD9CE057B ] intelide        C:\Windows\system32\drivers\intelide.sys
17:44:00.0018 0x0cdc  intelide - ok
17:44:00.0021 0x0cdc  [ A6BD2E20AE1BC5CB2776C87C28E4F4CA, BD8BE67CED9A4982D785CE9ECBEFE868C3A2E37DF7F9592B9F9049B807A1554B ] intelpep        C:\Windows\system32\drivers\intelpep.sys
17:44:00.0029 0x0cdc  intelpep - ok
17:44:00.0035 0x0cdc  [ 2A48DA39542636DB0FA3BA915385D1B3, 6CA0916F5F4B1E81AE6A6233276320599BFA7C129267177703E3BB6468FB4683 ] intelppm        C:\Windows\System32\drivers\intelppm.sys
17:44:00.0046 0x0cdc  intelppm - ok
17:44:00.0049 0x0cdc  [ DB32758F3A7F6CCE81A5430080A2EA65, 36A26BAA884E96804F8EA0B12BB3E81BBE6D4EE704809904091445F36CAB5A29 ] iorate          C:\Windows\system32\drivers\iorate.sys
17:44:00.0057 0x0cdc  iorate - ok
17:44:00.0061 0x0cdc  [ FE85D0A86CA7A5A99CF8CD04DE7F80AE, 544C01FC01EE728EB5667158207E5F4418FE77A88BA318192A834722DB766F4E ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
17:44:00.0071 0x0cdc  IpFilterDriver - ok
17:44:00.0091 0x0cdc  [ EF1BB0EF8A12C32DD88C409706B8145E, 7AEDE717C258C29592CC8AEC40F61617E5382646E5141E1C0941882ACE5C5758 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
17:44:00.0123 0x0cdc  iphlpsvc - ok
17:44:00.0128 0x0cdc  [ 450DBDD716C7911F83E05F78EE18BFA2, 43C0DA172F632131898F315A53DEDD1AE99FB0620AB32B3A5B99FEC498C9AAE5 ] IPMIDRV         C:\Windows\System32\drivers\IPMIDrv.sys
17:44:00.0136 0x0cdc  IPMIDRV - ok
17:44:00.0143 0x0cdc  [ F1DAECC3B3D6399875D4F10529D6A77C, 6533D2F858816BE6570C998510919FCA2904EC6EF806F61C1FD325E88133111B ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
17:44:00.0158 0x0cdc  IPNAT - ok
17:44:00.0164 0x0cdc  [ 7475A2903BB704B446AA6309E34D3362, C94643A1626A9716015EBA7041A1224098501EB7DAA704CBFCAD3DC6F3CFC6AF ] irda            C:\Windows\system32\drivers\irda.sys
17:44:00.0177 0x0cdc  irda - ok
17:44:00.0181 0x0cdc  [ 9725E7F0C64CE9916A5CDABE8D6E13C3, 04AF9E48FEF208A2850DF28352E8FDCBF4018982C72C0F67EE12C048C4070116 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
17:44:00.0190 0x0cdc  IRENUM - ok
17:44:00.0194 0x0cdc  [ 8C604213A2E73088BFFE6CD2E6F1AE53, B4C4FEE4D398A29F72EC27D5668071D7E68CD943FFFC38624DD5DF5BEBDF46D3 ] irmon           C:\Windows\System32\irmon.dll
17:44:00.0205 0x0cdc  irmon - ok
17:44:00.0209 0x0cdc  [ 58040898883A96160D41739C80328BBF, 7F85C91C905811416E266A263DDEFCDCB0B45376AAE51B551AB636C16577DB9F ] isapnp          C:\Windows\system32\drivers\isapnp.sys
17:44:00.0216 0x0cdc  isapnp - ok
17:44:00.0224 0x0cdc  [ C9FD02D62E09337B67B0C61EC8CA38CC, DC77E935ECC8474BE9018F0937CB11C137073582B20A0EE107CE247FD9E1F9C1 ] iScsiPrt        C:\Windows\System32\drivers\msiscsi.sys
17:44:00.0236 0x0cdc  iScsiPrt - ok
17:44:00.0240 0x0cdc  [ 210808437570BDDEE71A43535E3A2D30, EF5DE6EE4FF58F44CDE4D4E7F298ABBC9086EC05CC3AE4903060DA878115AC1E ] kbdclass        C:\Windows\System32\drivers\kbdclass.sys
17:44:00.0248 0x0cdc  kbdclass - ok
17:44:00.0251 0x0cdc  [ 0B779E9FC426CA2268D28181FA6C222F, 83292023A688C3044D096F22242EB954B7F7511BE8341D45FF0AFBD9CB9BCB4E ] kbdhid          C:\Windows\System32\drivers\kbdhid.sys
17:44:00.0260 0x0cdc  kbdhid - ok
17:44:00.0264 0x0cdc  [ 813BA3EB2CE038F2A5382DDD75CAD60B, 99FA444027CAC247B54317730D54AB0C4C000AE076B97E47470FDA9834594312 ] kdnic           C:\Windows\System32\drivers\kdnic.sys
17:44:00.0273 0x0cdc  kdnic - ok
17:44:00.0277 0x0cdc  [ 6F8E95716C1A27FF2FE96D30B147F1C1, 9403E9FE8B13EE294CFBBD96649BBD54CF723CF5872E3E03DA4380379D677983 ] KeyIso          C:\Windows\system32\lsass.exe
17:44:00.0286 0x0cdc  KeyIso - ok
17:44:00.0291 0x0cdc  [ 705C0F8BCCEF6E7CB704CCB454192D7E, FC608C708E2C3BF7A66E57B95E19E71E5F5C87EF359D8BC1A817500B45DF9338 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
17:44:00.0300 0x0cdc  KSecDD - ok
17:44:00.0305 0x0cdc  [ 55AD13E2BAFC5AB53A10F8C271F5D242, 058BEF14DCB95574BCAB985F04737BA89483937E8D8A74F7B4CEAFB7400C2397 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
17:44:00.0315 0x0cdc  KSecPkg - ok
17:44:00.0318 0x0cdc  [ 4ED115CD1A1099705F56B5E0FFF97CC6, 9CC49DF2CD6AAAE405BA661D13EFC1E05111D1DE3D1E50C39C425AF1F075610B ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys
17:44:00.0331 0x0cdc  ksthunk - ok
17:44:00.0341 0x0cdc  [ 8125BDF7ADC261F75EF0CAD92456E350, 184797AA1D58C4FF743BA60D48590B88B781EE7779205E45E0679DEC79F3E185 ] KtmRm           C:\Windows\system32\msdtckrm.dll
17:44:00.0359 0x0cdc  KtmRm - ok
17:44:00.0366 0x0cdc  [ 8CCAB08815B50AD78B823DB3F96C8604, 265E6D582EB7207B5CC577D61CB7BC3646F613047F168CD69BB776C37780EBF5 ] LanmanServer    C:\Windows\system32\srvsvc.dll
17:44:00.0384 0x0cdc  LanmanServer - ok
17:44:00.0392 0x0cdc  [ 33DBBCF71F68EA97D9FD34E4C9AB5AC6, 104F04A1560E75EB224A3825707CE51E8798ABD764F5CC3B854FFFC93A39AF60 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
17:44:00.0410 0x0cdc  LanmanWorkstation - ok
17:44:00.0415 0x0cdc  [ F8EBAA1FE6D3BF84752931DE1BFA0E2A, 2F3C512712BA709BBBBD779D9E792DBE324876C402CDCEF0345B8B7ABE1D232A ] lfsvc           C:\Windows\System32\lfsvc.dll
17:44:00.0426 0x0cdc  lfsvc - ok
17:44:00.0430 0x0cdc  [ 5A23E4BE0CCF49663C4CF7EB74C20278, 9DF91014B13B7CED1C3D409F90858FD03EFC5C4347C98901B4DF0AFF2B77845D ] LicenseManager  C:\Windows\system32\LicenseManagerSvc.dll
17:44:00.0439 0x0cdc  LicenseManager - ok
17:44:00.0444 0x0cdc  [ 5933A6673F00D8255C52957E40C2D601, 0AA1281F8B3F97E360592D1B35EE7D3D614F1AB46007F9884CFFB1C5E647575E ] lltdio          C:\Windows\system32\drivers\lltdio.sys
17:44:00.0453 0x0cdc  lltdio - ok
17:44:00.0461 0x0cdc  [ 88A3C935725FA6EA1A228DCC26CF9C6F, 9B1F70644EEFA1EE7CE151A8A970430087339B7A6345F2E0252370929D4AFAC6 ] lltdsvc         C:\Windows\System32\lltdsvc.dll
17:44:00.0477 0x0cdc  lltdsvc - ok
17:44:00.0480 0x0cdc  [ 3F858E28AEE6545FA1B64134DFD5C2CE, FFD7B4FB0A7B61BC6B76A172134673842F2CF00E96FA3ED4A8273DC525B6BB92 ] lmhosts         C:\Windows\System32\lmhsvc.dll
17:44:00.0491 0x0cdc  lmhosts - ok
17:44:00.0496 0x0cdc  [ 8E1B0946948CCC0BC1FA3CB70374A795, 0B894C129A35E223FF9594725AC90916CBD597FAD2211A18FC2AE03EA8679597 ] LSI_SAS         C:\Windows\system32\drivers\lsi_sas.sys
17:44:00.0505 0x0cdc  LSI_SAS - ok
17:44:00.0509 0x0cdc  [ 4F68163FC04C973500DC4DA0946917B0, DF060C29109EB3978CEDFE781999B0C4C1E8C0FDB133428058D8400C53315EEC ] LSI_SAS2i       C:\Windows\system32\drivers\lsi_sas2i.sys
17:44:00.0518 0x0cdc  LSI_SAS2i - ok
17:44:00.0522 0x0cdc  [ E5AC5F2815938651CDCC27F425474673, 3AF0598982153C36A766506FA088F7B84333CC96FEBB050402547AFC613AF9F7 ] LSI_SAS3i       C:\Windows\system32\drivers\lsi_sas3i.sys
17:44:00.0530 0x0cdc  LSI_SAS3i - ok
17:44:00.0534 0x0cdc  [ CCF6EC9FB9B8F18E05B4253E81013E48, EBE8D77FEE8B99BD8C29702404774D554673C96DF3FDF3DCEA9C99E22C2709FC ] LSI_SSS         C:\Windows\system32\drivers\lsi_sss.sys
17:44:00.0542 0x0cdc  LSI_SSS - ok
17:44:00.0556 0x0cdc  [ D5EFC0BAEC21EDE6FE03D377D403B421, 41BE71AF7C896FD4C51EF7E3871AAB769164DFB8050DA43E48C7A100711414B4 ] LSM             C:\Windows\System32\lsm.dll
17:44:00.0582 0x0cdc  LSM - ok
17:44:00.0587 0x0cdc  [ C9579D32219E5B936AC3A48D470117EC, E61A77191B6BA25D29B1221FEBBE826BBC11F825C0E35A72B4CEFFF8B7FE59A8 ] luafv           C:\Windows\system32\drivers\luafv.sys
17:44:00.0600 0x0cdc  luafv - ok
17:44:00.0604 0x0cdc  [ CAAF0CD70FEE7C5110B1E62804E41B17, 48482A6C8D2296C4DC613304637C8DBB7DD1DB39326F27650EBCA6FD2793BCFD ] MapsBroker      C:\Windows\System32\moshost.dll
17:44:00.0616 0x0cdc  MapsBroker - ok
17:44:00.0620 0x0cdc  [ C3CDCCF07486BD2616A7B82946E07AC0, 1EF95DAB2DA856BC7D7573B2EB2D9006DF337F827F0B56A161D0C97F45DB755E ] megasas         C:\Windows\system32\drivers\megasas.sys
17:44:00.0627 0x0cdc  megasas - ok
17:44:00.0632 0x0cdc  [ 2CF0CB2A0ED68C5455371E84C16F9627, 1C9166B52140145F1968E83E52BFF041250811B23C770FE181A18A4BA060CA81 ] megasas2i       C:\Windows\system32\drivers\MegaSas2i.sys
17:44:00.0640 0x0cdc  megasas2i - ok
17:44:00.0653 0x0cdc  [ FADB2FE017E69EECE0E1BA78661C2E8C, BE99B49031D8B4B670B6F6B6E829E54406779CF6F1D8AFE8AB79A73E6764AB2F ] megasr          C:\Windows\system32\drivers\megasr.sys
17:44:00.0674 0x0cdc  megasr - ok
17:44:00.0682 0x0cdc  [ 6D1671CB2E5402F01D2F13ECF764CAA1, 4778630F602FE8F9B9112DC5BB7A179632000D10D80C28E93711404108FCC6E0 ] MEIx64          C:\Windows\System32\drivers\TeeDriverW8x64.sys
17:44:00.0692 0x0cdc  MEIx64 - ok
17:44:00.0695 0x0cdc  [ 55A417C3E41F2A98666CF929EC19108E, A38C262B2863C87E4151525BF26D6AC16E7982D370E2C6998EB15C88C4BC8254 ] MessagingService C:\Windows\System32\MessagingService.dll
17:44:00.0707 0x0cdc  MessagingService - ok
17:44:00.0724 0x0cdc  [ FD60818B66B2E8A5415EA840E99A9D8F, 5D2F22909354534B821D958FBEF6A40EB4F642F53C7B509D00949096EF716F36 ] mlx4_bus        C:\Windows\System32\drivers\mlx4_bus.sys
17:44:00.0746 0x0cdc  mlx4_bus - ok
17:44:00.0751 0x0cdc  [ 68F6977F1CFBAAC770D940A8C0326FA1, 90EE1E7DAC680EAA5AD50E9B0B9FD8FCE8DD6A02D5EF941B5AA5084CBD40BB80 ] MMCSS           C:\Windows\system32\drivers\mmcss.sys
17:44:00.0761 0x0cdc  MMCSS - ok
17:44:00.0764 0x0cdc  [ 0D50B3F3AB32D416786B58D4553859CE, 9DA4D7A30982E8B31C45BDB721AEF5240EAD9DA6839CF34FDDBCF123BF104F2C ] Modem           C:\Windows\system32\drivers\modem.sys
17:44:00.0774 0x0cdc  Modem - ok
17:44:00.0778 0x0cdc  [ 9CCCB7FC3EDADEBA461D78615A6011A6, C120B58F25E8CCFD971EB78645C0682F367AD56DC15F2D8C1980CE75B04719DF ] monitor         C:\Windows\System32\drivers\monitor.sys
17:44:00.0790 0x0cdc  monitor - ok
17:44:00.0795 0x0cdc  [ 27A07B2FB2E3057DA8DAEA4F25D843C7, 09D2B39E6B9AAEC879E5871DD6BCFF2AEF0B894F3B44649665A685F8B3CA6F27 ] mouclass        C:\Windows\System32\drivers\mouclass.sys
17:44:00.0803 0x0cdc  mouclass - ok
17:44:00.0807 0x0cdc  [ 7BD6E7F7C9001AB21B8362CFFEE80B25, C470C3363EEF3A60409A5934988BFB9B72AE7C2BB63CC2C2D006D7EB1C797F6A ] mouhid          C:\Windows\System32\drivers\mouhid.sys
17:44:00.0816 0x0cdc  mouhid - ok
17:44:00.0821 0x0cdc  [ F5BDAEE4B7D369D4C74668DCFBA3FF10, 100F39288E56AFE0D39D1CC235BDC9F3727C873CD3114E092DA7A08810BD3EB2 ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
17:44:00.0829 0x0cdc  mountmgr - ok
17:44:00.0835 0x0cdc  [ E464A0A92E2E354D07DDA713D3E10DE4, D5CF213F03DF54EF9933027A7A7D4413371C1ECBFF61E4DE818D50FA72C8C5FC ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
17:44:00.0843 0x0cdc  MozillaMaintenance - ok
17:44:00.0848 0x0cdc  [ 30844BD376F9D01E62C820BEF446F1F8, 910D672EDB544A20AEB4450B4D89830F46EDD28CE0021156176315C5D068A1B4 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
17:44:00.0858 0x0cdc  mpsdrv - ok
17:44:00.0875 0x0cdc  [ 779CFDB17EA07A6D26FEBBAC95B65772, 74D9542E8DCCD07396A45A45D2F500AA6F9DCC1DB785A6153EB3067E42F576A4 ] MpsSvc          C:\Windows\system32\mpssvc.dll
17:44:00.0906 0x0cdc  MpsSvc - ok
17:44:00.0912 0x0cdc  [ 25D32BE04FE0A23FDF57FD5382757672, 64E39E3E21D9173FB1116B989D80C244C49DA827698A05AF5CC5CD1C6AE155DE ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
17:44:00.0924 0x0cdc  MRxDAV - ok
17:44:00.0935 0x0cdc  [ E671EDAB0726E05ECEF4058B4CD73C4D, 9F4C50E635CE2204E3291C8D3D7F658A969E80722B8B6F0304228D9B434C20EA ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
17:44:00.0950 0x0cdc  mrxsmb - ok
17:44:00.0958 0x0cdc  [ D4D12BC29DE0F09280868FDCA65B3474, A6FE89ABD52087FEE52FDF31DDF4CB627ED400E94FDA86BEBF1D4763F1E42518 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
17:44:00.0973 0x0cdc  mrxsmb10 - ok
17:44:00.0988 0x0cdc  [ 93A77008A8932FC84A173C4E97E52874, B7510CF7998C538D68BD2ECDC512A0BFC7CB7362F598EE4110F728427AFF0F5A ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
17:44:00.0999 0x0cdc  mrxsmb20 - ok
17:44:01.0008 0x0cdc  [ 74C9D21523DAE0C18F413C196DF0058A, 3DB4B8CA368D9DD82FAE2C2BC828A21142C8D29780A7C8667188C447519FF702 ] MsBridge        C:\Windows\system32\drivers\bridge.sys
17:44:01.0019 0x0cdc  MsBridge - ok
17:44:01.0031 0x0cdc  [ 308F08347923DEEDE7BC03EC7D485841, 72DB45CA11FE635DF9F8273C38CBEFB8DF5362ADA0CBF6D2B1E570365DC700C0 ] MSDTC           C:\Windows\System32\msdtc.exe
17:44:01.0043 0x0cdc  MSDTC - ok
17:44:01.0050 0x0cdc  [ F01B849D9D4A8CEAF32D4FDBD0B83C92, D2473AC4C6E6C03DEF13EA73EC78FB878BDC95C047651BF79A16C9DEA82AD046 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
17:44:01.0067 0x0cdc  Msfs - ok
17:44:01.0078 0x0cdc  [ 22ECD8F5D1DFADF2011BBB1700CB871D, 8F9EFF51137394EFA5471B8A29C541710063B65806B075B4925A84D5B6BC3BBB ] msgpiowin32     C:\Windows\System32\drivers\msgpiowin32.sys
17:44:01.0085 0x0cdc  msgpiowin32 - ok
17:44:01.0088 0x0cdc  [ FD870F6968A145E4D2BA8A8842686B03, 34B8F601F3B5E42B4D0A41E2AF7DB4EB4E5B627DA8DA9A2A2D46B153AF23AEB1 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
17:44:01.0097 0x0cdc  mshidkmdf - ok
17:44:01.0100 0x0cdc  [ 30364757963A028CE5DF0FBAAC270173, C72588A6A52FF8E418A15D2C407A4DB7EA768585423720145F8253D5CA519DC2 ] mshidumdf       C:\Windows\System32\drivers\mshidumdf.sys
17:44:01.0108 0x0cdc  mshidumdf - ok
17:44:01.0112 0x0cdc  [ 6BB0FEDDAE7135FA37FFAFF4D9E0E876, B41A3C0FFDFC493D6325ED493445AFCED04EC9DFF2B38125616FC5419AD1ACC4 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
17:44:01.0119 0x0cdc  msisadrv - ok
17:44:01.0124 0x0cdc  [ 07E3E54734B14F43A4A95A849C0A0DE2, 314AA02EA84D267B32DBAEBEA6C1AC1A266DED1E8D35A17B41D1D2AC75E8049E ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
17:44:01.0136 0x0cdc  MSiSCSI - ok
17:44:01.0139 0x0cdc  msiserver - ok
17:44:01.0142 0x0cdc  [ 13D614E6B51ECF36746C48CE829FA7F6, CAD63C0A4F7110093F84C58252C5803F14E3FC46584B79DA17EC86D49FEAEA64 ] MSKSSRV         C:\Windows\system32\DRIVERS\MSKSSRV.sys
17:44:01.0155 0x0cdc  MSKSSRV - ok
17:44:01.0160 0x0cdc  [ 642CDE46351D5D2D90311E77072AB46D, B2D3033E607BA2F6E6B9CFB1CBF154CD0CE910EA473C56343EC81B9B94044CCA ] MsLldp          C:\Windows\system32\drivers\mslldp.sys
17:44:01.0170 0x0cdc  MsLldp - ok
17:44:01.0173 0x0cdc  [ F2302A5CE63CA7673200FAFCEEEDB6AF, B8C44FC2DC0332183DE325CDBF511101F3307225295EDD428CE575A8DE15C223 ] MSPCLOCK        C:\Windows\system32\DRIVERS\MSPCLOCK.sys
17:44:01.0186 0x0cdc  MSPCLOCK - ok
17:44:01.0189 0x0cdc  [ 6114512EA26E835BA522C63635429DB5, 0F91CE41B4555316A79AEF3047C152D538CC9C7C329987C9FD0E3D961AFC87C8 ] MSPQM           C:\Windows\system32\DRIVERS\MSPQM.sys
17:44:01.0202 0x0cdc  MSPQM - ok
17:44:01.0211 0x0cdc  [ AA538E16E644D00E3BA5349BBA9598EC, 64A68B06883FE7ED34E04AB119BA819753F1222923EDD4E802C35D402B89D075 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
17:44:01.0224 0x0cdc  MsRPC - ok
17:44:01.0231 0x0cdc  [ 7ACFE7435317E791FF9EED2F49B402F2, EAF2CE12403A9D975112A22EDBC313EE63B926C070B35E62D515403DD34BD88D ] MsSecFlt        C:\Windows\system32\drivers\mssecflt.sys
17:44:01.0241 0x0cdc  MsSecFlt - ok
17:44:01.0244 0x0cdc  [ 0543BEFD41EC4D25C7F7CF36409CEC7D, 631622CFEC49952C0470531B23FFFFF483DC0EFFEF7A97B1179A600392C05DDD ] mssmbios        C:\Windows\System32\drivers\mssmbios.sys
17:44:01.0252 0x0cdc  mssmbios - ok
17:44:01.0255 0x0cdc  [ C1569E4DB8EFE3617847BF041A3C842F, 99ADE5E7F50E04CAEC737F7F90741CCA8EE628996BA5EB6C6BC62184884429B6 ] MSTEE           C:\Windows\system32\DRIVERS\MSTEE.sys
17:44:01.0268 0x0cdc  MSTEE - ok
17:44:01.0271 0x0cdc  [ 130B16970154BA9876B09E5C4BAC63BE, BE3AF8FC5A26AB9C9DBA9C015C2E1FD3C4CD9CB423A2BBDABA91428BF8620553 ] MTConfig        C:\Windows\System32\drivers\MTConfig.sys
17:44:01.0280 0x0cdc  MTConfig - ok
17:44:01.0284 0x0cdc  [ 15D987C8F6CCD4AC94E070C5986762CB, 452FB0C48B86C7F8F53794CC2DDBF2B900B03A0383B2DE8F6A830F8CB0AFBAD8 ] Mup             C:\Windows\system32\Drivers\mup.sys
17:44:01.0293 0x0cdc  Mup - ok
17:44:01.0297 0x0cdc  [ 3D2C5B4995CA0751D32DEA0DE9FDFE44, A26958785FD9E05E2CA97078C9BB277CD44222BF5F7D9E8DC2F3F6AAAFFC6483 ] mvumis          C:\Windows\system32\drivers\mvumis.sys
17:44:01.0306 0x0cdc  mvumis - ok
17:44:01.0318 0x0cdc  [ DB31EBB04C871F422C36A0962DA7D38B, B1BC2344744F537FB2C7D07B415F860195B7795E185253F05C0817A3764FEC10 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
17:44:01.0339 0x0cdc  NativeWifiP - ok
17:44:01.0345 0x0cdc  [ C3D9870E680D9D843B18F4626C3858FE, 43596CAC9FB488F810FBA954C52BC4D13F7D32028C40ACFE33DFD7EE36A65C17 ] NcaSvc          C:\Windows\System32\ncasvc.dll
17:44:01.0358 0x0cdc  NcaSvc - ok
17:44:01.0366 0x0cdc  [ 04CE2C0F0759EACD886BA4B658B60D5D, E34D0976FC5936C8629800D826DB127072D1DFC3D350EFACA3AA1B8119551762 ] NcbService      C:\Windows\System32\ncbservice.dll
17:44:01.0383 0x0cdc  NcbService - ok
17:44:01.0387 0x0cdc  [ E6094065008FE423377294050E7CEA2D, 86E200227256407530E2C28243DEFBC3CB6E9497644404D9AD79DA242286DF7B ] NcdAutoSetup    C:\Windows\System32\NcdAutoSetup.dll
17:44:01.0404 0x0cdc  NcdAutoSetup - ok
17:44:01.0409 0x0cdc  [ 629CB21AC49C8867E0F29DF1C16DB7B4, 20663E68C69D0A1A2FE99A0C2A9DEFABF49786A1DC8F7F4E1699458AF57D7E79 ] ndfltr          C:\Windows\System32\drivers\ndfltr.sys
17:44:01.0419 0x0cdc  ndfltr - ok
17:44:01.0443 0x0cdc  [ D5564FC81350458ED570528C4E3B1CCF, DD3C5012492EF9BCE3BE635BBB3AA40B3C5F5FDBD795A76B327D9C994102AC2B ] NDIS            C:\Windows\system32\drivers\ndis.sys
17:44:01.0472 0x0cdc  NDIS - ok
17:44:01.0477 0x0cdc  [ 6DD605338FAAF6BA17662AA874E0D162, 636607829F5D7C3B7A4683C0A2DD594360D72F2AA3F8710153BE32575AE34A15 ] NdisCap         C:\Windows\system32\drivers\ndiscap.sys
17:44:01.0486 0x0cdc  NdisCap - ok
17:44:01.0493 0x0cdc  [ E34196F285F8B8879E1FF36C31F7179E, 77A4F24F995D4C0689C43F9956E08DCEC62517E4F8B1B9EAA1852B5293DB5B9A ] NdisImPlatform  C:\Windows\system32\drivers\NdisImPlatform.sys
17:44:01.0508 0x0cdc  NdisImPlatform - ok
17:44:01.0510 0x0cdc  [ 1FAD2398673F30CEC616B89C46B7DCBA, 70302049E6AE2BC6B3A7A9DE54D3F940AD6A9771CC2EBCCEC65994E67A25ECB5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
17:44:01.0523 0x0cdc  NdisTapi - ok
17:44:01.0527 0x0cdc  [ AEB8ECBE66CC46854066CB1F5623E179, 2F650A85A9DAE38887610C0B876621035616CEDB65D4BBBD7F1405616D218AAF ] Ndisuio         C:\Windows\system32\drivers\ndisuio.sys
17:44:01.0537 0x0cdc  Ndisuio - ok
17:44:01.0540 0x0cdc  [ 7340104C2BF2F126714F7CDE85E63610, 45B64EC6F3A4C43F7D74806789067658C6EF0D44D36B841F4D26E1EBC95AF66C ] NdisVirtualBus  C:\Windows\System32\drivers\NdisVirtualBus.sys
17:44:01.0549 0x0cdc  NdisVirtualBus - ok
17:44:01.0555 0x0cdc  [ 07ADC1F8DCBEB8104D75129B11584B8C, CB51A294D9FD4E210DBEEF05A1E60A96CE52D6D138EF62A54E1F608F90FED300 ] NdisWan         C:\Windows\System32\drivers\ndiswan.sys
17:44:01.0572 0x0cdc  NdisWan - ok
17:44:01.0578 0x0cdc  [ 07ADC1F8DCBEB8104D75129B11584B8C, CB51A294D9FD4E210DBEEF05A1E60A96CE52D6D138EF62A54E1F608F90FED300 ] ndiswanlegacy   C:\Windows\system32\DRIVERS\ndiswan.sys
17:44:01.0595 0x0cdc  ndiswanlegacy - ok
17:44:01.0599 0x0cdc  [ 78A12E3DF035B5D054986949B19BE43C, AD9B34F89B9F27D473BD5FCE6694A40FCCB808B61ABEDD6F70F1AF6C7E73ABF8 ] ndproxy         C:\Windows\system32\DRIVERS\NDProxy.sys
17:44:01.0613 0x0cdc  ndproxy - ok
17:44:01.0622 0x0cdc  [ 04C8859355C1DC9C0FA198D1894D71C2, E7C67E73009341B5D402470C686781B3C7BBE2531CE26665E08E711B990B1A77 ] Ndu             C:\Windows\system32\drivers\Ndu.sys
17:44:01.0637 0x0cdc  Ndu - ok
17:44:01.0643 0x0cdc  [ 6C76780A01FC2B885BD6E957B5C36B02, DB7834F03A765F65C773E772D8051AFADB22CA4B5074180AA397857A0C47A068 ] NetAdapterCx    C:\Windows\system32\drivers\NetAdapterCx.sys
17:44:01.0654 0x0cdc  NetAdapterCx - ok
17:44:01.0658 0x0cdc  [ 5D1513BD6430307C9DB86C6E351372ED, D2AB709CF7CFA5B857B084AFC821914A975B7DDDCE154229981F19448973BD6D ] NetBIOS         C:\Windows\system32\drivers\netbios.sys
17:44:01.0666 0x0cdc  NetBIOS - ok
17:44:01.0680 0x0cdc  [ 6FEBB0A847FFD5F057B9AC8889F1B9A7, 558BCC64C59079E6569F61CCE1219A124B3313FC4E6CB5CBCC94124D202FF19D ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
17:44:01.0694 0x0cdc  NetBT - ok
17:44:01.0701 0x0cdc  [ 6F8E95716C1A27FF2FE96D30B147F1C1, 9403E9FE8B13EE294CFBBD96649BBD54CF723CF5872E3E03DA4380379D677983 ] Netlogon        C:\Windows\system32\lsass.exe
17:44:01.0710 0x0cdc  Netlogon - ok
17:44:01.0723 0x0cdc  [ D3BF2DA9216A4CF22A97820A50A67EFF, D00CBE0A7ECFB449D9B48967A01EE56141404EBE229893D5A1710781AD5F2551 ] Netman          C:\Windows\System32\netman.dll
17:44:01.0739 0x0cdc  Netman - ok
17:44:01.0756 0x0cdc  [ F2645D51DD8AABC8BC72358409410437, 8CB97628923D6CEA6EFAD7E666BE92C154060BD108C28D46287A520A14B18ADA ] netprofm        C:\Windows\System32\netprofmsvc.dll
17:44:01.0778 0x0cdc  netprofm - ok
17:44:01.0787 0x0cdc  [ D65F295A049473E6A39EA9A0EA76CA32, 274FC0BA044EB2D14093AB0E561F7FACEE06A3F433C81343C8B926FA2F9BD251 ] NetSetupSvc     C:\Windows\System32\NetSetupSvc.dll
17:44:01.0803 0x0cdc  NetSetupSvc - ok
17:44:01.0817 0x0cdc  [ EFA857E2B0CC7C9DFEF48A2187B910F7, 424475568CD70237F056838388A5F7BDCD1B09349085498644C75940B12E8EAF ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
17:44:01.0826 0x0cdc  NetTcpPortSharing - ok
17:44:01.0835 0x0cdc  [ B996DE26A2E16053C9485F5905B05320, 30EB2CEB466A4F05A44F7CBFCDFD8CC3C27B5FCF1269C1B9410C48AB362D2A75 ] NgcCtnrSvc      C:\Windows\System32\NgcCtnrSvc.dll
17:44:01.0851 0x0cdc  NgcCtnrSvc - ok
17:44:01.0870 0x0cdc  [ 54C31C2B815E2E26BB8158022F837C9C, CED660D1A58F635C6452F82FCB2EF8ACEEB7785E31617B2ADFD9EE69A2BDF2B8 ] NgcSvc          C:\Windows\system32\ngcsvc.dll
17:44:01.0902 0x0cdc  NgcSvc - ok
17:44:01.0911 0x0cdc  [ 9B9F520C72EE33EAEC857124BB800243, DFA9386B272F4D86F3E4BE861A2FC4617261E1AA40576DDA610FC24AB4961A63 ] NlaSvc          C:\Windows\System32\nlasvc.dll
17:44:01.0929 0x0cdc  NlaSvc - ok
17:44:01.0934 0x0cdc  [ 001CBD7A2CD45C4EB39C01C3C677EF73, F4AAF4D60DB1232921C7811A62287B55C7C098B7A1FF9A40D88AF58A5ABECBA2 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
17:44:01.0943 0x0cdc  Npfs - ok
17:44:01.0947 0x0cdc  [ 90F5DC9802AAA00CD0B6E2AD9E7FFADC, 71C0777829299DECA6ACD42F38802DBE3C29A42CFBD8A396F39DFA44D1F55B6C ] npsvctrig       C:\Windows\System32\drivers\npsvctrig.sys
17:44:01.0956 0x0cdc  npsvctrig - ok
17:44:01.0960 0x0cdc  [ 1993C85962692EF7024501E7FE92D466, F5BCAA8308495EBF8BB061C2015E07C202A779668D171364D7E312975BC18B10 ] nsi             C:\Windows\system32\nsisvc.dll
17:44:01.0971 0x0cdc  nsi - ok
17:44:01.0974 0x0cdc  [ 0C6218321A09A7B51BA7FFAFBA4CCB21, 330B3FA793A78410B28DFC8250BBF24442E3BB80434A7938BB96F02337614E0D ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
17:44:01.0983 0x0cdc  nsiproxy - ok
17:44:02.0065 0x0cdc  [ DB69C6DA8B3DDFDC547D455CA23A8250, AE495CEB18924C8B21F7F150FF17CD00880F2E222D7B5155661798E0535D63C4 ] NTFS            C:\Windows\system32\drivers\NTFS.sys
17:44:02.0117 0x0cdc  NTFS - ok
17:44:02.0123 0x0cdc  [ 6E6DD6F9DD2A034CF85E94047DBDB992, 63D0A0756F551B7668D1CBAB24B29FD462C706E8A81690BC248D6C92061FE215 ] Null            C:\Windows\system32\drivers\Null.sys
17:44:02.0132 0x0cdc  Null - ok
17:44:02.0137 0x0cdc  [ D261DF41F0840F734856A2B4F5E072C7, 2E703556D0C919375D0B7770513456844B13362190643D5524663EC8546E0FF5 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
17:44:02.0147 0x0cdc  nvraid - ok
17:44:02.0153 0x0cdc  [ 23B702B555EB0436B9DAA0BC63DA65CE, D454F80D9657CFEC852F022C12D7B2C1A2D7D247ECC591EDB07B9369DFD8C99E ] nvstor          C:\Windows\system32\drivers\nvstor.sys
17:44:02.0162 0x0cdc  nvstor - ok
17:44:02.0171 0x0cdc  [ 17997DC2441F7E29CDFC6458E0392764, 636CCE2DA1EF8195B33F8D6D5C8CC151D58EBF08DC9AD8ACCCE7ABD41A69639F ] OneSyncSvc      C:\Windows\System32\APHostService.dll
17:44:02.0188 0x0cdc  OneSyncSvc - ok
17:44:02.0198 0x0cdc  [ 4578ECA1FCEF4E7C787D84F78625143B, F5FE84D6D7412A4C037772593C434253D590E476B0B7498987A1697BED86A510 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
17:44:02.0215 0x0cdc  p2pimsvc - ok
17:44:02.0225 0x0cdc  [ 2BBCED66D7AFC968BDBB0E4D8524DF0A, 762D916390F9DE69B3EA1D31244224F910645F8E5CEF4C505B76B215BFDFCD9A ] p2psvc          C:\Windows\system32\p2psvc.dll
17:44:02.0245 0x0cdc  p2psvc - ok
17:44:02.0251 0x0cdc  [ 6B81BF7853D161DB8AC62CD8B9C2DE6B, B2DC06D135FD2501217DDA7349556EB873309E02188D4C3901807BA24FAB30C7 ] Parport         C:\Windows\System32\drivers\parport.sys
17:44:02.0262 0x0cdc  Parport - ok
17:44:02.0267 0x0cdc  [ CDBD029BAEC8D09F6FBD404632D9AF28, 71F4401150CD4C9C6BBF2DA854CF07EA2F8C9BBE900833858F49134DDAF14414 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
17:44:02.0276 0x0cdc  partmgr - ok
17:44:02.0287 0x0cdc  [ CDD8EDF4C35BE6D6137112F5CC7A70DA, 80EECA6BC2E668E5652A5CA9B119CCCE2A2E421F0EED1FD0EAC20C42E77C02ED ] PcaSvc          C:\Windows\System32\pcasvc.dll
17:44:02.0304 0x0cdc  PcaSvc - ok
17:44:02.0312 0x0cdc  [ E2DD2E5BDCCD225670831B439826065B, 0153F1CE26D402C03CFC155F428EBA04D6EA8E19A28AF629B1CE347363B7697C ] pci             C:\Windows\system32\drivers\pci.sys
17:44:02.0324 0x0cdc  pci - ok
         

TDSSKiller Teil 2

17:44:02.0327 0x0cdc  [ 214DCC87E3898F738075D1341252A552, E721FBBC3510DDB848A8CAEA3B6031EE988F42252DBC3BF7BDB6ABD9A0D9FABD ] pciide          C:\Windows\system32\drivers\pciide.sys
17:44:02.0334 0x0cdc  pciide - ok
17:44:02.0339 0x0cdc  [ AED76A3333B3A31536E430020E0226FC, EC255B79B0908E3C142D92E35B79D90A3F2594BA012CA2B1B04A6A8745153430 ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
17:44:02.0349 0x0cdc  pcmcia - ok
17:44:02.0352 0x0cdc  [ E63FB38B6E75B39467492FBAD2CD512A, DB406C92BA2460C833A49B98EB5BD58348E868F643A0123B0C9B5315FFC6A124 ] pcw             C:\Windows\system32\drivers\pcw.sys
17:44:02.0360 0x0cdc  pcw - ok
17:44:02.0364 0x0cdc  [ 9EA203A07EFA6D74F07F32EF0DAB5CA6, D851F1CC748B4CD0E263931668FFF2FE20D5778267F4FF2237D565CFC171B5AF ] pdc             C:\Windows\system32\drivers\pdc.sys
17:44:02.0374 0x0cdc  pdc - ok
17:44:02.0389 0x0cdc  [ 1509A77F840AA9E72CF8247D0CF2FBDE, 2D47AD4D8F5C2D871E603FB6D72D25EFD0E63FA3A542DAADAB9D82ED074C0E0B ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
17:44:02.0419 0x0cdc  PEAUTH - ok
17:44:02.0452 0x0cdc  [ 2B55ACB1727A8E5E7514D2D75AC4EBEB, 5E7449F3EE0B15E400E405DE561ED2D3932259107A9D9320AE42CA1A5C5AB992 ] PeerDistSvc     C:\Windows\system32\peerdistsvc.dll
17:44:02.0507 0x0cdc  PeerDistSvc - ok
17:44:02.0513 0x0cdc  [ 540116170E2135FCD5DDE77702166B67, CBEC51C2D47532F1781B3255040F303263420B204C2F8BB2B5D1EC342F57B285 ] percsas2i       C:\Windows\system32\drivers\percsas2i.sys
17:44:02.0521 0x0cdc  percsas2i - ok
17:44:02.0524 0x0cdc  [ 8356F87553BF49C703CF382033815898, 245EB941566D848F134629690BF271B1CBEAB6440771D3D8D7AED3756835354E ] percsas3i       C:\Windows\system32\drivers\percsas3i.sys
17:44:02.0532 0x0cdc  percsas3i - ok
17:44:02.0545 0x0cdc  [ CB5343FF52A702A9ACFAAE6BE972FE09, EAA5362D91D05D382DF4EBBAA3FD575456F23CAD531CC6F1270F8254892DBF02 ] PerfHost        C:\Windows\SysWow64\perfhost.exe
17:44:02.0556 0x0cdc  PerfHost - ok
17:44:02.0576 0x0cdc  [ D0D57322ABC7473E54472D8374169CC5, BD14A13D6908C8669E56EF9401FD8A3D7C618E8B6556B36E634864E733BCA4B2 ] PhoneSvc        C:\Windows\System32\PhoneService.dll
17:44:02.0604 0x0cdc  PhoneSvc - ok
17:44:02.0611 0x0cdc  [ B4AB2C0177715FFAED88A1223212043A, 1920792ADC78DD51EF98B6A9634D686EAED0848FB7EF74A0DCD3AEBA5AF41EC6 ] PimIndexMaintenanceSvc C:\Windows\System32\PimIndexMaintenance.dll
17:44:02.0626 0x0cdc  PimIndexMaintenanceSvc - ok
17:44:02.0658 0x0cdc  [ F931F21E4287FE3ECCF09B54A232BBA2, CEB7AB3236E5F30214027092B7B695ED35F7A1E007DF4046797D1E4DFEF49EC8 ] pla             C:\Windows\system32\pla.dll
17:44:02.0702 0x0cdc  pla - ok
17:44:02.0708 0x0cdc  [ FEA494AC3A1BAE63C1F2AF267D49F1DB, 0722FEA2481740B53EF26B1CA59166C63C157A5C708AC93DF3FBB74A27266C9C ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
17:44:02.0725 0x0cdc  PlugPlay - ok
17:44:02.0729 0x0cdc  [ 56D7A89423325121C4A9BD5C326414F3, 649048C23D1973C3504E26B35362AC99DFE9BF31FFE73F45B43306A212AEA34C ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
17:44:02.0739 0x0cdc  PNRPAutoReg - ok
17:44:02.0759 0x0cdc  [ 4578ECA1FCEF4E7C787D84F78625143B, F5FE84D6D7412A4C037772593C434253D590E476B0B7498987A1697BED86A510 ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
17:44:02.0777 0x0cdc  PNRPsvc - ok
17:44:02.0792 0x0cdc  [ F70CAC34B455D05EAA04B2F8FB58E1CB, 295BFFB3DA03C5CE5462C11D3240024B68AC06E8DEA9062A739BE2CCEE19EB5D ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
17:44:02.0811 0x0cdc  PolicyAgent - ok
17:44:02.0818 0x0cdc  [ 60C8376B48BA96F07AEA536527433D44, EB988C119C3E71169B91ED2A744C71933DD35447DC4A8249E80EC24E9E7077D4 ] Power           C:\Windows\system32\umpo.dll
17:44:02.0832 0x0cdc  Power - ok
17:44:02.0837 0x0cdc  [ 5645B9D9788CCA2C88B9534996ED2D6D, 4988942DF163DB5B9B1A08CE6B628D2C47C2E2EAA30AEAE4EFE21C8CF4C8DC5D ] PptpMiniport    C:\Windows\System32\drivers\raspptp.sys
17:44:02.0852 0x0cdc  PptpMiniport - ok
17:44:02.0908 0x0cdc  [ 7196D3C2E2E3129814C8DAB91F9A7D1E, 6763E4BF8E846B597E78778E520F5BADC95608BAA4EA0AC84971384B5D976DD7 ] PrintNotify     C:\Windows\system32\spool\drivers\x64\3\PrintConfig.dll
17:44:02.0994 0x0cdc  PrintNotify - ok
17:44:03.0004 0x0cdc  [ 372913E12677A8CBBBABDD8311894F9D, A5233D95A0D22D2A9DB214E7CB79A99D389B67189FF6A87D0AD4610A333A637F ] Processor       C:\Windows\System32\drivers\processr.sys
17:44:03.0015 0x0cdc  Processor - ok
17:44:03.0025 0x0cdc  [ 1F115AF75EFBAC28479B4F94A3F8D4A3, BE8D8C50D985F6AF9DDC0F13BDBE2D55D600E1F5E344982536538B14EC484AA6 ] ProfSvc         C:\Windows\system32\profsvc.dll
17:44:03.0045 0x0cdc  ProfSvc - ok
17:44:03.0054 0x0cdc  [ FC98407B85A31161851FDE245517574F, 2CCD706CF243934FCDA32B24CE0C385EA2E67F206E0306FA584496F583A20CD1 ] Psched          C:\Windows\system32\drivers\pacer.sys
17:44:03.0063 0x0cdc  Psched - ok
17:44:03.0070 0x0cdc  [ 7A68710BAC9B6809314B86C0CB1CBC4A, C02D97993D1F6FE6EFBA5B1366B3A4FE8CE1136A95F3A2DA07BA59554C163501 ] QWAVE           C:\Windows\system32\qwave.dll
17:44:03.0086 0x0cdc  QWAVE - ok
17:44:03.0090 0x0cdc  [ 819602BBBFDB0BD46DEA3715BF0DD452, D4007FF1E5296316B53436CA3598D6B1CF4F60AB77D5B02F3E595081EDD5D879 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
17:44:03.0099 0x0cdc  QWAVEdrv - ok
17:44:03.0102 0x0cdc  [ CDF47037A0939F56D11F699629C276AD, A63F2A3FE80FB8084E3870E907505694B79EE1D9E56E292C01D481FEFD2534B0 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
17:44:03.0110 0x0cdc  RasAcd - ok
17:44:03.0116 0x0cdc  [ 28C2EA278070EE12701D0EDF8CB0EC36, F10288C1C6835840026DB30285345EF892DE989F43C948E7F4760B8895FF675F ] RasAgileVpn     C:\Windows\System32\drivers\AgileVpn.sys
17:44:03.0126 0x0cdc  RasAgileVpn - ok
17:44:03.0131 0x0cdc  [ 7B82197BF35CC3BE59AEF8B706AB8A16, AB0216164A548A48CD21F5F035E57E867584A96890B9887EC08F8DABDD89F990 ] RasAuto         C:\Windows\System32\rasauto.dll
17:44:03.0143 0x0cdc  RasAuto - ok
17:44:03.0147 0x0cdc  [ 17E565710172ED71B8531D8822E1C5D1, 0CA39ABD9E544DDAD9D9D7D1FC50444274C31E18F9BF73069051D9F62833698F ] Rasl2tp         C:\Windows\System32\drivers\rasl2tp.sys
17:44:03.0161 0x0cdc  Rasl2tp - ok
17:44:03.0174 0x0cdc  [ F79BFB5588B777C71734C1D1EC129D07, 9B9D70EC8978AAC19B2B94694EE1B9957C13DFDDFCBE8AA82C5F0D0EA04CDBDF ] RasMan          C:\Windows\System32\rasmans.dll
17:44:03.0200 0x0cdc  RasMan - ok
17:44:03.0206 0x0cdc  [ 9387DF155233D45D4E010F4F2FB52A57, CABC25DA4E512809AED0085767BDD94BF3C1DA792BFF8A009B5465D9110E7060 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
17:44:03.0216 0x0cdc  RasPppoe - ok
17:44:03.0220 0x0cdc  [ F0F4EEDEEBEE7A4244FAFB96A16B5712, F64717E601BD5EB674003009507B8CDD6F69F00E8670D6895EC64786166A0E8D ] RasSstp         C:\Windows\System32\drivers\rassstp.sys
17:44:03.0235 0x0cdc  RasSstp - ok
17:44:03.0245 0x0cdc  [ AF6963414B820B7C45578ED3300438A7, C00F60FD72608E6983D32642768AECE891DD816FADFA7B872BA88091C16B95D7 ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
17:44:03.0260 0x0cdc  rdbss - ok
17:44:03.0264 0x0cdc  [ 79A415E6FA915EFC00297DAB16EC2635, 47BB49F6D756214193D38A4AB182B541AAC180381C3111FF7F9B0AD4C44D8733 ] rdpbus          C:\Windows\System32\drivers\rdpbus.sys
17:44:03.0273 0x0cdc  rdpbus - ok
17:44:03.0279 0x0cdc  [ 7135785C21CA79D270D11037C43D3F19, 654A3C65CF891ED8C82A740D10CF607FC7D709185E664DE03288CEB5B25F03A6 ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys
17:44:03.0292 0x0cdc  RDPDR - ok
17:44:03.0300 0x0cdc  [ 97A61A3CB2B5CB4FC32B3224EF333448, E4F2E8BCEE3639BE57BBC8A8E67FDE42C3A5158F1204684B0ECD216F4AA044A3 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
17:44:03.0307 0x0cdc  RdpVideoMiniport - ok
17:44:03.0314 0x0cdc  [ 69BB204AE07EE84ECFAB1BF13C4BD04B, 1CA832CBF4AE4821EEA2A19F9519C2D1D00406B8CCE2A86FE3B33A5F293DB218 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
17:44:03.0326 0x0cdc  rdyboost - ok
17:44:03.0343 0x0cdc  [ 940D6F5A2B0A61EE4170DF84F6C95C20, F8EE846DC8015EDFE7CB5BEEDC977EAA9C586BAC2216DE69D8ECCBDBC7408649 ] ReFSv1          C:\Windows\system32\drivers\ReFSv1.sys
17:44:03.0367 0x0cdc  ReFSv1 - ok
17:44:03.0379 0x0cdc  [ 13F6B64235C60167052364BF7D99E4CA, BC12EE00775F7456FB922FBD684BF3F0CFABA5BEBB6E162C23B41DED5C20A978 ] RemoteAccess    C:\Windows\System32\mprdim.dll
17:44:03.0400 0x0cdc  RemoteAccess - ok
17:44:03.0406 0x0cdc  [ 3183B161B1F05333F6C325577FEF3596, D6A89B2A021377B6F371E5B9EFC36FF018822B28F0ED41F8CD2F00C5C8605707 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
17:44:03.0430 0x0cdc  RemoteRegistry - ok
17:44:03.0454 0x0cdc  [ 0660F4A14F9D2A2F59B26B1D74F1A6D0, A9443B6B7ED1ECA22AC960A2C6A2BE18C0BA58CD7BCF60E7AA617CD3662D122D ] RetailDemo      C:\Windows\system32\RDXService.dll
17:44:03.0479 0x0cdc  RetailDemo - ok
17:44:03.0485 0x0cdc  [ 5DAA644F17780FC4E3F4820A46D38FEC, 32C27FFA0A4608B164F4E709CD0D998AB73CA9713BE3E47F9DBC7B3D1B6C7453 ] RmSvc           C:\Windows\System32\RMapi.dll
17:44:03.0499 0x0cdc  RmSvc - ok
17:44:03.0505 0x0cdc  [ 672724C8B21B7DC56646045DE4D5B860, 79986E80A92C949C543959F1E35647A9788DAB2892AC20B6DEA5C0BBC0CEDE9E ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
17:44:03.0518 0x0cdc  RpcEptMapper - ok
17:44:03.0521 0x0cdc  [ 109C1D609951E886D3643B15C1EDD1C2, 347D8E7C50EC7F96217C7421D9BC8A42C9DF50B94169CB58DCF857A63C33C2EA ] RpcLocator      C:\Windows\system32\locator.exe
17:44:03.0530 0x0cdc  RpcLocator - ok
17:44:03.0548 0x0cdc  [ 7BD259FC59CF9C2AE1B979564B374CC6, 299832FCE304A85080C80ABFE820A6093AC15A7C1E7C89D8C946708E955A2909 ] RpcSs           C:\Windows\system32\rpcss.dll
17:44:03.0579 0x0cdc  RpcSs - ok
17:44:03.0585 0x0cdc  [ 5FF28F097C9699097B473F8FC7C1AA7D, 695560F1DBD85073F3D6CB1FF16F16504CA044EA62E940E463A16BBA8B86E2FA ] rspndr          C:\Windows\system32\drivers\rspndr.sys
17:44:03.0595 0x0cdc  rspndr - ok
17:44:03.0610 0x0cdc  [ F9265C902BB9146C6BFF97BDF35C04DE, DC70B404A701CE5F60421F664F745CA84722ED86FAFC87F2A8A71BFD25CD6151 ] rt640x64        C:\Windows\System32\drivers\rt640x64.sys
17:44:03.0633 0x0cdc  rt640x64 - ok
17:44:03.0643 0x0cdc  [ 52AF831207F28D05676503828BA7946B, A780BBC63D586C96D8CDC00DDB7DC39AF8C2440D76ED06B3C787082832D0B456 ] RzWizardService C:\Program Files (x86)\Razer\RzWizard\RzWizardService.exe
17:44:03.0653 0x0cdc  RzWizardService - ok
17:44:03.0657 0x0cdc  [ B5DAEE69BACA64D2BB004568E22D8756, C0072CF6B438ED756435A182D55AC55F3AD356ACBD483DE06A94893D3CA8CCC5 ] s3cap           C:\Windows\System32\drivers\vms3cap.sys
17:44:03.0666 0x0cdc  s3cap - ok
17:44:03.0670 0x0cdc  [ 6F8E95716C1A27FF2FE96D30B147F1C1, 9403E9FE8B13EE294CFBBD96649BBD54CF723CF5872E3E03DA4380379D677983 ] SamSs           C:\Windows\system32\lsass.exe
17:44:03.0679 0x0cdc  SamSs - ok
17:44:03.0683 0x0cdc  [ 5E73FB63E2DBC75FE0C17DEB0010CE0E, 9DAC47486262397D03BC01F7438CAB62CF33BD7B5283F5B9548C770A3D6D0ADC ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
17:44:03.0693 0x0cdc  sbp2port - ok
17:44:03.0701 0x0cdc  [ 3CD0130FFDEAEACF0905B482F3934EA3, 1EC355B63135FD2563093EBB206741C0C4CCE0551A662F6DC86C875146A88B06 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
17:44:03.0721 0x0cdc  SCardSvr - ok
17:44:03.0728 0x0cdc  [ 9EE060D6560FFBFBDB2ED5D6ED192294, 14387B69CD26D12BE31A23251B6AA8EDFC4D6CDE4FA558F0950DE91D2DD03946 ] ScDeviceEnum    C:\Windows\System32\ScDeviceEnum.dll
17:44:03.0745 0x0cdc  ScDeviceEnum - ok
17:44:03.0748 0x0cdc  [ 3D9A82B03C92D1FEC42CB171D6F57778, DC027F02F5EB5F1D10DB6F405FB0C15D4D5C922445F5F3C916624113278AF072 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
17:44:03.0759 0x0cdc  scfilter - ok
17:44:03.0776 0x0cdc  [ D4DB6B318A0A0C74A90260725A228C0B, 57BA2EF9D880488C785C806ABF9EE753A48E589129442D72F815CD6EFFA07B22 ] Schedule        C:\Windows\system32\schedsvc.dll
17:44:03.0811 0x0cdc  Schedule - ok
17:44:03.0818 0x0cdc  [ 9055ADDFBA4C8B914C914CE693B55C0A, DB213AC36E14D856B81D2AFE46815402537A2ABEEA15032A9FF436F953129441 ] scmbus          C:\Windows\system32\drivers\scmbus.sys
17:44:03.0826 0x0cdc  scmbus - ok
17:44:03.0853 0x0cdc  [ B6F2363584E62960846F7C3F00124A4F, 252189FF9D623CF69BF415FF7C7FE74B0BBF756B632420578BFAFF6595616CF7 ] scmdisk0101     C:\Windows\System32\drivers\scmdisk0101.sys
17:44:03.0865 0x0cdc  scmdisk0101 - ok
17:44:03.0871 0x0cdc  [ 9450FA11E9DE6715FCB71A519A8FF90B, B7E341C6E4CE967FCDD0D17A497C07E8A1C6B0AACE8A6E8E5D6C21EF73F13E16 ] SCPolicySvc     C:\Windows\System32\certprop.dll
17:44:03.0885 0x0cdc  SCPolicySvc - ok
17:44:03.0892 0x0cdc  [ 7C3D10BEC8B0DBA00A78C78EB10B3AE2, A671C9CB97977613576D70607E106C7A29B9EA9E875C7C5AF293EE5903D7AD0A ] sdbus           C:\Windows\System32\drivers\sdbus.sys
17:44:03.0905 0x0cdc  sdbus - ok
17:44:03.0910 0x0cdc  [ F3714DBAA42C15F78FFCDFE4273214EB, 2D018970B92C5F0744FAE10A2FC298F3DCEA5C2EDEB760F4F0651337B9878ABF ] SDRSVC          C:\Windows\System32\SDRSVC.dll
17:44:03.0924 0x0cdc  SDRSVC - ok
17:44:03.0928 0x0cdc  [ 120DFCB71D6C502613A9E2D50E16850C, 2C294010AD1C9C380CD5221A37720544178B7358C8C8553AF44055E4CEE5DAF5 ] sdstor          C:\Windows\System32\drivers\sdstor.sys
17:44:03.0937 0x0cdc  sdstor - ok
17:44:03.0940 0x0cdc  [ EFD644DD091E1D94555FC3BBC95EA66D, FBDDA6680BEC378CCF12A32D9186020E884DA15A1E789D1531B1E687FC7B54B1 ] seclogon        C:\Windows\system32\seclogon.dll
17:44:03.0953 0x0cdc  seclogon - ok
17:44:03.0957 0x0cdc  [ F48535714BED7DD784853889B4594B26, 9B4AB7E7293E79A8F6CC46C84F23E62AD3BD6E958FCE078CDBB125A69FAC7E50 ] SENS            C:\Windows\System32\sens.dll
17:44:03.0969 0x0cdc  SENS - ok
17:44:03.0971 0x0cdc  Sense - ok
17:44:03.0994 0x0cdc  [ 2B4E090D06C60853C5C00CF255F9E02A, 4D4DBA7B04519622612BD4A4F28318CA2F5646C84CAFF8C5ACC9BF4C6031894E ] SensorDataService C:\Windows\System32\SensorDataService.exe
17:44:04.0035 0x0cdc  SensorDataService - ok
17:44:04.0046 0x0cdc  [ C09A42163878A082C3F0D0A3DFE95714, 8033DC38D0EDED3758DA6BF8C1955BE5FFE48863C079C589660B37D0E461300F ] SensorService   C:\Windows\system32\SensorService.dll
17:44:04.0065 0x0cdc  SensorService - ok
17:44:04.0072 0x0cdc  [ E6F00415DADCEEC860E7AB42BFD19A65, 274CAF22F93D43B6DB6953730E3DF8DA94776B24EEE74B80AB4CD780BC1366A9 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
17:44:04.0086 0x0cdc  SensrSvc - ok
17:44:04.0091 0x0cdc  [ 401D706DDC0A7AF18C3DD228ADF74551, 27C0B38D7C2E3F6FF06201124E63483931F6071954B2B99EC0143C464238C0B7 ] SerCx           C:\Windows\system32\drivers\SerCx.sys
17:44:04.0099 0x0cdc  SerCx - ok
17:44:04.0104 0x0cdc  [ 7084D11083F0CDCA8B5C76F9846ABF5D, F639920882B0E784D8CFAF0D4C0F0C411937B6831E5DD99B0ABFBFE06BA4742F ] SerCx2          C:\Windows\system32\drivers\SerCx2.sys
17:44:04.0113 0x0cdc  SerCx2 - ok
17:44:04.0117 0x0cdc  [ 3FF478A8ED32A83C36581425F6282B6C, 787646A17098EA7CF36064D0A950C1D470D4A280C8C5AC40023D566E53860EAE ] Serenum         C:\Windows\System32\drivers\serenum.sys
17:44:04.0126 0x0cdc  Serenum - ok
17:44:04.0130 0x0cdc  [ 92509187AA171A80521528B36F753E1D, FE0DA272B8A155ECC161E99586C4AE7EE17B1C84BC330DA1566C83B8E03FA825 ] Serial          C:\Windows\System32\drivers\serial.sys
17:44:04.0141 0x0cdc  Serial - ok
17:44:04.0145 0x0cdc  [ 433D38FF6D08B993847EA2A10EB8CB52, 29BA75DB6D1AC761BBDFB5AC8874FC7D763E1CD10D290E369063B34CE951270F ] sermouse        C:\Windows\System32\drivers\sermouse.sys
17:44:04.0154 0x0cdc  sermouse - ok
17:44:04.0163 0x0cdc  [ 82CF273F0E8F243789683DEB40757569, 5433D93A41C4BF04494E6158931C6AC3154888F7CD3A417253EC02FF7EA6D00E ] SessionEnv      C:\Windows\system32\sessenv.dll
17:44:04.0182 0x0cdc  SessionEnv - ok
17:44:04.0185 0x0cdc  [ 697D3EE0740AEAB62B66ABCA1C83D13B, FCF54A0071ED04AD3FC8551C67FE5FD49089DC0510F753052CAC5972A65C9E3D ] sfloppy         C:\Windows\System32\drivers\sfloppy.sys
17:44:04.0194 0x0cdc  sfloppy - ok
17:44:04.0206 0x0cdc  [ 832E933AA8DB9FD4733B96D8B6484D3F, 3A8E3D7ECA192EEE154CB568073B7211FDA06078EFC3BC7E961563A1BFDD0CAA ] SharedAccess    C:\Windows\System32\ipnathlp.dll
17:44:04.0227 0x0cdc  SharedAccess - ok
17:44:04.0241 0x0cdc  [ 482E6BE8A07832E824080D352075ACA1, 4123A76C8E805AF4FE229C53E9C174095C0937913BA81A63FE9B45C44AA5B15F ] ShellHWDetection C:\Windows\System32\shsvcs.dll
17:44:04.0271 0x0cdc  ShellHWDetection - ok
17:44:04.0278 0x0cdc  [ CF3BDF9EAD8D3EF671E9339B44B185BA, C17EC6D5B00F49D9C8B5B6C262A85F34ED71C58450659F006B3632AA84F68E23 ] shpamsvc        C:\Windows\system32\Windows.SharedPC.AccountManager.dll
17:44:04.0291 0x0cdc  shpamsvc - ok
17:44:04.0295 0x0cdc  [ A34CE1830E45DA98932295FDE4B7908A, FC553ECF4D64B4B10B7FDE5352707785517A18D487A80665BAFC7261E3F35CDC ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys
17:44:04.0303 0x0cdc  SiSRaid2 - ok
17:44:04.0307 0x0cdc  [ A7B5C670770E908DA5FEF5BF1136E933, 8D3BB6FF65E631C34BE8EA766481B2FDB2E1E916A4FD67F86705A8975A136E6C ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
17:44:04.0315 0x0cdc  SiSRaid4 - ok
17:44:04.0323 0x0cdc  [ F3AAB7DF6408431C762D8721B68F46E4, 56ED764AA660955B8B06322703D086B3A52106625A83CCAF195B08BCBDEDA88F ] SkypeUpdate     C:\Program Files (x86)\Skype\Updater\Updater.exe
17:44:04.0334 0x0cdc  SkypeUpdate - ok
17:44:04.0338 0x0cdc  [ D233EAE2A9D48485321816486ED635EF, 03AB49BE9CF15EB7EDC50C400E673B4DF0E5BFDA9A7811E157F2AF2F3CF38D49 ] smphost         C:\Windows\System32\smphost.dll
17:44:04.0348 0x0cdc  smphost - ok
17:44:04.0361 0x0cdc  [ 0B217141AC1283655402CDB356577735, 6EFA4CA46CFC8B7156CE7E5CA89B7F7073E16D66C2FC13F4DB95FEB78CCF698F ] SmsRouter       C:\Windows\system32\SmsRouterSvc.dll
17:44:04.0385 0x0cdc  SmsRouter - ok
17:44:04.0389 0x0cdc  [ 6F4CE07D420FB657B5936F71101ABD41, CEC52984C56E578E0FFE12BE1B8148335F788B7D1751F2D0E79B944A41113C20 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
17:44:04.0400 0x0cdc  SNMPTRAP - ok
17:44:04.0413 0x0cdc  [ C994DF90427103CCB80F893FFD2B1CE8, 7E4B08095C77E68D337A3425EEA38F8FEC4D103CA7661E34FD96BF518DFB4BCB ] spaceport       C:\Windows\system32\drivers\spaceport.sys
17:44:04.0430 0x0cdc  spaceport - ok
17:44:04.0436 0x0cdc  [ E03264C4C25B568F92ED1656AD541E64, D42942BFFBC7213D204FAF84F4FE015FC23A6ACB29B5E752834EDBC17A3AC20D ] SpbCx           C:\Windows\system32\drivers\SpbCx.sys
17:44:04.0444 0x0cdc  SpbCx - ok
17:44:04.0455 0x0cdc  [ 0FFE35F0B0CD5A324BBE22F02569AE3B, F4EE803EEFDB4EAEEDB3024C3516F1F9A202C77F4870D6B74356BBDE32B3B560 ] speedfan        C:\Windows\SysWoW64\speedfan.sys
17:44:04.0462 0x0cdc  speedfan - ok
17:44:04.0479 0x0cdc  [ 79DCE27E8C4CF6701BFE49EC2446BBF6, F51CBB7A45C3C878F41653FD5FBDC93CC302712B7725DAAB4D3475A1F4771E3D ] Spooler         C:\Windows\System32\spoolsv.exe
17:44:04.0507 0x0cdc  Spooler - ok
17:44:04.0597 0x0cdc  [ 23529A00195CE71252FEBF647E56E27D, 8ADF7A1C96DAE005E9A974D90BE8954F88D49B6848252B88513C49E0A3BD9774 ] sppsvc          C:\Windows\system32\sppsvc.exe
17:44:04.0707 0x0cdc  sppsvc - ok
17:44:04.0723 0x0cdc  [ E83830BB74AE8CBECEA0ECD94DE436F9, 4A34569A34260324EBD629039E1BF45A3527FC75B22D9A3DB6360A6EB365483A ] srv             C:\Windows\system32\DRIVERS\srv.sys
17:44:04.0740 0x0cdc  srv - ok
17:44:04.0755 0x0cdc  [ 55CA5329D1ADEB8F8034045930147AE4, D4F31BC82700D166564C7F9CDCEA3ABAB4A37B55137C34572768DF46FDA9320A ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
17:44:04.0780 0x0cdc  srv2 - ok
17:44:04.0788 0x0cdc  [ F13EE0DB1FB1D6946AC3228D7EFCFC8F, 109A809F0338FAB0F4045FA5EE33C6F0A994A9F586B2FBD8920A6AABA0E0EF66 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
17:44:04.0802 0x0cdc  srvnet - ok
17:44:04.0809 0x0cdc  [ 44758105AB3EA34E815D4B6CA1153311, 7F223A20D2538C123BAC6F75BE0E126876A116F09502FD980C05B8916E26E1B7 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
17:44:04.0824 0x0cdc  SSDPSRV - ok
17:44:04.0831 0x0cdc  [ B97C7EC07218A8002323718202BF5E77, 39D3254383E3F49FD3E2DFF8212F4B5744D8D5E0A6BB320516C5EE525AD211EB ] SstpSvc         C:\Windows\system32\sstpsvc.dll
17:44:04.0847 0x0cdc  SstpSvc - ok
17:44:04.0912 0x0cdc  [ 4E330AD1EED4A5D582EE415FD55953A2, 2C02E1F45F74D250110BA5117AA942495CB2EBAC7F2CCECC284B4FB8F47B13E1 ] StateRepository C:\Windows\system32\windows.staterepository.dll
17:44:05.0017 0x0cdc  StateRepository - ok
17:44:05.0048 0x0cdc  [ 9867A86327E8AE3806305F1BCF01211A, CCDDB2560B30D27CE662F1B02710E1FAA9331E6A27D9A6629EEDED2CBA822062 ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe
17:44:05.0075 0x0cdc  Steam Client Service - ok
17:44:05.0082 0x0cdc  [ 29D26E1347AE1BBD4201014E19880B2C, 9E2153AD96CE4F189EEE43BB02515532C619FB1CA02D8F6DEF517AC3347AAA14 ] stexstor        C:\Windows\system32\drivers\stexstor.sys
17:44:05.0089 0x0cdc  stexstor - ok
17:44:05.0104 0x0cdc  [ 91CB95B35481155BFE29C217CD237F27, CA66957DF1441D991453BEF02D768D44E5D9A484BC23C8874E8A7AC20904CB06 ] stisvc          C:\Windows\System32\wiaservc.dll
17:44:05.0130 0x0cdc  stisvc - ok
17:44:05.0135 0x0cdc  [ 53EB8CE34B55A1EE63424C8DB7388BFC, 5AB59117BA8A2844EB8693CCC19B217AE039B28C87519F96E1C845FE9BF456C2 ] storahci        C:\Windows\system32\drivers\storahci.sys
17:44:05.0144 0x0cdc  storahci - ok
17:44:05.0147 0x0cdc  [ C5E0ACE4771F5575D9D5B457ABF3AD03, 365880BC5AC313F25C313EFB7758301F98D9B2BF4C5FC9499F98C2B7F8407D96 ] storflt         C:\Windows\system32\drivers\vmstorfl.sys
17:44:05.0155 0x0cdc  storflt - ok
17:44:05.0160 0x0cdc  [ B66D8C75C9BC59D637177AB3B1C569A6, 76252A631F03EEBF5FDC7693F6B0A5E73838CDBE3157114CC96B8BBE88B476BF ] stornvme        C:\Windows\system32\drivers\stornvme.sys
17:44:05.0168 0x0cdc  stornvme - ok
17:44:05.0172 0x0cdc  [ BEBF85EB4D90E6996047DA027D0ED26E, DF109CF0F07CDD1B9B702C2A076D4DD5366DAAD971CC9359AF0358E79981706F ] storqosflt      C:\Windows\system32\drivers\storqosflt.sys
17:44:05.0181 0x0cdc  storqosflt - ok
17:44:05.0191 0x0cdc  [ B91FBE7CB4633FEB32AFBD0B48576396, 9EFDD92E8096CE5555F8DC3C870864E5515469603C2373B99B3607234633CA66 ] StorSvc         C:\Windows\system32\storsvc.dll
17:44:05.0210 0x0cdc  StorSvc - ok
17:44:05.0214 0x0cdc  [ 8E73037A6F8938475692FFCC26EBF385, F78C5CD1A3CD17AA831EEC82426B14006B4DDBC9085A4814E04E8C37FD6B05F7 ] storufs         C:\Windows\system32\drivers\storufs.sys
17:44:05.0222 0x0cdc  storufs - ok
17:44:05.0225 0x0cdc  [ 9D9DED47DA10E845EFF2DD57C94C809B, 520D0CE7A867051B80C8141E351FE5A5BCE3C99776093F234DB77D3407B1F104 ] storvsc         C:\Windows\system32\drivers\storvsc.sys
17:44:05.0232 0x0cdc  storvsc - ok
17:44:05.0237 0x0cdc  [ 224C92E442B1B8C20C274332F1ACF00D, CDE5DCFB7A21089464A6E2ABB29BBE08B184C3433C218756AA5902A8F67C0B2C ] svsvc           C:\Windows\system32\svsvc.dll
17:44:05.0249 0x0cdc  svsvc - ok
17:44:05.0252 0x0cdc  [ 505E0C40B5D0ADDCBB414640F59BD2E0, DF4B5E65FE6FF2224F298A2A2FAC9B648C082DFF8463148633647580A9FAD34D ] swenum          C:\Windows\System32\drivers\swenum.sys
17:44:05.0260 0x0cdc  swenum - ok
17:44:05.0272 0x0cdc  [ 2EE27411B5904C63D723BEA391819F58, C88C11D460E90398E16011B8A2CED5EE5626084F24790EA6115532F8F70060C6 ] swprv           C:\Windows\System32\swprv.dll
17:44:05.0295 0x0cdc  swprv - ok
17:44:05.0301 0x0cdc  [ 32F46FB0F290D16DAA452B289C985795, 73F88AAAA6026DB4C27F1D054145216DCC3F1960946FB2A7A90518DD1D5737CB ] Synth3dVsc      C:\Windows\System32\drivers\Synth3dVsc.sys
17:44:05.0310 0x0cdc  Synth3dVsc - ok
17:44:05.0328 0x0cdc  [ FED48B19D6F55D7A3AB498D85729D1BA, FA5E0E02BC2E2DE108C55991E3B063CC947072228B53539F42F922661510DE7C ] SysMain         C:\Windows\system32\sysmain.dll
17:44:05.0363 0x0cdc  SysMain - ok
17:44:05.0373 0x0cdc  [ D9FEA79BF6AF136F8E656AE045C2FEC8, E6F08A93348E035185F0F1C6B6277E636F4F25D1136E3ACCA63488DAEEC7114B ] SystemEventsBroker C:\Windows\System32\SystemEventsBrokerServer.dll
17:44:05.0392 0x0cdc  SystemEventsBroker - ok
17:44:05.0397 0x0cdc  [ 86E7FD5C8DBEC1EB51C4368561402B75, 86EE61414CD5854E39E33F67BF5DA4377B569B3ED4D18882C470BC6784891DA1 ] TabletInputService C:\Windows\System32\TabSvc.dll
17:44:05.0410 0x0cdc  TabletInputService - ok
17:44:05.0414 0x0cdc  [ 5B4A09AB34D0205C616C4D247AD29F57, B1DBDD5E2149114E1DCC56DAB00876AAE1FBFC5D4063D3F5A59D8C66918EF693 ] tap-tb-0901     C:\Windows\System32\drivers\tap-tb-0901.sys
17:44:05.0420 0x0cdc  tap-tb-0901 - ok
17:44:05.0428 0x0cdc  [ 3929C8FC134AC672C4F3F85160956257, CD3195CA58BA6F55EA0DDA2BE6AB58280AD1CA488D7AAA1539DD05FB99374F36 ] TapiSrv         C:\Windows\System32\tapisrv.dll
17:44:05.0445 0x0cdc  TapiSrv - ok
17:44:05.0487 0x0cdc  [ 4F25E481124059CC593B4C68BC485640, 2814D2BA4E83D3B0F7569E6C6EE0C763D9801BC505D8ED84675D19C8573834DB ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
17:44:05.0539 0x0cdc  Tcpip - ok
17:44:05.0602 0x0cdc  [ 4F25E481124059CC593B4C68BC485640, 2814D2BA4E83D3B0F7569E6C6EE0C763D9801BC505D8ED84675D19C8573834DB ] Tcpip6          C:\Windows\system32\drivers\tcpip.sys
17:44:05.0654 0x0cdc  Tcpip6 - ok
17:44:05.0661 0x0cdc  [ 8DBB1BE20C36E6D19BCC89EEA00B953C, 8B97A7E53E1D77363AFF6A5AAEAD89EBAE28DCB8D82753C804FD7CD5646500AF ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
17:44:05.0671 0x0cdc  tcpipreg - ok
17:44:05.0677 0x0cdc  [ 9D2DD64A0B51C56285512DC9454340F6, ABB90CE6A55269F71AFB08E04969CF9A4EFD93F7A7189AF920EEE3E005214DDD ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
17:44:05.0685 0x0cdc  tdx - ok
17:44:05.0689 0x0cdc  [ 06130AFFECEB94525FC2352936576B70, 10EBE2C8FDC087D29E2FFB328F0F7905A5374AB8CC9FAE8699E7676DBC8CBF91 ] terminpt        C:\Windows\System32\drivers\terminpt.sys
17:44:05.0696 0x0cdc  terminpt - ok
17:44:05.0715 0x0cdc  [ FB68E5F02316C42BE7282DA492351C6F, AC31D841FEA58B776127E138DB20F8D48E26FD8C00CE2FA9695EA14EBF159A0A ] TermService     C:\Windows\System32\termsrv.dll
17:44:05.0749 0x0cdc  TermService - ok
17:44:05.0754 0x0cdc  [ 2AF438EC0D361A7BBB70E604A686602C, 4BE6A0461EB2CB94288614434A1CEC81C2ED46241721FD5BBD8ABE0680F7C804 ] Themes          C:\Windows\system32\themeservice.dll
17:44:05.0774 0x0cdc  Themes - ok
17:44:05.0782 0x0cdc  [ 1482B8ED5CACA87992A882B853B83CEE, 613247F0E362A109090E8563D977DECC50C64D45D6962905FA84A2D59329045C ] TieringEngineService C:\Windows\system32\TieringEngineService.exe
17:44:05.0802 0x0cdc  TieringEngineService - ok
17:44:05.0822 0x0cdc  [ 3B3C607C3C62DFBEF61938DA2CAB94DF, E5EEA7F45A7BBFDF6F0003CD77E39958C451DD1B4B401876B5619A3C20F5C370 ] tiledatamodelsvc C:\Windows\system32\tileobjserver.dll
17:44:05.0845 0x0cdc  tiledatamodelsvc - ok
17:44:05.0853 0x0cdc  [ C1F8CBE2D4843E0CCC3EFEA2EC60D4AB, 9D07527D982066922318C77AECE99280DE55034C375ACE145E827A6BEB5C3B70 ] TimeBrokerSvc   C:\Windows\System32\TimeBrokerServer.dll
17:44:05.0867 0x0cdc  TimeBrokerSvc - ok
17:44:05.0878 0x0cdc  [ 46171262D0E806779DEEDFCAB2F830CC, 7F4A4658B8BA217D99E5B5C0E01600C20DC96ECBCA32A5BA7FBE17D2A7B8BFD8 ] TPM             C:\Windows\System32\drivers\tpm.sys
17:44:05.0892 0x0cdc  TPM - ok
17:44:05.0900 0x0cdc  [ 3B91F35089240F6187AD681A5EC28BDE, 3D035CB73BC8E7831DCD0FB7D9DAD91CE51D3D0F9D9C8B866A0009BD508B6702 ] TrkWks          C:\Windows\System32\trkwks.dll
17:44:05.0913 0x0cdc  TrkWks - ok
17:44:05.0918 0x0cdc  [ 09440FA30C020B4443391FAFCF4876E3, 208C7725F70C75D8C96CCAF5B22F83B8B1C66D8C9FFF48465B1C9F4A77425569 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
17:44:05.0929 0x0cdc  TrustedInstaller - ok
17:44:05.0933 0x0cdc  [ A6F4025664C9D4BC2A9EDAB4092706D7, 89808A1679C0E716F86F06EE7701DCC289200894F0FA1F120DA2AC3A45FDB312 ] tsusbflt        C:\Windows\system32\drivers\TsUsbFlt.sys
17:44:05.0943 0x0cdc  tsusbflt - ok
17:44:05.0946 0x0cdc  [ 37A96AD493E110C0BF1EE0AC0F9E7DBD, F2A6894A4AEE18DF2B92222CDB0801A13AEEB7212071F0431430788339B30E23 ] TsUsbGD         C:\Windows\System32\drivers\TsUsbGD.sys
17:44:05.0956 0x0cdc  TsUsbGD - ok
17:44:05.0961 0x0cdc  [ 5A91FDBA4D3FCB56DAEB8C091B3EB8E1, 8AB91F4423125267FA8509A1C3A9AD1CBD642FA6A96D8789F9AB8CB75ABAD58C ] tsusbhub        C:\Windows\system32\drivers\tsusbhub.sys
17:44:05.0972 0x0cdc  tsusbhub - ok
17:44:05.0978 0x0cdc  [ 79E264287F17D56D768440B0270466DE, ABF9DC95C5E939B30BFD9BF9EDFDB3BD78A9DFCB055B945965303B6A60E6D7A7 ] tunnel          C:\Windows\System32\drivers\tunnel.sys
17:44:05.0989 0x0cdc  tunnel - ok
17:44:05.0994 0x0cdc  [ F723552F65D44FE693DB1A383825B3A8, EF8C343C4EB5EEA4EC830378EF576CCD6CD4EEDEDD486C0F29697044E8C71F45 ] tzautoupdate    C:\Windows\system32\tzautoupdate.dll
17:44:06.0006 0x0cdc  tzautoupdate - ok
17:44:06.0009 0x0cdc  [ AA65954F512BA097DD190790876DD991, C1BB2B8F54F064D01190327B5E7949EBBDA21D6FC6F94D9FCD20F685C2F855FA ] UASPStor        C:\Windows\System32\drivers\uaspstor.sys
17:44:06.0018 0x0cdc  UASPStor - ok
17:44:06.0022 0x0cdc  [ AB6268022C3A5B529075A39C33904DA6, 2717F1704640201F2681711543EA39A74C3E89C7DB232EC5DD89FD8AA6F07846 ] UcmCx0101       C:\Windows\system32\Drivers\UcmCx.sys
17:44:06.0032 0x0cdc  UcmCx0101 - ok
17:44:06.0036 0x0cdc  [ 7ED2EDA43D21C7A5F589A7960E265C52, 7DB8A595236FBB8A264D7AB155201357212855050ABB5B1036EF32F1223FDCC2 ] UcmTcpciCx0101  C:\Windows\system32\Drivers\UcmTcpciCx.sys
17:44:06.0047 0x0cdc  UcmTcpciCx0101 - ok
17:44:06.0051 0x0cdc  [ 169351463039B45F5CDED9768879F712, 990C8C4AEF9ED7FF6BCEAE67F7BDAA037777B142B8D96A74F8715C941A5C63C6 ] UcmUcsi         C:\Windows\System32\drivers\UcmUcsi.sys
17:44:06.0060 0x0cdc  UcmUcsi - ok
17:44:06.0066 0x0cdc  [ 08A9E3AD29B215484FBB68CDC175DF3A, 3EFFF99C3BC4A1454E3D2B5177AE587ED3041AB4CE2A95BA7E28A2124E38E1E5 ] Ucx01000        C:\Windows\system32\drivers\ucx01000.sys
17:44:06.0076 0x0cdc  Ucx01000 - ok
17:44:06.0079 0x0cdc  [ DA70AEE267491AA56BC63AA0C0C96CA2, 0A0AADB27607F9292BB3CE000CFDDB19BD4CA09EAAD926C4925CB43B17817AD9 ] UdeCx           C:\Windows\system32\drivers\udecx.sys
17:44:06.0089 0x0cdc  UdeCx - ok
17:44:06.0096 0x0cdc  [ FBC5ECF6D5A868D0B116C2DBB02B8168, 945AA76C60ABAD6075B5C8F9172C018F75BCF393A1CB8B329F5E68E664627775 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
17:44:06.0115 0x0cdc  udfs - ok
17:44:06.0120 0x0cdc  [ B918E40FAA9CD118CCA4AD388B748C98, 4B539B7B656F02C5E5BAEE52A677757B05CC11C5500D619850A564C28FAB8115 ] UEFI            C:\Windows\System32\drivers\UEFI.sys
17:44:06.0128 0x0cdc  UEFI - ok
17:44:06.0132 0x0cdc  [ 166B17AE1DD24D8BA8CA474C7C31148F, D34E786277093278F58EFAC957279DC4ED43A190538C875B80F5B1E0A0C30381 ] UevAgentDriver  C:\Windows\system32\drivers\UevAgentDriver.sys
17:44:06.0140 0x0cdc  UevAgentDriver - ok
17:44:06.0164 0x0cdc  [ FCA4D901FB9934DAB82ED31C4EE89A11, 8EDF8DD71C13DE77AC83D1086670E9E90C69DE379F1CF768C8B9C789254C04AA ] UevAgentService C:\Windows\system32\AgentService.exe
17:44:06.0201 0x0cdc  UevAgentService - ok
17:44:06.0210 0x0cdc  [ 0FD75222C1AD2687AB365BEBEA400DD4, AD10DBCA59EB7D34FD8F963CE267F36774A9BC613F8D637903B12AC88C328E8A ] Ufx01000        C:\Windows\system32\drivers\ufx01000.sys
17:44:06.0221 0x0cdc  Ufx01000 - ok
17:44:06.0225 0x0cdc  [ C1A78C53E01C641AE41BFA65797819F5, 0B9FE1BD724B3315199A1B1DA2F03255E4FE744DA3CE6CD0F77699A8E42E9359 ] UfxChipidea     C:\Windows\System32\drivers\UfxChipidea.sys
17:44:06.0234 0x0cdc  UfxChipidea - ok
17:44:06.0239 0x0cdc  [ 767307212110EBEFB93EC9A5BE9E85B9, 368797400FE54802CE74F34B773CE2AF09EB8DEA6C035B55419A52F0B5A6FAD0 ] ufxsynopsys     C:\Windows\System32\drivers\ufxsynopsys.sys
17:44:06.0248 0x0cdc  ufxsynopsys - ok
17:44:06.0254 0x0cdc  [ 8578F83EC5175920F2D8586FFF9DCE47, 049A16AC87F93E761150C8286633FFCA62EE85F5645DDE77D36BD0EB6481FF83 ] UI0Detect       C:\Windows\system32\UI0Detect.exe
17:44:06.0267 0x0cdc  UI0Detect - ok
17:44:06.0271 0x0cdc  [ DC460AAA18CA2342FBBFB2DF9B044472, 14D45E059C596AE97506D26705F248CA1C2269160B31A60341060E8A93146CBD ] umbus           C:\Windows\System32\drivers\umbus.sys
17:44:06.0282 0x0cdc  umbus - ok
17:44:06.0286 0x0cdc  [ C3CF0377917ECE6D65D7623E1E61568F, 4909695E04CBC86BFCFFBC15F332C367521054B7B4D3C141C7CA6B2E40E090B9 ] UmPass          C:\Windows\System32\drivers\umpass.sys
17:44:06.0294 0x0cdc  UmPass - ok
17:44:06.0302 0x0cdc  [ 640CF093C1CF16D5FD317616CA348F31, BEC34D1AACA83BF5A84CE01F6A668E3CA5A33C56A446DC42EFFF7C43D22E1AE6 ] UmRdpService    C:\Windows\System32\umrdp.dll
17:44:06.0318 0x0cdc  UmRdpService - ok
17:44:06.0340 0x0cdc  [ B8272BB8D4982C496FDC704809C38E02, F93855D932FB1DBBCC86E82C0FE0DC9ECF93BBD629D2CA9D0BE7E075E114B7FF ] UnistoreSvc     C:\Windows\System32\unistore.dll
17:44:06.0379 0x0cdc  UnistoreSvc - ok
17:44:06.0391 0x0cdc  [ 6CDA3536F6BAB7896A57EAB7DC07F379, 8FBE6457ECD1ABB518D9800EBA8A017774FFAA8EABD2EDC0825181A12FE9AEF6 ] upnphost        C:\Windows\System32\upnphost.dll
17:44:06.0416 0x0cdc  upnphost - ok
17:44:06.0420 0x0cdc  [ 6B46FC140C9AF68E6E7697D66D59CB4D, F018B4784D65F1A8140A6EA69C35D6A7ECE01738694052FD54AFD2B81A8F2FF8 ] UrsChipidea     C:\Windows\System32\drivers\urschipidea.sys
17:44:06.0427 0x0cdc  UrsChipidea - ok
17:44:06.0431 0x0cdc  [ B4402E7F0923F660270442CE76877ABE, 1C2DD26EAB71F75EA576E8DAABAF71FD7DC3DF807CF025617C774CEF33C0B718 ] UrsCx01000      C:\Windows\system32\drivers\urscx01000.sys
17:44:06.0440 0x0cdc  UrsCx01000 - ok
17:44:06.0443 0x0cdc  [ 9DD431F1B94789CFB527E5D19261F124, 8F5A249A97C5B14B282E3147DD21951D2AD34B651E762814C12F4C26D74EC70C ] UrsSynopsys     C:\Windows\System32\drivers\urssynopsys.sys
17:44:06.0452 0x0cdc  UrsSynopsys - ok
17:44:06.0459 0x0cdc  [ C87E32B90F085970D9637FBAD45EF6FE, C180EACD2EE479277DA5DBF39E43B428BD7945141B2451CB3946B0C1E495E76F ] usbccgp         C:\Windows\System32\drivers\usbccgp.sys
17:44:06.0469 0x0cdc  usbccgp - ok
17:44:06.0473 0x0cdc  [ 0B663856474AC41924D9E9112203858F, 9E09F2A6279B48CAC09F8C7AA1F1BE02864D540C2ED1460CBA9FABCF0A546A1E ] usbcir          C:\Windows\System32\drivers\usbcir.sys
17:44:06.0484 0x0cdc  usbcir - ok
17:44:06.0490 0x0cdc  [ F83D2250256203AC5DA5E8601C1AFDD7, AC0D90E2DB3051798B9D287CF3D0E92FED4000822E65A82775A29CF896B76F04 ] usbehci         C:\Windows\System32\drivers\usbehci.sys
17:44:06.0502 0x0cdc  usbehci - ok
17:44:06.0512 0x0cdc  [ 7FFD26742321919590ED77FCA556D65F, F7FAB63C36F8519F5A7B9091C507F3CB580C390322FAF9155CCE7F66C965B968 ] usbhub          C:\Windows\System32\drivers\usbhub.sys
17:44:06.0529 0x0cdc  usbhub - ok
17:44:06.0541 0x0cdc  [ 7A749B2863B5561BE34B39E8E249AD8F, E5B67DFAF5407007FD0CC408D6B4BA19DF59584819FC715E9F9E0FBF3EA00AAB ] USBHUB3         C:\Windows\System32\drivers\UsbHub3.sys
17:44:06.0558 0x0cdc  USBHUB3 - ok
17:44:06.0562 0x0cdc  [ D2109F1F4FEBF1DAC415CDC5DE876479, C8A871EBD0E5EF004BA622A73DAC36C03608CD317FDCD0A6A98608DF4CC10D55 ] usbohci         C:\Windows\System32\drivers\usbohci.sys
17:44:06.0571 0x0cdc  usbohci - ok
17:44:06.0574 0x0cdc  [ 29C9572F2D061CFC3C0BD48A3163E343, 2527DCC9E6D421F5DC40051C787A5270EB077746785465C9AA2A2AEEF47307D5 ] usbprint        C:\Windows\System32\drivers\usbprint.sys
17:44:06.0583 0x0cdc  usbprint - ok
17:44:06.0587 0x0cdc  [ 429477D6DEF3321FF7D3EF23CAAADA00, BB7D2AFE99736AAFFA8B0B2DABF7D6A6D5CB9563B1DE6A7E86CE7DC9D27F31C0 ] usbser          C:\Windows\System32\drivers\usbser.sys
17:44:06.0596 0x0cdc  usbser - ok
17:44:06.0601 0x0cdc  [ 0CC16F7B91C57AE9A4E44425A295FDAA, 7CEE11955E5742DA390601F565412C14A7481B8747C495CCD246696C56B426DC ] USBSTOR         C:\Windows\System32\drivers\USBSTOR.SYS
17:44:06.0610 0x0cdc  USBSTOR - ok
17:44:06.0614 0x0cdc  [ C917D09064CDBD18F75ADC9B2C48F847, A7F6223346CCD7E84186CD0C0715014F8E3A4398298925A43290224678620D23 ] usbuhci         C:\Windows\System32\drivers\usbuhci.sys
17:44:06.0627 0x0cdc  usbuhci - ok
17:44:06.0637 0x0cdc  [ 95BCCEFBC40D06484CF16144FE79B8A5, 8ABA73C5FFEDD319FB96B807AD08716698E557522478DF1A2C5D662675636AE0 ] USBXHCI         C:\Windows\System32\drivers\USBXHCI.SYS
17:44:06.0651 0x0cdc  USBXHCI - ok
17:44:06.0682 0x0cdc  [ 4CC81AB9D380A6264FF4C0C1512CF965, 76C33053D1C9155B0F3F8392FF982AD4EABEE2BBBEE89EA41DBFE8E436973EB0 ] UserDataSvc     C:\Windows\System32\userdataservice.dll
17:44:06.0733 0x0cdc  UserDataSvc - ok
17:44:06.0771 0x0cdc  [ AA24C61D88E36BA1144072227922173D, 2EBBC827E740F72EA2E75745E585378189BC0DEE91CACD7FA31BDBC5EFCF8733 ] UserManager     C:\Windows\System32\usermgr.dll
17:44:06.0807 0x0cdc  UserManager - ok
17:44:06.0831 0x0cdc  [ C75B1B48BCAADEB0275C1EBE2EAE742D, 19875B87BDB23E5B60D6D3173FDF7A7634E81E43501529A56FFCCEE21B7E3B71 ] UsoSvc          C:\Windows\system32\usocore.dll
17:44:06.0853 0x0cdc  UsoSvc - ok
17:44:06.0857 0x0cdc  [ A603D464C27356DA0D208E42A272B371, 897E85BE83E5A617BC6E3467BAE486C140DB435457E55C428499212669F0A6EE ] uvhid           C:\Windows\System32\drivers\uvhid.sys
17:44:06.0864 0x0cdc  uvhid - ok
17:44:06.0868 0x0cdc  [ 6F8E95716C1A27FF2FE96D30B147F1C1, 9403E9FE8B13EE294CFBBD96649BBD54CF723CF5872E3E03DA4380379D677983 ] VaultSvc        C:\Windows\system32\lsass.exe
17:44:06.0877 0x0cdc  VaultSvc - ok
17:44:06.0882 0x0cdc  [ 0E3C4F20B2CE21168F3242D9CAC6CBF2, 1BD5E1A2000EBC1C335A8960ACDCD08BDC8230F533A80D086D2EE6FE4990EA02 ] VBoxUSBMon      C:\Windows\system32\DRIVERS\VBoxUSBMon.sys
17:44:06.0891 0x0cdc  VBoxUSBMon - ok
17:44:06.0895 0x0cdc  [ 0CBDE344FB48E42D78E29469F202ADBC, A1C3FBA5409DD3BBEAF1D3CE2583D6C8A621C0E4F534155EC540AFD67BC9E8CA ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
17:44:06.0902 0x0cdc  vdrvroot - ok
17:44:06.0916 0x0cdc  [ 0783EDE1FA94649ED7F3CEF6A734041A, 1A13A613EF6B67459031C7994FFC6F32F73E02E0F123A171618E4F011C635684 ] vds             C:\Windows\System32\vds.exe
17:44:06.0943 0x0cdc  vds - ok
17:44:06.0949 0x0cdc  [ 723195568C8755CAD57F7933C5F2C5C2, 5C403799F67223605F825BC16D217C1EF5E1A0DDF00AC6380FE8976339B67D9B ] VerifierExt     C:\Windows\system32\drivers\VerifierExt.sys
17:44:06.0960 0x0cdc  VerifierExt - ok
17:44:06.0975 0x0cdc  [ 46ADD0CD4473AAEF1C68266A803F704D, D521E46891253884CF8285E864FAE63F2E8E0974AD8D2EB4D910E8A35350844F ] vhdmp           C:\Windows\System32\drivers\vhdmp.sys
17:44:06.0994 0x0cdc  vhdmp - ok
17:44:07.0000 0x0cdc  [ 7929228F0E8B0C2FA0495A17A4FC27F6, 1F1667B10A96B1D85ED165F62A5C0EF28C37F828B8280EA08BFCC1BAC03F2C90 ] vhf             C:\Windows\System32\drivers\vhf.sys
17:44:07.0009 0x0cdc  vhf - ok
17:44:07.0014 0x0cdc  [ AEE432ED868831B1F068E373598F6D93, BAE91F47B0CB94B826CA010B490AD924D7B715911DF3FCE62F9165F3B571105C ] vmbus           C:\Windows\system32\drivers\vmbus.sys
17:44:07.0023 0x0cdc  vmbus - ok
17:44:07.0028 0x0cdc  [ 9444B23FC694B5F90F21B0FC7F10D8DD, 86F92856F5C985DD8E5993B51E85E1F47EF8C9B2FB37468998C94266963BB4BD ] VMBusHID        C:\Windows\System32\drivers\VMBusHID.sys
17:44:07.0037 0x0cdc  VMBusHID - ok
17:44:07.0040 0x0cdc  [ 4D0287F566B36536DD812A54C015FC4A, 01D6508CA59CF04A47902B1F7C202FD14A81240E0B447588D919DD1072B040CF ] vmgid           C:\Windows\System32\drivers\vmgid.sys
17:44:07.0049 0x0cdc  vmgid - ok
17:44:07.0056 0x0cdc  [ 704609D80666FCB1DAE91260CF2CBB20, 0764DA123DA3FE8543B9205DDF17B0621E6A0F0DF95E8C3D177FD3FAED516119 ] vmicguestinterface C:\Windows\System32\icsvc.dll
17:44:07.0072 0x0cdc  vmicguestinterface - ok
17:44:07.0079 0x0cdc  [ 704609D80666FCB1DAE91260CF2CBB20, 0764DA123DA3FE8543B9205DDF17B0621E6A0F0DF95E8C3D177FD3FAED516119 ] vmicheartbeat   C:\Windows\System32\icsvc.dll
17:44:07.0095 0x0cdc  vmicheartbeat - ok
17:44:07.0103 0x0cdc  [ 704609D80666FCB1DAE91260CF2CBB20, 0764DA123DA3FE8543B9205DDF17B0621E6A0F0DF95E8C3D177FD3FAED516119 ] vmickvpexchange C:\Windows\System32\icsvc.dll
17:44:07.0118 0x0cdc  vmickvpexchange - ok
17:44:07.0128 0x0cdc  [ 0F621B52259D88A719AA20C6D04E3D72, 80B0528CCDE6E1B6F092787E1C0769C649698B196602859A5855134F0ECCBAE5 ] vmicrdv         C:\Windows\System32\icsvcext.dll
17:44:07.0145 0x0cdc  vmicrdv - ok
17:44:07.0153 0x0cdc  [ 704609D80666FCB1DAE91260CF2CBB20, 0764DA123DA3FE8543B9205DDF17B0621E6A0F0DF95E8C3D177FD3FAED516119 ] vmicshutdown    C:\Windows\System32\icsvc.dll
17:44:07.0169 0x0cdc  vmicshutdown - ok
17:44:07.0176 0x0cdc  [ 704609D80666FCB1DAE91260CF2CBB20, 0764DA123DA3FE8543B9205DDF17B0621E6A0F0DF95E8C3D177FD3FAED516119 ] vmictimesync    C:\Windows\System32\icsvc.dll
17:44:07.0192 0x0cdc  vmictimesync - ok
17:44:07.0198 0x0cdc  [ 704609D80666FCB1DAE91260CF2CBB20, 0764DA123DA3FE8543B9205DDF17B0621E6A0F0DF95E8C3D177FD3FAED516119 ] vmicvmsession   C:\Windows\System32\icsvc.dll
17:44:07.0214 0x0cdc  vmicvmsession - ok
17:44:07.0224 0x0cdc  [ 0F621B52259D88A719AA20C6D04E3D72, 80B0528CCDE6E1B6F092787E1C0769C649698B196602859A5855134F0ECCBAE5 ] vmicvss         C:\Windows\System32\icsvcext.dll
17:44:07.0241 0x0cdc  vmicvss - ok
17:44:07.0245 0x0cdc  [ 29075915F9BDC3437F8BED71C067D399, 2C7718080C11DFDD4C9A2085537F78F5633369B4A27D9C64168F0249594A4AA2 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
17:44:07.0253 0x0cdc  volmgr - ok
17:44:07.0261 0x0cdc  [ 6BDB6CE6D2D9E3D3F28F1C97E12B62E2, 5E77D7AF858D7B90FF395F39B86D6F96413D1DDEA28BC9FB40C5524A4DF6DAD0 ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
17:44:07.0275 0x0cdc  volmgrx - ok
17:44:07.0283 0x0cdc  [ BF2546583BB75F01DDA60A7921DFB230, 579BD0BC55F4F03CD8D1FCDAC3975A1649C688820F2F7FC1AD354132D9E3BEE9 ] volsnap         C:\Windows\system32\drivers\volsnap.sys
17:44:07.0296 0x0cdc  volsnap - ok
17:44:07.0299 0x0cdc  [ AC2E20A74D09D24485BE8396CE04F07B, 23FCE8BEE01B89E5CDCA536D75DBA6DCE3E92E13178A66836CEB7829310A89D1 ] volume          C:\Windows\system32\drivers\volume.sys
17:44:07.0306 0x0cdc  volume - ok
17:44:07.0310 0x0cdc  [ 92F6E3E6D3F1795263EB34B37F74AEF7, 33AB1ECCA1216AF1995E1DB4F11E48156FF62391D7C176C8A4CC1037B9CB3A27 ] vpci            C:\Windows\System32\drivers\vpci.sys
17:44:07.0319 0x0cdc  vpci - ok
17:44:07.0323 0x0cdc  [ FD9BCB8920973CEAD4D49DC7A6D8A618, 34AB4A485FB40DF737600006D8323BE927FB0BDA2BC170F4C123BE775EAE7CC8 ] vsmraid         C:\Windows\system32\drivers\vsmraid.sys
17:44:07.0333 0x0cdc  vsmraid - ok
17:44:07.0360 0x0cdc  [ 01FFD5AF533F2CFDF26DDDC9313731C1, BFF0F2E57CD2358AC8F519F6F5692A46D97EC4E9B763D47101CEF31712FD4738 ] VSS             C:\Windows\system32\vssvc.exe
17:44:07.0407 0x0cdc  VSS - ok
17:44:07.0417 0x0cdc  [ 0C111F220798CCE80484026E06822379, B98A5E44D3ABA67E6DE99E18BF3C2C606923E6269E262665C721F672ACBBED2A ] VSTXRAID        C:\Windows\system32\drivers\vstxraid.sys
17:44:07.0429 0x0cdc  VSTXRAID - ok
17:44:07.0432 0x0cdc  [ 607639716E9DB1CEF4E18B5B229293B4, 1D997177093F907EFE8A04AD10443BB9C355C0D7657DBD449E7EE7FCABC3ECBC ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
17:44:07.0443 0x0cdc  vwifibus - ok
17:44:07.0447 0x0cdc  [ B1ED64E628763148BF84FBE23F2AD711, 6182A39675E6049BC3DD353694720795A8E3D0331509AA8ABA4883D5C569AD5E ] vwififlt        C:\Windows\system32\drivers\vwififlt.sys
17:44:07.0457 0x0cdc  vwififlt - ok
17:44:07.0468 0x0cdc  [ 76C1CC611352499326001F25A3ED15F8, 228BFA8A01BB1B3868576D509A2EA6F3D37FEDC8F12D4DC4E0A84CE926C6D1B1 ] W32Time         C:\Windows\system32\w32time.dll
17:44:07.0490 0x0cdc  W32Time - ok
17:44:07.0494 0x0cdc  [ 55D00B785A7587F4263D125817871283, B92400B229099C1E243F2B149881A1423A2E9C8CA2D77D868B9B923BFDEC7FF2 ] WacomPen        C:\Windows\System32\drivers\wacompen.sys
17:44:07.0503 0x0cdc  WacomPen - ok
17:44:07.0512 0x0cdc  [ 1483BE4D0135C378CB61D3CD73AB3E03, B7309C9E4F370860C507BF52D17234CDF4A7FAE95D2D822714E07EF5DEC0249B ] WalletService   C:\Windows\system32\WalletService.dll
17:44:07.0532 0x0cdc  WalletService - ok
17:44:07.0537 0x0cdc  [ CEF3D306C09BEC1A800E9B4A06F859F6, 75D21F97E9F94FA97024F945AF512FEC94F88DD8073F3FAD92A6E0A9FDC586DB ] wanarp          C:\Windows\system32\DRIVERS\wanarp.sys
17:44:07.0551 0x0cdc  wanarp - ok
17:44:07.0555 0x0cdc  [ CEF3D306C09BEC1A800E9B4A06F859F6, 75D21F97E9F94FA97024F945AF512FEC94F88DD8073F3FAD92A6E0A9FDC586DB ] wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
17:44:07.0570 0x0cdc  wanarpv6 - ok
17:44:07.0600 0x0cdc  [ 30B8286F8FE1AE90A583100D45E02247, 3C86A4A5E21F9A1267EA231B20914E0A162BA4C25FE8917AD3AB6D504DA5BE0C ] wbengine        C:\Windows\system32\wbengine.exe
17:44:07.0645 0x0cdc  wbengine - ok
17:44:07.0668 0x0cdc  [ 7C4FAE7A8D55C897E5AE681B245A005F, 7E1E6299579BF02E89C5B828A1C19A43FF4E1F43D46D058F8DC0A8E6421C86A7 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
17:44:07.0697 0x0cdc  WbioSrvc - ok
17:44:07.0703 0x0cdc  [ E330144B97D493AA886000DCAAA8DAF5, ED86F46F5A76FD8F06CA98BD61B174ADB9AD4B065394356872708DF8B614E4F9 ] wcifs           C:\Windows\system32\drivers\wcifs.sys
17:44:07.0713 0x0cdc  wcifs - ok
17:44:07.0728 0x0cdc  [ 32960EA9CF836D7DD77767DCB68CE230, 679446A4FAB0331C181D2716CAEA225267C6164BB9867E360C5B3D6AB1083195 ] Wcmsvc          C:\Windows\System32\wcmsvc.dll
17:44:07.0760 0x0cdc  Wcmsvc - ok
17:44:07.0774 0x0cdc  [ D50645235A507B0546B1B5CF7D0B8849, 19F5FE10C953B8EE8EEDA9A9F7F2E97AA193BB085E7FC364066686089ADD1C9F ] wcncsvc         C:\Windows\System32\wcncsvc.dll
17:44:07.0796 0x0cdc  wcncsvc - ok
17:44:07.0801 0x0cdc  [ AEA1093B751339267D8C8C1EF3D669CF, 8F3325E7FB16BD856A0593C36F2E3E018909038C52CD5F92E116E0C1366F31CB ] wcnfs           C:\Windows\system32\drivers\wcnfs.sys
17:44:07.0811 0x0cdc  wcnfs - ok
17:44:07.0814 0x0cdc  [ D520B1B849B6D4D707AB31722B952C2D, 149BABB7BD63C1F212ADD9306C84FFB2A5CE6DC435BD3213EAB787E9B222C61F ] WdBoot          C:\Windows\system32\drivers\WdBoot.sys
17:44:07.0823 0x0cdc  WdBoot - ok
17:44:07.0839 0x0cdc  [ 5030C76047D756263093A47B82970868, E772F15973F6DE36851DD230F1F4190746CD81CA1E7284DC074711C4BF45CAF0 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
17:44:07.0859 0x0cdc  Wdf01000 - ok
17:44:07.0868 0x0cdc  [ 29FF9199EDEB4F5470BB134D1A2563D2, 94713F98A6EA6042203D5DD0DE6758F5F0F331F7D4BB05E91EF20CEEEBD6780F ] WdFilter        C:\Windows\system32\drivers\WdFilter.sys
17:44:07.0880 0x0cdc  WdFilter - ok
17:44:07.0884 0x0cdc  [ E7A7E8803E66B7CCED95D327A4DBC135, 401ECD953D4014A95C9022822D9ACEC1A68C917281DBA2365503A473FC6D9507 ] WdiServiceHost  C:\Windows\system32\wdi.dll
17:44:07.0899 0x0cdc  WdiServiceHost - ok
17:44:07.0903 0x0cdc  [ E7A7E8803E66B7CCED95D327A4DBC135, 401ECD953D4014A95C9022822D9ACEC1A68C917281DBA2365503A473FC6D9507 ] WdiSystemHost   C:\Windows\system32\wdi.dll
17:44:07.0919 0x0cdc  WdiSystemHost - ok
17:44:07.0934 0x0cdc  [ 8CB606A3057355FD5A9DBDD1A0AC94EF, 6DD0B4A2270633086EBB569A00B87430EE6EF173525E341404B15845B57BE86D ] wdiwifi         C:\Windows\system32\DRIVERS\wdiwifi.sys
17:44:07.0960 0x0cdc  wdiwifi - ok
17:44:07.0965 0x0cdc  [ 17CF416CFF408190F5A4CBD79AB12E55, E376C8865C7EA633AE20D2CF940E4C7584AC783BAAF7941780FB6C4C84802F33 ] WdNisDrv        C:\Windows\system32\Drivers\WdNisDrv.sys
17:44:07.0974 0x0cdc  WdNisDrv - ok
17:44:07.0977 0x0cdc  WdNisSvc - ok
17:44:07.0983 0x0cdc  [ 3570C4E14F85CE0B537D126727ACA91C, A474C9E6B6E4E5945C63367C1D3D24D4782C4A4FEB00FAE15DFED099D8283078 ] WebClient       C:\Windows\System32\webclnt.dll
17:44:08.0000 0x0cdc  WebClient - ok
17:44:08.0007 0x0cdc  [ 1785F9C96A0BDEC1F6E0C79EF412F342, D6D4EDA69457BEDDA69C2F60FC4C2FAC97D46CD8E9C1804CCD68F169383583E3 ] Wecsvc          C:\Windows\system32\wecsvc.dll
17:44:08.0023 0x0cdc  Wecsvc - ok
17:44:08.0027 0x0cdc  [ B9175D63527B05131F2FA504CF0265F2, 1E43A17788F1B6A29E2889C81E0BE100D64BD3A9DEE7C154D9581F01D2D7D05F ] WEPHOSTSVC      C:\Windows\system32\wephostsvc.dll
17:44:08.0039 0x0cdc  WEPHOSTSVC - ok
17:44:08.0043 0x0cdc  [ 5C58EC0C9D4DE04DCDE56F6DCEA62080, 8ED386EDF4C39C339CE0BB2AC7E199C38705E5A6B3F56A4987B9A8ABD19BB59F ] wercplsupport   C:\Windows\System32\wercplsupport.dll
17:44:08.0058 0x0cdc  wercplsupport - ok
17:44:08.0063 0x0cdc  [ F899B355CC95AF26AB36E84E8A0DD685, C400F2F80FFF6473FEF066943C4A2AFF0FFE988A4F755757A2E5005C2A10DAD8 ] WerSvc          C:\Windows\System32\WerSvc.dll
17:44:08.0077 0x0cdc  WerSvc - ok
17:44:08.0082 0x0cdc  [ E1785942AC51FEE6826CDF02075C5AA9, 56FE7017684086F4F9C3A2C0D3AC00369BA0938BA3987EEBEE9A75B8E3CA0AE1 ] WFPLWFS         C:\Windows\system32\drivers\wfplwfs.sys
17:44:08.0091 0x0cdc  WFPLWFS - ok
17:44:08.0096 0x0cdc  [ B154618505A6A9026EFA6AB8C4123BF1, 713648D71AA027B4472E7E75B942630DBE7383687984B02A5E99C9E4192C95EB ] WiaRpc          C:\Windows\System32\wiarpc.dll
17:44:08.0108 0x0cdc  WiaRpc - ok
17:44:08.0111 0x0cdc  [ 0CF79A0EACFFBB75A50A469A27696D02, E112BF7B5A8D0B0AD2EA0E7B9FD4E8CFEC9371C8E94A60248292D688AFE715C4 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
17:44:08.0121 0x0cdc  WIMMount - ok
17:44:08.0123 0x0cdc  WinDefend - ok
17:44:08.0128 0x0cdc  [ 0DE131733317EB4BE67028366B0CAAC6, AC7DADBF03A3752B4D33CA19F03DBCEDD6F56893C2DA25C98B0AB07063D990E3 ] WindowsTrustedRT C:\Windows\system32\drivers\WindowsTrustedRT.sys
17:44:08.0137 0x0cdc  WindowsTrustedRT - ok
17:44:08.0140 0x0cdc  [ 92EB5D38BDF10C790450F3E46BF93A0E, 0FC027398DBD43EDC1F7D703C0B6DB20294DF34E67C9288442039B1A5663CE1B ] WindowsTrustedRTProxy C:\Windows\system32\drivers\WindowsTrustedRTProxy.sys
17:44:08.0147 0x0cdc  WindowsTrustedRTProxy - ok
17:44:08.0163 0x0cdc  [ C2A3B07F0118D61086C99BDCBAB6A6A3, 04D646BEF1C6F427503C594F0ECBB33140C3991A3A7AFB66B2C9581E358F9FD2 ] WinHttpAutoProxySvc C:\Windows\system32\winhttp.dll
17:44:08.0195 0x0cdc  WinHttpAutoProxySvc - ok
17:44:08.0200 0x0cdc  [ F95DE20312ACCA7761446DE152BD1F7C, F6C5ACA500C2182437F4A7402BD81C3A2B77C0BBD78BA31FB574DC1997FCBFE6 ] WinMad          C:\Windows\System32\drivers\winmad.sys
17:44:08.0208 0x0cdc  WinMad - ok
17:44:08.0218 0x0cdc  [ CD49CA8E3280ACEEC5ECF431A59F5EFD, 75F48EFC6DEE9E06B490703EE47602AFDEA51505285B02D2CF884601E71857CC ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
17:44:08.0232 0x0cdc  Winmgmt - ok
17:44:08.0278 0x0cdc  [ B8C0D620219ECAA23A2AC841EAF454D1, FB527C4D36929D7FAE2A837727C557B7823A72069EBCAB7D16C49E8B21E8D952 ] WinRM           C:\Windows\system32\WsmSvc.dll
17:44:08.0355 0x0cdc  WinRM - ok
17:44:08.0364 0x0cdc  [ 4EFB346BFDAEEB29316AA52BBB9852B1, 4BC5554F44BD9549D0A929D77BD410FA3EB502A7D0170303D369268672505494 ] WINUSB          C:\Windows\System32\drivers\WinUSB.SYS
17:44:08.0374 0x0cdc  WINUSB - ok
17:44:08.0378 0x0cdc  [ 8B9AFF5F08E66A6F1F1063DEC9457FB6, 98F2AF6988D125521FD34CAA48B9652922F0C8ECFAE9B0C1DF4B3CE6B9CF500F ] WinVerbs        C:\Windows\System32\drivers\winverbs.sys
17:44:08.0386 0x0cdc  WinVerbs - ok
17:44:08.0399 0x0cdc  [ ECD999D8412A3473C26B118F89DB9908, 5FB9B93E4B5482CCFF01D805DFA386FD8D3441BC81E7BD5DF89EE3078FD724F3 ] wisvc           C:\Windows\system32\flightsettings.dll
17:44:08.0423 0x0cdc  wisvc - ok
17:44:08.0465 0x0cdc  [ 7671078AEF4C0203B053A9642C401FF7, BBFADA89CD31F20ADDBFAFAD2E492C72D82BF2F8B823BB6773F04D229B62534C ] WlanSvc         C:\Windows\System32\wlansvc.dll
17:44:08.0531 0x0cdc  WlanSvc - ok
17:44:08.0570 0x0cdc  [ E15711970C5BE05E8D70B294D0AFF621, 30670CFC4DA57B4A3E0E895E4111100D847BB8041A258A303524CD96DC566482 ] wlidsvc         C:\Windows\system32\wlidsvc.dll
17:44:08.0629 0x0cdc  wlidsvc - ok
17:44:08.0634 0x0cdc  [ 6F4F4F5A007D1710BD76FB311DA97C07, FC0FEA4364F6BA4E31DBC82735D09D429CA3BE9AFCFF5D5E1263D8B27FC2CE3E ] WmiAcpi         C:\Windows\System32\drivers\wmiacpi.sys
17:44:08.0643 0x0cdc  WmiAcpi - ok
17:44:08.0651 0x0cdc  [ 3CDDFF6CAD962C5EF1C52FD667C358B6, F6F09145E9461EB17172988D26749FCF36920A1A683459334D04A6D072B31A92 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
17:44:08.0664 0x0cdc  wmiApSrv - ok
17:44:08.0666 0x0cdc  WMPNetworkSvc - ok
17:44:08.0670 0x0cdc  [ 92C6184E6F62D542B8DCDC93BD73CB7E, CFC98601730ADEE4802C55C07B6DFF6037E3EECC818802A698448C68819F5308 ] wod0205         C:\Windows\System32\drivers\wod0205.sys
17:44:08.0676 0x0cdc  wod0205 - ok
17:44:08.0682 0x0cdc  [ 43C8D087B31C592163B33A4BDA540E40, 3A6C4E5E56931B29321DCC723585F2F0E804EF4DCDEAB2A8687F30FC3AE70E43 ] Wof             C:\Windows\system32\drivers\Wof.sys
17:44:08.0692 0x0cdc  Wof - ok
17:44:08.0725 0x0cdc  [ 909CB4BBF7B08E78C363000E09E79A6F, 217205D1B5EE03274AFF9405AED6D2A5665CBA4C3876E84B53DA44920CDF9CB1 ] workfolderssvc  C:\Windows\system32\workfolderssvc.dll
17:44:08.0778 0x0cdc  workfolderssvc - ok
17:44:08.0784 0x0cdc  [ F02930EB91596042F2221397D60AFCE5, 10E2AB0993B67CBAA9E11C68280608965064EC9F7E0C570F5B453FACADB8AB5D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
17:44:08.0796 0x0cdc  WPDBusEnum - ok
17:44:08.0805 0x0cdc  [ 75A9284F01FE7CB1A7D5EAE5C1EB4F33, 390EF23AEA06D8711555F7979FF8BE0620B53C1A551638C4EC6FB7C6678965B3 ] WpdUpFltr       C:\Windows\system32\drivers\WpdUpFltr.sys
17:44:08.0812 0x0cdc  WpdUpFltr - ok
17:44:08.0880 0x0cdc  [ 60E2EB3E7B7F15C25E02462159F90707, D8344B529EEC0D4922CAC3E6897CC9F191ACF1376017BE38ED6BF6019F1ED181 ] WpnService      C:\Windows\system32\WpnService.dll
17:44:08.0897 0x0cdc  WpnService - ok
17:44:08.0901 0x0cdc  [ C7C91FB86A3C6CD7619725A88ED1884C, 132C43C518F37BF303D768BD5FB0AB835F693C43FE693937D804A34E940D770F ] WpnUserService  C:\Windows\System32\WpnUserService.dll
17:44:08.0913 0x0cdc  WpnUserService - ok
17:44:08.0918 0x0cdc  [ 36D7B73ADC3E10607ED6EC874AFB5D1E, 1737B3E4D2CA76BB27903BF460E4960E6A0BC32D35069AC7C5E4B07F625F3282 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
17:44:08.0926 0x0cdc  ws2ifsl - ok
17:44:08.0933 0x0cdc  [ 9A0E0B836413EB0BC885532D2A5389D6, AFEE4A0578D5581E4D72999A33C0DEA6253BD891F611AFF9AFDE4160A60105F3 ] wscsvc          C:\Windows\System32\wscsvc.dll
17:44:08.0947 0x0cdc  wscsvc - ok
17:44:08.0951 0x0cdc  WSearch - ok
17:44:08.0992 0x0cdc  [ 5163F5BABAE1FF8CCC0AFD60B6EDD20A, E4F3FC2D7E9995DD34D6DD392D33B51649077985ECA0BF2AF0552D72DC3DF08E ] wuauserv        C:\Windows\system32\wuaueng.dll
17:44:09.0058 0x0cdc  wuauserv - ok
17:44:09.0065 0x0cdc  [ AED7FE551E8672B824A56324076183EB, FFE543AAEFDEFFE6B20C244DB141A9425BDA88ED36F4870F0B70FEC433BDF0C1 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
17:44:09.0076 0x0cdc  WudfPf - ok
17:44:09.0082 0x0cdc  [ CEFAB17FD7DFCFA515626C306262E89D, 9D2B728DDD478580987E2DB7AA4DA81D77F3362F536AC1CADED20EB6ECEBB55D ] WUDFRd          C:\Windows\system32\drivers\WudfRd.sys
17:44:09.0095 0x0cdc  WUDFRd - ok
17:44:09.0100 0x0cdc  [ 47F6450F28BAA32B2AB0D6BE00996249, C8A47D6ADF89AD613AB685C6224B9099DCEFDCD8ABCF703542AFDC356404116E ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
17:44:09.0113 0x0cdc  wudfsvc - ok
17:44:09.0120 0x0cdc  [ CEFAB17FD7DFCFA515626C306262E89D, 9D2B728DDD478580987E2DB7AA4DA81D77F3362F536AC1CADED20EB6ECEBB55D ] WUDFWpdFs       C:\Windows\system32\DRIVERS\WUDFRd.sys
17:44:09.0133 0x0cdc  WUDFWpdFs - ok
17:44:09.0138 0x0cdc  [ CEFAB17FD7DFCFA515626C306262E89D, 9D2B728DDD478580987E2DB7AA4DA81D77F3362F536AC1CADED20EB6ECEBB55D ] WUDFWpdMtp      C:\Windows\system32\DRIVERS\WUDFRd.sys
17:44:09.0151 0x0cdc  WUDFWpdMtp - ok
17:44:09.0172 0x0cdc  [ E231728BC515A4B85543AF74A1FEDFCB, 5D250D7D789B5BB56BFA2E7A109BCEB3686B7636C54D89F4E9804101D145C955 ] WwanSvc         C:\Windows\System32\wwansvc.dll
17:44:09.0213 0x0cdc  WwanSvc - ok
17:44:09.0239 0x0cdc  [ F39D6915451D9226AC9A5E7AE70E2ABA, E05D678DC0423A4D0EB8B3BB5A942721BB4F3B0BED22748252DBD6053FE956F1 ] XblAuthManager  C:\Windows\System32\XblAuthManager.dll
17:44:09.0274 0x0cdc  XblAuthManager - ok
17:44:09.0298 0x0cdc  [ 765FF96467A26C4C03281ECA426EC2D9, 2526B03C518D72F429C29BA4D4F11707AF277BF71520A1A92238A932950AE161 ] XblGameSave     C:\Windows\System32\XblGameSave.dll
17:44:09.0335 0x0cdc  XblGameSave - ok
17:44:09.0344 0x0cdc  [ 9627BBAA50878F6833A6A7843EE3B1D9, 637566BB56501C4D11E3B6E6AC1C602D880C9D357CCE3DF1DF74EE672744F2B7 ] xboxgip         C:\Windows\System32\drivers\xboxgip.sys
17:44:09.0358 0x0cdc  xboxgip - ok
17:44:09.0377 0x0cdc  [ 335E6F2BE58523B295945C840C185B00, 94ED7E2CB212A3D55B8A2CB90CD1D02A6AF92DC0DDD487CB5B7CAC9883343460 ] XboxNetApiSvc   C:\Windows\system32\XboxNetApiSvc.dll
17:44:09.0415 0x0cdc  XboxNetApiSvc - ok
17:44:09.0420 0x0cdc  [ 63088A3361D9A308F328F11E9099DD87, E03FDB932FC57F199C8F8A8EADA338BDF7D2F9C6CB8FAB679A92B48B1E5AFE8A ] xinputhid       C:\Windows\System32\drivers\xinputhid.sys
17:44:09.0429 0x0cdc  xinputhid - ok
17:44:09.0435 0x0cdc  [ 80D89A9C089F1FADCDFD3C593B67E9EF, 88E0C708C0BFCC140AD7763F6BE586EFEF1CADDDAD7850A4065AF6507CD7A672 ] xusb22          C:\Windows\System32\drivers\xusb22.sys
17:44:09.0447 0x0cdc  xusb22 - ok
17:44:09.0452 0x0cdc  ================ Scan global ===============================
17:44:09.0456 0x0cdc  [ 0C710DB449712EE13ACE733695DB7780, BBC7875B38D318CE4E88979D083AC72E8993254A466A8A6882DDE9E0C3B687A3 ] C:\Windows\system32\basesrv.dll
17:44:09.0462 0x0cdc  [ C509CCD23B086DFC9EAF86E280043672, BF431DC1C618BAF0CB67976C5A8BCCDC3F3CB266F83C614D605BA559BA8EDFD8 ] C:\Windows\system32\winsrv.dll
17:44:09.0470 0x0cdc  [ 1EE06E957B0B2CA52D26DA7861E160EF, 4B743A1C7010138F5F6684BBCF7CAD6FD05F49920BDD3FDB776347AA6B44AB94 ] C:\Windows\system32\sxssrv.dll
17:44:09.0482 0x0cdc  [ 3C69CC28665854F1AAB4B4005005FA31, 2750F5ECCD448C07E3402AA64EA625D27C6BC1D000A3FFE57C03D62428BB46C4 ] C:\Windows\system32\services.exe
17:44:09.0491 0x0cdc  [ Global ] - ok
17:44:09.0491 0x0cdc  ================ Scan MBR ==================================
17:44:09.0493 0x0cdc  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
17:44:09.0549 0x0cdc  \Device\Harddisk0\DR0 - ok
17:44:09.0580 0x0cdc  [ 508F4A6A6A6B3DADC6D881D9948389D2 ] \Device\Harddisk1\DR1
17:44:10.0880 0x0cdc  \Device\Harddisk1\DR1 - ok
17:44:10.0880 0x0cdc  ================ Scan VBR ==================================
17:44:10.0882 0x0cdc  [ 1D12EB2AA25D96DC18D080975AFF67F0 ] \Device\Harddisk0\DR0\Partition1
17:44:10.0883 0x0cdc  \Device\Harddisk0\DR0\Partition1 - ok
17:44:10.0885 0x0cdc  [ 6973A7C044C18BB8111A8866BCBA0EFE ] \Device\Harddisk0\DR0\Partition2
17:44:10.0886 0x0cdc  \Device\Harddisk0\DR0\Partition2 - ok
17:44:10.0888 0x0cdc  [ 9CED4B08CB5D7F3C5075A83A769E1D41 ] \Device\Harddisk1\DR1\Partition1
17:44:10.0889 0x0cdc  \Device\Harddisk1\DR1\Partition1 - ok
17:44:10.0889 0x0cdc  ================ Scan generic autorun ======================
17:44:10.0893 0x0cdc  [ 0C3154D0620F974AD5C4E8D87626C8CF, 4E6B751F9C0D5D4833A12166BC5142E0A7402E98D00F570926ED9CA0936A8007 ] C:\Windows\system32\igfxtray.exe
17:44:10.0902 0x0cdc  IgfxTray - ok
17:44:10.0912 0x0cdc  [ CF40080765D6F66FA93318C0DB6C7D1F, 015EE5BE439DAC6D3F7C7471EEF554C11F28947492E3F7AA14BB72622C327DCD ] C:\Windows\system32\igfxpers.exe
17:44:10.0924 0x0cdc  Persistence - ok
17:44:10.0929 0x0cdc  [ 5677C8C60F4659E8626AC9036EEF38DF, 1C7D3EC3BCB3E34900DD9556A3EBAF449C68585DC8E07682E680790497105B8B ] C:\Program Files\Classic Shell\ClassicStartMenu.exe
17:44:10.0937 0x0cdc  Classic Start Menu - ok
17:44:10.0940 0x0cdc  [ B69B3F28C5DB496202C88F5A181640AC, 6ECD6DCFE27A043457BA910289849534ED9D173856DAF694687366E1A2C7A135 ] C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe
17:44:10.0945 0x0cdc  Avira SystrayStartTrigger - ok
17:44:10.0964 0x0cdc  [ 1BC31F797516DC7B7446B62A849D5905, 49B35A41F1C3739800CBA2A559C2AEFE89FBC090F8305681AF3B379B639E16AA ] C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
17:44:10.0983 0x0cdc  avgnt - ok
17:44:10.0990 0x0cdc  [ A613ECAD4E6C99B6DAD2CDFEAA134695, 9F67C28589863B388456BAF9C42AEB64E5FD17F8BDE57DA785CC6046CD426055 ] C:\Program Files (x86)\Razer\RzWizard\RzWizard.exe
17:44:10.0998 0x0cdc  RzWizard - ok
17:44:11.0009 0x0cdc  [ AD055EE2A9A7AB3589BCDA28D66C1235, DD47CD4AF842175DDA65C13AE849B9CC14A6BB2BBDB1ECCC272A17B9EE052C80 ] C:\Program Files (x86)\ROCCAT\Kone Pure Optical Black Edition\KoneBlackMonitor.exe
17:44:11.0026 0x0cdc  RoccatKoneBulk - detected UnsignedFile.Multi.Generic ( 1 )
17:44:11.0325 0x0cdc  RoccatKoneBulk ( UnsignedFile.Multi.Generic ) - warning
17:44:11.0325 0x0cdc  Force sending object to P2P due to detect: C:\Program Files (x86)\ROCCAT\Kone Pure Optical Black Edition\KoneBlackMonitor.exe
17:44:11.0469 0x0cdc  Object send P2P result: true
17:44:11.0745 0x0cdc  [ 114F7096CEFB9C6C57BB3952843176EB, E2887611C07C0DFD1CB9B5AF5BFD287867C70D77AB123186144EE7D6B62D7452 ] C:\Program Files (x86)\Corsair\Corsair Utility Engine\CUE.exe
17:44:11.0964 0x0cdc  Corsair Utility Engine - ok
17:44:11.0985 0x0cdc  [ 5153C06FC9D4D094D1A785545928B134, 0037C935722663F9EF028F841DE222FC6418E9D60939AB60C965807E67A458DC ] C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
17:44:11.0998 0x0cdc  SunJavaUpdateSched - ok
17:44:12.0174 0x0cdc  [ 1496120E3867FD75AE5D4EAD6E618E7A, 8D8A2FD43D33A3F7A177783921BB7E50FECBAEF1E09CD42BCDC851375F3294D1 ] C:\Windows\SysWOW64\OneDriveSetup.exe
17:44:12.0315 0x0cdc  OneDriveSetup - ok
17:44:12.0463 0x0cdc  [ 1496120E3867FD75AE5D4EAD6E618E7A, 8D8A2FD43D33A3F7A177783921BB7E50FECBAEF1E09CD42BCDC851375F3294D1 ] C:\Windows\SysWOW64\OneDriveSetup.exe
17:44:12.0600 0x0cdc  OneDriveSetup - ok
17:44:12.0791 0x0cdc  [ 1496120E3867FD75AE5D4EAD6E618E7A, 8D8A2FD43D33A3F7A177783921BB7E50FECBAEF1E09CD42BCDC851375F3294D1 ] C:\Windows\SysWOW64\OneDriveSetup.exe
17:44:12.0930 0x0cdc  OneDriveSetup - ok
17:44:12.0964 0x0cdc  [ 44348495F9D6ED21F4EFB3FF80677D99, 05B76248764B2BF7F9229626D7EFAFF96B724D38A82969EBE376CBE879E30450 ] C:\Users\habob\AppData\Local\Microsoft\OneDrive\OneDrive.exe
17:44:12.0995 0x0cdc  OneDrive - ok
17:44:13.0056 0x0cdc  [ C1CE66436AFE9216A3E7C650C3D0F8AB, B2EF7A948604FB531A9744AACE2706C20B38CE14AD122CF5BA4B670078D155D9 ] C:\Program Files (x86)\Gyazo\GyStation.exe
17:44:13.0118 0x0cdc  Gyazo - ok
17:44:13.0170 0x0cdc  [ FF206944E3A8590FABE10FB2C321AA6D, 77C555667674C9E4473C64921C5F2A7D723FBE28A73EB5EBAA777CD04D11C06B ] C:\Program Files (x86)\Steam\steam.exe
17:44:13.0222 0x0cdc  Steam - ok
17:44:13.0226 0x0cdc  Skype - ok
17:44:13.0368 0x0cdc  [ 2269768074F6A93E454BA384ED9652E2, 3BB698018941471327A3031CC0F4011D69EBA03B00E9E6F2D99922639DCCDA59 ] C:\Program Files\CCleaner\CCleaner64.exe
17:44:13.0524 0x0cdc  CCleaner Monitoring - ok
17:44:13.0602 0x0cdc  [ 8A56226A650DFC6F12F9BB91F52449A9, 28F657D218A51BB16D17830CACFCAEF2BBE6FA6C9B16A8195DF8AD45FF68B823 ] C:\Program Files (x86)\Unified Remote 3\RemoteServerWin.exe
17:44:13.0698 0x0cdc  Unified Remote V3 - ok
17:44:13.0789 0x0cdc  [ B8E262F4824CD03AE58D70B33307DCD5, 74EECAD827C5C307A2A5281299C15EED24DDD54E3B8E656B830F6932A3BE7D62 ] C:\Program Files\DAEMON Tools Lite\DTAgent.exe
17:44:13.0886 0x0cdc  DAEMON Tools Lite Automount - ok
17:44:13.0891 0x0cdc  Waiting for KSN requests completion. In queue: 235
17:44:14.0898 0x0cdc  AV detected via SS2: Avira Antivirus, C:\Program Files (x86)\Avira\Antivirus\wsctool.exe ( 15.0.24.143 ), 0x41000 ( enabled : updated )
17:44:14.0899 0x0cdc  AV detected via SS2: Windows Defender, C:\Program Files\Windows Defender\MSASCui.exe ( 4.10.14393.187 ), 0x60100 ( disabled : updated )
17:44:14.0901 0x0cdc  Win FW state via NFP2: enabled ( trusted )
17:44:14.0959 0x0cdc  ============================================================
17:44:14.0959 0x0cdc  Scan finished
17:44:14.0959 0x0cdc  ============================================================
17:44:14.0964 0x22a0  Detected object count: 1
17:44:14.0964 0x22a0  Actual detected object count: 1
17:44:25.0565 0x22a0  RoccatKoneBulk ( UnsignedFile.Multi.Generic ) - skipped by user
17:44:25.0565 0x22a0  RoccatKoneBulk ( UnsignedFile.Multi.Generic ) - User select action: Skip
         

Servus,


hast du diese Remote-Software installiert?

HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\Run: [Unified Remote V3] => C:\Program Files (x86)\Unified Remote 3\RemoteServerWin.exe [4340992 2016-07-06] (Unified Intents AB)

Remote-Software kann theoretisch ein Einfallstor sein.

Tag,

ja damit benutze ich mein Handy als Tastatur, wurde aber auch schon seit Monaten nicht mehr benutzt, und auf dem Handy ist das Programm auch nicht mehr.

Servus,


dann hast du nichts dagegen, wenn wir es später mit entfernen?






Schritt 1
Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser.
• Starte die adwcleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Werkzeuge > Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel
  • "Prefetch" Dateien
  • Proxy
  • Winsock
  • Internet Explorer Richtlinien
  • Chrome Richtlinien
• Bestätige die Auswahl mit Ok.
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen (auch dann wenn AdwCleaner sagt, dass nichts gefunden wurde) und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 2
Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad.
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scan, wähle den Bedrohungs-Scan aus und klicke auf Scan starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Ausgewählte Elemente in die Quarantäne verschieben.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM nach dem Neustart, klicke auf Berichte.
• Wähle den neuesten Scan-Bericht aus, klicke auf Bericht anzeigen und dann auf Export.
• Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 3

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Schritt 4

• Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Scan.
• FRST erstellt nun zwei Logdateien (FRST.txt und Addition.txt).
• Poste mir beide Logdateien mit deiner nächsten Antwort.

Bitte poste mit deiner nächsten Antwort

• die Logdatei von AdwCleaner,
• die Logdatei von MBAM,
• die Logdatei von JRT,
• die beiden neuen Logdateien von FRST.

Hallo,

nein können wir gerne entfernen


Edit: bei dem Adwcleaner waren eine ganze reihe von Logs zu sehen C0 C2 C3 S0 S1 S2 S3,
habe die Logs alle Kopiert und in eine txt datei gepackt und gepostet


ADWcleaner log

C0AdwCleaner Logfile:
AdwCleaner Logfile:
AdwCleaner Logfile:
AdwCleaner Logfile:
AdwCleaner Logfile:
AdwCleaner Logfile:

	
	
# AdwCleaner v6.030 - Bericht erstellt am 21/10/2016 um 21:11:23
# Aktualisiert am 19/10/2016 von Malwarebytes
# Datenbank : 2016-10-18.1 [Server]
# Betriebssystem : Windows 10 Pro  (X64)
# Benutzername : habob - DESKTOP-PNO8QHG
# Gestartet von : C:\Users\habob\Desktop\TEST\adwcleaner_6.030.exe
# Modus: Löschen
# Unterstützung : hxxps://www.malwarebytes.com/support



***** [ Dienste ] *****

[-] Dienst gelöscht: YSearchUtilSvc


***** [ Ordner ] *****

[-] Ordner gelöscht: C:\Users\habob\AppData\Local\YSearchUtil
[-] Ordner gelöscht: C:\Program Files (x86)\Yahoo!\yset
[-] Ordner gelöscht: C:\Windows\SysWoW64\config\systemprofile\AppData\Local\YSearchUtil


***** [ Dateien ] *****

[-] Datei gelöscht: C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\extensions\YouTubeAutoReplay@arikv.com.xpi
[-] Datei gelöscht: C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\extensions\jid1-16aeif9OQIRKxA@jetpack.xpi


***** [ DLL ] *****



***** [ WMI ] *****



***** [ Verknüpfungen ] *****

[-] Verknüpfung desinfiziert: C:\Users\habob\Desktop\SpeedFan.lnk


***** [ Aufgabenplanung ] *****



***** [ Registrierungsdatenbank ] *****

[-] Schlüssel gelöscht: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\Software\csastats
[#] Schlüssel mit Neustart gelöscht: HKCU\Software\csastats
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! SearchSet
[#] Schlüssel mit Neustart gelöscht: [x64] HKCU\Software\csastats


***** [ Browser ] *****



*************************

:: "Tracing" Schlüssel gelöscht
:: Winsock Einstellungen zurückgesetzt

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [1740 Bytes] - [21/10/2016 21:11:23]
C:\AdwCleaner\AdwCleaner[S0].txt - [1995 Bytes] - [21/10/2016 21:10:53]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [1886 Bytes] ##########
         
 
 

[/CODE][/CODE][/CODE]
[/CODE]
--- --- ---
--- --- ---
--- --- ---
--- --- ---
--- --- ---
--- --- ---
c2AdwCleaner Logfile:
AdwCleaner Logfile:
AdwCleaner Logfile:
AdwCleaner Logfile:
AdwCleaner Logfile:
AdwCleaner Logfile:

# AdwCleaner v6.041 - Bericht erstellt am 21/12/2016 um 17:51:24
# Aktualisiert am 16/12/2016 von Malwarebytes
# Datenbank : 2016-12-21.1 [Server]
# Betriebssystem : Windows 10 Pro  (X64)
# Benutzername : habob - DESKTOP-PNO8QHG
# Gestartet von : E:\1FireFOX DLS\adwcleaner_6.041(1).exe
# Modus: Löschen
# Unterstützung : https://www.malwarebytes.com/support



***** [ Dienste ] *****



***** [ Ordner ] *****



***** [ Dateien ] *****

[#] Datei gelöscht: C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\extensions\YouTubeAutoReplay@arikv.com.xpi


***** [ DLL ] *****



***** [ WMI ] *****



***** [ Verknüpfungen ] *****

c3

# AdwCleaner v6.042 - Bericht erstellt am 11/01/2017 um 17:04:56
# Aktualisiert am 06/01/2017 von Malwarebytes
# Datenbank : 2017-01-11.1 [Server]
# Betriebssystem : Windows 10 Pro  (X64)
# Benutzername : habob - DESKTOP-PNO8QHG
# Gestartet von : C:\Users\habob\Desktop\troja\AdwCleaner_6.042.exe
# Modus: Löschen
# Unterstützung : https://www.malwarebytes.com/support



***** [ Dienste ] *****



***** [ Ordner ] *****



***** [ Dateien ] *****

[-] Datei gelöscht: C:\END
[-] Datei gelöscht: C:\Users\habob\AppData\Local\Temp\Utils.dll
[-] Datei gelöscht: C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\extensions\YouTubeAutoReplay@arikv.com.xpi


***** [ DLL ] *****



***** [ WMI ] *****



***** [ Verknüpfungen ] *****



***** [ Aufgabenplanung ] *****



***** [ Registrierungsdatenbank ] *****



***** [ Browser ] *****



*************************

:: "Tracing" Schlüssel gelöscht
:: Winsock Einstellungen zurückgesetzt
:: "Prefetch" Dateien gelöscht
:: Internet Explorer Richtlinien gelöscht
:: Chrome Richtlinien gelöscht

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [1969 Bytes] - [21/10/2016 20:11:23]
C:\AdwCleaner\AdwCleaner[C2].txt - [1321 Bytes] - [21/12/2016 17:51:24]
C:\AdwCleaner\AdwCleaner[C3].txt - [1311 Bytes] - [11/01/2017 17:04:56]
C:\AdwCleaner\AdwCleaner[S0].txt - [1995 Bytes] - [21/10/2016 20:10:53]
C:\AdwCleaner\AdwCleaner[S1].txt - [1582 Bytes] - [21/12/2016 17:51:07]
C:\AdwCleaner\AdwCleaner[S2].txt - [1823 Bytes] - [11/01/2017 17:04:25]

########## EOF - C:\AdwCleaner\AdwCleaner[C3].txt - [1603 Bytes] ##########
         

[/CODE][/CODE][/CODE][/CODE]
[/CODE]
--- --- ---
--- --- ---
--- --- ---
--- --- ---
--- --- ---
--- --- ---
s0AdwCleaner Logfile:
AdwCleaner Logfile:
AdwCleaner Logfile:
AdwCleaner Logfile:
AdwCleaner Logfile:
AdwCleaner Logfile:

# AdwCleaner v6.030 - Bericht erstellt am 21/10/2016 um 21:10:53
# Aktualisiert am 19/10/2016 von Malwarebytes
# Datenbank : 2016-10-18.1 [Server]
# Betriebssystem : Windows 10 Pro  (X64)
# Benutzername : habob - DESKTOP-PNO8QHG
# Gestartet von : C:\Users\habob\Desktop\TEST\adwcleaner_6.030.exe
# Modus: Suchlauf
# Unterstützung : https://www.malwarebytes.com/support



***** [ Dienste ] *****

Dienst Gefunden: YSearchUtilSvc


***** [ Ordner ] *****

Ordner Gefunden: C:\Users\habob\AppData\Local\YSearchUtil
Ordner Gefunden: C:\Program Files (x86)\Yahoo!\yset
Ordner Gefunden: C:\Windows\SysWoW64\config\systemprofile\AppData\Local\YSearchUtil


***** [ Dateien ] *****

Datei Gefunden: C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\extensions\YouTubeAutoReplay@arikv.com.xpi
Datei Gefunden: C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\extensions\jid1-16aeif9OQIRKxA@jetpack.xpi


***** [ DLL ] *****

Keine infizierten DLLs gefunden.


***** [ WMI ] *****

Keine schädlichen Schlüssel gefunden.


***** [ Verknüpfungen ] *****

Verknüpfung infiziert: C:\Users\habob\Desktop\SpeedFan.lnk ( /NOSMBSCAN /mountvol d:\ /d )


***** [ Aufgabenplanung ] *****

Keine schädlichen Aufgaben gefunden.


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\Software\csastats
Schlüssel Gefunden: HKCU\Software\csastats
Schlüssel Gefunden: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! SearchSet
Schlüssel Gefunden: [x64] HKCU\Software\csastats


***** [ Internetbrowser ] *****

Keine schädlichen Elemente in Firefox basierten Browsern gefunden.
Keine schädlichen Elemente in Chrome basierten Browsern gefunden.

*************************

C:\AdwCleaner\AdwCleaner[S0].txt - [1839 Bytes] - [21/10/2016 21:10:53]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1912 Bytes] ##########
         

[/CODE][/CODE][/CODE][/CODE]
[/CODE]
--- --- ---
--- --- ---
--- --- ---
--- --- ---
--- --- ---
--- --- ---

s1AdwCleaner Logfile:
AdwCleaner Logfile:
AdwCleaner Logfile:
AdwCleaner Logfile:
AdwCleaner Logfile:
AdwCleaner Logfile:

# AdwCleaner v6.041 - Bericht erstellt am 21/12/2016 um 17:51:07
# Aktualisiert am 16/12/2016 von Malwarebytes
# Datenbank : 2016-12-21.1 [Server]
# Betriebssystem : Windows 10 Pro  (X64)
# Benutzername : habob - DESKTOP-PNO8QHG
# Gestartet von : E:\1FireFOX DLS\adwcleaner_6.041(1).exe
# Modus: Suchlauf
# Unterstützung : https://www.malwarebytes.com/support



***** [ Dienste ] *****

Keine schädlichen Dienste gefunden.


***** [ Ordner ] *****

Keine schädlichen Ordner gefunden.


***** [ Dateien ] *****

Datei Gefunden: C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\extensions\YouTubeAutoReplay@arikv.com.xpi


***** [ DLL ] *****

Keine infizierten DLLs gefunden.


***** [ WMI ] *****

Keine schädlichen Schlüssel gefunden.


***** [ Verknüpfungen ] *****

Keine infizierten Verknüpfungen gefunden.


***** [ Aufgabenplanung ] *****

Keine schädlichen Aufgaben gefunden.


***** [ Registrierungsdatenbank ] *****

Keine schädlichen Elemente in der Registrierungsdatenbank gefunden.


***** [ Internetbrowser ] *****

Keine schädlichen Elemente in Firefox basierten Browsern gefunden.
Keine schädlichen Elemente in Chrome basierten Browsern gefunden.

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [1969 Bytes] - [21/10/2016 20:11:23]
C:\AdwCleaner\AdwCleaner[S0].txt - [1995 Bytes] - [21/10/2016 20:10:53]
C:\AdwCleaner\AdwCleaner[S1].txt - [1430 Bytes] - [21/12/2016 17:51:07]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1503 Bytes] ##########
         

[/CODE][/CODE][/CODE][/CODE]
[/CODE]
--- --- ---
--- --- ---
--- --- ---
--- --- ---
--- --- ---
--- --- ---
s2AdwCleaner Logfile:
AdwCleaner Logfile:
AdwCleaner Logfile:
AdwCleaner Logfile:
AdwCleaner Logfile:
AdwCleaner Logfile:

# AdwCleaner v6.042 - Bericht erstellt am 11/01/2017 um 17:04:25
# Aktualisiert am 06/01/2017 von Malwarebytes
# Datenbank : 2017-01-11.1 [Server]
# Betriebssystem : Windows 10 Pro  (X64)
# Benutzername : habob - DESKTOP-PNO8QHG
# Gestartet von : C:\Users\habob\Desktop\troja\AdwCleaner_6.042.exe
# Modus: Suchlauf
# Unterstützung : https://www.malwarebytes.com/support



***** [ Dienste ] *****

Keine schädlichen Dienste gefunden.


***** [ Ordner ] *****

Keine schädlichen Ordner gefunden.


***** [ Dateien ] *****

Datei Gefunden: C:\END
Datei Gefunden: C:\Users\habob\AppData\Local\Temp\Utils.dll
Datei Gefunden: C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\extensions\YouTubeAutoReplay@arikv.com.xpi


***** [ DLL ] *****

Keine infizierten DLLs gefunden.


***** [ WMI ] *****

Keine schädlichen Schlüssel gefunden.


***** [ Verknüpfungen ] *****

Keine infizierten Verknüpfungen gefunden.


***** [ Aufgabenplanung ] *****

Keine schädlichen Aufgaben gefunden.


***** [ Registrierungsdatenbank ] *****

Keine schädlichen Elemente in der Registrierungsdatenbank gefunden.


***** [ Internetbrowser ] *****

Keine schädlichen Elemente in Firefox basierten Browsern gefunden.
Keine schädlichen Elemente in Chrome basierten Browsern gefunden.

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [1969 Bytes] - [21/10/2016 20:11:23]
C:\AdwCleaner\AdwCleaner[C2].txt - [1321 Bytes] - [21/12/2016 17:51:24]
C:\AdwCleaner\AdwCleaner[S0].txt - [1995 Bytes] - [21/10/2016 20:10:53]
C:\AdwCleaner\AdwCleaner[S1].txt - [1582 Bytes] - [21/12/2016 17:51:07]
C:\AdwCleaner\AdwCleaner[S2].txt - [1671 Bytes] - [11/01/2017 17:04:25]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1744 Bytes] ##########
         

[/CODE][/CODE][/CODE][/CODE]
[/CODE]
--- --- ---
--- --- ---
--- --- ---
--- --- ---
--- --- ---
--- --- ---

[/CODE]

MBAM Log

Malwarebytes
www.malwarebytes.com

-Protokolldetails-
Scan-Datum: 11.01.17
Scan-Zeit: 17:08
Protokolldatei: mbam.txt
Administrator: Ja

-Softwaredaten-
Version: 3.0.5.1299
Komponentenversion: 1.0.43
Version des Aktualisierungspakets: 1.0.979
Lizenz: Testversion

-Systemdaten-
Betriebssystem: Windows 10
CPU: x64
Dateisystem: NTFS
Benutzer: DESKTOP-PNO8QHG\habob

-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Ergebnis: Abgeschlossen
Gescannte Objekte: 400732
Abgelaufene Zeit: 1 Min., 22 Sek.

-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

-Scan-Details-
Prozess: 0
(keine bösartigen Elemente erkannt)

Modul: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)

Registrierungswert: 0
(keine bösartigen Elemente erkannt)

Daten-Stream: 0
(keine bösartigen Elemente erkannt)

Ordner: 0
(keine bösartigen Elemente erkannt)

Datei: 0
(keine bösartigen Elemente erkannt)

Physischer Sektor: 0
(keine bösartigen Elemente erkannt)


(end)
         

JRT Log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.0 (12.05.2016)
Operating System: Windows 10 Pro x64 
Ran by habob (Administrator) on 11.01.2017 at 17:22:12,07
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 0 




Registry: 0 





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 11.01.2017 at 17:23:09,38
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

FRST

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 08-01-2017
durchgeführt von habob (Administrator) auf DESKTOP-PNO8QHG (11-01-2017 17:24:39)
Gestartet von C:\Users\habob\Desktop\troja
Geladene Profile: habob &  (Verfügbare Profile: defaultuser0 & habob)
Platform: Windows 10 Pro Version 1607 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Razer Inc.) C:\Program Files (x86)\Razer\RzWizard\RzWizardService.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [163800 2016-07-30] (IvoSoft)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2776528 2016-12-14] (Malwarebytes)
HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [60136 2016-11-15] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [917576 2016-12-13] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [RzWizard] => C:\Program Files (x86)\Razer\RzWizard\RzWizard.exe [263112 2016-03-23] (Razer Inc.)
HKLM-x32\...\Run: [RoccatKoneBulk] => C:\Program Files (x86)\ROCCAT\Kone Pure Optical Black Edition\KoneBlackMonitor.exe [561152 2015-02-11] (ROCCAT GmbH)
HKLM-x32\...\Run: [Corsair Utility Engine] => C:\Program Files (x86)\Corsair\Corsair Utility Engine\CUE.exe [11054800 2016-09-14] (Corsair Components, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-09-22] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\Run: [Gyazo] => C:\Program Files (x86)\Gyazo\GyStation.exe [3582240 2016-08-03] (Nota Inc.)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2876704 2016-12-20] (Valve Corporation)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27230168 2016-11-15] (Skype Technologies S.A.)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9288408 2016-12-06] (Piriform Ltd)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\Run: [Unified Remote V3] => C:\Program Files (x86)\Unified Remote 3\RemoteServerWin.exe [4340992 2016-07-06] (Unified Intents AB)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [4299968 2016-08-29] (Disc Soft Ltd)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe [1046064 2016-12-25] ()
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\MountPoints2: {1d27f743-8b37-11e6-a112-bc5ff4e4f83a} - "D:\startme.exe" 
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\MountPoints2: {a824682a-b701-11e6-a13c-bc5ff4e4f83a} - "L:\setup.exe" 
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\MountPoints2: {d4d7dc7a-82ef-11e6-a10f-bc5ff4e4f83a} - "D:\setup.exe" 
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Users\habob\Documents\DyingLight\out\settings\video.scr [1245 2016-11-18] ()
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\...\Run: [Gyazo] => C:\Program Files (x86)\Gyazo\GyStation.exe [3582240 2016-08-03] (Nota Inc.)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2876704 2016-12-20] (Valve Corporation)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27230168 2016-11-15] (Skype Technologies S.A.)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9288408 2016-12-06] (Piriform Ltd)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\...\Run: [Unified Remote V3] => C:\Program Files (x86)\Unified Remote 3\RemoteServerWin.exe [4340992 2016-07-06] (Unified Intents AB)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [4299968 2016-08-29] (Disc Soft Ltd)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe [1046064 2016-12-25] ()
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\...\MountPoints2: {1d27f743-8b37-11e6-a112-bc5ff4e4f83a} - "D:\startme.exe" 
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\...\MountPoints2: {a824682a-b701-11e6-a13c-bc5ff4e4f83a} - "L:\setup.exe" 
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\...\MountPoints2: {d4d7dc7a-82ef-11e6-a10f-bc5ff4e4f83a} - "D:\setup.exe" 
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Users\habob\Documents\DyingLight\out\settings\video.scr [1245 2016-11-18] ()
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{9c987ca3-7649-4efe-a371-28237f661719}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://de.yahoo.com/?fr=yset_ie_syc_oracle&type=orcl_hpset
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://de.yahoo.com/?fr=yset_ie_syc_oracle&type=orcl_hpset
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001 -> {A533EB44-EA74-44B5-8922-E1AE8B9E23D7} URL = hxxps://de.search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default
SearchScopes: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084 -> {A533EB44-EA74-44B5-8922-E1AE8B9E23D7} URL = hxxps://de.search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2016-07-30] (IvoSoft)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\ssv.dll [2016-10-21] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\jp2ssv.dll [2016-10-21] (Oracle Corporation)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2016-07-30] (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)

FireFox:
========
FF DefaultProfile: rv2x1vd2.default
FF ProfilePath: C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default [2017-01-11]
FF Extension: (Avira Browser Safety) - C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\Extensions\abs@avira.com.xpi [2016-11-22]
FF Extension: (Roomy Bookmarks Toolbar) - C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\Extensions\ALone-live@ya.ru.xpi [2017-01-09]
FF Extension: (German Dictionary) - C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\Extensions\de-DE@dictionaries.addons.mozilla.org [2016-12-03]
FF Extension: (Media Keys) - C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\Extensions\jid1-4GP7z3tkUd3Tzg@jetpack.xpi [2016-10-24]
FF Extension: (NoScript) - C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2016-11-29]
FF Extension: (WOT) - C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2016-08-23]
FF Extension: (Adblock Plus) - C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-24]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_24_0_0_194.dll [2017-01-11] ()
FF Plugin: @videolan.org/vlc,version=2.2.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWoW64\Macromed\Flash\NPSWF32_24_0_0_194.dll [2017-01-11] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.111.2 -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\dtplugin\npDeployJava1.dll [2016-10-21] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.111.2 -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\plugin2\npjp2.dll [2016-10-21] (Oracle Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [1089592 2016-12-13] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\Antivirus\sched.exe [476736 2016-12-13] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [476736 2016-12-13] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [1490296 2016-12-13] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [350528 2016-11-24] (Avira Operations GmbH & Co. KG)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1404936 2016-08-01] ()
R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe [1467072 2016-08-29] (Disc Soft Ltd)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4317648 2016-12-14] (Malwarebytes)
S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [1317104 2016-12-25] (Overwolf LTD)
R2 RzWizardService; C:\Program Files (x86)\Razer\RzWizard\RzWizardService.exe [376272 2016-03-23] (Razer Inc.)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-09-15] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [49448 2016-08-18] (Advanced Micro Devices, Inc.)
R3 amdkmdag; C:\Windows\System32\DriverStore\FileRepository\c0309270.inf_amd64_47c09dd18e1ee4c5\atikmdag.sys [28729240 2016-12-07] (Advanced Micro Devices, Inc.)
R3 amdkmdap; C:\Windows\System32\DriverStore\FileRepository\c0309270.inf_amd64_47c09dd18e1ee4c5\atikmpag.sys [530328 2016-12-07] (Advanced Micro Devices, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWT6.sys [110104 2016-09-28] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [151352 2016-12-13] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [153904 2016-12-13] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [35488 2016-07-18] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [78208 2016-07-18] (Avira Operations GmbH & Co. KG)
R3 CorsairVBusDriver; C:\Windows\System32\drivers\CorsairVBusDriver.sys [45056 2016-09-09] (Corsair)
R3 CorsairVHidDriver; C:\Windows\System32\drivers\CorsairVHidDriver.sys [22520 2016-09-09] (Corsair)
R3 dtlitescsibus; C:\Windows\System32\drivers\dtlitescsibus.sys [30264 2016-09-25] (Disc Soft Ltd)
R3 dtliteusbbus; C:\Windows\System32\drivers\dtliteusbbus.sys [47672 2016-09-25] (Disc Soft Ltd)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77416 2016-12-14] ()
S3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [45680 2016-10-07] (LogMeIn Inc.)
R2 MBAMChameleon; C:\Windows\system32\drivers\MBAMChameleon.sys [176064 2017-01-11] (Malwarebytes)
R3 MBAMFarflt; C:\Windows\system32\drivers\farflt.sys [102856 2017-01-11] (Malwarebytes)
R3 MBAMProtection; C:\Windows\system32\drivers\mbam.sys [43968 2017-01-11] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [250816 2017-01-11] (Malwarebytes)
R3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [91584 2017-01-11] (Malwarebytes)
S3 NetAdapterCx; C:\Windows\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [589824 2016-07-16] (Realtek                                            )
S3 tap-tb-0901; C:\Windows\System32\drivers\tap-tb-0901.sys [38656 2015-08-10] (The OpenVPN Project)
R3 uvhid; C:\Windows\System32\drivers\uvhid.sys [27064 2016-07-06] (Windows (R) Win 7 DDK provider)
R1 VBoxUSBMon; C:\Windows\system32\DRIVERS\VBoxUSBMon.sys [127432 2016-12-05] (BigNox Corporation)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
S3 wod0205; C:\Windows\System32\drivers\wod0205.sys [33160 2011-04-23] (WeOnlyDo Software)

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-01-11 17:23 - 2017-01-11 17:23 - 00000546 _____ C:\Users\habob\Desktop\JRT.txt
2017-01-11 17:19 - 2017-01-11 17:19 - 00001176 _____ C:\Users\habob\Desktop\mbam.txt
2017-01-11 17:07 - 2017-01-11 17:08 - 00176064 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys
2017-01-11 17:07 - 2017-01-11 17:07 - 00102856 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2017-01-11 17:07 - 2017-01-11 17:07 - 00001912 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-01-11 17:07 - 2017-01-11 17:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-01-11 17:07 - 2017-01-11 17:07 - 00000000 ____D C:\Program Files\Malwarebytes
2017-01-11 17:07 - 2016-12-14 12:55 - 00077416 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-01-11 03:46 - 2016-12-21 08:43 - 04130440 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll
2017-01-11 03:46 - 2016-12-21 08:43 - 01454504 _____ (Microsoft Corporation) C:\Windows\system32\mfnetsrc.dll
2017-01-11 03:46 - 2016-12-21 08:42 - 01988560 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4srcsnk.dll
2017-01-11 03:46 - 2016-12-21 08:42 - 01702392 _____ (Microsoft Corporation) C:\Windows\system32\mfasfsrcsnk.dll
2017-01-11 03:46 - 2016-12-21 08:42 - 01300600 _____ (Microsoft Corporation) C:\Windows\system32\mfmpeg2srcsnk.dll
2017-01-11 03:46 - 2016-12-21 08:06 - 06285312 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.dll
2017-01-11 03:46 - 2016-12-21 07:53 - 04474368 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_47.dll
2017-01-11 03:46 - 2016-12-21 07:51 - 05611008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2017-01-11 03:46 - 2016-12-21 06:09 - 00263472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Storage.ApplicationData.dll
2017-01-11 03:46 - 2016-12-21 05:40 - 00557568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StoreAgent.dll
2017-01-11 03:46 - 2016-12-21 05:40 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InstallAgent.exe
2017-01-11 03:46 - 2016-12-21 05:39 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InstallAgentUserBroker.exe
2017-01-11 03:46 - 2016-12-21 05:22 - 01883648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Logon.dll
2017-01-11 03:46 - 2016-12-14 06:41 - 01235296 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2017-01-11 03:46 - 2016-12-14 05:48 - 01631232 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.Resources.dll
2017-01-11 03:46 - 2016-12-14 05:38 - 17188864 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.dll
2017-01-11 03:46 - 2016-12-14 05:23 - 03134976 _____ (Microsoft Corporation) C:\Windows\system32\rdpcore.dll
2017-01-11 03:45 - 2016-12-21 09:08 - 00245600 _____ (Microsoft Corporation) C:\Windows\system32\offlinesam.dll
2017-01-11 03:45 - 2016-12-21 09:08 - 00136032 _____ (Microsoft Corporation) C:\Windows\system32\ImplatSetup.dll
2017-01-11 03:45 - 2016-12-21 09:04 - 07816032 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-01-11 03:45 - 2016-12-21 08:49 - 00328008 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Storage.ApplicationData.dll
2017-01-11 03:45 - 2016-12-21 08:46 - 00624048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2017-01-11 03:45 - 2016-12-21 08:43 - 01071736 _____ (Microsoft Corporation) C:\Windows\system32\mfnetcore.dll
2017-01-11 03:45 - 2016-12-21 08:43 - 00092512 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2017-01-11 03:45 - 2016-12-21 08:42 - 22224480 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2017-01-11 03:45 - 2016-12-21 08:42 - 00241504 _____ (Microsoft Corporation) C:\Windows\system32\CloudExperienceHost.dll
2017-01-11 03:45 - 2016-12-21 08:41 - 01600632 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2017-01-11 03:45 - 2016-12-21 08:37 - 00455520 _____ (Microsoft Corporation) C:\Windows\system32\securekernel.exe
2017-01-11 03:45 - 2016-12-21 08:15 - 22563840 _____ (Microsoft Corporation) C:\Windows\system32\edgehtml.dll
2017-01-11 03:45 - 2016-12-21 08:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\LaunchWinApp.exe
2017-01-11 03:45 - 2016-12-21 08:13 - 00119808 _____ (Microsoft Corporation) C:\Windows\system32\KnobsCsp.dll
2017-01-11 03:45 - 2016-12-21 08:12 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\ProvPluginEng.dll
2017-01-11 03:45 - 2016-12-21 08:10 - 00234496 _____ (Microsoft Corporation) C:\Windows\system32\KnobsCore.dll
2017-01-11 03:45 - 2016-12-21 08:09 - 00368640 _____ (Microsoft Corporation) C:\Windows\system32\OneBackupHandler.dll
2017-01-11 03:45 - 2016-12-21 08:09 - 00363520 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.BioFeedback.dll
2017-01-11 03:45 - 2016-12-21 08:08 - 01292288 _____ (Microsoft Corporation) C:\Windows\system32\MSVPXENC.dll
2017-01-11 03:45 - 2016-12-21 08:08 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.BlockedShutdown.dll
2017-01-11 03:45 - 2016-12-21 08:08 - 00360448 _____ (Microsoft Corporation) C:\Windows\system32\rdpencom.dll
2017-01-11 03:45 - 2016-12-21 08:08 - 00349184 _____ (Microsoft Corporation) C:\Windows\system32\provengine.dll
2017-01-11 03:45 - 2016-12-21 08:08 - 00289792 _____ (Microsoft Corporation) C:\Windows\system32\DeveloperOptionsSettingsHandlers.dll
2017-01-11 03:45 - 2016-12-21 08:08 - 00211968 _____ (Microsoft Corporation) C:\Windows\system32\InstallAgent.exe
2017-01-11 03:45 - 2016-12-21 08:07 - 00748544 _____ (Microsoft Corporation) C:\Windows\system32\StoreAgent.dll
2017-01-11 03:45 - 2016-12-21 08:06 - 00310784 _____ (Microsoft Corporation) C:\Windows\system32\SyncSettings.dll
2017-01-11 03:45 - 2016-12-21 08:06 - 00260608 _____ (Microsoft Corporation) C:\Windows\system32\InstallAgentUserBroker.exe
2017-01-11 03:45 - 2016-12-21 08:06 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-01-11 03:45 - 2016-12-21 08:05 - 00425984 _____ (Microsoft Corporation) C:\Windows\system32\aadcloudap.dll
2017-01-11 03:45 - 2016-12-21 08:05 - 00261632 _____ (Microsoft Corporation) C:\Windows\system32\indexeddbserver.dll
2017-01-11 03:45 - 2016-12-21 08:05 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Shell.dll
2017-01-11 03:45 - 2016-12-21 08:01 - 09131008 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2017-01-11 03:45 - 2016-12-21 08:00 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\fhcfg.dll
2017-01-11 03:45 - 2016-12-21 07:59 - 01908224 _____ (Microsoft Corporation) C:\Windows\system32\AzureSettingSyncProvider.dll
2017-01-11 03:45 - 2016-12-21 07:59 - 00883712 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2017-01-11 03:45 - 2016-12-21 07:58 - 23678464 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-01-11 03:45 - 2016-12-21 07:57 - 00462336 _____ (Microsoft Corporation) C:\Windows\system32\fhsettingsprovider.dll
2017-01-11 03:45 - 2016-12-21 07:56 - 00947712 _____ (Microsoft Corporation) C:\Windows\system32\MSVP9DEC.dll
2017-01-11 03:45 - 2016-12-21 07:56 - 00936960 _____ (Microsoft Corporation) C:\Windows\system32\MCRecvSrc.dll
2017-01-11 03:45 - 2016-12-21 07:55 - 08129536 _____ (Microsoft Corporation) C:\Windows\system32\Chakra.dll
2017-01-11 03:45 - 2016-12-21 07:55 - 04749312 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_nt.dll
2017-01-11 03:45 - 2016-12-21 07:54 - 05511680 _____ (Microsoft Corporation) C:\Windows\system32\aclui.dll
2017-01-11 03:45 - 2016-12-21 07:53 - 06664192 _____ (Microsoft Corporation) C:\Windows\system32\mspaint.exe
2017-01-11 03:45 - 2016-12-21 07:53 - 01692672 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.onecore.dll
2017-01-11 03:45 - 2016-12-21 07:51 - 08075776 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2017-01-11 03:45 - 2016-12-21 07:51 - 02275840 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentServer.dll
2017-01-11 03:45 - 2016-12-21 07:50 - 01490432 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-01-11 03:45 - 2016-12-21 07:49 - 04149248 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2017-01-11 03:45 - 2016-12-21 07:49 - 02691072 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Logon.dll
2017-01-11 03:45 - 2016-12-21 07:49 - 01062912 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncCore.dll
2017-01-11 03:45 - 2016-12-21 07:47 - 01121280 _____ (Microsoft Corporation) C:\Windows\system32\aadtb.dll
2017-01-11 03:45 - 2016-12-21 06:59 - 00218976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\offlinesam.dll
2017-01-11 03:45 - 2016-12-21 06:02 - 03892864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
2017-01-11 03:45 - 2016-12-21 06:02 - 01852720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll
2017-01-11 03:45 - 2016-12-21 06:02 - 01360464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfnetsrc.dll
2017-01-11 03:45 - 2016-12-21 06:02 - 01277344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfasfsrcsnk.dll
2017-01-11 03:45 - 2016-12-21 06:02 - 01201872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmpeg2srcsnk.dll
2017-01-11 03:45 - 2016-12-21 06:02 - 00980832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfnetcore.dll
2017-01-11 03:45 - 2016-12-21 06:01 - 20969928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2017-01-11 03:45 - 2016-12-21 05:46 - 00034304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LaunchWinApp.exe
2017-01-11 03:45 - 2016-12-21 05:43 - 00285184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.BlockedShutdown.dll
2017-01-11 03:45 - 2016-12-21 05:41 - 00253952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.BioFeedback.dll
2017-01-11 03:45 - 2016-12-21 05:41 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2017-01-11 03:45 - 2016-12-21 05:40 - 00318976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpencom.dll
2017-01-11 03:45 - 2016-12-21 05:40 - 00237056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SyncSettings.dll
2017-01-11 03:45 - 2016-12-21 05:39 - 01300480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVPXENC.dll
2017-01-11 03:45 - 2016-12-21 05:38 - 00866816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Cred.dll
2017-01-11 03:45 - 2016-12-21 05:35 - 04612608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.dll
2017-01-11 03:45 - 2016-12-21 05:35 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\indexeddbserver.dll
2017-01-11 03:45 - 2016-12-21 05:34 - 07626752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2017-01-11 03:45 - 2016-12-21 05:33 - 19413504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgehtml.dll
2017-01-11 03:45 - 2016-12-21 05:32 - 19417600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-01-11 03:45 - 2016-12-21 05:30 - 05398016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aclui.dll
2017-01-11 03:45 - 2016-12-21 05:30 - 01255936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AzureSettingSyncProvider.dll
2017-01-11 03:45 - 2016-12-21 05:27 - 00640000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MCRecvSrc.dll
2017-01-11 03:45 - 2016-12-21 05:26 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVP9DEC.dll
2017-01-11 03:45 - 2016-12-21 05:25 - 07469056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2017-01-11 03:45 - 2016-12-21 05:25 - 06474752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mspaint.exe
2017-01-11 03:45 - 2016-12-21 05:24 - 06044160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakra.dll
2017-01-11 03:45 - 2016-12-21 05:24 - 05061120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2017-01-11 03:45 - 2016-12-21 05:24 - 03733504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_47.dll
2017-01-11 03:45 - 2016-12-21 05:24 - 00886272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aadtb.dll
2017-01-11 03:45 - 2016-12-21 05:22 - 00860672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncCore.dll
2017-01-11 03:45 - 2016-12-14 06:41 - 00590960 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2017-01-11 03:45 - 2016-12-14 06:34 - 02482280 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 02169184 _____ (Microsoft Corporation) C:\Windows\system32\AppVEntSubsystems64.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 01669984 _____ (Microsoft Corporation) C:\Windows\system32\AppVIntegration.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 01400160 _____ (Microsoft Corporation) C:\Windows\system32\AppVEntSubsystemController.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 01356864 _____ (Microsoft Corporation) C:\Windows\system32\ClipUp.exe
2017-01-11 03:45 - 2016-12-14 06:33 - 01054048 _____ (Microsoft Corporation) C:\Windows\system32\AppVPolicy.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 00992096 _____ (Microsoft Corporation) C:\Windows\system32\AppVManifest.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 00822624 _____ (Microsoft Corporation) C:\Windows\system32\AppVClient.exe
2017-01-11 03:45 - 2016-12-14 06:33 - 00813408 _____ (Microsoft Corporation) C:\Windows\system32\AppVEntStreamingManager.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 00779616 _____ (Microsoft Corporation) C:\Windows\system32\AppVReporting.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 00752992 _____ (Microsoft Corporation) C:\Windows\system32\AppVOrchestration.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 00704352 _____ (Microsoft Corporation) C:\Windows\system32\AppVEntVirtualization.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 00696160 _____ (Microsoft Corporation) C:\Windows\system32\AppVPublishing.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 00571744 _____ (Microsoft Corporation) C:\Windows\system32\AppVCatalog.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 00513376 _____ (Microsoft Corporation) C:\Windows\system32\TransportDSA.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 00406368 _____ (Microsoft Corporation) C:\Windows\system32\AppVScripting.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 00241504 _____ (Microsoft Corporation) C:\Windows\system32\AppVShNotify.exe
2017-01-11 03:45 - 2016-12-14 06:33 - 00190816 _____ (Microsoft Corporation) C:\Windows\system32\AppVDllSurrogate.exe
2017-01-11 03:45 - 2016-12-14 06:26 - 01469792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppVEntSubsystems32.dll
2017-01-11 03:45 - 2016-12-14 06:23 - 00404832 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-01-11 03:45 - 2016-12-14 06:21 - 02206496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2017-01-11 03:45 - 2016-12-14 06:19 - 00584544 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncHost.exe
2017-01-11 03:45 - 2016-12-14 06:18 - 00715104 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vhdmp.sys
2017-01-11 03:45 - 2016-12-14 06:18 - 00335712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys
2017-01-11 03:45 - 2016-12-14 06:17 - 00319288 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2017-01-11 03:45 - 2016-12-14 06:14 - 01694712 _____ (Microsoft Corporation) C:\Windows\system32\winmde.dll
2017-01-11 03:45 - 2016-12-14 06:14 - 00418952 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2017-01-11 03:45 - 2016-12-14 06:14 - 00089416 _____ (Microsoft Corporation) C:\Windows\system32\remoteaudioendpoint.dll
2017-01-11 03:45 - 2016-12-14 06:08 - 00341344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2017-01-11 03:45 - 2016-12-14 06:06 - 00509792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncHost.exe
2017-01-11 03:45 - 2016-12-14 06:01 - 01557808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmde.dll
2017-01-11 03:45 - 2016-12-14 06:01 - 00382784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2017-01-11 03:45 - 2016-12-14 06:01 - 00076984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\remoteaudioendpoint.dll
2017-01-11 03:45 - 2016-12-14 05:46 - 01631232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.Resources.dll
2017-01-11 03:45 - 2016-12-14 05:46 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-01-11 03:45 - 2016-12-14 05:45 - 00147968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32k.sys
2017-01-11 03:45 - 2016-12-14 05:43 - 00201728 _____ (Microsoft Corporation) C:\Windows\system32\ScDeviceEnum.dll
2017-01-11 03:45 - 2016-12-14 05:42 - 00352768 _____ (Microsoft Corporation) C:\Windows\system32\cloudAP.dll
2017-01-11 03:45 - 2016-12-14 05:42 - 00236544 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll
2017-01-11 03:45 - 2016-12-14 05:42 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Internal.UI.Logon.ProxyStub.dll
2017-01-11 03:45 - 2016-12-14 05:42 - 00167424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll
2017-01-11 03:45 - 2016-12-14 05:41 - 00223744 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-01-11 03:45 - 2016-12-14 05:40 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\domgmt.dll
2017-01-11 03:45 - 2016-12-14 05:40 - 00266752 _____ (Microsoft Corporation) C:\Windows\system32\ConsoleLogon.dll
2017-01-11 03:45 - 2016-12-14 05:40 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CloudBackupSettings.dll
2017-01-11 03:45 - 2016-12-14 05:40 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\certprop.dll
2017-01-11 03:45 - 2016-12-14 05:40 - 00104448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Internal.UI.Logon.ProxyStub.dll
2017-01-11 03:45 - 2016-12-14 05:39 - 00837632 _____ (Microsoft Corporation) C:\Windows\system32\wbiosrvc.dll
2017-01-11 03:45 - 2016-12-14 05:39 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\updatehandlers.dll
2017-01-11 03:45 - 2016-12-14 05:39 - 00257024 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.CredDialogController.dll
2017-01-11 03:45 - 2016-12-14 05:38 - 13869056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll
2017-01-11 03:45 - 2016-12-14 05:38 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\CloudBackupSettings.dll
2017-01-11 03:45 - 2016-12-14 05:38 - 00213504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.CredDialogController.dll
2017-01-11 03:45 - 2016-12-14 05:37 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\updatepolicy.dll
2017-01-11 03:45 - 2016-12-14 05:36 - 01002496 _____ (Microsoft Corporation) C:\Windows\system32\SRH.dll
2017-01-11 03:45 - 2016-12-14 05:36 - 00539648 _____ (Microsoft Corporation) C:\Windows\system32\usocore.dll
2017-01-11 03:45 - 2016-12-14 05:36 - 00074752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\updatepolicy.dll
2017-01-11 03:45 - 2016-12-14 05:35 - 00755712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2017-01-11 03:45 - 2016-12-14 05:35 - 00712192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2017-01-11 03:45 - 2016-12-14 05:35 - 00600576 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2017-01-11 03:45 - 2016-12-14 05:35 - 00553984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2017-01-11 03:45 - 2016-12-14 05:32 - 00806400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3D12.dll
2017-01-11 03:45 - 2016-12-14 05:32 - 00497152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LogonController.dll
2017-01-11 03:45 - 2016-12-14 05:26 - 00932864 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-01-11 03:45 - 2016-12-14 05:26 - 00869888 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2017-01-11 03:45 - 2016-12-14 05:25 - 02009600 _____ (Microsoft Corporation) C:\Windows\system32\SRHInproc.dll
2017-01-11 03:45 - 2016-12-14 05:24 - 01005568 _____ (Microsoft Corporation) C:\Windows\system32\D3D12.dll
2017-01-11 03:45 - 2016-12-14 05:24 - 00673792 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2017-01-11 03:45 - 2016-12-14 05:23 - 01231872 _____ (Microsoft Corporation) C:\Windows\system32\dosvc.dll
2017-01-11 03:45 - 2016-12-14 05:22 - 02998272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32kfull.sys
2017-01-11 03:45 - 2016-12-14 05:22 - 02748416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpcore.dll
2017-01-11 03:45 - 2016-12-14 05:22 - 02317824 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2017-01-11 03:45 - 2016-12-14 05:22 - 01513472 _____ (Microsoft Corporation) C:\Windows\system32\win32kbase.sys
2017-01-11 03:45 - 2016-12-14 05:22 - 00707584 _____ (Microsoft Corporation) C:\Windows\system32\LogonController.dll
2017-01-11 03:45 - 2016-12-14 05:22 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\wuuhext.dll
2017-01-11 03:45 - 2016-12-14 05:21 - 03616768 _____ (Microsoft Corporation) C:\Windows\system32\win32kfull.sys
2017-01-11 03:45 - 2016-11-02 13:01 - 00484584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2017-01-11 03:45 - 2016-11-02 12:00 - 00534096 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2017-01-11 03:45 - 2016-11-02 11:28 - 00324608 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.LockScreen.dll
2017-01-11 03:45 - 2016-11-02 11:22 - 00337920 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2017-01-11 03:45 - 2016-11-02 11:21 - 00942080 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2017-01-11 03:45 - 2016-08-02 05:30 - 00822784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakradiag.dll
2017-01-10 21:49 - 2017-01-10 21:49 - 00004382 _____ C:\Windows\System32\Tasks\Overwolf Updater Task
2017-01-10 21:49 - 2017-01-10 21:49 - 00001154 _____ C:\Users\Public\Desktop\Overwolf.lnk
2017-01-10 21:49 - 2017-01-10 21:49 - 00000000 ____D C:\Users\habob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Overwolf
2017-01-10 21:49 - 2017-01-10 21:49 - 00000000 ____D C:\ProgramData\Overwolf
2017-01-10 21:49 - 2017-01-10 21:49 - 00000000 ____D C:\Program Files (x86)\Overwolf
2017-01-10 21:48 - 2017-01-11 17:05 - 00000000 ____D C:\Users\habob\AppData\Local\Overwolf
2017-01-10 18:02 - 2017-01-10 18:02 - 00098296 _____ C:\Users\habob\Desktop\bluegreeUpdate.cueprofile
2017-01-10 17:43 - 2017-01-10 17:48 - 00262512 _____ C:\TDSSKiller.3.1.0.12_10.01.2017_17.43.07_log.txt
2017-01-10 17:42 - 2017-01-10 17:43 - 00000492 _____ C:\TDSSKiller.3.1.0.12_10.01.2017_17.42.59_log.txt
2017-01-10 17:29 - 2017-01-11 17:24 - 00000000 ____D C:\FRST
2017-01-10 17:18 - 2017-01-11 17:24 - 00000000 ____D C:\Users\habob\Desktop\troja
2016-12-27 13:51 - 2016-12-27 13:51 - 00000000 _____ C:\Windows\setuperr.log
2016-12-27 13:51 - 2016-12-27 13:51 - 00000000 _____ C:\Windows\setupact.log
2016-12-27 03:59 - 2017-01-11 16:36 - 00000275 _____ C:\Windows\WindowsUpdate.log
2016-12-24 22:24 - 2016-12-24 22:24 - 00095155 _____ C:\Users\habob\Desktop\RAINbu.cueprofile
2016-12-24 19:23 - 2016-12-24 19:23 - 00000219 _____ C:\Users\habob\Desktop\Left 4 Dead 2.url
2016-12-21 19:36 - 2016-12-26 12:04 - 00000000 ____D C:\Windows\Minidump
2016-12-21 17:10 - 2016-12-21 17:10 - 00000000 _____ C:\Users\habob\Desktop\Neues Textdokument (3).txt
2016-12-21 02:16 - 2016-12-21 02:16 - 00000000 ____D C:\Users\habob\Documents\Telltale Games
2016-12-20 23:57 - 2016-12-20 23:57 - 00000856 _____ C:\Users\Public\Desktop\The Walking Dead A New Frontier.lnk
2016-12-20 23:57 - 2016-12-20 23:57 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Walking Dead A New Frontier
2016-12-20 17:38 - 2016-12-20 17:38 - 00000000 ____D C:\Users\habob\AppData\Roaming\ATI
2016-12-20 17:38 - 2016-12-20 17:38 - 00000000 ____D C:\Users\habob\AppData\Local\ATI
2016-12-20 17:38 - 2016-12-20 17:38 - 00000000 ____D C:\ProgramData\ATI
2016-12-20 17:37 - 2016-12-20 17:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Settings
2016-12-20 17:37 - 2016-12-20 17:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Problem Report Wizard
2016-12-20 17:37 - 2016-12-20 17:37 - 00000000 ____D C:\Program Files (x86)\AMD
2016-12-20 17:36 - 2016-12-20 17:36 - 00000000 ____D C:\Program Files (x86)\VulkanRT
2016-12-20 17:34 - 2016-12-20 17:37 - 00000000 ____D C:\Program Files\AMD
2016-12-20 17:01 - 2016-12-23 15:46 - 00000000 ____D C:\Users\habob\AppData\Local\AMD
2016-12-20 17:00 - 2016-12-20 17:00 - 00000000 ____D C:\Program Files\Common Files\ATI Technologies
2016-12-20 16:59 - 2016-09-09 19:25 - 00269600 _____ C:\Windows\SysWOW64\vulkan-1.dll
2016-12-20 16:59 - 2016-09-09 19:25 - 00261920 _____ C:\Windows\system32\vulkan-1.dll
2016-12-20 16:59 - 2016-09-09 19:25 - 00110880 _____ C:\Windows\SysWOW64\vulkaninfo.exe
2016-12-20 16:59 - 2016-09-09 19:24 - 00125216 _____ C:\Windows\system32\vulkaninfo.exe
2016-12-17 16:12 - 2016-12-17 16:12 - 00539384 _____ C:\Windows\system32\Drivers\EasyAntiCheat.sys
2016-12-17 16:12 - 2016-12-17 16:12 - 00000000 ____D C:\Users\habob\AppData\Local\DeadByDaylight
2016-12-17 16:03 - 2016-12-18 23:12 - 00000000 ____D C:\Users\habob\AppData\Roaming\TS3Client
2016-12-17 16:03 - 2016-12-17 16:03 - 00001008 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2016-12-17 16:03 - 2016-12-17 16:03 - 00000970 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client.lnk
2016-12-17 16:03 - 2016-12-17 16:03 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2016-12-17 08:22 - 2016-12-18 00:38 - 00000123 _____ C:\Users\habob\Desktop\sounds list.txt
2016-12-17 08:07 - 2016-12-17 08:07 - 00894354 _____ C:\Users\habob\Desktop\SOUNDS SETTINGS.jpg
2016-12-17 05:44 - 2016-12-17 05:44 - 00001924 _____ C:\Users\habob\Desktop\Virtual Audio Cable - Verknüpfung.lnk
2016-12-17 05:39 - 2016-12-17 05:39 - 00098464 _____ (Eugene V. Muzychenko) C:\Windows\system32\Drivers\vrtaucbl.sys
2016-12-17 05:39 - 2016-12-17 05:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Virtual Audio Cable
2016-12-17 05:39 - 2016-12-17 05:39 - 00000000 ____D C:\Program Files\Virtual Audio Cable
2016-12-17 05:29 - 2016-12-17 05:33 - 00000000 ____D C:\Users\habob\Desktop\vac
2016-12-17 04:39 - 2016-12-17 19:27 - 00000000 ____D C:\Users\habob\Desktop\audio keybinds
2016-12-17 04:37 - 2016-12-17 04:36 - 05501972 _____ C:\Users\habob\Desktop\Linkin Park-In The End Lyrics (360p_30fps_H264-96kbit_AAC).mp4
2016-12-16 05:14 - 2016-12-16 05:14 - 00000000 ____D C:\Users\habob\AppData\Local\Chromium
2016-12-14 13:28 - 2016-12-09 11:42 - 01637728 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-12-14 13:28 - 2016-12-09 11:42 - 00137568 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-12-14 13:28 - 2016-12-09 11:34 - 01051112 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2016-12-14 13:28 - 2016-12-09 11:34 - 00894096 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2016-12-14 13:28 - 2016-12-09 11:33 - 01354320 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2016-12-14 13:28 - 2016-12-09 11:33 - 01173496 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2016-12-14 13:28 - 2016-12-09 11:30 - 00377184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
2016-12-14 13:28 - 2016-12-09 11:29 - 02681200 _____ C:\Windows\system32\CoreUIComponents.dll
2016-12-14 13:28 - 2016-12-09 11:28 - 00764392 _____ (Microsoft Corporation) C:\Windows\system32\CoreMessaging.dll
2016-12-14 13:28 - 2016-12-09 11:27 - 00172528 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-12-14 13:28 - 2016-12-09 11:20 - 02677544 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2016-12-14 13:28 - 2016-12-09 11:20 - 02189664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2016-12-14 13:28 - 2016-12-09 11:20 - 01738560 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2016-12-14 13:28 - 2016-12-09 11:20 - 00658784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms2.sys
2016-12-14 13:28 - 2016-12-09 11:20 - 00402272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2016-12-14 13:28 - 2016-12-09 11:19 - 01293152 _____ (Microsoft Corporation) C:\Windows\system32\LicenseManager.dll
2016-12-14 13:28 - 2016-12-09 11:19 - 00168424 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2016-12-14 13:28 - 2016-12-09 11:18 - 02913144 _____ (Microsoft Corporation) C:\Windows\system32\combase.dll
2016-12-14 13:28 - 2016-12-09 11:18 - 01267512 _____ (Microsoft Corporation) C:\Windows\system32\WinTypes.dll
2016-12-14 13:28 - 2016-12-09 11:18 - 01100128 _____ (Microsoft Corporation) C:\Windows\system32\hvix64.exe
2016-12-14 13:28 - 2016-12-09 11:18 - 00989024 _____ (Microsoft Corporation) C:\Windows\system32\hvax64.exe
2016-12-14 13:28 - 2016-12-09 11:18 - 00947552 _____ (Microsoft Corporation) C:\Windows\system32\hvloader.efi
2016-12-14 13:28 - 2016-12-09 11:18 - 00811872 _____ (Microsoft Corporation) C:\Windows\system32\hvloader.exe
2016-12-14 13:28 - 2016-12-09 11:15 - 08168000 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.Protection.PlayReady.dll
2016-12-14 13:28 - 2016-12-09 11:14 - 01274712 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2016-12-14 13:28 - 2016-12-09 11:11 - 02048496 _____ C:\Windows\SysWOW64\CoreUIComponents.dll
2016-12-14 13:28 - 2016-12-09 11:10 - 01572768 _____ (Microsoft Corporation) C:\Windows\system32\gdi32full.dll
2016-12-14 13:28 - 2016-12-09 11:10 - 01461200 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2016-12-14 13:28 - 2016-12-09 11:01 - 02323728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2016-12-14 13:28 - 2016-12-09 11:01 - 01503544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2016-12-14 13:28 - 2016-12-09 11:01 - 00861024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LicenseManager.dll
2016-12-14 13:28 - 2016-12-09 11:00 - 00106896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2016-12-14 13:28 - 2016-12-09 10:59 - 02166752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\combase.dll
2016-12-14 13:28 - 2016-12-09 10:59 - 00846560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinTypes.dll
2016-12-14 13:28 - 2016-12-09 10:57 - 06668040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.Protection.PlayReady.dll
2016-12-14 13:28 - 2016-12-09 10:56 - 00959112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2016-12-14 13:28 - 2016-12-09 10:52 - 01435896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2016-12-14 13:28 - 2016-12-09 10:52 - 01415752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32full.dll
2016-12-14 13:28 - 2016-12-09 10:51 - 00117240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2016-12-14 13:28 - 2016-12-09 10:45 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\WordBreakers.dll
2016-12-14 13:28 - 2016-12-09 10:42 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2016-12-14 13:28 - 2016-12-09 10:41 - 00380928 _____ (Microsoft Corporation) C:\Windows\system32\wincorlib.dll
2016-12-14 13:28 - 2016-12-09 10:41 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WordBreakers.dll
2016-12-14 13:28 - 2016-12-09 10:37 - 00411136 _____ (Microsoft Corporation) C:\Windows\system32\facecredentialprovider.dll
2016-12-14 13:28 - 2016-12-09 10:36 - 03059200 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2016-12-14 13:28 - 2016-12-09 10:36 - 00410112 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentClient.dll
2016-12-14 13:28 - 2016-12-09 10:34 - 00288768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincorlib.dll
2016-12-14 13:28 - 2016-12-09 10:33 - 03777536 _____ (Microsoft Corporation) C:\Windows\system32\MFMediaEngine.dll
2016-12-14 13:28 - 2016-12-09 10:33 - 01589760 _____ (Microsoft Corporation) C:\Windows\system32\msdtctm.dll
2016-12-14 13:28 - 2016-12-09 10:32 - 00635904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2016-12-14 13:28 - 2016-12-09 10:31 - 03689984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2016-12-14 13:28 - 2016-12-09 10:31 - 00313856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppXDeploymentClient.dll
2016-12-14 13:28 - 2016-12-09 10:28 - 03306496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFMediaEngine.dll
2016-12-14 13:28 - 2016-12-09 10:28 - 01004544 _____ (Microsoft Corporation) C:\Windows\system32\enterprisecsps.dll
2016-12-14 13:28 - 2016-12-09 10:27 - 13084160 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-12-14 13:28 - 2016-12-09 10:27 - 05114368 _____ (Microsoft Corporation) C:\Windows\system32\cdp.dll
2016-12-14 13:28 - 2016-12-09 10:27 - 00981504 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Security.Authentication.OnlineId.dll
2016-12-14 13:28 - 2016-12-09 10:25 - 00376832 _____ (Microsoft Corporation) C:\Windows\system32\CryptoWinRT.dll
2016-12-14 13:28 - 2016-12-09 10:23 - 12177920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-12-14 13:28 - 2016-12-09 10:22 - 02820096 _____ (Microsoft Corporation) C:\Windows\system32\InputService.dll
2016-12-14 13:28 - 2016-12-09 10:21 - 04746752 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-12-14 13:28 - 2016-12-09 10:21 - 00716800 _____ (Microsoft Corporation) C:\Windows\system32\ShareHost.dll
2016-12-14 13:28 - 2016-12-09 10:20 - 03198464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdp.dll
2016-12-14 13:28 - 2016-12-09 10:20 - 00730624 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll
2016-12-14 13:28 - 2016-12-09 10:20 - 00187392 _____ (Microsoft Corporation) C:\Windows\system32\mdmregistration.dll
2016-12-14 13:28 - 2016-12-09 10:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\DeviceEnroller.exe
2016-12-14 13:28 - 2016-12-09 10:19 - 00433664 _____ (Microsoft Corporation) C:\Windows\system32\TextInputFramework.dll
2016-12-14 13:28 - 2016-12-09 10:19 - 00261120 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Core.TextInput.dll
2016-12-14 13:28 - 2016-12-09 10:19 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\InputLocaleManager.dll
2016-12-14 13:28 - 2016-12-09 10:19 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\EditBufferTestHook.dll
2016-12-14 13:28 - 2016-12-09 10:18 - 03666432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-12-14 13:28 - 2016-12-09 10:18 - 02138112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InputService.dll
2016-12-14 13:28 - 2016-12-09 10:18 - 00165376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mdmregistration.dll
2016-12-14 13:28 - 2016-12-09 10:17 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ShareHost.dll
2016-12-14 13:28 - 2016-12-09 10:16 - 00353280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TextInputFramework.dll
2016-12-14 13:28 - 2016-12-09 10:15 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Core.TextInput.dll
2016-12-14 13:28 - 2016-12-09 10:15 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InputLocaleManager.dll
2016-12-14 13:28 - 2016-12-09 10:15 - 00068096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EditBufferTestHook.dll
2016-12-14 13:28 - 2016-12-09 09:54 - 00483840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CoreMessaging.dll
2016-12-14 13:28 - 2016-11-02 11:28 - 00807424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Security.Authentication.OnlineId.dll
2016-12-14 13:28 - 2016-11-02 11:25 - 00956416 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.desktop.dll
2016-12-14 13:28 - 2016-09-15 17:36 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\fveapibase.dll
2016-12-13 20:57 - 2016-12-13 20:57 - 00003290 _____ C:\Windows\System32\Tasks\OneDrive Standalone Update Task v2

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-01-11 17:23 - 2016-11-18 08:39 - 00000000 ____D C:\Users\habob\AppData\LocalLow\Mozilla
2017-01-11 17:19 - 2016-08-23 21:09 - 00000000 ____D C:\Program Files (x86)\SpeedFan
2017-01-11 17:17 - 2016-08-24 19:11 - 00000000 ____D C:\Users\habob\AppData\Local\ClassicShell
2017-01-11 17:16 - 2016-08-24 20:56 - 00000000 ____D C:\Users\habob\AppData\Roaming\Skype
2017-01-11 17:11 - 2016-08-23 20:57 - 03828012 _____ C:\Windows\system32\PerfStringBackup.INI
2017-01-11 17:11 - 2016-07-16 23:51 - 01776294 _____ C:\Windows\system32\perfh007.dat
2017-01-11 17:11 - 2016-07-16 23:51 - 00459848 _____ C:\Windows\system32\perfc007.dat
2017-01-11 17:10 - 2016-08-25 19:13 - 00000000 ____D C:\Program Files (x86)\Steam
2017-01-11 17:08 - 2016-10-21 20:27 - 00091584 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2017-01-11 17:07 - 2016-10-21 20:29 - 00250816 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-01-11 17:07 - 2016-10-21 20:27 - 00043968 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-01-11 17:07 - 2016-10-21 20:27 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-01-11 17:05 - 2016-09-07 18:18 - 00065536 _____ C:\Windows\system32\spu_storage.bin
2017-01-11 17:05 - 2016-08-23 20:51 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-01-11 17:05 - 2016-07-16 07:04 - 00524288 _____ C:\Windows\system32\config\BBI
2017-01-11 17:04 - 2016-10-21 20:10 - 00000000 ____D C:\AdwCleaner
2017-01-11 17:00 - 2016-08-23 21:05 - 00000000 ____D C:\Users\habob\AppData\Local\Battle.net
2017-01-11 16:37 - 2016-08-23 21:04 - 00000000 ____D C:\Program Files (x86)\Battle.net
2017-01-11 16:36 - 2016-07-16 12:45 - 00000000 ____D C:\Windows\INF
2017-01-11 16:35 - 2016-08-23 20:55 - 00000000 __RHD C:\Users\Public\AccountPictures
2017-01-11 16:35 - 2016-08-23 20:51 - 00194296 _____ C:\Windows\system32\FNTCACHE.DAT
2017-01-11 16:35 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\AppReadiness
2017-01-11 16:33 - 2016-07-16 12:47 - 00000000 ___RD C:\Windows\ImmersiveControlPanel
2017-01-11 16:33 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\WinBioPlugIns
2017-01-11 16:33 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\oobe
2017-01-11 16:33 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\ShellExperiences
2017-01-11 16:33 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\Provisioning
2017-01-11 16:33 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\PolicyDefinitions
2017-01-11 15:36 - 2016-08-23 20:51 - 00000000 ____D C:\Windows\system32\SleepStudy
2017-01-11 05:53 - 2016-07-16 12:36 - 00000000 ____D C:\Windows\CbsTemp
2017-01-11 05:51 - 2016-08-24 00:26 - 00000000 ____D C:\Windows\system32\MRT
2017-01-11 05:50 - 2016-08-24 00:26 - 135657872 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-01-11 05:50 - 2016-08-23 20:52 - 00000000 ____D C:\Users\defaultuser0
2017-01-11 03:29 - 2016-09-03 05:11 - 00000000 ____D C:\ProgramData\Unified Remote
2017-01-11 03:28 - 2016-08-25 01:04 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2017-01-11 03:28 - 2016-08-23 20:54 - 00000000 ____D C:\Users\habob
2017-01-11 01:13 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2017-01-11 01:13 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\Macromed
2017-01-10 18:10 - 2016-07-16 12:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-01-09 22:43 - 2016-10-24 13:10 - 00000000 ____D C:\Users\habob\Desktop\p64
2017-01-09 22:17 - 2016-08-23 22:07 - 00000000 ____D C:\Program Files (x86)\Overwatch
2017-01-09 21:57 - 2016-12-06 13:08 - 00000000 ____D C:\Users\habob\AppData\Local\ElevatedDiagnostics
2016-12-28 08:31 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\LiveKernelReports
2016-12-27 03:59 - 2016-08-23 20:52 - 00000000 ____D C:\Windows\SoftwareDistribution
2016-12-27 00:47 - 2016-08-23 20:55 - 00000000 ____D C:\Users\habob\AppData\Local\Packages
2016-12-27 00:46 - 2016-09-07 17:57 - 00000000 __SHD C:\Config.Msi
2016-12-27 00:46 - 2016-08-25 19:16 - 00000000 ____D C:\Users\habob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2016-12-27 00:46 - 2016-07-16 12:47 - 00000000 __SHD C:\Windows\Installer
2016-12-26 12:04 - 2016-09-25 10:30 - 00000000 ____D C:\Users\habob\AppData\Roaming\DAEMON Tools Lite
2016-12-25 14:01 - 2016-09-01 10:53 - 00000000 ____D C:\Users\habob\AppData\Roaming\vlc
2016-12-24 22:20 - 2016-08-25 19:20 - 00000000 ____D C:\Users\habob\Documents\My Games
2016-12-23 00:13 - 2016-07-16 12:49 - 00835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-12-23 00:13 - 2016-07-16 12:49 - 00177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-12-21 19:37 - 2016-10-10 23:10 - 00000000 ____D C:\Users\habob\Desktop\bitcch
2016-12-21 17:51 - 2016-07-16 07:04 - 00000000 ____D C:\Windows\system32\CatRoot
2016-12-20 19:45 - 2016-09-23 14:30 - 00000000 ____D C:\Users\habob\AppData\LocalLow\AMD
2016-12-20 17:38 - 2016-08-23 20:54 - 00000000 ____D C:\Users\habob\AppData\Roaming
2016-12-20 17:31 - 2016-08-23 20:56 - 00000000 ____D C:\AMD
2016-12-20 17:00 - 2016-07-16 07:04 - 00000000 ____D C:\Program Files\Common Files
2016-12-19 08:36 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\rescache
2016-12-18 23:12 - 2016-07-16 07:04 - 00000000 ____D C:\Windows\Logs
2016-12-18 23:06 - 2016-08-30 19:09 - 00000863 _____ C:\Users\Public\Desktop\CCleaner.lnk
2016-12-18 23:06 - 2016-08-30 19:08 - 00000000 ____D C:\Program Files\CCleaner
2016-12-17 16:12 - 2016-11-17 21:08 - 00000000 ____D C:\Users\habob\AppData\Local\UnrealEngine
2016-12-17 15:32 - 2016-08-23 20:52 - 00524288 ___SH C:\Windows\system32\config\COMPONENTS{f5b135e6-4b48-11e6-80cb-e41d2d012050}.TMContainer00000000000000000002.regtrans-ms
2016-12-16 05:14 - 2016-08-25 19:14 - 00000000 ____D C:\Users\habob\AppData\Local\Steam
2016-12-16 05:12 - 2016-12-01 02:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-12-16 05:12 - 2016-08-23 20:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-12-16 05:12 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\SysWOW64\de-DE
2016-12-16 05:12 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\de-DE
2016-12-16 05:12 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\Boot
2016-12-16 05:12 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\AppPatch
2016-12-16 05:10 - 2016-08-23 20:54 - 00524288 ___SH C:\Users\habob\NTUSER.DAT{f5b13604-4b48-11e6-80cb-e41d2d012050}.TMContainer00000000000000000002.regtrans-ms
2016-12-16 05:10 - 2016-08-23 20:54 - 00524288 ___SH C:\Users\habob\NTUSER.DAT{f5b13604-4b48-11e6-80cb-e41d2d012050}.TMContainer00000000000000000001.regtrans-ms
2016-12-16 05:10 - 2016-08-23 20:54 - 00065536 ___SH C:\Users\habob\NTUSER.DAT{f5b13604-4b48-11e6-80cb-e41d2d012050}.TM.blf
2016-12-13 20:57 - 2016-08-23 20:56 - 00002387 _____ C:\Users\habob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2016-12-13 20:57 - 2016-08-23 20:56 - 00000000 ___RD C:\Users\habob\OneDrive
2016-12-13 20:45 - 2016-08-23 22:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2016-12-13 20:44 - 2016-10-06 22:33 - 00028272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avusbflt.sys
2016-12-13 20:44 - 2016-08-23 22:12 - 00153904 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2016-12-13 20:44 - 2016-08-23 22:12 - 00151352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2016-12-12 11:55 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\SysWOW64\oobe
2016-12-12 11:55 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\sr-Latn-CS
2016-12-12 11:55 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\bcastdvr
2016-12-12 11:55 - 2016-07-16 07:04 - 00000000 ____D C:\Windows\SysWOW64\Dism
2016-12-12 11:55 - 2016-07-16 07:04 - 00000000 ____D C:\Windows\system32\Sysprep
2016-12-12 11:55 - 2016-07-16 07:04 - 00000000 ____D C:\Windows\system32\Dism
2016-12-12 11:55 - 2016-07-16 07:04 - 00000000 ____D C:\Windows\servicing

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2016-10-17 20:38 - 2016-10-17 20:38 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Einige Dateien in TEMP:
====================
C:\Users\habob\AppData\Local\Temp\proxy_vole3566938020834228.dll
C:\Users\habob\AppData\Local\Temp\proxy_vole4229924891294842844.dll
C:\Users\habob\AppData\Local\Temp\proxy_vole8267566524826979010.dll
C:\Users\habob\AppData\Local\Temp\sfamcc00001.dll
C:\Users\habob\AppData\Local\Temp\sfareca00001.dll


==================== Bamital & volsnap ======================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert

LastRegBack: 2017-01-09 21:57

==================== Ende von FRST.txt ============================
         

Addition

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 08-01-2017
durchgeführt von habob (11-01-2017 17:25:03)
Gestartet von C:\Users\habob\Desktop\troja
Windows 10 Pro Version 1607 (X64) (2016-08-23 19:53:56)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-1200777665-2148727873-1026762903-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1200777665-2148727873-1026762903-503 - Limited - Disabled)
defaultuser0 (S-1-5-21-1200777665-2148727873-1026762903-1000 - Limited - Disabled) => C:\Users\defaultuser0
Gast (S-1-5-21-1200777665-2148727873-1026762903-501 - Limited - Disabled)
habob (S-1-5-21-1200777665-2148727873-1026762903-1001 - Administrator - Enabled) => C:\Users\habob

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Avira Antivirus (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Avira Antivirus (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.020.20042 - Adobe Systems Incorporated)
Adobe Flash Player 24 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 24.0.0.194 - Adobe Systems Incorporated)
AMD Software (HKLM\...\AMD Catalyst Install Manager) (Version: 9.0.000.8 - Advanced Micro Devices, Inc.)
Attack on Titan Wings of Freedom MULTi3 - ElAmigos Version 1.0 (HKLM-x32\...\{EAC7611D-5F72-40A3-9AF6-9552FD21054A}_is1) (Version: 1.0 - KOEI TECMO GAMES)
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.24.146 - Avira Operations GmbH & Co. KG)
Avira Connect (HKLM-x32\...\{707e8edf-9482-4417-ae39-c9b5fe605e87}) (Version: 1.2.76.27124 - Avira Operations GmbH & Co. KG)
Avira Connect (x32 Version: 1.2.76.27124 - Avira Operations GmbH & Co. KG) Hidden
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Catalyst Control Center Next Localization BR (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.25 - Piriform)
Classic Shell (HKLM\...\{383BB30A-B4A7-4666-9A83-22CFA8640097}) (Version: 4.3.0 - IvoSoft)
Corsair Utility Engine (HKLM-x32\...\{84BE2927-A017-4DDC-9706-8D1051C23141}) (Version: 2.5.66 - Corsair)
DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 10.4.0.0195 - Disc Soft Ltd)
Dark Souls III Deluxe Edition MULTi12 - ElAmigos Version 1.08 reg. 1.21 (HKLM-x32\...\{C21D00A3-8A5B-489A-801C-DB8388811C16}_is1) (Version: 1.08 reg. 1.21 - FromSoftware)
Dying Light The Following Enhanced Edition Incl. Update 4 MULTi2 1.11.2 (HKLM-x32\...\Dying Light The Following Enhanced Edition Incl. Update 4 MULTi2 1.11.2) (Version:  - )
Fraps (HKLM-x32\...\Fraps) (Version:  - )
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
Heroes of the Storm (HKLM-x32\...\Heroes of the Storm) (Version:  - Blizzard Entertainment)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.4229 - Intel Corporation)
Java 8 Update 111 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180111F0}) (Version: 8.0.1110.14 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
JDownloader 2 (HKLM\...\jdownloader2-1) (Version: 2.0 - AppWork GmbH)
League of Legends (HKLM-x32\...\League of Legends 4.1.2) (Version: 4.1.2 - Riot Games)
League of Legends (x32 Version: 4.1.2 - Riot Games) Hidden
Left 4 Dead 2 (HKLM\...\Steam App 550) (Version:  - Valve)
Livestreamer 1.12.2 (HKLM-x32\...\Livestreamer) (Version:  - )
Malwarebytes Version 3.0.5.1299 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.0.5.1299 - Malwarebytes)
Microsoft OneDrive (HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\OneDriveSetup.exe) (Version: 17.3.6720.1207 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\...\OneDriveSetup.exe) (Version: 17.3.6720.1207 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24210 (HKLM-x32\...\{f144e08f-9cbe-4f09-9a8c-f2b858b7ee7f}) (Version: 14.0.24210.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24210 (HKLM-x32\...\{23658c02-145e-483d-ba6b-1eb82c580529}) (Version: 14.0.24210.0 - Microsoft Corporation)
Mozilla Firefox 50.1.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 50.1.0 (x86 de)) (Version: 50.1.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 50.1.0.6186 - Mozilla)
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version:  - )
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
Overwatch (HKLM-x32\...\Overwatch) (Version:  - Blizzard Entertainment)
Overwatch Test (HKLM-x32\...\Overwatch Test) (Version:  - Blizzard Entertainment)
Overwolf (HKLM-x32\...\Overwolf) (Version: 0.101.26.0 - Overwolf Ltd.)
Project64 Version 2.2 (HKLM-x32\...\{BEB5FB69-4080-466F-96C4-F15DF271718B}_is1) (Version: 2.2 - Henryxs87)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7541 - Realtek Semiconductor Corp.)
ROCCAT Kone Pure Optical Black Edition Driver (HKLM-x32\...\{B39826A3-8B08-40FB-8FCD-AB68A0F2AF4A}) (Version:  - Roccat GmbH)
Rocket League (HKLM\...\Steam App 252950) (Version:  - Psyonix, Inc.)
Shadow Warrior 2 Deluxe Edition Incl. Update 2 MULTi7 1.0 (HKLM-x32\...\Shadow Warrior 2 Deluxe Edition Incl. Update 2 MULTi7 1.0) (Version:  - )
Skype™ 7.30 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.30.105 - Skype Technologies S.A.)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.19 - TeamSpeak Systems GmbH)
The Walking Dead A New Frontier MULTi9 - ElAmigos Version 1.0 (HKLM-x32\...\{519AAAF0-6BA4-4130-9BD8-C3A295811CE5}_is1) (Version: 1.0 - Telltale Games)
Track-o-Bot version 0.8.5 (HKLM-x32\...\Track-o-Bot_is1) (Version: 0.8.5 - spidy.ch)
Virtual Audio Cable 4.13 (HKLM\...\Virtual Audio Cable 4.13) (Version:  - )
VLC media player (HKLM\...\VLC media player) (Version: 2.2.4 - VideoLAN)
Vulkan Run Time Libraries 1.0.26.0 (HKLM\...\VulkanRT1.0.26.0-2) (Version: 1.0.26.0 - LunarG, Inc.)
Vulkan Run Time Libraries 1.0.26.0 (Version: 1.0.26.0 - LunarG, Inc.) Hidden
WinRAR 5.40 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001_Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001_Classes\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001_Classes\CLSID\{00020422-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001_Classes\CLSID\{00020423-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001_Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001_Classes\CLSID\{00020425-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {0B58CFE7-C727-4EC0-A469-4B1AFF49B3D6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-12-06] (Piriform Ltd)
Task: {12A892D1-B78A-4636-9C7E-92F89674DB61} - System32\Tasks\GyazoUpdateTaskMachineDaily => C:\Program Files (x86)\Gyazo\GyazoUpdate.exe [2016-08-03] ()
Task: {5EA74DCF-9C46-4502-92B5-DA8A14D577A6} - System32\Tasks\Overwolf Updater Task => C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [2016-12-25] (Overwolf LTD)
Task: {87A42A4B-04D3-4050-B533-C90234CF19DC} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-10-21] (Adobe Systems Incorporated)
Task: {925C8AAE-D23C-40A2-8B7F-66164ACB0CD6} - System32\Tasks\GyazoUpdateTaskMachine => C:\Program Files (x86)\Gyazo\GyazoUpdate.exe [2016-08-03] ()
Task: {C433EE6C-77DF-4FCB-85E9-72F9C83BD0A6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWoW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-01-11] (Adobe Systems Incorporated)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWoW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2016-07-16 12:42 - 2016-07-16 12:42 - 00231424 _____ () C:\Windows\SYSTEM32\ism32k.dll
2016-12-14 13:28 - 2016-12-09 11:29 - 02681200 _____ () C:\Windows\system32\CoreUIComponents.dll
2016-12-14 13:28 - 2016-12-09 11:29 - 02681200 _____ () C:\Windows\SYSTEM32\CoreUIComponents.dll
2016-12-13 20:57 - 2016-12-13 20:57 - 01678560 _____ () C:\Users\habob\AppData\Local\Microsoft\OneDrive\17.3.6720.1207\amd64\ClientTelemetry.dll
2016-01-06 17:41 - 2016-01-06 17:41 - 00062168 _____ () C:\Program Files\CCleaner\branding.dll
2016-12-06 15:09 - 2016-12-06 15:09 - 00061440 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2017-01-11 17:07 - 2016-12-14 12:55 - 02259232 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll
2017-01-11 17:07 - 2016-12-14 12:55 - 02813904 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\arwlib.dll
2017-01-11 17:07 - 2016-12-14 12:55 - 02247632 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2016-09-17 00:40 - 2016-09-07 05:56 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-11 03:45 - 2016-12-21 08:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-01-11 03:45 - 2016-12-21 07:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-11 03:45 - 2016-12-21 07:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-11 03:45 - 2016-12-21 07:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-11 03:45 - 2016-12-21 07:48 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2017-01-11 03:45 - 2016-12-21 07:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-11 03:45 - 2016-12-21 07:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2017-01-11 03:45 - 2016-12-21 07:47 - 00114176 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Dss.BackgroundTask.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PAexec => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PAexec => ""="Service"

==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)


==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2016-07-16 12:47 - 2016-07-16 12:45 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170843984\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844028\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg
HKU\S-1-5-21-1200777665-2148727873-1026762903-1000-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-01112017170739675\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\Control Panel\Desktop\\Wallpaper -> C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\StartupApproved\Run: => "Spotify"
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\StartupApproved\Run: => "Spotify Web Helper"
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\...\StartupApproved\Run: => "Spotify"
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\...\StartupApproved\Run: => "Spotify Web Helper"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [{538982AA-0771-4CB1-B518-68E7DC9E97D2}] => C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{B6F4FFF3-081B-432B-9849-59F87CCA4978}] => C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [TCP Query User{C4AE1BB5-5002-4AE3-86C1-C48330ACD0DE}C:\program files (x86)\skype\phone\skype.exe] => C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{BFA4A1D3-5A4D-4125-B344-3C4969D41A44}C:\program files (x86)\skype\phone\skype.exe] => C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{48873A9C-466F-4B8D-93B7-768518FE7960}C:\program files (x86)\unified remote 3\remoteserverwin.exe] => C:\program files (x86)\unified remote 3\remoteserverwin.exe
FirewallRules: [UDP Query User{0FB9B621-C39F-4B0E-89F5-1514DE288B6E}C:\program files (x86)\unified remote 3\remoteserverwin.exe] => C:\program files (x86)\unified remote 3\remoteserverwin.exe
FirewallRules: [TCP Query User{EC7CBB32-4D88-476A-A196-8E9070A1F422}C:\program files (x86)\hearthstone\hearthstone.exe] => C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [UDP Query User{DCCEF48A-7E45-4679-B270-C7229497BD3F}C:\program files (x86)\hearthstone\hearthstone.exe] => C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [TCP Query User{1404913B-AC51-4014-BD9D-2579C3C45051}C:\program files (x86)\overwatch\overwatch.exe] => C:\program files (x86)\overwatch\overwatch.exe
FirewallRules: [UDP Query User{3E374C1F-F73F-42AA-8EA3-9A14BAADC0E0}C:\program files (x86)\overwatch\overwatch.exe] => C:\program files (x86)\overwatch\overwatch.exe
FirewallRules: [{4A4F8D0E-8EEC-418A-B5A5-3B8DD4DAD6C9}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{FBF9A9DA-1DE9-499E-80C5-69500C57A2E3}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{FBF05581-30BA-42AB-AAB0-021737BB73C8}C:\program files (x86)\dying light\dyinglightgame.exe] => C:\program files (x86)\dying light\dyinglightgame.exe
FirewallRules: [UDP Query User{E8A651E8-F059-4067-98B5-B23D6FB227F6}C:\program files (x86)\dying light\dyinglightgame.exe] => C:\program files (x86)\dying light\dyinglightgame.exe
FirewallRules: [{D2CA2C98-1166-495D-B246-FE3D98CFA57B}] => C:\program files (x86)\dying light\dyinglightgame.exe
FirewallRules: [{488839D0-2D48-4CBF-B859-1B4F00D02337}] => C:\program files (x86)\dying light\dyinglightgame.exe
FirewallRules: [TCP Query User{6BA9BA64-7997-4C15-9B25-9D4140E4B3DC}E:\hoes\overwatch test\overwatch.exe] => E:\hoes\overwatch test\overwatch.exe
FirewallRules: [UDP Query User{ABB54D8F-227E-44B3-A637-796D5FBB01A7}E:\hoes\overwatch test\overwatch.exe] => E:\hoes\overwatch test\overwatch.exe
FirewallRules: [{72EE8AAB-9AF7-47A7-BB1F-F27728E13CC3}] => E:\hoes\overwatch test\overwatch.exe
FirewallRules: [{E6D3E91C-A0CC-45AF-AC28-BE3844BE824D}] => E:\hoes\overwatch test\overwatch.exe
FirewallRules: [{4BF707C7-4C94-4C70-A310-329DDE4EE036}] => C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{4F698D4D-774A-4D72-AE5B-DE8AB863561A}] => C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{A02BCDF6-2946-44C5-8522-3D3BF81B5F16}] => C:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{4C6FF824-CDA1-4E66-A21E-04E61B39F23A}] => C:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{8BB81C65-F69B-4383-B327-4BB0549095B0}] => E:\steam\steamapps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [{9A317F47-39C5-42B6-B986-A95AA2E970C0}] => E:\steam\steamapps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [TCP Query User{867007AC-A62A-4170-8C42-C8A5C8C60AF2}E:\hoes\heroes of the storm\versions\base49008\heroesofthestorm_x64.exe] => E:\hoes\heroes of the storm\versions\base49008\heroesofthestorm_x64.exe
FirewallRules: [UDP Query User{1A1925E8-DFBA-4A18-AB86-ED32CE81B315}E:\hoes\heroes of the storm\versions\base49008\heroesofthestorm_x64.exe] => E:\hoes\heroes of the storm\versions\base49008\heroesofthestorm_x64.exe
FirewallRules: [{46E4A4E6-0EAF-4B28-87FF-5B9F6679E5C3}] => C:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{3C09D7DE-2485-4694-886D-8967420BC2D9}] => C:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe

==================== Wiederherstellungspunkte =========================

27-12-2016 00:46:42 Removed LogMeIn Hamachi
10-01-2017 11:14:15 Geplanter Prüfpunkt
11-01-2017 17:22:12 JRT Pre-Junkware Removal

==================== Fehlerhafte Geräte im Gerätemanager =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (01/11/2017 05:24:28 PM) (Source: ATIeRecord) (EventID: 16387) (User: )
Description: 

Error: (01/11/2017 05:23:44 PM) (Source: ATIeRecord) (EventID: 16387) (User: )
Description: 

Error: (01/11/2017 05:22:38 PM) (Source: ATIeRecord) (EventID: 16387) (User: )
Description: 

Error: (01/11/2017 05:22:17 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: Die Open-Prozedur für den Dienst "WmiApRpl" in der DLL "C:\Windows\system32\wbem\wmiaprpl.dll" war nicht erfolgreich. Die Leistungsdaten für diesen Dienst sind nicht verfügbar. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Fehlercode.

Error: (01/11/2017 05:22:17 PM) (Source: PerfNet) (EventID: 2004) (User: )
Description: Das Serverdienst-Leistungsobjekt kann nicht geöffnet werden. Die ersten vier Bytes (DWORD) des Datenabschnitts enthalten den Statuscode.

Error: (01/11/2017 05:22:17 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: Die Open-Prozedur für den Dienst "MSDTC" in der DLL "C:\Windows\system32\msdtcuiu.DLL" war nicht erfolgreich. Die Leistungsdaten für diesen Dienst sind nicht verfügbar. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Fehlercode.

Error: (01/11/2017 05:22:17 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: Die Open-Prozedur für den Dienst "Lsa" in der DLL "C:\Windows\System32\Secur32.dll" war nicht erfolgreich. Die Leistungsdaten für diesen Dienst sind nicht verfügbar. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Fehlercode.

Error: (01/11/2017 05:22:17 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: Die Open-Prozedur für den Dienst "ESENT" in der DLL "C:\Windows\system32\esentprf.dll" war nicht erfolgreich. Die Leistungsdaten für diesen Dienst sind nicht verfügbar. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Fehlercode.

Error: (01/11/2017 05:22:14 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.

System Error:
Zugriff verweigert
.

Error: (01/11/2017 05:21:37 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: Die Open-Prozedur für den Dienst "WmiApRpl" in der DLL "C:\Windows\system32\wbem\wmiaprpl.dll" war nicht erfolgreich. Die Leistungsdaten für diesen Dienst sind nicht verfügbar. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Fehlercode.


Systemfehler:
=============
Error: (01/11/2017 05:08:02 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-PNO8QHG)
Description: Der Server "{37998346-3765-45B1-8C66-AA88CA6B20B8}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (01/11/2017 05:07:43 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Plattformdienst für verbundene Geräte" wurde mit folgendem Fehler beendet: 
Unbekannter Fehler

Error: (01/11/2017 05:05:43 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 und der APPID 
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (01/11/2017 05:05:05 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (01/11/2017 05:04:44 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Disc Soft Lite Bus Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/11/2017 05:04:44 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (01/11/2017 05:04:43 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (01/11/2017 05:04:43 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Razer Wizard Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/11/2017 05:04:43 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Adobe Acrobat Update Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/11/2017 05:04:43 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Druckwarteschlange" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.


CodeIntegrity:
===================================
  Date: 2016-10-09 20:27:10.775
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-10-09 17:08:27.981
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-10-09 16:58:20.059
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-09-30 22:53:14.118
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-09-25 20:08:55.098
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-09-25 11:48:03.984
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-09-25 01:22:30.224
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-09-24 09:11:03.969
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-09-23 15:19:31.243
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-09-23 15:05:26.305
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Speicherinformationen =========================== 

Prozessor: Intel(R) Core(TM) i7-2600K CPU @ 3.40GHz
Prozentuale Nutzung des RAM: 31%
Installierter physikalischer RAM: 8074.74 MB
Verfügbarer physikalischer RAM: 5561.37 MB
Summe virtueller Speicher: 9354.74 MB
Verfügbarer virtueller Speicher: 6464.87 MB

==================== Laufwerke ================================

Drive c: () (Fixed) (Total:111.3 GB) (Free:6.6 GB) NTFS
Drive d: (NewFrontier) (CDROM) (Total:5.9 GB) (Free:0 GB) UDF
Drive e: (TOSHIBA EXT) (Fixed) (Total:931.51 GB) (Free:96.58 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: EAE69DB8)
Partition 1: (Active) - (Size=500 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=111.3 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 931.5 GB) (Disk ID: 97F01B21)
Partition 1: (Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== Ende von Addition.txt ============================
         

Servus,


wir entfernen die letzten Reste und kontrollieren nochmal alles.



Hinweis: Der Suchlauf mit ESET kann länger dauern.



Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

start
CloseProcesses:
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\Run: [Unified Remote V3] => C:\Program Files (x86)\Unified Remote 3\RemoteServerWin.exe [4340992 2016-07-06] (Unified Intents AB)
C:\Program Files (x86)\Unified Remote 3
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\MountPoints2: {1d27f743-8b37-11e6-a112-bc5ff4e4f83a} - "D:\startme.exe" 
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\MountPoints2: {a824682a-b701-11e6-a13c-bc5ff4e4f83a} - "L:\setup.exe" 
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\MountPoints2: {d4d7dc7a-82ef-11e6-a10f-bc5ff4e4f83a} - "D:\setup.exe" 
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\...\Run: [Unified Remote V3] => C:\Program Files (x86)\Unified Remote 3\RemoteServerWin.exe [4340992 2016-07-06] (Unified Intents AB)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\...\MountPoints2: {1d27f743-8b37-11e6-a112-bc5ff4e4f83a} - "D:\startme.exe" 
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\...\MountPoints2: {a824682a-b701-11e6-a13c-bc5ff4e4f83a} - "L:\setup.exe" 
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\...\MountPoints2: {d4d7dc7a-82ef-11e6-a10f-bc5ff4e4f83a} - "D:\setup.exe" 
C:\Users\habob\AppData\Local\Chromium
RemoveProxy:
CMD: ipconfig /flushdns
CMD: netsh winsock reset
EmptyTemp:
end
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Schritt 2

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 3
Downloade dir die passende Version von HitmanPro auf deinen Desktop: HitmanPro - 32 Bit | HitmanPro - 64 Bit.

• Starte die HitmanPro.exe
• Klicke auf
  
• Entferne den Haken bei
  
• Klicke auf
  und
• Akzeptiere die Lizenzbedingungen und klicke auf
• Klicke auf
  
  und auf
• Wenn der Scan beendet wurde, nichts löschen lassen etc. sondern wähle unten links auf der Button-Leiste
  und speichere die Logdatei auf Deinem Desktop.
• Schließe HitmanPro und poste mir das Log.

 

Schritt 4

• Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Untersuchen.
• FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
• Poste mir beide Logdateien mit deiner nächsten Antwort.

Gibt es jetzt noch Probleme mit dem PC? Wenn ja, welche?







Bitte poste mit deiner nächsten Antwort

• die Logdatei des FRST-Fix,
• die Logdatei von ESET,
• die Logdatei von HitmanPro,
• die beiden neuen Logdateien von FRST,
• die Beantwortung der gestellten Fragen.

Edit: Probleme gibt es soweit keine ich hätte noch eine Frage zu den Scannern die meisten werde ich Deinstallieren, wäre es Ratsam z.b Malwarebytes auf dem Pc zu lassen oder einen anderen Scanner/Antiviren Programm(im falle das Avira nicht reicht)


FRST-Fix Log

Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version: 11-01-2017
durchgeführt von habob (12-01-2017 00:55:29) Run:2
Gestartet von C:\Users\habob\Desktop\troja
Geladene Profile: habob (Verfügbare Profile: defaultuser0 & habob)
Start-Modus: Normal
==============================================

fixlist Inhalt:
*****************
start
CloseProcesses:
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\Run: [Unified Remote V3] => C:\Program Files (x86)\Unified Remote 3\RemoteServerWin.exe [4340992 2016-07-06] (Unified Intents AB)
C:\Program Files (x86)\Unified Remote 3
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\MountPoints2: {1d27f743-8b37-11e6-a112-bc5ff4e4f83a} - "D:\startme.exe" 
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\MountPoints2: {a824682a-b701-11e6-a13c-bc5ff4e4f83a} - "L:\setup.exe" 
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\MountPoints2: {d4d7dc7a-82ef-11e6-a10f-bc5ff4e4f83a} - "D:\setup.exe" 
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\...\Run: [Unified Remote V3] => C:\Program Files (x86)\Unified Remote 3\RemoteServerWin.exe [4340992 2016-07-06] (Unified Intents AB)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\...\MountPoints2: {1d27f743-8b37-11e6-a112-bc5ff4e4f83a} - "D:\startme.exe" 
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\...\MountPoints2: {a824682a-b701-11e6-a13c-bc5ff4e4f83a} - "L:\setup.exe" 
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01112017170844084\...\MountPoints2: {d4d7dc7a-82ef-11e6-a10f-bc5ff4e4f83a} - "D:\setup.exe" 
C:\Users\habob\AppData\Local\Chromium
RemoveProxy:
CMD: ipconfig /flushdns
CMD: netsh winsock reset
EmptyTemp:
end
*****************

Prozess erfolgreich geschlossen.
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Unified Remote V3 => Wert nicht gefunden.
"C:\Program Files (x86)\Unified Remote 3" => nicht gefunden.
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1d27f743-8b37-11e6-a112-bc5ff4e4f83a} => Schlüssel nicht gefunden. 
HKCR\CLSID\{1d27f743-8b37-11e6-a112-bc5ff4e4f83a} => Schlüssel nicht gefunden. 
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a824682a-b701-11e6-a13c-bc5ff4e4f83a} => Schlüssel nicht gefunden. 
HKCR\CLSID\{a824682a-b701-11e6-a13c-bc5ff4e4f83a} => Schlüssel nicht gefunden. 
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d4d7dc7a-82ef-11e6-a10f-bc5ff4e4f83a} => Schlüssel nicht gefunden. 
HKCR\CLSID\{d4d7dc7a-82ef-11e6-a10f-bc5ff4e4f83a} => Schlüssel nicht gefunden.
         

ESET Log

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=b4737b702a9bdc408906f897e1f3d4d4
# end=init
# utc_time=2017-01-11 11:48:01
# local_time=2017-01-12 12:48:01 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# osver=6.2.9200 NT 
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=b4737b702a9bdc408906f897e1f3d4d4
# end=init
# utc_time=2017-01-12 12:05:58
# local_time=2017-01-12 01:05:58 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# osver=6.2.9200 NT 
Update Init
Update Download
esets_scanner_update returned -1 esets_gle=41217
Update Finalize
Updated modules version: 0
Old modules - leave modules
Update Init
Update Download
Update Finalize
Updated modules version: 32034
Update Init
Update Download
esets_scanner_update returned -1 esets_gle=53251
Update Finalize
Updated modules version: 32034
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=b4737b702a9bdc408906f897e1f3d4d4
# end=updated
# utc_time=2017-01-12 12:10:13
# local_time=2017-01-12 01:10:13 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# osver=6.2.9200 NT 
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=b4737b702a9bdc408906f897e1f3d4d4
# engine=32034
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2017-01-12 01:01:59
# local_time=2017-01-12 02:01:59 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1='Avira Antivirus'
# compatibility_mode=1815 16777213 100 96 29334 15331136 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 6780576 15513535 0 0
# scanned=330264
# found=1
# cleaned=0
# scan_time=3105
sh=8641FE00ADEA89A25B6D4BE8A4E9E83517A5970A ft=1 fh=1b3d8375c1b4e7e5 vn="Variante von Win32/DownloadSponsor.C eventuell unerwünschte Anwendung" ac=I fn="C:\Users\habob\Downloads\Battle net Software - CHIP-Installer.exe"
         

HitmanPro Log Teil 1

[CODE]

HitmanPro 3.7.15.281
www.hitmanpro.com

   Computer name . . . . : DESKTOP-PNO8QHG
   Windows . . . . . . . : 10.0.0.14393.X64/8
   User name . . . . . . : DESKTOP-PNO8QHG\habob
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2017-01-12 02:11:46
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 1m 28s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 1
   Traces  . . . . . . . : 7

   Objects scanned . . . : 1.612.622
   Files scanned . . . . : 51.429
   Remnants scanned  . . : 435.637 files / 1.125.556 keys

Malware _____________________________________________________________________

   C:\Users\habob\Downloads\Battle net Software - CHIP-Installer.exe
      Size . . . . . . . : 1.474.568 bytes
      Age  . . . . . . . : 141.2 days (2016-08-23 21:02:25)
      Entropy  . . . . . : 7.2
      SHA-256  . . . . . : FCFDF63721C612D6AAE67E63F5AD0483BDBBDB4BCAD8A76872C8E4E200B72CEC
      Needs elevation  . : Yes
      RSA Key Size . . . : 2048
      Authenticode . . . : Valid
    > Kaspersky  . . . . : not-a-virus:Downloader.Win32.DownloadSponsor.pe
      Fuzzy  . . . . . . : 103.0


Suspicious files ____________________________________________________________

   C:\Users\habob\AppData\Local\Microsoft\Windows\INetCache\IE\W2GIW797\FRST64[1].exe
      Size . . . . . . . : 2.419.200 bytes
      Age  . . . . . . . : 0.1 days (2017-01-12 00:45:08)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : 7510B845A891ABECBDB42053F2967CC356CA2FD528D4B6EFE4E7C2D7ABB12705
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.
      Forensic Cluster
         -147.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\97AB66DBA738B4AAB026509C6E8D650538884B20
         -146.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B520F97887E1167307F19FA04A79DACD736EC160
         -146.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D6DA54FB305B077E737C3B91FED3FBF273C29934
         -143.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\40B745CD91567350788103F6CC118E1000C9EFF2
         -143.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D7DF16411F0C36D777227B8324ACD2A8D3E3F917
         -142.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\EA89698F3DEA659EA6F499B0BA8A25A5CF3371A7
         -141.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0CF9E0E7EBDF13FCF32846E4F6D982C61D4CE2EE
         -141.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\801872471D1CF89D56245FF008B355E2775B00BF
         -140.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1EA4EB79A16118F7AFCC5394FC819F09E81F2CC2
         -139.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\238BD2A7A42803E5D4CFBA4DD7D291062B03A668
         -139.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0ED2081668C15A94F854F51C362CF14D2EC37F4A
         -138.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\FADDC4C2F76AF4BF207C5C2D8E3FC7C1096D1FB0
         -138.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C100D3A1C3DE5FEF3A0C80674BA59691705AB4E0
         -138.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\CA7ABDCB9C2CEAB3111D683917DEE67A894AEDAB
         -137.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\FE403EA52CE1489962C5B595765A92A1673B8FAE
         -137.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\60AE306570D4F8CC487C053005C31DDAFC37A59C
         -127.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1DF0D3AE23F6D4117A3C842870338802BE542E06
         -120.7s C:\Users\habob\AppData\Roaming\Skype\shared.xml
         -120.6s C:\Users\habob\Desktop\troja\Fixlist.txt
         -120.6s C:\Users\habob\AppData\Roaming\Microsoft\Windows\Recent\Fixlist.lnk
         -120.5s C:\Users\habob\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017011220170113\
         -120.5s C:\Users\habob\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017011220170113\container.dat
         -102.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E37FE5281C6979AF0A0E87DD9C8906D9B3B8ADE1
         -97.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F8D90FA549F610CB3DBCC06ACB2661D8EE6F948E
         -95.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4C62317BEFAC886604608BD02649C2987BAFEF73
         -70.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0A0E0D6714F9E0BE7CB3B5A14305FC4016AD21EC
         -56.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E6E36E250A99019482CB2018611649D0FFB8DFE5
         -53.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\119CB9CD4E15FBEA635C425B08D112527F55F8F3
         -44.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8CCF11FE38A861DC41CDFC14EEC22E06679C2C56
         -42.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A64273B82B8F00A898BA72FBE106DB791B8D89C0
         -30.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2DAB89563240BE3455D0959ECFC4AFDFD8EB4CB7
         -30.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\729B6C35996CD0C8981900A3620711C593FA28BD
         -30.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8E6A9A7966D882C23911341785A312026B69B21A
         -30.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BB7D1678527E5E63EED4CEEE7A834B90AE6019AF
         -20.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\9F7C961F8B3DF41B2D0554EA3CB711FB6D3C2D28
         -17.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A61B2F9C91A409A8DFD8DA0ED28037BE5E93427B
         -15.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A7E172CF2785C2ACAA8E172781F548E1F104AE4C
         -11.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\928FB76B42409278D3D6F5395D448DE5A1F76FF8
         -11.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4BE9179FAE9863037F73D254B1C61C874FC4C6EF
         -8.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\81E21AF5145440C43F8F8534A1832158E1A19C8B
         -1.3s C:\Users\habob\AppData\Local\Microsoft\Windows\INetCache\IE\WXB6Z67K\82[1].htm
         -1.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B7796545A396F606C1A1A07F52099DFE92796714
         -0.6s C:\Users\habob\AppData\Local\Microsoft\Windows\INetCookies\L8FAW6Z2.cookie
         -0.6s C:\Users\habob\AppData\Local\Microsoft\Windows\INetCache\IE\ZCOEU9OK\82[1].htm
         -0.2s C:\Users\habob\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6AF4EE75E3A4ABA658C0087EB9A0BB5B_556BB0FF4D382D90E7703209690E089E
         -0.2s C:\Users\habob\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AF4EE75E3A4ABA658C0087EB9A0BB5B_556BB0FF4D382D90E7703209690E089E
          0.0s C:\Users\habob\AppData\Local\Microsoft\Windows\INetCache\IE\W2GIW797\FRST64[1].exe
          0.0s C:\Users\habob\Desktop\troja\FRST64.exe
          0.9s C:\Users\habob\Desktop\troja\FRST-OlderVersion\
          4.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4B764CAA31398BA4C4309AFAD6067BF55F6E309D
          7.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3EAB2489567ED1D97A0AFEBFCA06D5F4975458CC
          9.8s C:\FRST\Logs\ct
          9.8s C:\FRST\users00
          9.8s C:\Users\habob\Desktop\troja\Fixlog.txt
         10.3s C:\Windows\Prefetch\RUNDLL32.EXE-90B5D9EF.pf
         10.4s C:\FRST\re
         10.4s C:\FRST\Quarantine\C\
         10.4s C:\FRST\Quarantine\C\Program Files (x86)\
         25.0s C:\Windows\Prefetch\SPOOLSV.EXE-D1F6B8B6.pf
         37.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\7DD33EDF3D7B0BED260538952B54E01F8B7D2CE6
         38.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C3FB117A0CAC20A9361D45694BB2AD0D4F856A8C
         39.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B1BF484310B181937E88AFC02D2B2F23B1FBCC38
         40.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5C93C9F76600B4663BEF69AAE36993D8ABE6884E
         41.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E3085D42FE4290B96797C0D859EFB2C00235405D
         42.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\59A0BE7A78DBBF72F69C0B4B1F1A36B6CAF69814
         42.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\436389A0A3AC2CA6E7FDF53ED4A2C7019A0F38BB
         42.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A7EEF205DABE321091C548EE7CDA24803B36140D
         42.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A5C6368023EC81107CE72C8928F2DD770EC530EE
         43.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F092C26698B0060D1BCCE8A513B811E3786C597F
         43.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\007DBE88E47921A6425A2000D77FB80B3A452FAF
         43.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8699D5432583BD179F2D621616735194372203FE
         44.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2413A91B9DF19949EDA61F48E127BA849C8FBBF8
         44.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\064509193D6F40B49A497A629412EC9572324EDC
         45.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\FA2BF5D4C12E48A8349CEEE416BB5E60052A419C
         45.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\9DA7AB84A8A951129C5BB6BB20BFE80B4567475D
         45.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D2B327C0C2FF403CF7B354734EC26516CE6BA47D
         45.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5D92DAE9545E62DBEAA15F3A873D65E5BBF1DA02
         45.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3DBCCA3F9DC7B406E99ABC43E1AEDDE539762A9A
         45.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\EBF2F8D428DFA535E0CF3B6DFD6C028D0B3062A7
         45.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0C893422DE7E3C905EEA418AC18579F880FE57E8
         45.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F37ADDD033A3243130F3F5BAA8E8B17E2A6D556E
         45.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\125BB221139EA7F809C006F79C8263C711B6EBF6
         45.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5E8F1C16DDB12D2B3DC061F8558B399E27261BC5
         45.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\150FF5E1D33F76A843E171C59BE9DFE2998AC45E
         45.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B50879054520B66642D22A447655594DDCD87B4D
         45.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BB48A7EB07F741C3DF378CFAFABD833E7A06B6E7
         45.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6CC4ECB2F894A8068069A0B6CA50EEA309CD998C
         47.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\213C73556CCF5794C3BCA0DE26FC8411AC7DA401
         47.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\49F13F6FA79AE95852C13226F13DDB561DF20573
         47.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\54CF3EFF92AE556A0FB874A43CB2E7ECF1DE4878
         47.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4B973A8E56D13E1AAB08BC2910CB8558F55E1DF5
         47.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\EA62471621AD2F756A40052FD789E629E93C16D4
         47.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\7C91ACBCF18209404D91BB326093C8B809AF4E0C
         47.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\40C418AC052A73EA762651CEC482D7E2B530622B
         47.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\9E80F17A8DA34CA8C74164C0CB6A1B417145FA42
         47.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\56DEEEEAC5B0398A370B59DC2628F1E900AB4EE9
         47.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\FC6EBA163B77781A0A560042D2418BB1580785A0
         49.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E9153FD5B3EA1EE25C4FCE1167E869C3FA7F652C
         49.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B82D8C0941EF58A81FB705B78BE0CC2333F318FA
         49.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\9F377DD2B7839618CDE33D17D87066D0FF47EEF0
         49.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A83ABA6608D445D8F06F15101AAEAD692BBE292F
         49.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D9861F4746D39C6E177E368E71B7AE0DDCEBA21B
         49.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\470ADE8A5F194B5367E172B82A444F1C7FA964D1
         49.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C8CC37DD030AC6CB48C02E3671D1772B810FC204
         49.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B9C2B6CDB102DE34E18EA9C493950F516C18AD54
         49.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6C50ABBFA17BC3FAAA2933202AD8CBCAFB18FACA
         49.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E8E480C62518D6BB61125A2D9181E45C6B3F8877
         49.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0EC5C579640BF799FAFE41194B112B4406904B99
         49.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\004823CCD3ED74AC5C5A30629F3AF074F978CCBF
         49.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3BA3B5E07A95CBC2C2ABF06F777107EEF954842F
         49.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\EE3E302858A28A3A8535FA4F00D7F4EA2FD1B71D
         49.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B565AC72D37673836001AAB678ADA35D468A59D8
         49.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1622C30288A6287288ACB2D46FBECCAC6AD7E1FB
         49.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1BD433877A2019B7F0B3B37164928A42F12EE878
         49.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\68A8955BCCC2C00EA26ECD23C2B9701330A738C7
         49.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\9677D9611D7E963824913008E1B48E2BEBB2EE30
         50.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2DB612B4BE7F5D73BB25DCD0F0BDC5357AF21B6A
         50.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C8F384FB5C5186F7DD8F63473C17B07D92D809FB
         50.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\605E6B03D960FC93AC73037712FC49EF3E4BC4EB
         50.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3A8EEA208E0F7E54A490A2391A1A79C9FFF2E02F
         50.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\33556704560C4C510A217678991F5A985C785D8C
         50.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\50CD14F1D91179F95065FC4CED397DE625E5A2B8
         52.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\FDCB678401838BD3101B67843745E97BB2AB82A3
         53.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\46F596D6A44D9FC1D8F977D977727CFA07C56C2B
         53.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\510E9414271371E577D9BC5598C2001D6FD5FD8D
         54.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D2C6F64FE8A20BC5147F9EA0F575D54890E48477
         54.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A3C6F9EDC8F1B348B94BCD08F0925EFCF3059C9A
         54.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\AB53E76491AE1C36D67745A4EA8625A84BCCDC9A
         56.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\00E986EF2FC8A5C03A2EAAA64EA4AB492335176C
         56.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0195BBCC8BD800ABEC46AF439081CF73D692839B
         56.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F88CA05DD735A7FC049FA78F39B138A317D6B44C
         56.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\745A3307AD56C498345F7C73930CF4EF886C21A0
         56.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A3D7AC0163403AC20593ED21BF9632FFF9FA092C
         56.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F9B1A35226752CB4F92E74116A48915C792C7A38
         56.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E647E591356FB74BA5D7FA94321277129BA18B33
         56.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6AB4176FBABA42EBEF8965514F36C366E8CAEF60
         56.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0912AA7B17CE983292A1CB1B7C8B150F709BBDEF
         56.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F76CF74CB9B8D32B0E7CCE361F6ABE5045259F37
         56.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2551654A735607DAAE30541BF82B307780310F30
         56.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0C005D7C7945A45DC18DDF321E1BD5FF3A77CD8C
         56.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\DFC9386903B8233E4BFB2D053F02F41E10282DAE
         56.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\437AD5E711A3299E08923BDEDED096C881FD84BE
         56.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6042435233CDD86B6FB848EDB93785AB0804F8B8
         56.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\416A5A5C2C8086E32C8B41AD99FA612E8B6C89A5
         56.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1D98506E638F1CA1FDC1438B72FCE4EFD34F558C
         56.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\97394F2B353367A81E11CEDC603F18329B62CC8E
         56.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\343012197E58DB41D16D522C2FF96FDB1206AA97
         57.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5D542C31BD3611E73F76E7EB6C7DB7A497169CC9
         57.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8D099DA316D6755F6A7896205A87FF1D8F48D79B
         57.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C982DB3B35E3769B26ECF859CDBEF85489E404CE
         57.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8D73ACE4B75043ADCF43B665A9B351EB5E0012B5
         57.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3EE806BFF5F882C1F250DC1D867AD1FFC0551E38
         57.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0CB93DD292E63AE96AF6B8DE79C7152C68110EB9
         57.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\05F3557AD60749B4FA8FF1D2981FA47472DCC17E
         57.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\44116C1FD79009D202BD5D0B37E1942F025CA346
         57.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\ED9F27A63BC2F2D241265D93DE8E755D6FE29B3A
         57.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BB78072F40CA5403EA0D5C4B1198FF61F8F84A33
         58.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\841D212C96A2A2544CCA229FE381A9321E989A03
         58.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\15CCB4F235BB167DC57D1AC32924FE4C1F6C712A
         58.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\50C0A1FE26ABA290ECBF86E6751F5519C1167DFE
         58.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1A5F18B367541A7C226B57A45A256F3F412FAB52
         58.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\7B1303CD5EF12C9538DA83E7ADDA009F49B3B965
         58.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\98A20B6EB6FCE16EF5BE37C44A96C96500F632D8
         59.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D97B9CAF78F057604E4BD090653B13CB1BF9E33F
         59.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B60AB5576DC86ABC806C2F79734E7E8A280B51AA
         59.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D6CB4773D116E08FAE8F89AA3486CF4B74C25294
         59.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\60011B411A17D150F9548D7273F553677CDF96B5
         59.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E4E8A4DF4855D0F7707672415279CCEED33B9880
         59.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B71F4219B479517F9FF97E8173C65280095C9FB8
         59.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8FCD47E863170B63F7094A144F98D2998082766C
         59.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\590E369C33562661F9F931E456AA107B14F3C3BE
         59.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8E7FDCD29186AE926A36A23F700062F80DECA6D1
         59.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\90C02900B841DE2D37B1F9CBEE93FFB066B74D3A
         60.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\52C438F3C68EED57FB74813CA117DEB3438173B1
         60.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3BDE82C2274D680264D258E656EB5E8F3DDFBDD6
         60.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\136E885AF15AFA93D2114744317A7D94437AA85A
         60.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4CFA1101C83451162BCCA0FA30450AC714A981FB
         60.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D5165BF5E7A22962A6FA99F6DA75D24F1C23D35B
         60.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\382BCD62850F1463BCD5129D36B01306F529AD60
         60.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\DEF251D7FA64C1DBAE8410E55A0A8A2414C9B45F
         60.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\662CF77B34A78EDAA57D09A227775C61344CA2E6
         60.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5AFDD2B912F74C78B0C3D343632FFAD6AEFCFA1F
         61.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\848FF8B2E306B93F48580EF84409B13BBE3C0701
         61.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5231097229BFDC696ABC023E3E51ABAD525F7290
         61.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\9E89901BCB6833B1786891533E3DB0FC2CF8A568
         61.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F97A2063753F7CA86A5F56673CAD85E65D9A741A
         61.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\ED29D11BDBCF9B24D886F7513A4E622893218029
         61.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\021CE915ECF80CB3A0E34FBE096D2D1C2EA706AE
         61.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C4D083A6403FDB1778F18F081231C65D4001BC6D
         61.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\10EB8EA7896AF5BB8423CFFE1320A68F3B0041F3
         61.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BE3CD713BA6D23DC21B72481BCC8BCDCD4C1022B
         62.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6BA8D5EF0BD733F0ACF8A568FD1EE855DB4E427D
         62.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F7884B6946FAB0F3E8E40D9016747DD9A61926D0
         62.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\35919559619E8A9890B93568D6630142DCB3F11A
         63.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\748383ECB0FD0030E1FF2678093AF40C57906163
         63.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\ED3B2F12D4DC8E96981E6F8D38A0E9EB6076C3C5
         63.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\7E3DC9E108C3E67796B87B7C0600C5EAE39BEC6F
         65.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\835C07E5C1CF4C4EC0E190F2D524F7B61A5261CA
         65.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E078FAC41DA0B93F4A846A9B090DB697AD060BCE
         66.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4A1A9C4E37AFEB2BCF0F0505EAED6C201D57C702
         66.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\72110EED392A75B1F210CB15C18BBA9A5DEEEAAE
         66.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\32C7F5FBF2677E97E1E7ABBA766CFC7BB8DABC9F
         66.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\79BB65C0C852DBB1AA0501D8E87989B9036AD648
         66.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\47A6F0FA2D0F23467B9F9F5AF722C41B71B74E99
         67.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1816C747D1EB1E4C102CF1D95349369439C64D8D
         67.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\15FCE3A9CD2D102ECC24A8B9F63348D7BDC25F9F
         67.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\57D759250656724050AF71678CB5F17463460153
         67.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A5D35D02873E5B54F9CD59E712C121FC45ABAA25
         67.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E745ECDBB8C580E52DDED1FF37958FB335A889F5
         67.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\10275F25EF413CE9671BD41E6F8675E9A1937A5A
         67.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\AAC546ED2388898D477EB1546522524855A7C5F2
         67.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\460F247EA32091CE600D019E595474D74F8D0047
         68.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\47EACE06E6972BD5975328690650290B2B929CAA
         94.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\DC7622A91C1910306A350FF0C48B27F946EFCEEB
         95.0s C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\datareporting\archived\2017-01\1484178098918.509d8fb2-7844-49e4-81a8-086dfdca62aa.main.jsonlz4
         96.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3262BBD770D299A13317E9F055C9C4B84AA8DAB6
         98.2s C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\datareporting\archived\2017-01\1484178406192.f15f8358-cd66-4792-b01c-340debcd03d7.main.jsonlz4
         98.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\042E21155DF68191A2B82E95F8235CF8582A8FF2
         98.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\18751CEB990A6196EF16FA1DA5801644718F74DB
         98.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BCBE449AF70D7D2AFB331A1C813A5720E0C8CCB0
         98.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\865C136A5926641602D566FE4F337191D3C43446
         105.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\65C1A3B3A40A05317A4C958049F7CDEC64C6A8EC
         107.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4B446CA907E3075936509FDDA14701575AA215EA
         108.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A4BC34CE962901BA57500A6B897C28080B91A68D
         110.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\30D40E836487A9A1F378280185AB8D0C4EEF2DA2
         111.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\456CA7E4D100C57B3753C5F5F256D9478B14A267
         111.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\45ABC8E275E5B121BED5693CD467D49DC2FD4CC1
         117.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\85809AB8F0E233AA62C4F33BC1EE0B5727EC1E0E
         117.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BC8E9D9BA6FA57D8B0AB02CD97165914541A2647
         118.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0C481F96BA63AB57D91BAEBDB3846267D1BF1F99
         124.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B96F2138BAD38C769A64CDEA58FD87B6978CB491
         124.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F53A9FFCC98B8418DD9AD5A24E6D5511DD153565
         129.3s C:\Users\habob\Desktop\troja\esetsmartinstaller_deu.exe
         130.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\96C3C514873235C8F54728C7D06DF2F69BD19823
         138.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BC128E4C17CEB7141942F887FA71E8F05485C751
         138.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6D69C015CC636AE32F1828393C439A1F122ED603
         145.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6C3017D365E10F8584141AA7246CAB783E6CE42C
         153.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BB61D0A8B40CAD431B870AC5C7FC962F58A1D200
         157.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\AC57F4B1ADEA03F5FC6E325CFC9788A16DAF1B82
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2CE17D1D089B9C1EA10AD613E3EDA0A96477A4C2
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\FE4B898B37413B0E02AB4E03FCAB252187AC71C1
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E641E78F45239BD586C54059CE0D720A0FBB8F66
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6F69275201650810B774A8849666431D9C7D0602
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0773B826DD1C2064375C255B7AF9035367CDBA8A
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E92899E8888C17D752891082B1CD9D38ED78BF99
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\52456B3F28769DAD41E420AE64DF59C8F7031F5B
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\868B3DEE549FDE13E208350C53E33724061D2BC6
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\11E8B8D2630451217A833678D0878074D3AE0270
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0313539B5AF19B47F340ACECA9DFBC6D951C03C2
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\EC86059394D320E802D0B7F720735C978C24463C
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\844C33A0CB7A17F2C24E801597D7C77A28368648
         157.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B5E03580A30398375128ECE316E493784CDB099F
         157.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\20B5A2A8AC7281C06E33AC0C92EE6EC51DC00E1D
         157.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\23F295D146EAFCC2AEFDA545DFCB6313C6A42326
         157.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\572315B5AB6A920E2C1FE9D106C19EBD2BCC68D2
         157.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2485FF1E45EDFBA35901BC70F8B4CD78164EA358
         157.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B6B5C1C05ADA825B98471BD1748CCD2157A28BAC
         160.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\54F1389B59CE310E6354CD42333F3DEC6369E10D
         161.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A23816F3E363E756F0A56CE17EEDEC42C1D40075
         166.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E664F8DB448BDE73D46E08B5BD7B4F9D640C36CD
         167.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5259819201A7AB0E27680FC9535B5427592663F9
         169.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\CF9777C8217A2B733585DBD667288EF9782454FA
         171.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\DCC5ED37D2A22553948FFDD4F35976F877009270
         172.0s C:\Windows\Prefetch\ESETSMARTINSTALLER_DEU.EXE-E655EA4E.pf
         172.1s C:\Program Files (x86)\ESET\
         172.1s C:\Program Files (x86)\ESET\ESET Online Scanner\
         172.1s C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\
         172.1s C:\Program Files (x86)\ESET\ESET Online Scanner\Modules\
         172.5s C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScanner.cab
         172.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\712B7869B0AB20BD8A222C7FA2A63AB23064014F
         173.2s C:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
         173.2s C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerApp.exe
         173.2s C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerUninstaller.exe
         173.2s C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
         173.2s C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScannerA.exe
         173.2s C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerLang.dll
         173.2s C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScanner.ocx
         173.2s C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScanner64.ocx
         173.2s C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScanner.inf
         173.2s C:\Program Files (x86)\ESET\ESET Online Scanner\unicows.dll
         173.2s C:\Program Files (x86)\ESET\ESET Online Scanner\esets_apiW.dll
         173.3s C:\Program Files (x86)\ESET\ESET Online Scanner\esets_apiW_a.dll
         173.3s C:\Program Files (x86)\ESET\ESET Online Scanner\esets_apiA.dll
         173.5s C:\Windows\Prefetch\REGSVR32.EXE-D5170E12.pf
         173.6s C:\Program Files (x86)\ESET\ESET Online Scanner\log.txt
         174.4s C:\Users\habob\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AC59853F556157EE97023493D5850BE5_5B273A0DF9C4EE8181D27A3F02534177
         174.4s C:\Users\habob\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AC59853F556157EE97023493D5850BE5_5B273A0DF9C4EE8181D27A3F02534177
         179.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B19C00C2F27819E0F45DC0D60AFE7BD15973BF92
         182.2s C:\Windows\Prefetch\DLLHOST.EXE-61F58501.pf
         183.6s C:\Windows\Prefetch\ONLINESCANNERAPP.EXE-B2412F9A.pf
         184.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F883D84B5366E1654C9A1A4B158A686DF0B55B99
         188.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\85F5AD95B0F10529CF6A126C4702BAA87A0E0B3A
         189.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\91B0BB70B03BE2D59720F8263D32DF75893257E2
         193.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BC6848FF063714C985B24B61280BABAD08C97C33
         202.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\324C86BA67AF661A29120BB68C777E6ACD2C16C2
         214.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1815883AC96520C17636AFAE6710F203FFE283BC
         216.6s C:\Users\habob\AppData\Local\Battle.net\Logs\battle.net-20170111T234844.722837.log
         217.8s C:\ProgramData\Battle.net\Agent\Logs\Switcher-20170111T234845.log
         218.2s C:\ProgramData\Battle.net\Agent\Agent.5362\Logs\Agent-20170111T234846.log
         218.3s C:\ProgramData\Battle.net\Agent\Agent.5362\Logs\Features-20170111T234846.log
         218.6s C:\Users\habob\AppData\Local\Battle.net\Logs\libcef-20170111T234846.729747.log
         226.6s C:\ProgramData\Battle.net\Setup\battle.net\Logs\battle.net-launcher-20170111T234854.759404.log
         227.4s C:\ProgramData\Battle.net\Agent\Agent.5362\Logs\Operations-20170111T234846.log
         228.6s C:\Users\habob\AppData\Local\Battle.net\Logs\battle.net-20170111T234856.729854.log
         230.3s C:\Users\habob\AppData\Local\Battle.net\Logs\libcef-20170111T234858.480923.log
         237.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\069EDB4DC85FB0278B43443874FE4E0100733E3C
         238.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D4F42F706531656465C8EBEA853F676DD8E225F5
         238.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\08A309EF0234A1A786A9A3DB2C1F81BC5A7ACC7A
         259.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\460080EB3298E07514B3E509C266C16291BDC317
         268.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\96B758FDF0B9A43DEB3ED82A612AA25FD35744BE
         268.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4C047EB885929C7912DD9F500B5061670FEE0DAC
         268.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\7947C3F377BB5CE60368D37D3858BA1BFCB4EA6D
         268.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\9324813C1228090F97AA85B75DEABAD1B901B2CA
         270.0s C:\Windows\Prefetch\BACKGROUNDTASKHOST.EXE-2C6F4889.pf
         271.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\941D674414123CDF8199494E837A2D952D19E6E6
         275.1s C:\Windows\Prefetch\DLLHOST.EXE-A8DE6D5B.pf
         277.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\9116D92FB5A5CF45E085665F96DFE85A96342213
         281.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\85C687D5D25ADFB3DF53E9870AF1859EAD428D72
         281.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\267313D962EBF4B9C130174F6C733A30B39F44F3
         282.8s C:\Windows\Prefetch\SETTINGSYNCHOST.EXE-2521C7ED.pf
         286.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A1F22B3A581B8873ED64E7B984DD602598272764
         295.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\CE861E001A6336F92FEF694F8E93E7E56F1A0754
         307.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C599911AFC0A21D88375A7FD1D7626790CF034CE
         307.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2CFFEB2D45C694123396DF52543608D0CD2D2458
         307.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5A15DB01AA2D332EB91B0D43C1FCA7A2B4E2E104
         308.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\DA053441FECB28FD56D9CA10DC7A46A6B3B926AE
         310.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\393B2BBEA1BF9859F37F4D7F88F2ECBB35A2AF3B
         310.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BE71884634259C03C4B87244D2FA918F55D81493
         310.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C0A01F87281B092DD72FE73D33C2B428F5B22062
         310.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8C7553727F3895A170D60CD35B95ADB4D4FE1E9F
         311.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\86A4707EDEC40FD8A5DE891A4A16F47EAF1A5658
         311.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3814042C0F1DD6D6AF88870B8C8A0D8DDD47FFE8
         311.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A32E505400E9B35FD173BD77FCE99F82918ACCD0
         311.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5E4D0950AEE178BEDEE8A0C27A1002F886F1F991
         311.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3BE9726EED4232A41EFA99759A3558C65BFFBDD1
         311.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0476B1455491B2B0E9D5177C53BE4A312EFEE650
         311.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\049C56C9313636A1418028A05AFB62E95F109876
         311.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2AC5EEEC6198087240889C7990BE24A081BC5FA1
         311.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\DF19581BC148D4BF1727D596D2282898C0EA9D1A
         313.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8DF0D393B55C4DE686C01B9B0E1904D9685F65F8
         313.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\DBE994F747FDDBD171492B5D6DFF6768AE33EAAF
         313.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C0D7C5AE71C3D15191D0E91FD5839C43F85B978F
         313.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\85F56B460AE74E1CB16B2826D3D055A3505A9506
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\DC043474CCF6AF71F611A60C14B8EA2E86352A36
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A86DDCD10E4446B0BFE51BFC13687AFB0D2F357C
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1CA1718CA89BA23E6EFB282AABFCC87D1C0B23E7
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\767A07A150F669CC88D10A31622DB1A45A4BB17E
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\78BB7B26D683400E693E8FB4CA3C7798675AE66E
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E19A5A77332F38ACF4D15238B58786EBA231A729
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\9BB1D41839415BF6352B99194A83E64362CE63F6
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\44BCD11E4C20F9ABF351C7FB9674416C7B450D97
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\76F5ED013D774262E016CD471056AEC0891157E4
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\CDC5D826661BDF0C1FCC38C4C3105885D3EF70D5
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B53453EB81D7BB8EC253A386360866A5A15FCB62
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6C699088EFB3586418CD177DD55173520ECB93CF
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E710B7BD1F79F23E79FF39E529ACC75D021EF452
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\DC60A7C7D58950FC3E47268CF46454B1331D255E
         314.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2ED89B4204804B00755DEC7017B0B42359CAEB05
         314.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1CC6FF3109B4E1253F03540C1A01F7B20D21D8D1
         315.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\985218B6D31EC094A957DF3B8472364EAFEB4748
         316.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\37A9592B780F8AC4A4733CC8ABA0CBED0C3AB875
         316.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6C69A217F6BA5AC179F5F6FB79EA7D6264EEE73F
         317.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2AC0A23743DA93AEC0D9E33EDF39618626655A3B
         317.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F4DC98AE4614DC4E723B53CD53A74B1C9548A008
         317.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D8AB85A0BF79089224CFD701BF5D5209E6A974BB
         317.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\FAAB407AF66AE6E6406D011C76F1448B65DE967E
         317.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\7F00BC763B12DE8E1507A410F6BCB25F7E98F19D
         317.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\42479AF174E1C5AB80492169A2E0F03272D8BFB2
         317.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\85E3A29A0ABB5CB002E98A7CB439292F012C6895
         318.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B366B3C7ED3D567BEE730360832227460AC1EBF3
         318.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\ABBB1E660CC6D257675E6FC297888D8E487B49AF
         318.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4A8147E493669ED07BD9E22B75E4D73213760E8E
         324.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3B56278B729FAC4227AA019D045377FF36EFFF27
         326.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8E74F138F77A5FBA461DF28348DEF43D3BF6571C
         326.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\AB68F5C473FD7664585548CDE3FBDFDD1E3C07C6
         326.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\802BE3AA31B56010CCBBA4A50AB8CBD9083CE1C5
         326.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A423096059EA6CDDD83A0FAF8360C90258625E75
         326.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E3A3AC639652363954BCCDF66B0658A3F19EEBA5
         326.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5857650DA3BAEFED994065C933219D5FEC3EADA3
         326.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C0EDF292E812E90FF4FA30D5D2D65AD9F16B03C3
         326.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\909D41419D239E64B9C7797FAD3F513057121D24
         326.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\22E29AD1421240C146D6BF400F960FFC80985662
         326.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\218F9FC8B306188E6B149C9C38F06A09879543EE
         326.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A42E755D602C3033CC0CE240CD0ED872E74EC893
         326.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\7339B5E26A4FB7FA930C23F93B1777CDFA083269
         326.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2965C5C25D45B5E8DA4FE6F6519469BA0EA75A02
         326.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\ECCF2829F32E3B359B9C615F69ABD1DA4EBC5F9B
         326.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4E586DAB0F91DC77E810CBA945F21DB66FD0087F
         326.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\12AC7CD3A1521CD203E8A351A4265476EC3DCFF2
         326.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\515B92CCFFD11EFA9DC9865CC30DF8D798DDAC2D
         326.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8565C29D8DCEDA828120E2B95B469F8657E5F692
         326.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\7DFC0EB5636500A311001F8FA0E1064BA04FFB34
         326.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\731D01B5E4FEF83B38B6BFB16DE255DD4442E552
         326.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6BA48E3B38236BE38C6697A762E85F68F39F9077
         326.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\29C1474A09EB2EF930C96BA180DC0A8B6699AB12
         326.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\78BA1A0DABF0F54B066CB7354A8ED31E1F5FBD2F
         326.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\99818D84B2694E6D80AEEF344899AC8D38A5E9B4
         327.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\12C78D6EE62BD2ACA3D9F07C91F623897FE3FCBE
         327.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\DBAD22E9F2C721DFBD10F53A35A1C4A029690AE5
         327.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2291002D0184F5A070FD8737FD93AE353AF84163
         327.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4166AF835E0FF63A479C338E699EA1589585BCBB
         327.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\76A60AB82B74C4C29E60910CF5F732B2D546069C
         328.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3F08E019E6944DFFDFE8A1DBEDE4AA5A6335821E
         328.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3D5FBF489C79F1A7835C1F6B67B82C3DBAB175D9
         329.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0A203133C05AF675F06E7BDD8E94ADF2B8CD2E45
         329.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\746D8CD82E7FC2B4D48EE656FEC1AE7FCDED285D
         329.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\31D5E0834569B172D157B4037988763AB2C5FF3F
         329.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\323831E22F6C1C330759AA7EC87999C913E0BAE3
         329.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BFC66D9786527CB880A88EDD1397EA81F429D42E
         329.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B78F1EB10D33D5285C4786E73852B906869DB0C7
         329.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A259F80B3D086BA9F8806966361E2FE73B6D4DFD
         329.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B458C855D60F4335676A2FCC92E94E30A700E5A1
         329.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\02ED3ECBBB319E3BD9364874218752165D803897
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D05EBC93466AFB5E42C0303258716F8B3D2B1FC5
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\324034E97F582AA9EAC0FD74CBDC7A2022969F41
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4294E82A396F8E5901CA4B2CF9CA63F4B4C0B829
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\904C5393FB3E86DEC4625AA7AA73E53A470F84FB
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D394E2A4235F3D464A67E85FD1E607B2ED9CA7EB
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5A39E33CBEB05521F49198BDDB021CE1FF48F817
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\143F9E34A4798C89AACD7FF23AAFD96FA127461B
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\243EC8836C2E10E3D697405697B7D01CF21B8B57
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F3259D70F3747E0EEB0325426AD501656ABEC58C
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\10F2A8919F51AD132A27836273FD1C2ACB7ED29A
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C5DA323ABB6199452352700B47532BEB4A009D4B
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E5A91A914BCA9D8DEC7FB8C1DF37A611EA48C320
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4CB067085EED56F06D58F6947AFFCBE574386EC4
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B942FF49D4355D59E4CEE9564EE8ACD122291DEF
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\83430E627D25973122A1F21FD53E4608A9E9FEE8
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\99892DF9BE26A4F08BB9E052F976358E09EA8AF9
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1A05C8D6E1AC508773FB449F3195D968F57386BD
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BE3123AB6D404A045F9E6E702BD79B5F1A4F104B
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BE6A4A69CD5F4E4857A0AE7C58B9DB830CD912A0
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6CF28153702381439F3DF888BAE9B557E837DDAD
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A1BC46DCB1E1BE41B2FFA790ED71B483B187A9DB
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\17B93139A6500AE7CEC681CD1AF9E5A6D65A25BB
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0F778BE3737ABCC7CD2DF57EF0DC0D214479F99C
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\522A5E3BE8937965C12122FEADD7FB80458A711F
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\255D9795705D736DC1F50403796178E530A3ACE5
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F5E134AFECCD65A85D840B6B90D98F332D411871
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A8A59E978C0D5CFF08503169C649A863D75ACA58
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B5CF72D1CB864F605856E1FAD66085D200D3CE0E
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3B9A0EED202F33421BF1C6FFDA7B364EBE6495F2
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\7281B21D37C12D9B15044E516DE0BBBB308ABEED
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C7E240BD108A7A24EE3AD96C50464593DCD4985F
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1630F86F4C1FC35BCFA268B0FBD2C574DCACDA6E
         330.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E32EBE75D3DB684198317CF6B7E4EBBD67CFEE15
         330.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8405F105FD8DDC2CF58A861C7F81C380F84DB97F
         330.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C33F0A7803E732B02F3A66B0B360C01E089A6577
         330.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\56C8599DF77D96DCEB8DE327A3161206D563AA59
         330.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\93C2AC25F52796A7945E2880555CDBD3F3EB5721
         330.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\178E4A77E2999F4E40BAAB92ABABF40160337677
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\71E759EEB196FC57F18AA2244207BAF87956CD0E
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0033F814112594312D50800DE4C27D8FCD0F744D
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\10AFA6F302286F9921A42C61D8FE4A1ABAB2E98A
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3D85D8B77A65899C65F42CE08072C5854CBDD4DD
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\31EB57CE0098331846C2FEA79EA2B9C1936B1323
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\73E9A9B959A634286FD4999C21307167E9D7BADB
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\19C491A5052908BB4358172E323649F7815E60AA
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4479A83239EA9021255169791BBBE0F7282B9CAF
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0AED98F9B008821E57F9921D8EF457631630979D
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\45E94139C91A6266E27D2A0433D0EB1CE29D4356
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\FA0CA0AB583FA02CD7A42A8BE26FAA240FC864BA
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0D75EAEB7810B2991812F63AD3EE353A2D587EE4
         331.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5BACFE4AE614FCDB6FDE85D9CC9656833B3BE406
         332.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\71A844B5D4A95441E07ACAC11205F629C0BE473F
         332.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8778361E53F4D4F978650C7A8CDEB9D092CFA7CA
         336.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\03D8665FF52841D96A25EB39E8E4E4DEC8C10949
         337.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\AB7F42C5BD6C776F8257B4544D968B37AF4E1679
         339.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A00D6BAFD5CD62253CB93823D9E6652D8574AD7E
         

HitmanPro Log Teil 2

  C:\Users\habob\Desktop\troja\FRST-OlderVersion\FRST64.exe
      Size . . . . . . . : 2.419.200 bytes
      Age  . . . . . . . : 1.4 days (2017-01-10 17:29:22)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : 0B4E2E914C2BE30FF539A204F1BE480058F1BDAAE2483C0C960EB4A2CFAA2C4A
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.

   C:\Users\habob\Desktop\troja\FRST64.exe
      Size . . . . . . . : 2.419.200 bytes
      Age  . . . . . . . : 0.1 days (2017-01-12 00:45:08)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : 7510B845A891ABECBDB42053F2967CC356CA2FD528D4B6EFE4E7C2D7ABB12705
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.
      Forensic Cluster
         -147.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\97AB66DBA738B4AAB026509C6E8D650538884B20
         -146.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B520F97887E1167307F19FA04A79DACD736EC160
         -146.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D6DA54FB305B077E737C3B91FED3FBF273C29934
         -143.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\40B745CD91567350788103F6CC118E1000C9EFF2
         -143.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D7DF16411F0C36D777227B8324ACD2A8D3E3F917
         -142.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\EA89698F3DEA659EA6F499B0BA8A25A5CF3371A7
         -141.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0CF9E0E7EBDF13FCF32846E4F6D982C61D4CE2EE
         -141.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\801872471D1CF89D56245FF008B355E2775B00BF
         -140.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1EA4EB79A16118F7AFCC5394FC819F09E81F2CC2
         -139.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\238BD2A7A42803E5D4CFBA4DD7D291062B03A668
         -139.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0ED2081668C15A94F854F51C362CF14D2EC37F4A
         -138.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\FADDC4C2F76AF4BF207C5C2D8E3FC7C1096D1FB0
         -138.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C100D3A1C3DE5FEF3A0C80674BA59691705AB4E0
         -138.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\CA7ABDCB9C2CEAB3111D683917DEE67A894AEDAB
         -137.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\FE403EA52CE1489962C5B595765A92A1673B8FAE
         -137.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\60AE306570D4F8CC487C053005C31DDAFC37A59C
         -127.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1DF0D3AE23F6D4117A3C842870338802BE542E06
         -120.7s C:\Users\habob\AppData\Roaming\Skype\shared.xml
         -120.6s C:\Users\habob\Desktop\troja\Fixlist.txt
         -120.6s C:\Users\habob\AppData\Roaming\Microsoft\Windows\Recent\Fixlist.lnk
         -120.5s C:\Users\habob\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017011220170113\
         -120.5s C:\Users\habob\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017011220170113\container.dat
         -102.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E37FE5281C6979AF0A0E87DD9C8906D9B3B8ADE1
         -97.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F8D90FA549F610CB3DBCC06ACB2661D8EE6F948E
         -95.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4C62317BEFAC886604608BD02649C2987BAFEF73
         -70.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0A0E0D6714F9E0BE7CB3B5A14305FC4016AD21EC
         -56.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E6E36E250A99019482CB2018611649D0FFB8DFE5
         -53.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\119CB9CD4E15FBEA635C425B08D112527F55F8F3
         -44.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8CCF11FE38A861DC41CDFC14EEC22E06679C2C56
         -42.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A64273B82B8F00A898BA72FBE106DB791B8D89C0
         -30.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2DAB89563240BE3455D0959ECFC4AFDFD8EB4CB7
         -30.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\729B6C35996CD0C8981900A3620711C593FA28BD
         -30.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8E6A9A7966D882C23911341785A312026B69B21A
         -30.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BB7D1678527E5E63EED4CEEE7A834B90AE6019AF
         -20.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\9F7C961F8B3DF41B2D0554EA3CB711FB6D3C2D28
         -17.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A61B2F9C91A409A8DFD8DA0ED28037BE5E93427B
         -15.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A7E172CF2785C2ACAA8E172781F548E1F104AE4C
         -11.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\928FB76B42409278D3D6F5395D448DE5A1F76FF8
         -11.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4BE9179FAE9863037F73D254B1C61C874FC4C6EF
         -8.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\81E21AF5145440C43F8F8534A1832158E1A19C8B
         -1.3s C:\Users\habob\AppData\Local\Microsoft\Windows\INetCache\IE\WXB6Z67K\82[1].htm
         -1.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B7796545A396F606C1A1A07F52099DFE92796714
         -0.6s C:\Users\habob\AppData\Local\Microsoft\Windows\INetCookies\L8FAW6Z2.cookie
         -0.6s C:\Users\habob\AppData\Local\Microsoft\Windows\INetCache\IE\ZCOEU9OK\82[1].htm
         -0.2s C:\Users\habob\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6AF4EE75E3A4ABA658C0087EB9A0BB5B_556BB0FF4D382D90E7703209690E089E
         -0.2s C:\Users\habob\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AF4EE75E3A4ABA658C0087EB9A0BB5B_556BB0FF4D382D90E7703209690E089E
         -0.0s C:\Users\habob\AppData\Local\Microsoft\Windows\INetCache\IE\W2GIW797\FRST64[1].exe
          0.0s C:\Users\habob\Desktop\troja\FRST64.exe
          0.9s C:\Users\habob\Desktop\troja\FRST-OlderVersion\
          4.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4B764CAA31398BA4C4309AFAD6067BF55F6E309D
          7.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3EAB2489567ED1D97A0AFEBFCA06D5F4975458CC
          9.8s C:\FRST\Logs\ct
          9.8s C:\FRST\users00
          9.8s C:\Users\habob\Desktop\troja\Fixlog.txt
         10.3s C:\Windows\Prefetch\RUNDLL32.EXE-90B5D9EF.pf
         10.4s C:\FRST\re
         10.4s C:\FRST\Quarantine\C\
         10.4s C:\FRST\Quarantine\C\Program Files (x86)\
         24.9s C:\Windows\Prefetch\SPOOLSV.EXE-D1F6B8B6.pf
         37.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\7DD33EDF3D7B0BED260538952B54E01F8B7D2CE6
         38.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C3FB117A0CAC20A9361D45694BB2AD0D4F856A8C
         39.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B1BF484310B181937E88AFC02D2B2F23B1FBCC38
         40.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5C93C9F76600B4663BEF69AAE36993D8ABE6884E
         41.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E3085D42FE4290B96797C0D859EFB2C00235405D
         42.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\59A0BE7A78DBBF72F69C0B4B1F1A36B6CAF69814
         42.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\436389A0A3AC2CA6E7FDF53ED4A2C7019A0F38BB
         42.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A7EEF205DABE321091C548EE7CDA24803B36140D
         42.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A5C6368023EC81107CE72C8928F2DD770EC530EE
         43.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F092C26698B0060D1BCCE8A513B811E3786C597F
         43.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\007DBE88E47921A6425A2000D77FB80B3A452FAF
         43.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8699D5432583BD179F2D621616735194372203FE
         44.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2413A91B9DF19949EDA61F48E127BA849C8FBBF8
         44.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\064509193D6F40B49A497A629412EC9572324EDC
         45.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\FA2BF5D4C12E48A8349CEEE416BB5E60052A419C
         45.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\9DA7AB84A8A951129C5BB6BB20BFE80B4567475D
         45.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D2B327C0C2FF403CF7B354734EC26516CE6BA47D
         45.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5D92DAE9545E62DBEAA15F3A873D65E5BBF1DA02
         45.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3DBCCA3F9DC7B406E99ABC43E1AEDDE539762A9A
         45.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\EBF2F8D428DFA535E0CF3B6DFD6C028D0B3062A7
         45.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0C893422DE7E3C905EEA418AC18579F880FE57E8
         45.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F37ADDD033A3243130F3F5BAA8E8B17E2A6D556E
         45.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\125BB221139EA7F809C006F79C8263C711B6EBF6
         45.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5E8F1C16DDB12D2B3DC061F8558B399E27261BC5
         45.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\150FF5E1D33F76A843E171C59BE9DFE2998AC45E
         45.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B50879054520B66642D22A447655594DDCD87B4D
         45.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BB48A7EB07F741C3DF378CFAFABD833E7A06B6E7
         45.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6CC4ECB2F894A8068069A0B6CA50EEA309CD998C
         47.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\213C73556CCF5794C3BCA0DE26FC8411AC7DA401
         47.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\49F13F6FA79AE95852C13226F13DDB561DF20573
         47.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\54CF3EFF92AE556A0FB874A43CB2E7ECF1DE4878
         47.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4B973A8E56D13E1AAB08BC2910CB8558F55E1DF5
         47.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\EA62471621AD2F756A40052FD789E629E93C16D4
         47.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\7C91ACBCF18209404D91BB326093C8B809AF4E0C
         47.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\40C418AC052A73EA762651CEC482D7E2B530622B
         47.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\9E80F17A8DA34CA8C74164C0CB6A1B417145FA42
         47.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\56DEEEEAC5B0398A370B59DC2628F1E900AB4EE9
         47.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\FC6EBA163B77781A0A560042D2418BB1580785A0
         49.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E9153FD5B3EA1EE25C4FCE1167E869C3FA7F652C
         49.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B82D8C0941EF58A81FB705B78BE0CC2333F318FA
         49.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\9F377DD2B7839618CDE33D17D87066D0FF47EEF0
         49.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A83ABA6608D445D8F06F15101AAEAD692BBE292F
         49.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D9861F4746D39C6E177E368E71B7AE0DDCEBA21B
         49.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\470ADE8A5F194B5367E172B82A444F1C7FA964D1
         49.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C8CC37DD030AC6CB48C02E3671D1772B810FC204
         49.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B9C2B6CDB102DE34E18EA9C493950F516C18AD54
         49.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6C50ABBFA17BC3FAAA2933202AD8CBCAFB18FACA
         49.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E8E480C62518D6BB61125A2D9181E45C6B3F8877
         49.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0EC5C579640BF799FAFE41194B112B4406904B99
         49.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\004823CCD3ED74AC5C5A30629F3AF074F978CCBF
         49.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3BA3B5E07A95CBC2C2ABF06F777107EEF954842F
         49.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\EE3E302858A28A3A8535FA4F00D7F4EA2FD1B71D
         49.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B565AC72D37673836001AAB678ADA35D468A59D8
         49.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1622C30288A6287288ACB2D46FBECCAC6AD7E1FB
         49.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1BD433877A2019B7F0B3B37164928A42F12EE878
         49.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\68A8955BCCC2C00EA26ECD23C2B9701330A738C7
         49.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\9677D9611D7E963824913008E1B48E2BEBB2EE30
         50.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2DB612B4BE7F5D73BB25DCD0F0BDC5357AF21B6A
         50.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C8F384FB5C5186F7DD8F63473C17B07D92D809FB
         50.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\605E6B03D960FC93AC73037712FC49EF3E4BC4EB
         50.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3A8EEA208E0F7E54A490A2391A1A79C9FFF2E02F
         50.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\33556704560C4C510A217678991F5A985C785D8C
         50.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\50CD14F1D91179F95065FC4CED397DE625E5A2B8
         52.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\FDCB678401838BD3101B67843745E97BB2AB82A3
         53.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\46F596D6A44D9FC1D8F977D977727CFA07C56C2B
         53.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\510E9414271371E577D9BC5598C2001D6FD5FD8D
         54.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D2C6F64FE8A20BC5147F9EA0F575D54890E48477
         54.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A3C6F9EDC8F1B348B94BCD08F0925EFCF3059C9A
         54.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\AB53E76491AE1C36D67745A4EA8625A84BCCDC9A
         56.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\00E986EF2FC8A5C03A2EAAA64EA4AB492335176C
         56.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0195BBCC8BD800ABEC46AF439081CF73D692839B
         56.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F88CA05DD735A7FC049FA78F39B138A317D6B44C
         56.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\745A3307AD56C498345F7C73930CF4EF886C21A0
         56.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A3D7AC0163403AC20593ED21BF9632FFF9FA092C
         56.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F9B1A35226752CB4F92E74116A48915C792C7A38
         56.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E647E591356FB74BA5D7FA94321277129BA18B33
         56.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6AB4176FBABA42EBEF8965514F36C366E8CAEF60
         56.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0912AA7B17CE983292A1CB1B7C8B150F709BBDEF
         56.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F76CF74CB9B8D32B0E7CCE361F6ABE5045259F37
         56.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2551654A735607DAAE30541BF82B307780310F30
         56.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0C005D7C7945A45DC18DDF321E1BD5FF3A77CD8C
         56.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\DFC9386903B8233E4BFB2D053F02F41E10282DAE
         56.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\437AD5E711A3299E08923BDEDED096C881FD84BE
         56.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6042435233CDD86B6FB848EDB93785AB0804F8B8
         56.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\416A5A5C2C8086E32C8B41AD99FA612E8B6C89A5
         56.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1D98506E638F1CA1FDC1438B72FCE4EFD34F558C
         56.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\97394F2B353367A81E11CEDC603F18329B62CC8E
         56.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\343012197E58DB41D16D522C2FF96FDB1206AA97
         57.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5D542C31BD3611E73F76E7EB6C7DB7A497169CC9
         57.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8D099DA316D6755F6A7896205A87FF1D8F48D79B
         57.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C982DB3B35E3769B26ECF859CDBEF85489E404CE
         57.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8D73ACE4B75043ADCF43B665A9B351EB5E0012B5
         57.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3EE806BFF5F882C1F250DC1D867AD1FFC0551E38
         57.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0CB93DD292E63AE96AF6B8DE79C7152C68110EB9
         57.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\05F3557AD60749B4FA8FF1D2981FA47472DCC17E
         57.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\44116C1FD79009D202BD5D0B37E1942F025CA346
         57.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\ED9F27A63BC2F2D241265D93DE8E755D6FE29B3A
         57.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BB78072F40CA5403EA0D5C4B1198FF61F8F84A33
         58.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\841D212C96A2A2544CCA229FE381A9321E989A03
         58.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\15CCB4F235BB167DC57D1AC32924FE4C1F6C712A
         58.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\50C0A1FE26ABA290ECBF86E6751F5519C1167DFE
         58.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1A5F18B367541A7C226B57A45A256F3F412FAB52
         58.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\7B1303CD5EF12C9538DA83E7ADDA009F49B3B965
         58.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\98A20B6EB6FCE16EF5BE37C44A96C96500F632D8
         59.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D97B9CAF78F057604E4BD090653B13CB1BF9E33F
         59.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B60AB5576DC86ABC806C2F79734E7E8A280B51AA
         59.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D6CB4773D116E08FAE8F89AA3486CF4B74C25294
         59.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\60011B411A17D150F9548D7273F553677CDF96B5
         59.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E4E8A4DF4855D0F7707672415279CCEED33B9880
         59.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B71F4219B479517F9FF97E8173C65280095C9FB8
         59.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8FCD47E863170B63F7094A144F98D2998082766C
         59.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\590E369C33562661F9F931E456AA107B14F3C3BE
         59.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8E7FDCD29186AE926A36A23F700062F80DECA6D1
         59.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\90C02900B841DE2D37B1F9CBEE93FFB066B74D3A
         60.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\52C438F3C68EED57FB74813CA117DEB3438173B1
         60.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3BDE82C2274D680264D258E656EB5E8F3DDFBDD6
         60.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\136E885AF15AFA93D2114744317A7D94437AA85A
         60.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4CFA1101C83451162BCCA0FA30450AC714A981FB
         60.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D5165BF5E7A22962A6FA99F6DA75D24F1C23D35B
         60.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\382BCD62850F1463BCD5129D36B01306F529AD60
         60.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\DEF251D7FA64C1DBAE8410E55A0A8A2414C9B45F
         60.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\662CF77B34A78EDAA57D09A227775C61344CA2E6
         60.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5AFDD2B912F74C78B0C3D343632FFAD6AEFCFA1F
         61.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\848FF8B2E306B93F48580EF84409B13BBE3C0701
         61.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5231097229BFDC696ABC023E3E51ABAD525F7290
         61.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\9E89901BCB6833B1786891533E3DB0FC2CF8A568
         61.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F97A2063753F7CA86A5F56673CAD85E65D9A741A
         61.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\ED29D11BDBCF9B24D886F7513A4E622893218029
         61.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\021CE915ECF80CB3A0E34FBE096D2D1C2EA706AE
         61.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C4D083A6403FDB1778F18F081231C65D4001BC6D
         61.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\10EB8EA7896AF5BB8423CFFE1320A68F3B0041F3
         61.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BE3CD713BA6D23DC21B72481BCC8BCDCD4C1022B
         62.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6BA8D5EF0BD733F0ACF8A568FD1EE855DB4E427D
         62.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F7884B6946FAB0F3E8E40D9016747DD9A61926D0
         62.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\35919559619E8A9890B93568D6630142DCB3F11A
         63.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\748383ECB0FD0030E1FF2678093AF40C57906163
         63.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\ED3B2F12D4DC8E96981E6F8D38A0E9EB6076C3C5
         63.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\7E3DC9E108C3E67796B87B7C0600C5EAE39BEC6F
         65.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\835C07E5C1CF4C4EC0E190F2D524F7B61A5261CA
         65.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E078FAC41DA0B93F4A846A9B090DB697AD060BCE
         66.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4A1A9C4E37AFEB2BCF0F0505EAED6C201D57C702
         66.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\72110EED392A75B1F210CB15C18BBA9A5DEEEAAE
         66.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\32C7F5FBF2677E97E1E7ABBA766CFC7BB8DABC9F
         66.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\79BB65C0C852DBB1AA0501D8E87989B9036AD648
         66.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\47A6F0FA2D0F23467B9F9F5AF722C41B71B74E99
         67.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1816C747D1EB1E4C102CF1D95349369439C64D8D
         67.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\15FCE3A9CD2D102ECC24A8B9F63348D7BDC25F9F
         67.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\57D759250656724050AF71678CB5F17463460153
         67.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A5D35D02873E5B54F9CD59E712C121FC45ABAA25
         67.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E745ECDBB8C580E52DDED1FF37958FB335A889F5
         67.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\10275F25EF413CE9671BD41E6F8675E9A1937A5A
         67.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\AAC546ED2388898D477EB1546522524855A7C5F2
         67.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\460F247EA32091CE600D019E595474D74F8D0047
         68.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\47EACE06E6972BD5975328690650290B2B929CAA
         94.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\DC7622A91C1910306A350FF0C48B27F946EFCEEB
         95.0s C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\datareporting\archived\2017-01\1484178098918.509d8fb2-7844-49e4-81a8-086dfdca62aa.main.jsonlz4
         96.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3262BBD770D299A13317E9F055C9C4B84AA8DAB6
         98.2s C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\datareporting\archived\2017-01\1484178406192.f15f8358-cd66-4792-b01c-340debcd03d7.main.jsonlz4
         98.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\042E21155DF68191A2B82E95F8235CF8582A8FF2
         98.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\18751CEB990A6196EF16FA1DA5801644718F74DB
         98.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BCBE449AF70D7D2AFB331A1C813A5720E0C8CCB0
         98.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\865C136A5926641602D566FE4F337191D3C43446
         105.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\65C1A3B3A40A05317A4C958049F7CDEC64C6A8EC
         107.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4B446CA907E3075936509FDDA14701575AA215EA
         108.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A4BC34CE962901BA57500A6B897C28080B91A68D
         110.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\30D40E836487A9A1F378280185AB8D0C4EEF2DA2
         111.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\456CA7E4D100C57B3753C5F5F256D9478B14A267
         111.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\45ABC8E275E5B121BED5693CD467D49DC2FD4CC1
         117.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\85809AB8F0E233AA62C4F33BC1EE0B5727EC1E0E
         117.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BC8E9D9BA6FA57D8B0AB02CD97165914541A2647
         118.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0C481F96BA63AB57D91BAEBDB3846267D1BF1F99
         124.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B96F2138BAD38C769A64CDEA58FD87B6978CB491
         124.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F53A9FFCC98B8418DD9AD5A24E6D5511DD153565
         129.3s C:\Users\habob\Desktop\troja\esetsmartinstaller_deu.exe
         130.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\96C3C514873235C8F54728C7D06DF2F69BD19823
         138.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BC128E4C17CEB7141942F887FA71E8F05485C751
         138.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6D69C015CC636AE32F1828393C439A1F122ED603
         145.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6C3017D365E10F8584141AA7246CAB783E6CE42C
         153.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BB61D0A8B40CAD431B870AC5C7FC962F58A1D200
         157.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\AC57F4B1ADEA03F5FC6E325CFC9788A16DAF1B82
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2CE17D1D089B9C1EA10AD613E3EDA0A96477A4C2
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\FE4B898B37413B0E02AB4E03FCAB252187AC71C1
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E641E78F45239BD586C54059CE0D720A0FBB8F66
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6F69275201650810B774A8849666431D9C7D0602
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0773B826DD1C2064375C255B7AF9035367CDBA8A
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E92899E8888C17D752891082B1CD9D38ED78BF99
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\52456B3F28769DAD41E420AE64DF59C8F7031F5B
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\868B3DEE549FDE13E208350C53E33724061D2BC6
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\11E8B8D2630451217A833678D0878074D3AE0270
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0313539B5AF19B47F340ACECA9DFBC6D951C03C2
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\EC86059394D320E802D0B7F720735C978C24463C
         157.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\844C33A0CB7A17F2C24E801597D7C77A28368648
         157.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B5E03580A30398375128ECE316E493784CDB099F
         157.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\20B5A2A8AC7281C06E33AC0C92EE6EC51DC00E1D
         157.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\23F295D146EAFCC2AEFDA545DFCB6313C6A42326
         157.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\572315B5AB6A920E2C1FE9D106C19EBD2BCC68D2
         157.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2485FF1E45EDFBA35901BC70F8B4CD78164EA358
         157.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B6B5C1C05ADA825B98471BD1748CCD2157A28BAC
         160.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\54F1389B59CE310E6354CD42333F3DEC6369E10D
         161.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A23816F3E363E756F0A56CE17EEDEC42C1D40075
         166.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E664F8DB448BDE73D46E08B5BD7B4F9D640C36CD
         167.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5259819201A7AB0E27680FC9535B5427592663F9
         169.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\CF9777C8217A2B733585DBD667288EF9782454FA
         171.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\DCC5ED37D2A22553948FFDD4F35976F877009270
         172.0s C:\Windows\Prefetch\ESETSMARTINSTALLER_DEU.EXE-E655EA4E.pf
         172.1s C:\Program Files (x86)\ESET\
         172.1s C:\Program Files (x86)\ESET\ESET Online Scanner\
         172.1s C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\
         172.1s C:\Program Files (x86)\ESET\ESET Online Scanner\Modules\
         172.5s C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScanner.cab
         172.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\712B7869B0AB20BD8A222C7FA2A63AB23064014F
         173.2s C:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
         173.2s C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerApp.exe
         173.2s C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerUninstaller.exe
         173.2s C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
         173.2s C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScannerA.exe
         173.2s C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerLang.dll
         173.2s C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScanner.ocx
         173.2s C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScanner64.ocx
         173.2s C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScanner.inf
         173.2s C:\Program Files (x86)\ESET\ESET Online Scanner\unicows.dll
         173.2s C:\Program Files (x86)\ESET\ESET Online Scanner\esets_apiW.dll
         173.3s C:\Program Files (x86)\ESET\ESET Online Scanner\esets_apiW_a.dll
         173.3s C:\Program Files (x86)\ESET\ESET Online Scanner\esets_apiA.dll
         173.5s C:\Windows\Prefetch\REGSVR32.EXE-D5170E12.pf
         173.6s C:\Program Files (x86)\ESET\ESET Online Scanner\log.txt
         174.4s C:\Users\habob\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AC59853F556157EE97023493D5850BE5_5B273A0DF9C4EE8181D27A3F02534177
         174.4s C:\Users\habob\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AC59853F556157EE97023493D5850BE5_5B273A0DF9C4EE8181D27A3F02534177
         179.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B19C00C2F27819E0F45DC0D60AFE7BD15973BF92
         182.2s C:\Windows\Prefetch\DLLHOST.EXE-61F58501.pf
         183.6s C:\Windows\Prefetch\ONLINESCANNERAPP.EXE-B2412F9A.pf
         184.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F883D84B5366E1654C9A1A4B158A686DF0B55B99
         188.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\85F5AD95B0F10529CF6A126C4702BAA87A0E0B3A
         189.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\91B0BB70B03BE2D59720F8263D32DF75893257E2
         193.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BC6848FF063714C985B24B61280BABAD08C97C33
         202.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\324C86BA67AF661A29120BB68C777E6ACD2C16C2
         214.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1815883AC96520C17636AFAE6710F203FFE283BC
         216.6s C:\Users\habob\AppData\Local\Battle.net\Logs\battle.net-20170111T234844.722837.log
         217.8s C:\ProgramData\Battle.net\Agent\Logs\Switcher-20170111T234845.log
         218.2s C:\ProgramData\Battle.net\Agent\Agent.5362\Logs\Agent-20170111T234846.log
         218.3s C:\ProgramData\Battle.net\Agent\Agent.5362\Logs\Features-20170111T234846.log
         218.6s C:\Users\habob\AppData\Local\Battle.net\Logs\libcef-20170111T234846.729747.log
         226.6s C:\ProgramData\Battle.net\Setup\battle.net\Logs\battle.net-launcher-20170111T234854.759404.log
         227.4s C:\ProgramData\Battle.net\Agent\Agent.5362\Logs\Operations-20170111T234846.log
         228.6s C:\Users\habob\AppData\Local\Battle.net\Logs\battle.net-20170111T234856.729854.log
         230.3s C:\Users\habob\AppData\Local\Battle.net\Logs\libcef-20170111T234858.480923.log
         237.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\069EDB4DC85FB0278B43443874FE4E0100733E3C
         238.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D4F42F706531656465C8EBEA853F676DD8E225F5
         238.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\08A309EF0234A1A786A9A3DB2C1F81BC5A7ACC7A
         259.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\460080EB3298E07514B3E509C266C16291BDC317
         268.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\96B758FDF0B9A43DEB3ED82A612AA25FD35744BE
         268.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4C047EB885929C7912DD9F500B5061670FEE0DAC
         268.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\7947C3F377BB5CE60368D37D3858BA1BFCB4EA6D
         268.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\9324813C1228090F97AA85B75DEABAD1B901B2CA
         270.0s C:\Windows\Prefetch\BACKGROUNDTASKHOST.EXE-2C6F4889.pf
         271.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\941D674414123CDF8199494E837A2D952D19E6E6
         275.1s C:\Windows\Prefetch\DLLHOST.EXE-A8DE6D5B.pf
         277.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\9116D92FB5A5CF45E085665F96DFE85A96342213
         281.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\85C687D5D25ADFB3DF53E9870AF1859EAD428D72
         281.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\267313D962EBF4B9C130174F6C733A30B39F44F3
         282.7s C:\Windows\Prefetch\SETTINGSYNCHOST.EXE-2521C7ED.pf
         286.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A1F22B3A581B8873ED64E7B984DD602598272764
         295.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\CE861E001A6336F92FEF694F8E93E7E56F1A0754
         307.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C599911AFC0A21D88375A7FD1D7626790CF034CE
         307.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2CFFEB2D45C694123396DF52543608D0CD2D2458
         307.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5A15DB01AA2D332EB91B0D43C1FCA7A2B4E2E104
         308.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\DA053441FECB28FD56D9CA10DC7A46A6B3B926AE
         310.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\393B2BBEA1BF9859F37F4D7F88F2ECBB35A2AF3B
         310.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BE71884634259C03C4B87244D2FA918F55D81493
         310.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C0A01F87281B092DD72FE73D33C2B428F5B22062
         310.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8C7553727F3895A170D60CD35B95ADB4D4FE1E9F
         311.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\86A4707EDEC40FD8A5DE891A4A16F47EAF1A5658
         311.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3814042C0F1DD6D6AF88870B8C8A0D8DDD47FFE8
         311.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A32E505400E9B35FD173BD77FCE99F82918ACCD0
         311.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5E4D0950AEE178BEDEE8A0C27A1002F886F1F991
         311.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3BE9726EED4232A41EFA99759A3558C65BFFBDD1
         311.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0476B1455491B2B0E9D5177C53BE4A312EFEE650
         311.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\049C56C9313636A1418028A05AFB62E95F109876
         311.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2AC5EEEC6198087240889C7990BE24A081BC5FA1
         311.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\DF19581BC148D4BF1727D596D2282898C0EA9D1A
         313.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8DF0D393B55C4DE686C01B9B0E1904D9685F65F8
         313.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\DBE994F747FDDBD171492B5D6DFF6768AE33EAAF
         313.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C0D7C5AE71C3D15191D0E91FD5839C43F85B978F
         313.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\85F56B460AE74E1CB16B2826D3D055A3505A9506
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\DC043474CCF6AF71F611A60C14B8EA2E86352A36
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A86DDCD10E4446B0BFE51BFC13687AFB0D2F357C
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1CA1718CA89BA23E6EFB282AABFCC87D1C0B23E7
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\767A07A150F669CC88D10A31622DB1A45A4BB17E
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\78BB7B26D683400E693E8FB4CA3C7798675AE66E
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E19A5A77332F38ACF4D15238B58786EBA231A729
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\9BB1D41839415BF6352B99194A83E64362CE63F6
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\44BCD11E4C20F9ABF351C7FB9674416C7B450D97
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\76F5ED013D774262E016CD471056AEC0891157E4
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\CDC5D826661BDF0C1FCC38C4C3105885D3EF70D5
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B53453EB81D7BB8EC253A386360866A5A15FCB62
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6C699088EFB3586418CD177DD55173520ECB93CF
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E710B7BD1F79F23E79FF39E529ACC75D021EF452
         313.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\DC60A7C7D58950FC3E47268CF46454B1331D255E
         314.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2ED89B4204804B00755DEC7017B0B42359CAEB05
         314.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1CC6FF3109B4E1253F03540C1A01F7B20D21D8D1
         315.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\985218B6D31EC094A957DF3B8472364EAFEB4748
         316.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\37A9592B780F8AC4A4733CC8ABA0CBED0C3AB875
         316.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6C69A217F6BA5AC179F5F6FB79EA7D6264EEE73F
         317.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2AC0A23743DA93AEC0D9E33EDF39618626655A3B
         317.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F4DC98AE4614DC4E723B53CD53A74B1C9548A008
         317.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D8AB85A0BF79089224CFD701BF5D5209E6A974BB
         317.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\FAAB407AF66AE6E6406D011C76F1448B65DE967E
         317.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\7F00BC763B12DE8E1507A410F6BCB25F7E98F19D
         317.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\42479AF174E1C5AB80492169A2E0F03272D8BFB2
         317.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\85E3A29A0ABB5CB002E98A7CB439292F012C6895
         318.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B366B3C7ED3D567BEE730360832227460AC1EBF3
         318.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\ABBB1E660CC6D257675E6FC297888D8E487B49AF
         318.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4A8147E493669ED07BD9E22B75E4D73213760E8E
         324.5s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3B56278B729FAC4227AA019D045377FF36EFFF27
         326.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8E74F138F77A5FBA461DF28348DEF43D3BF6571C
         326.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\AB68F5C473FD7664585548CDE3FBDFDD1E3C07C6
         326.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\802BE3AA31B56010CCBBA4A50AB8CBD9083CE1C5
         326.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A423096059EA6CDDD83A0FAF8360C90258625E75
         326.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E3A3AC639652363954BCCDF66B0658A3F19EEBA5
         326.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5857650DA3BAEFED994065C933219D5FEC3EADA3
         326.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C0EDF292E812E90FF4FA30D5D2D65AD9F16B03C3
         326.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\909D41419D239E64B9C7797FAD3F513057121D24
         326.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\22E29AD1421240C146D6BF400F960FFC80985662
         326.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\218F9FC8B306188E6B149C9C38F06A09879543EE
         326.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A42E755D602C3033CC0CE240CD0ED872E74EC893
         326.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\7339B5E26A4FB7FA930C23F93B1777CDFA083269
         326.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2965C5C25D45B5E8DA4FE6F6519469BA0EA75A02
         326.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\ECCF2829F32E3B359B9C615F69ABD1DA4EBC5F9B
         326.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4E586DAB0F91DC77E810CBA945F21DB66FD0087F
         326.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\12AC7CD3A1521CD203E8A351A4265476EC3DCFF2
         326.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\515B92CCFFD11EFA9DC9865CC30DF8D798DDAC2D
         326.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8565C29D8DCEDA828120E2B95B469F8657E5F692
         326.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\7DFC0EB5636500A311001F8FA0E1064BA04FFB34
         326.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\731D01B5E4FEF83B38B6BFB16DE255DD4442E552
         326.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6BA48E3B38236BE38C6697A762E85F68F39F9077
         326.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\29C1474A09EB2EF930C96BA180DC0A8B6699AB12
         326.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\78BA1A0DABF0F54B066CB7354A8ED31E1F5FBD2F
         326.7s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\99818D84B2694E6D80AEEF344899AC8D38A5E9B4
         327.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\12C78D6EE62BD2ACA3D9F07C91F623897FE3FCBE
         327.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\DBAD22E9F2C721DFBD10F53A35A1C4A029690AE5
         327.3s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\2291002D0184F5A070FD8737FD93AE353AF84163
         327.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4166AF835E0FF63A479C338E699EA1589585BCBB
         327.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\76A60AB82B74C4C29E60910CF5F732B2D546069C
         328.8s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3F08E019E6944DFFDFE8A1DBEDE4AA5A6335821E
         328.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3D5FBF489C79F1A7835C1F6B67B82C3DBAB175D9
         329.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0A203133C05AF675F06E7BDD8E94ADF2B8CD2E45
         329.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\746D8CD82E7FC2B4D48EE656FEC1AE7FCDED285D
         329.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\31D5E0834569B172D157B4037988763AB2C5FF3F
         329.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\323831E22F6C1C330759AA7EC87999C913E0BAE3
         329.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BFC66D9786527CB880A88EDD1397EA81F429D42E
         329.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B78F1EB10D33D5285C4786E73852B906869DB0C7
         329.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A259F80B3D086BA9F8806966361E2FE73B6D4DFD
         329.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B458C855D60F4335676A2FCC92E94E30A700E5A1
         329.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\02ED3ECBBB319E3BD9364874218752165D803897
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D05EBC93466AFB5E42C0303258716F8B3D2B1FC5
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\324034E97F582AA9EAC0FD74CBDC7A2022969F41
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4294E82A396F8E5901CA4B2CF9CA63F4B4C0B829
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\904C5393FB3E86DEC4625AA7AA73E53A470F84FB
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\D394E2A4235F3D464A67E85FD1E607B2ED9CA7EB
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5A39E33CBEB05521F49198BDDB021CE1FF48F817
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\143F9E34A4798C89AACD7FF23AAFD96FA127461B
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\243EC8836C2E10E3D697405697B7D01CF21B8B57
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F3259D70F3747E0EEB0325426AD501656ABEC58C
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\10F2A8919F51AD132A27836273FD1C2ACB7ED29A
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C5DA323ABB6199452352700B47532BEB4A009D4B
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E5A91A914BCA9D8DEC7FB8C1DF37A611EA48C320
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4CB067085EED56F06D58F6947AFFCBE574386EC4
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B942FF49D4355D59E4CEE9564EE8ACD122291DEF
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\83430E627D25973122A1F21FD53E4608A9E9FEE8
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\99892DF9BE26A4F08BB9E052F976358E09EA8AF9
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1A05C8D6E1AC508773FB449F3195D968F57386BD
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BE3123AB6D404A045F9E6E702BD79B5F1A4F104B
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\BE6A4A69CD5F4E4857A0AE7C58B9DB830CD912A0
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\6CF28153702381439F3DF888BAE9B557E837DDAD
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A1BC46DCB1E1BE41B2FFA790ED71B483B187A9DB
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\17B93139A6500AE7CEC681CD1AF9E5A6D65A25BB
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0F778BE3737ABCC7CD2DF57EF0DC0D214479F99C
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\522A5E3BE8937965C12122FEADD7FB80458A711F
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\255D9795705D736DC1F50403796178E530A3ACE5
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\F5E134AFECCD65A85D840B6B90D98F332D411871
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A8A59E978C0D5CFF08503169C649A863D75ACA58
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\B5CF72D1CB864F605856E1FAD66085D200D3CE0E
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3B9A0EED202F33421BF1C6FFDA7B364EBE6495F2
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\7281B21D37C12D9B15044E516DE0BBBB308ABEED
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C7E240BD108A7A24EE3AD96C50464593DCD4985F
         330.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\1630F86F4C1FC35BCFA268B0FBD2C574DCACDA6E
         330.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\E32EBE75D3DB684198317CF6B7E4EBBD67CFEE15
         330.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8405F105FD8DDC2CF58A861C7F81C380F84DB97F
         330.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\C33F0A7803E732B02F3A66B0B360C01E089A6577
         330.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\56C8599DF77D96DCEB8DE327A3161206D563AA59
         330.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\93C2AC25F52796A7945E2880555CDBD3F3EB5721
         330.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\178E4A77E2999F4E40BAAB92ABABF40160337677
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\71E759EEB196FC57F18AA2244207BAF87956CD0E
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0033F814112594312D50800DE4C27D8FCD0F744D
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\10AFA6F302286F9921A42C61D8FE4A1ABAB2E98A
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\3D85D8B77A65899C65F42CE08072C5854CBDD4DD
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\31EB57CE0098331846C2FEA79EA2B9C1936B1323
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\73E9A9B959A634286FD4999C21307167E9D7BADB
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\19C491A5052908BB4358172E323649F7815E60AA
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\4479A83239EA9021255169791BBBE0F7282B9CAF
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0AED98F9B008821E57F9921D8EF457631630979D
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\45E94139C91A6266E27D2A0433D0EB1CE29D4356
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\FA0CA0AB583FA02CD7A42A8BE26FAA240FC864BA
         331.2s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\0D75EAEB7810B2991812F63AD3EE353A2D587EE4
         331.4s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\5BACFE4AE614FCDB6FDE85D9CC9656833B3BE406
         332.0s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\71A844B5D4A95441E07ACAC11205F629C0BE473F
         332.6s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\8778361E53F4D4F978650C7A8CDEB9D092CFA7CA
         336.9s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\03D8665FF52841D96A25EB39E8E4E4DEC8C10949
         337.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\AB7F42C5BD6C776F8257B4544D968B37AF4E1679
         339.1s C:\Users\habob\AppData\Local\Mozilla\Firefox\Profiles\rv2x1vd2.default\cache2\entries\A00D6BAFD5CD62253CB93823D9E6652D8574AD7E

   C:\Windows\System32\DriverStore\FileRepository\c0309270.inf_amd64_47c09dd18e1ee4c5\atidxx32.dll
      Size . . . . . . . : 11.017.760 bytes
      Age  . . . . . . . : 35.1 days (2016-12-07 23:22:50)
      Entropy  . . . . . : 6.2
      SHA-256  . . . . . : B473A31619BC479CD436C7323E534FF02F0439D2F23438DDBA36A94B71E9BD77
      Product  . . . . . : Advanced Micro Devices, Inc. Radeon DirectX 11 Driver
      Publisher  . . . . : Advanced Micro Devices, Inc. 
      Description  . . . : atidxx32.dll
      Version  . . . . . : 8.17.10.0708
      Copyright  . . . . : Copyright (C) 1998-2011 AMD Inc.
      RSA Key Size . . . : 1024
      LanguageID . . . . : 1033
      Authenticode . . . : Invalid
      Fuzzy  . . . . . . : 22.0
         Program is altered or corrupted since it was code signed by its author. This is typical for malware and pirated software.
         The file is in use by one or more active processes.
         

[/CODE]

FRST

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 11-01-2017
durchgeführt von habob (Administrator) auf DESKTOP-PNO8QHG (12-01-2017 02:16:12)
Gestartet von C:\Users\habob\Desktop\troja
Geladene Profile: defaultuser0 & habob (Verfügbare Profile: defaultuser0 & habob)
Platform: Windows 10 Pro Version 1607 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.1118.10000.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.10211.0_x64__8wekyb3d8bbwe\Music.UI.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Blizzard Entertainment) C:\ProgramData\Battle.net\Agent\Agent.5362\Agent.exe
(Blizzard Entertainment) C:\Program Files (x86)\Battle.net\Battle.net.8265\Battle.net.exe
() C:\Program Files (x86)\Battle.net\Battle.net.8265\Battle.net Helper.exe
() C:\Program Files (x86)\Battle.net\Battle.net.8265\Battle.net Helper.exe

==================== Registry (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [163800 2016-07-30] (IvoSoft)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2776528 2016-12-14] (Malwarebytes)
HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [60136 2016-11-15] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [917576 2016-12-13] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [RzWizard] => C:\Program Files (x86)\Razer\RzWizard\RzWizard.exe [263112 2016-03-23] (Razer Inc.)
HKLM-x32\...\Run: [RoccatKoneBulk] => C:\Program Files (x86)\ROCCAT\Kone Pure Optical Black Edition\KoneBlackMonitor.exe [561152 2015-02-11] (ROCCAT GmbH)
HKLM-x32\...\Run: [Corsair Utility Engine] => C:\Program Files (x86)\Corsair\Corsair Utility Engine\CUE.exe [11054800 2016-09-14] (Corsair Components, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-09-22] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\Run: [Gyazo] => C:\Program Files (x86)\Gyazo\GyStation.exe [3582240 2016-08-03] (Nota Inc.)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2876704 2016-12-20] (Valve Corporation)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27230168 2016-11-15] (Skype Technologies S.A.)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9288408 2016-12-06] (Piriform Ltd)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [4299968 2016-08-29] (Disc Soft Ltd)
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe [1046064 2016-12-25] ()
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Users\habob\Documents\DyingLight\out\settings\video.scr [1245 2016-11-18] ()
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{9c987ca3-7649-4efe-a371-28237f661719}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://de.yahoo.com/?fr=yset_ie_syc_oracle&type=orcl_hpset
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001 -> {A533EB44-EA74-44B5-8922-E1AE8B9E23D7} URL = hxxps://de.search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2016-07-30] (IvoSoft)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\ssv.dll [2016-10-21] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\jp2ssv.dll [2016-10-21] (Oracle Corporation)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2016-07-30] (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)

FireFox:
========
FF DefaultProfile: rv2x1vd2.default
FF ProfilePath: C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default [2017-01-12]
FF Extension: (Avira Browser Safety) - C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\Extensions\abs@avira.com.xpi [2016-11-22]
FF Extension: (Roomy Bookmarks Toolbar) - C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\Extensions\ALone-live@ya.ru.xpi [2017-01-09]
FF Extension: (German Dictionary) - C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\Extensions\de-DE@dictionaries.addons.mozilla.org [2016-12-03]
FF Extension: (Media Keys) - C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\Extensions\jid1-4GP7z3tkUd3Tzg@jetpack.xpi [2016-10-24]
FF Extension: (NoScript) - C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2016-11-29]
FF Extension: (WOT) - C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2016-08-23]
FF Extension: (Adblock Plus) - C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Profiles\rv2x1vd2.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-24]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_24_0_0_194.dll [2017-01-11] ()
FF Plugin: @videolan.org/vlc,version=2.2.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWoW64\Macromed\Flash\NPSWF32_24_0_0_194.dll [2017-01-11] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.111.2 -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\dtplugin\npDeployJava1.dll [2016-10-21] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.111.2 -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\plugin2\npjp2.dll [2016-10-21] (Oracle Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [1089592 2016-12-13] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\Antivirus\sched.exe [476736 2016-12-13] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [476736 2016-12-13] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [1490296 2016-12-13] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [350528 2016-11-24] (Avira Operations GmbH & Co. KG)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1404936 2016-08-01] ()
S3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe [1467072 2016-08-29] (Disc Soft Ltd)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4317648 2016-12-14] (Malwarebytes)
S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [1317104 2016-12-25] (Overwolf LTD)
S2 RzWizardService; C:\Program Files (x86)\Razer\RzWizard\RzWizardService.exe [376272 2016-03-23] (Razer Inc.)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-09-15] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [49448 2016-08-18] (Advanced Micro Devices, Inc.)
R3 amdkmdag; C:\Windows\System32\DriverStore\FileRepository\c0309270.inf_amd64_47c09dd18e1ee4c5\atikmdag.sys [28729240 2016-12-07] (Advanced Micro Devices, Inc.)
R3 amdkmdap; C:\Windows\System32\DriverStore\FileRepository\c0309270.inf_amd64_47c09dd18e1ee4c5\atikmpag.sys [530328 2016-12-07] (Advanced Micro Devices, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWT6.sys [110104 2016-09-28] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [151352 2016-12-13] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [153904 2016-12-13] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [35488 2016-07-18] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [78208 2016-07-18] (Avira Operations GmbH & Co. KG)
R3 CorsairVBusDriver; C:\Windows\System32\drivers\CorsairVBusDriver.sys [45056 2016-09-09] (Corsair)
R3 CorsairVHidDriver; C:\Windows\System32\drivers\CorsairVHidDriver.sys [22520 2016-09-09] (Corsair)
R3 dtlitescsibus; C:\Windows\System32\drivers\dtlitescsibus.sys [30264 2016-09-25] (Disc Soft Ltd)
R3 dtliteusbbus; C:\Windows\System32\drivers\dtliteusbbus.sys [47672 2016-09-25] (Disc Soft Ltd)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77416 2016-12-14] ()
S3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [45680 2016-10-07] (LogMeIn Inc.)
R2 MBAMChameleon; C:\Windows\system32\drivers\MBAMChameleon.sys [176064 2017-01-11] (Malwarebytes)
R3 MBAMFarflt; C:\Windows\system32\drivers\farflt.sys [102856 2017-01-11] (Malwarebytes)
R3 MBAMProtection; C:\Windows\system32\drivers\mbam.sys [43968 2017-01-11] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [250816 2017-01-11] (Malwarebytes)
R3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [91584 2017-01-11] (Malwarebytes)
S3 NetAdapterCx; C:\Windows\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [589824 2016-07-16] (Realtek                                            )
S3 tap-tb-0901; C:\Windows\System32\drivers\tap-tb-0901.sys [38656 2015-08-10] (The OpenVPN Project)
R3 uvhid; C:\Windows\System32\drivers\uvhid.sys [27064 2016-07-06] (Windows (R) Win 7 DDK provider)
R1 VBoxUSBMon; C:\Windows\system32\DRIVERS\VBoxUSBMon.sys [127432 2016-12-05] (BigNox Corporation)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
S3 wod0205; C:\Windows\System32\drivers\wod0205.sys [33160 2011-04-23] (WeOnlyDo Software)

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-01-12 02:11 - 2017-01-12 02:15 - 00000000 ____D C:\ProgramData\HitmanPro
2017-01-12 00:48 - 2017-01-12 00:48 - 00000000 ____D C:\Program Files (x86)\ESET
2017-01-11 17:07 - 2017-01-11 17:42 - 00102856 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2017-01-11 17:07 - 2017-01-11 17:08 - 00176064 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys
2017-01-11 17:07 - 2017-01-11 17:07 - 00001912 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-01-11 17:07 - 2017-01-11 17:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-01-11 17:07 - 2017-01-11 17:07 - 00000000 ____D C:\Program Files\Malwarebytes
2017-01-11 17:07 - 2016-12-14 12:55 - 00077416 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-01-11 03:46 - 2016-12-21 08:43 - 04130440 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll
2017-01-11 03:46 - 2016-12-21 08:43 - 01454504 _____ (Microsoft Corporation) C:\Windows\system32\mfnetsrc.dll
2017-01-11 03:46 - 2016-12-21 08:42 - 01988560 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4srcsnk.dll
2017-01-11 03:46 - 2016-12-21 08:42 - 01702392 _____ (Microsoft Corporation) C:\Windows\system32\mfasfsrcsnk.dll
2017-01-11 03:46 - 2016-12-21 08:42 - 01300600 _____ (Microsoft Corporation) C:\Windows\system32\mfmpeg2srcsnk.dll
2017-01-11 03:46 - 2016-12-21 08:06 - 06285312 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.dll
2017-01-11 03:46 - 2016-12-21 07:53 - 04474368 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_47.dll
2017-01-11 03:46 - 2016-12-21 07:51 - 05611008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2017-01-11 03:46 - 2016-12-21 06:09 - 00263472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Storage.ApplicationData.dll
2017-01-11 03:46 - 2016-12-21 05:40 - 00557568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StoreAgent.dll
2017-01-11 03:46 - 2016-12-21 05:40 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InstallAgent.exe
2017-01-11 03:46 - 2016-12-21 05:39 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InstallAgentUserBroker.exe
2017-01-11 03:46 - 2016-12-21 05:22 - 01883648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Logon.dll
2017-01-11 03:46 - 2016-12-14 06:41 - 01235296 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2017-01-11 03:46 - 2016-12-14 05:48 - 01631232 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.Resources.dll
2017-01-11 03:46 - 2016-12-14 05:38 - 17188864 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.dll
2017-01-11 03:46 - 2016-12-14 05:23 - 03134976 _____ (Microsoft Corporation) C:\Windows\system32\rdpcore.dll
2017-01-11 03:45 - 2016-12-21 09:08 - 00245600 _____ (Microsoft Corporation) C:\Windows\system32\offlinesam.dll
2017-01-11 03:45 - 2016-12-21 09:08 - 00136032 _____ (Microsoft Corporation) C:\Windows\system32\ImplatSetup.dll
2017-01-11 03:45 - 2016-12-21 09:04 - 07816032 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-01-11 03:45 - 2016-12-21 08:49 - 00328008 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Storage.ApplicationData.dll
2017-01-11 03:45 - 2016-12-21 08:46 - 00624048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2017-01-11 03:45 - 2016-12-21 08:43 - 01071736 _____ (Microsoft Corporation) C:\Windows\system32\mfnetcore.dll
2017-01-11 03:45 - 2016-12-21 08:43 - 00092512 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2017-01-11 03:45 - 2016-12-21 08:42 - 22224480 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2017-01-11 03:45 - 2016-12-21 08:42 - 00241504 _____ (Microsoft Corporation) C:\Windows\system32\CloudExperienceHost.dll
2017-01-11 03:45 - 2016-12-21 08:41 - 01600632 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2017-01-11 03:45 - 2016-12-21 08:37 - 00455520 _____ (Microsoft Corporation) C:\Windows\system32\securekernel.exe
2017-01-11 03:45 - 2016-12-21 08:15 - 22563840 _____ (Microsoft Corporation) C:\Windows\system32\edgehtml.dll
2017-01-11 03:45 - 2016-12-21 08:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\LaunchWinApp.exe
2017-01-11 03:45 - 2016-12-21 08:13 - 00119808 _____ (Microsoft Corporation) C:\Windows\system32\KnobsCsp.dll
2017-01-11 03:45 - 2016-12-21 08:12 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\ProvPluginEng.dll
2017-01-11 03:45 - 2016-12-21 08:10 - 00234496 _____ (Microsoft Corporation) C:\Windows\system32\KnobsCore.dll
2017-01-11 03:45 - 2016-12-21 08:09 - 00368640 _____ (Microsoft Corporation) C:\Windows\system32\OneBackupHandler.dll
2017-01-11 03:45 - 2016-12-21 08:09 - 00363520 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.BioFeedback.dll
2017-01-11 03:45 - 2016-12-21 08:08 - 01292288 _____ (Microsoft Corporation) C:\Windows\system32\MSVPXENC.dll
2017-01-11 03:45 - 2016-12-21 08:08 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.BlockedShutdown.dll
2017-01-11 03:45 - 2016-12-21 08:08 - 00360448 _____ (Microsoft Corporation) C:\Windows\system32\rdpencom.dll
2017-01-11 03:45 - 2016-12-21 08:08 - 00349184 _____ (Microsoft Corporation) C:\Windows\system32\provengine.dll
2017-01-11 03:45 - 2016-12-21 08:08 - 00289792 _____ (Microsoft Corporation) C:\Windows\system32\DeveloperOptionsSettingsHandlers.dll
2017-01-11 03:45 - 2016-12-21 08:08 - 00211968 _____ (Microsoft Corporation) C:\Windows\system32\InstallAgent.exe
2017-01-11 03:45 - 2016-12-21 08:07 - 00748544 _____ (Microsoft Corporation) C:\Windows\system32\StoreAgent.dll
2017-01-11 03:45 - 2016-12-21 08:06 - 00310784 _____ (Microsoft Corporation) C:\Windows\system32\SyncSettings.dll
2017-01-11 03:45 - 2016-12-21 08:06 - 00260608 _____ (Microsoft Corporation) C:\Windows\system32\InstallAgentUserBroker.exe
2017-01-11 03:45 - 2016-12-21 08:06 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-01-11 03:45 - 2016-12-21 08:05 - 00425984 _____ (Microsoft Corporation) C:\Windows\system32\aadcloudap.dll
2017-01-11 03:45 - 2016-12-21 08:05 - 00261632 _____ (Microsoft Corporation) C:\Windows\system32\indexeddbserver.dll
2017-01-11 03:45 - 2016-12-21 08:05 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Shell.dll
2017-01-11 03:45 - 2016-12-21 08:01 - 09131008 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2017-01-11 03:45 - 2016-12-21 08:00 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\fhcfg.dll
2017-01-11 03:45 - 2016-12-21 07:59 - 01908224 _____ (Microsoft Corporation) C:\Windows\system32\AzureSettingSyncProvider.dll
2017-01-11 03:45 - 2016-12-21 07:59 - 00883712 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2017-01-11 03:45 - 2016-12-21 07:58 - 23678464 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-01-11 03:45 - 2016-12-21 07:57 - 00462336 _____ (Microsoft Corporation) C:\Windows\system32\fhsettingsprovider.dll
2017-01-11 03:45 - 2016-12-21 07:56 - 00947712 _____ (Microsoft Corporation) C:\Windows\system32\MSVP9DEC.dll
2017-01-11 03:45 - 2016-12-21 07:56 - 00936960 _____ (Microsoft Corporation) C:\Windows\system32\MCRecvSrc.dll
2017-01-11 03:45 - 2016-12-21 07:55 - 08129536 _____ (Microsoft Corporation) C:\Windows\system32\Chakra.dll
2017-01-11 03:45 - 2016-12-21 07:55 - 04749312 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_nt.dll
2017-01-11 03:45 - 2016-12-21 07:54 - 05511680 _____ (Microsoft Corporation) C:\Windows\system32\aclui.dll
2017-01-11 03:45 - 2016-12-21 07:53 - 06664192 _____ (Microsoft Corporation) C:\Windows\system32\mspaint.exe
2017-01-11 03:45 - 2016-12-21 07:53 - 01692672 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.onecore.dll
2017-01-11 03:45 - 2016-12-21 07:51 - 08075776 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2017-01-11 03:45 - 2016-12-21 07:51 - 02275840 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentServer.dll
2017-01-11 03:45 - 2016-12-21 07:50 - 01490432 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-01-11 03:45 - 2016-12-21 07:49 - 04149248 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2017-01-11 03:45 - 2016-12-21 07:49 - 02691072 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Logon.dll
2017-01-11 03:45 - 2016-12-21 07:49 - 01062912 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncCore.dll
2017-01-11 03:45 - 2016-12-21 07:47 - 01121280 _____ (Microsoft Corporation) C:\Windows\system32\aadtb.dll
2017-01-11 03:45 - 2016-12-21 06:59 - 00218976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\offlinesam.dll
2017-01-11 03:45 - 2016-12-21 06:02 - 03892864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
2017-01-11 03:45 - 2016-12-21 06:02 - 01852720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll
2017-01-11 03:45 - 2016-12-21 06:02 - 01360464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfnetsrc.dll
2017-01-11 03:45 - 2016-12-21 06:02 - 01277344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfasfsrcsnk.dll
2017-01-11 03:45 - 2016-12-21 06:02 - 01201872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmpeg2srcsnk.dll
2017-01-11 03:45 - 2016-12-21 06:02 - 00980832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfnetcore.dll
2017-01-11 03:45 - 2016-12-21 06:01 - 20969928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2017-01-11 03:45 - 2016-12-21 05:46 - 00034304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LaunchWinApp.exe
2017-01-11 03:45 - 2016-12-21 05:43 - 00285184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.BlockedShutdown.dll
2017-01-11 03:45 - 2016-12-21 05:41 - 00253952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.BioFeedback.dll
2017-01-11 03:45 - 2016-12-21 05:41 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2017-01-11 03:45 - 2016-12-21 05:40 - 00318976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpencom.dll
2017-01-11 03:45 - 2016-12-21 05:40 - 00237056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SyncSettings.dll
2017-01-11 03:45 - 2016-12-21 05:39 - 01300480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVPXENC.dll
2017-01-11 03:45 - 2016-12-21 05:38 - 00866816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Cred.dll
2017-01-11 03:45 - 2016-12-21 05:35 - 04612608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.dll
2017-01-11 03:45 - 2016-12-21 05:35 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\indexeddbserver.dll
2017-01-11 03:45 - 2016-12-21 05:34 - 07626752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2017-01-11 03:45 - 2016-12-21 05:33 - 19413504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgehtml.dll
2017-01-11 03:45 - 2016-12-21 05:32 - 19417600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-01-11 03:45 - 2016-12-21 05:30 - 05398016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aclui.dll
2017-01-11 03:45 - 2016-12-21 05:30 - 01255936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AzureSettingSyncProvider.dll
2017-01-11 03:45 - 2016-12-21 05:27 - 00640000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MCRecvSrc.dll
2017-01-11 03:45 - 2016-12-21 05:26 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVP9DEC.dll
2017-01-11 03:45 - 2016-12-21 05:25 - 07469056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2017-01-11 03:45 - 2016-12-21 05:25 - 06474752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mspaint.exe
2017-01-11 03:45 - 2016-12-21 05:24 - 06044160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakra.dll
2017-01-11 03:45 - 2016-12-21 05:24 - 05061120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2017-01-11 03:45 - 2016-12-21 05:24 - 03733504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_47.dll
2017-01-11 03:45 - 2016-12-21 05:24 - 00886272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aadtb.dll
2017-01-11 03:45 - 2016-12-21 05:22 - 00860672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncCore.dll
2017-01-11 03:45 - 2016-12-14 06:41 - 00590960 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2017-01-11 03:45 - 2016-12-14 06:34 - 02482280 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 02169184 _____ (Microsoft Corporation) C:\Windows\system32\AppVEntSubsystems64.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 01669984 _____ (Microsoft Corporation) C:\Windows\system32\AppVIntegration.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 01400160 _____ (Microsoft Corporation) C:\Windows\system32\AppVEntSubsystemController.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 01356864 _____ (Microsoft Corporation) C:\Windows\system32\ClipUp.exe
2017-01-11 03:45 - 2016-12-14 06:33 - 01054048 _____ (Microsoft Corporation) C:\Windows\system32\AppVPolicy.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 00992096 _____ (Microsoft Corporation) C:\Windows\system32\AppVManifest.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 00822624 _____ (Microsoft Corporation) C:\Windows\system32\AppVClient.exe
2017-01-11 03:45 - 2016-12-14 06:33 - 00813408 _____ (Microsoft Corporation) C:\Windows\system32\AppVEntStreamingManager.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 00779616 _____ (Microsoft Corporation) C:\Windows\system32\AppVReporting.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 00752992 _____ (Microsoft Corporation) C:\Windows\system32\AppVOrchestration.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 00704352 _____ (Microsoft Corporation) C:\Windows\system32\AppVEntVirtualization.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 00696160 _____ (Microsoft Corporation) C:\Windows\system32\AppVPublishing.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 00571744 _____ (Microsoft Corporation) C:\Windows\system32\AppVCatalog.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 00513376 _____ (Microsoft Corporation) C:\Windows\system32\TransportDSA.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 00406368 _____ (Microsoft Corporation) C:\Windows\system32\AppVScripting.dll
2017-01-11 03:45 - 2016-12-14 06:33 - 00241504 _____ (Microsoft Corporation) C:\Windows\system32\AppVShNotify.exe
2017-01-11 03:45 - 2016-12-14 06:33 - 00190816 _____ (Microsoft Corporation) C:\Windows\system32\AppVDllSurrogate.exe
2017-01-11 03:45 - 2016-12-14 06:26 - 01469792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppVEntSubsystems32.dll
2017-01-11 03:45 - 2016-12-14 06:23 - 00404832 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-01-11 03:45 - 2016-12-14 06:21 - 02206496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2017-01-11 03:45 - 2016-12-14 06:19 - 00584544 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncHost.exe
2017-01-11 03:45 - 2016-12-14 06:18 - 00715104 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vhdmp.sys
2017-01-11 03:45 - 2016-12-14 06:18 - 00335712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys
2017-01-11 03:45 - 2016-12-14 06:17 - 00319288 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2017-01-11 03:45 - 2016-12-14 06:14 - 01694712 _____ (Microsoft Corporation) C:\Windows\system32\winmde.dll
2017-01-11 03:45 - 2016-12-14 06:14 - 00418952 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2017-01-11 03:45 - 2016-12-14 06:14 - 00089416 _____ (Microsoft Corporation) C:\Windows\system32\remoteaudioendpoint.dll
2017-01-11 03:45 - 2016-12-14 06:08 - 00341344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2017-01-11 03:45 - 2016-12-14 06:06 - 00509792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncHost.exe
2017-01-11 03:45 - 2016-12-14 06:01 - 01557808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmde.dll
2017-01-11 03:45 - 2016-12-14 06:01 - 00382784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2017-01-11 03:45 - 2016-12-14 06:01 - 00076984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\remoteaudioendpoint.dll
2017-01-11 03:45 - 2016-12-14 05:46 - 01631232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.Resources.dll
2017-01-11 03:45 - 2016-12-14 05:46 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-01-11 03:45 - 2016-12-14 05:45 - 00147968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32k.sys
2017-01-11 03:45 - 2016-12-14 05:43 - 00201728 _____ (Microsoft Corporation) C:\Windows\system32\ScDeviceEnum.dll
2017-01-11 03:45 - 2016-12-14 05:42 - 00352768 _____ (Microsoft Corporation) C:\Windows\system32\cloudAP.dll
2017-01-11 03:45 - 2016-12-14 05:42 - 00236544 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll
2017-01-11 03:45 - 2016-12-14 05:42 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Internal.UI.Logon.ProxyStub.dll
2017-01-11 03:45 - 2016-12-14 05:42 - 00167424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll
2017-01-11 03:45 - 2016-12-14 05:41 - 00223744 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-01-11 03:45 - 2016-12-14 05:40 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\domgmt.dll
2017-01-11 03:45 - 2016-12-14 05:40 - 00266752 _____ (Microsoft Corporation) C:\Windows\system32\ConsoleLogon.dll
2017-01-11 03:45 - 2016-12-14 05:40 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CloudBackupSettings.dll
2017-01-11 03:45 - 2016-12-14 05:40 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\certprop.dll
2017-01-11 03:45 - 2016-12-14 05:40 - 00104448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Internal.UI.Logon.ProxyStub.dll
2017-01-11 03:45 - 2016-12-14 05:39 - 00837632 _____ (Microsoft Corporation) C:\Windows\system32\wbiosrvc.dll
2017-01-11 03:45 - 2016-12-14 05:39 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\updatehandlers.dll
2017-01-11 03:45 - 2016-12-14 05:39 - 00257024 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.CredDialogController.dll
2017-01-11 03:45 - 2016-12-14 05:38 - 13869056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll
2017-01-11 03:45 - 2016-12-14 05:38 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\CloudBackupSettings.dll
2017-01-11 03:45 - 2016-12-14 05:38 - 00213504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.CredDialogController.dll
2017-01-11 03:45 - 2016-12-14 05:37 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\updatepolicy.dll
2017-01-11 03:45 - 2016-12-14 05:36 - 01002496 _____ (Microsoft Corporation) C:\Windows\system32\SRH.dll
2017-01-11 03:45 - 2016-12-14 05:36 - 00539648 _____ (Microsoft Corporation) C:\Windows\system32\usocore.dll
2017-01-11 03:45 - 2016-12-14 05:36 - 00074752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\updatepolicy.dll
2017-01-11 03:45 - 2016-12-14 05:35 - 00755712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2017-01-11 03:45 - 2016-12-14 05:35 - 00712192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2017-01-11 03:45 - 2016-12-14 05:35 - 00600576 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2017-01-11 03:45 - 2016-12-14 05:35 - 00553984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2017-01-11 03:45 - 2016-12-14 05:32 - 00806400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3D12.dll
2017-01-11 03:45 - 2016-12-14 05:32 - 00497152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LogonController.dll
2017-01-11 03:45 - 2016-12-14 05:26 - 00932864 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-01-11 03:45 - 2016-12-14 05:26 - 00869888 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2017-01-11 03:45 - 2016-12-14 05:25 - 02009600 _____ (Microsoft Corporation) C:\Windows\system32\SRHInproc.dll
2017-01-11 03:45 - 2016-12-14 05:24 - 01005568 _____ (Microsoft Corporation) C:\Windows\system32\D3D12.dll
2017-01-11 03:45 - 2016-12-14 05:24 - 00673792 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2017-01-11 03:45 - 2016-12-14 05:23 - 01231872 _____ (Microsoft Corporation) C:\Windows\system32\dosvc.dll
2017-01-11 03:45 - 2016-12-14 05:22 - 02998272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32kfull.sys
2017-01-11 03:45 - 2016-12-14 05:22 - 02748416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpcore.dll
2017-01-11 03:45 - 2016-12-14 05:22 - 02317824 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2017-01-11 03:45 - 2016-12-14 05:22 - 01513472 _____ (Microsoft Corporation) C:\Windows\system32\win32kbase.sys
2017-01-11 03:45 - 2016-12-14 05:22 - 00707584 _____ (Microsoft Corporation) C:\Windows\system32\LogonController.dll
2017-01-11 03:45 - 2016-12-14 05:22 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\wuuhext.dll
2017-01-11 03:45 - 2016-12-14 05:21 - 03616768 _____ (Microsoft Corporation) C:\Windows\system32\win32kfull.sys
2017-01-11 03:45 - 2016-11-02 13:01 - 00484584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2017-01-11 03:45 - 2016-11-02 12:00 - 00534096 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2017-01-11 03:45 - 2016-11-02 11:28 - 00324608 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.LockScreen.dll
2017-01-11 03:45 - 2016-11-02 11:22 - 00337920 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2017-01-11 03:45 - 2016-11-02 11:21 - 00942080 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2017-01-11 03:45 - 2016-08-02 05:30 - 00822784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakradiag.dll
2017-01-10 21:49 - 2017-01-10 21:49 - 00004382 _____ C:\Windows\System32\Tasks\Overwolf Updater Task
2017-01-10 21:49 - 2017-01-10 21:49 - 00001154 _____ C:\Users\Public\Desktop\Overwolf.lnk
2017-01-10 21:49 - 2017-01-10 21:49 - 00000000 ____D C:\Users\habob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Overwolf
2017-01-10 21:49 - 2017-01-10 21:49 - 00000000 ____D C:\ProgramData\Overwolf
2017-01-10 21:49 - 2017-01-10 21:49 - 00000000 ____D C:\Program Files (x86)\Overwolf
2017-01-10 21:48 - 2017-01-11 17:42 - 00000000 ____D C:\Users\habob\AppData\Local\Overwolf
2017-01-10 18:02 - 2017-01-10 18:02 - 00098296 _____ C:\Users\habob\Desktop\bluegreeUpdate.cueprofile
2017-01-10 17:43 - 2017-01-10 17:48 - 00262512 _____ C:\TDSSKiller.3.1.0.12_10.01.2017_17.43.07_log.txt
2017-01-10 17:42 - 2017-01-10 17:43 - 00000492 _____ C:\TDSSKiller.3.1.0.12_10.01.2017_17.42.59_log.txt
2017-01-10 17:29 - 2017-01-12 00:55 - 00000000 ____D C:\FRST
2017-01-10 17:18 - 2017-01-12 02:15 - 00000000 ____D C:\Users\habob\Desktop\troja
2016-12-27 13:51 - 2016-12-27 13:51 - 00000000 _____ C:\Windows\setuperr.log
2016-12-27 13:51 - 2016-12-27 13:51 - 00000000 _____ C:\Windows\setupact.log
2016-12-27 03:59 - 2017-01-12 00:59 - 00000275 _____ C:\Windows\WindowsUpdate.log
2016-12-24 22:24 - 2016-12-24 22:24 - 00095155 _____ C:\Users\habob\Desktop\RAINbu.cueprofile
2016-12-24 19:23 - 2016-12-24 19:23 - 00000219 _____ C:\Users\habob\Desktop\Left 4 Dead 2.url
2016-12-21 19:36 - 2016-12-26 12:04 - 00000000 ____D C:\Windows\Minidump
2016-12-21 17:10 - 2016-12-21 17:10 - 00000000 _____ C:\Users\habob\Desktop\Neues Textdokument (3).txt
2016-12-21 02:16 - 2016-12-21 02:16 - 00000000 ____D C:\Users\habob\Documents\Telltale Games
2016-12-20 23:57 - 2016-12-20 23:57 - 00000856 _____ C:\Users\Public\Desktop\The Walking Dead A New Frontier.lnk
2016-12-20 23:57 - 2016-12-20 23:57 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Walking Dead A New Frontier
2016-12-20 17:38 - 2016-12-20 17:38 - 00000000 ____D C:\Users\habob\AppData\Roaming\ATI
2016-12-20 17:38 - 2016-12-20 17:38 - 00000000 ____D C:\Users\habob\AppData\Local\ATI
2016-12-20 17:38 - 2016-12-20 17:38 - 00000000 ____D C:\ProgramData\ATI
2016-12-20 17:37 - 2016-12-20 17:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Settings
2016-12-20 17:37 - 2016-12-20 17:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Problem Report Wizard
2016-12-20 17:37 - 2016-12-20 17:37 - 00000000 ____D C:\Program Files (x86)\AMD
2016-12-20 17:36 - 2016-12-20 17:36 - 00000000 ____D C:\Program Files (x86)\VulkanRT
2016-12-20 17:34 - 2016-12-20 17:37 - 00000000 ____D C:\Program Files\AMD
2016-12-20 17:01 - 2016-12-23 15:46 - 00000000 ____D C:\Users\habob\AppData\Local\AMD
2016-12-20 17:00 - 2016-12-20 17:00 - 00000000 ____D C:\Program Files\Common Files\ATI Technologies
2016-12-20 16:59 - 2016-09-09 19:25 - 00269600 _____ C:\Windows\SysWOW64\vulkan-1.dll
2016-12-20 16:59 - 2016-09-09 19:25 - 00261920 _____ C:\Windows\system32\vulkan-1.dll
2016-12-20 16:59 - 2016-09-09 19:25 - 00110880 _____ C:\Windows\SysWOW64\vulkaninfo.exe
2016-12-20 16:59 - 2016-09-09 19:24 - 00125216 _____ C:\Windows\system32\vulkaninfo.exe
2016-12-17 16:12 - 2016-12-17 16:12 - 00539384 _____ C:\Windows\system32\Drivers\EasyAntiCheat.sys
2016-12-17 16:12 - 2016-12-17 16:12 - 00000000 ____D C:\Users\habob\AppData\Local\DeadByDaylight
2016-12-17 16:03 - 2016-12-18 23:12 - 00000000 ____D C:\Users\habob\AppData\Roaming\TS3Client
2016-12-17 16:03 - 2016-12-17 16:03 - 00001008 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2016-12-17 16:03 - 2016-12-17 16:03 - 00000970 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client.lnk
2016-12-17 16:03 - 2016-12-17 16:03 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2016-12-17 08:22 - 2016-12-18 00:38 - 00000123 _____ C:\Users\habob\Desktop\sounds list.txt
2016-12-17 08:07 - 2016-12-17 08:07 - 00894354 _____ C:\Users\habob\Desktop\SOUNDS SETTINGS.jpg
2016-12-17 05:44 - 2016-12-17 05:44 - 00001924 _____ C:\Users\habob\Desktop\Virtual Audio Cable - Verknüpfung.lnk
2016-12-17 05:39 - 2016-12-17 05:39 - 00098464 _____ (Eugene V. Muzychenko) C:\Windows\system32\Drivers\vrtaucbl.sys
2016-12-17 05:39 - 2016-12-17 05:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Virtual Audio Cable
2016-12-17 05:39 - 2016-12-17 05:39 - 00000000 ____D C:\Program Files\Virtual Audio Cable
2016-12-17 05:29 - 2016-12-17 05:33 - 00000000 ____D C:\Users\habob\Desktop\vac
2016-12-17 04:39 - 2016-12-17 19:27 - 00000000 ____D C:\Users\habob\Desktop\audio keybinds
2016-12-17 04:37 - 2016-12-17 04:36 - 05501972 _____ C:\Users\habob\Desktop\Linkin Park-In The End Lyrics (360p_30fps_H264-96kbit_AAC).mp4
2016-12-16 05:14 - 2016-12-16 05:14 - 00000000 ____D C:\Users\habob\AppData\Local\Chromium
2016-12-14 13:28 - 2016-12-09 11:42 - 01637728 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-12-14 13:28 - 2016-12-09 11:42 - 00137568 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-12-14 13:28 - 2016-12-09 11:34 - 01051112 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2016-12-14 13:28 - 2016-12-09 11:34 - 00894096 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2016-12-14 13:28 - 2016-12-09 11:33 - 01354320 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2016-12-14 13:28 - 2016-12-09 11:33 - 01173496 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2016-12-14 13:28 - 2016-12-09 11:30 - 00377184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
2016-12-14 13:28 - 2016-12-09 11:29 - 02681200 _____ C:\Windows\system32\CoreUIComponents.dll
2016-12-14 13:28 - 2016-12-09 11:28 - 00764392 _____ (Microsoft Corporation) C:\Windows\system32\CoreMessaging.dll
2016-12-14 13:28 - 2016-12-09 11:27 - 00172528 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-12-14 13:28 - 2016-12-09 11:20 - 02677544 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2016-12-14 13:28 - 2016-12-09 11:20 - 02189664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2016-12-14 13:28 - 2016-12-09 11:20 - 01738560 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2016-12-14 13:28 - 2016-12-09 11:20 - 00658784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms2.sys
2016-12-14 13:28 - 2016-12-09 11:20 - 00402272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2016-12-14 13:28 - 2016-12-09 11:19 - 01293152 _____ (Microsoft Corporation) C:\Windows\system32\LicenseManager.dll
2016-12-14 13:28 - 2016-12-09 11:19 - 00168424 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2016-12-14 13:28 - 2016-12-09 11:18 - 02913144 _____ (Microsoft Corporation) C:\Windows\system32\combase.dll
2016-12-14 13:28 - 2016-12-09 11:18 - 01267512 _____ (Microsoft Corporation) C:\Windows\system32\WinTypes.dll
2016-12-14 13:28 - 2016-12-09 11:18 - 01100128 _____ (Microsoft Corporation) C:\Windows\system32\hvix64.exe
2016-12-14 13:28 - 2016-12-09 11:18 - 00989024 _____ (Microsoft Corporation) C:\Windows\system32\hvax64.exe
2016-12-14 13:28 - 2016-12-09 11:18 - 00947552 _____ (Microsoft Corporation) C:\Windows\system32\hvloader.efi
2016-12-14 13:28 - 2016-12-09 11:18 - 00811872 _____ (Microsoft Corporation) C:\Windows\system32\hvloader.exe
2016-12-14 13:28 - 2016-12-09 11:15 - 08168000 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.Protection.PlayReady.dll
2016-12-14 13:28 - 2016-12-09 11:14 - 01274712 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2016-12-14 13:28 - 2016-12-09 11:11 - 02048496 _____ C:\Windows\SysWOW64\CoreUIComponents.dll
2016-12-14 13:28 - 2016-12-09 11:10 - 01572768 _____ (Microsoft Corporation) C:\Windows\system32\gdi32full.dll
2016-12-14 13:28 - 2016-12-09 11:10 - 01461200 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2016-12-14 13:28 - 2016-12-09 11:01 - 02323728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2016-12-14 13:28 - 2016-12-09 11:01 - 01503544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2016-12-14 13:28 - 2016-12-09 11:01 - 00861024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LicenseManager.dll
2016-12-14 13:28 - 2016-12-09 11:00 - 00106896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2016-12-14 13:28 - 2016-12-09 10:59 - 02166752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\combase.dll
2016-12-14 13:28 - 2016-12-09 10:59 - 00846560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinTypes.dll
2016-12-14 13:28 - 2016-12-09 10:57 - 06668040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.Protection.PlayReady.dll
2016-12-14 13:28 - 2016-12-09 10:56 - 00959112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2016-12-14 13:28 - 2016-12-09 10:52 - 01435896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2016-12-14 13:28 - 2016-12-09 10:52 - 01415752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32full.dll
2016-12-14 13:28 - 2016-12-09 10:51 - 00117240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2016-12-14 13:28 - 2016-12-09 10:45 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\WordBreakers.dll
2016-12-14 13:28 - 2016-12-09 10:42 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2016-12-14 13:28 - 2016-12-09 10:41 - 00380928 _____ (Microsoft Corporation) C:\Windows\system32\wincorlib.dll
2016-12-14 13:28 - 2016-12-09 10:41 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WordBreakers.dll
2016-12-14 13:28 - 2016-12-09 10:37 - 00411136 _____ (Microsoft Corporation) C:\Windows\system32\facecredentialprovider.dll
2016-12-14 13:28 - 2016-12-09 10:36 - 03059200 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2016-12-14 13:28 - 2016-12-09 10:36 - 00410112 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentClient.dll
2016-12-14 13:28 - 2016-12-09 10:34 - 00288768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincorlib.dll
2016-12-14 13:28 - 2016-12-09 10:33 - 03777536 _____ (Microsoft Corporation) C:\Windows\system32\MFMediaEngine.dll
2016-12-14 13:28 - 2016-12-09 10:33 - 01589760 _____ (Microsoft Corporation) C:\Windows\system32\msdtctm.dll
2016-12-14 13:28 - 2016-12-09 10:32 - 00635904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2016-12-14 13:28 - 2016-12-09 10:31 - 03689984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2016-12-14 13:28 - 2016-12-09 10:31 - 00313856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppXDeploymentClient.dll
2016-12-14 13:28 - 2016-12-09 10:28 - 03306496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFMediaEngine.dll
2016-12-14 13:28 - 2016-12-09 10:28 - 01004544 _____ (Microsoft Corporation) C:\Windows\system32\enterprisecsps.dll
2016-12-14 13:28 - 2016-12-09 10:27 - 13084160 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-12-14 13:28 - 2016-12-09 10:27 - 05114368 _____ (Microsoft Corporation) C:\Windows\system32\cdp.dll
2016-12-14 13:28 - 2016-12-09 10:27 - 00981504 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Security.Authentication.OnlineId.dll
2016-12-14 13:28 - 2016-12-09 10:25 - 00376832 _____ (Microsoft Corporation) C:\Windows\system32\CryptoWinRT.dll
2016-12-14 13:28 - 2016-12-09 10:23 - 12177920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-12-14 13:28 - 2016-12-09 10:22 - 02820096 _____ (Microsoft Corporation) C:\Windows\system32\InputService.dll
2016-12-14 13:28 - 2016-12-09 10:21 - 04746752 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-12-14 13:28 - 2016-12-09 10:21 - 00716800 _____ (Microsoft Corporation) C:\Windows\system32\ShareHost.dll
2016-12-14 13:28 - 2016-12-09 10:20 - 03198464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdp.dll
2016-12-14 13:28 - 2016-12-09 10:20 - 00730624 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll
2016-12-14 13:28 - 2016-12-09 10:20 - 00187392 _____ (Microsoft Corporation) C:\Windows\system32\mdmregistration.dll
2016-12-14 13:28 - 2016-12-09 10:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\DeviceEnroller.exe
2016-12-14 13:28 - 2016-12-09 10:19 - 00433664 _____ (Microsoft Corporation) C:\Windows\system32\TextInputFramework.dll
2016-12-14 13:28 - 2016-12-09 10:19 - 00261120 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Core.TextInput.dll
2016-12-14 13:28 - 2016-12-09 10:19 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\InputLocaleManager.dll
2016-12-14 13:28 - 2016-12-09 10:19 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\EditBufferTestHook.dll
2016-12-14 13:28 - 2016-12-09 10:18 - 03666432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-12-14 13:28 - 2016-12-09 10:18 - 02138112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InputService.dll
2016-12-14 13:28 - 2016-12-09 10:18 - 00165376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mdmregistration.dll
2016-12-14 13:28 - 2016-12-09 10:17 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ShareHost.dll
2016-12-14 13:28 - 2016-12-09 10:16 - 00353280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TextInputFramework.dll
2016-12-14 13:28 - 2016-12-09 10:15 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Core.TextInput.dll
2016-12-14 13:28 - 2016-12-09 10:15 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InputLocaleManager.dll
2016-12-14 13:28 - 2016-12-09 10:15 - 00068096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EditBufferTestHook.dll
2016-12-14 13:28 - 2016-12-09 09:54 - 00483840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CoreMessaging.dll
2016-12-14 13:28 - 2016-11-02 11:28 - 00807424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Security.Authentication.OnlineId.dll
2016-12-14 13:28 - 2016-11-02 11:25 - 00956416 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.desktop.dll
2016-12-14 13:28 - 2016-09-15 17:36 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\fveapibase.dll
2016-12-13 20:57 - 2016-12-13 20:57 - 00003290 _____ C:\Windows\System32\Tasks\OneDrive Standalone Update Task v2

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-01-12 02:12 - 2016-08-23 21:05 - 00000000 ____D C:\Users\habob\AppData\Local\Battle.net
2017-01-12 02:09 - 2016-08-24 19:11 - 00000000 ____D C:\Users\habob\AppData\Local\ClassicShell
2017-01-12 01:32 - 2016-08-23 21:04 - 00000000 ____D C:\Program Files (x86)\Battle.net
2017-01-12 01:03 - 2016-11-18 08:39 - 00000000 ____D C:\Users\habob\AppData\LocalLow\Mozilla
2017-01-12 00:43 - 2016-08-24 20:56 - 00000000 ____D C:\Users\habob\AppData\Roaming\Skype
2017-01-11 22:43 - 2016-10-21 20:27 - 00091584 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2017-01-11 20:45 - 2016-08-23 22:07 - 00000000 ____D C:\Program Files (x86)\Overwatch
2017-01-11 19:41 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\AppReadiness
2017-01-11 17:47 - 2016-08-25 19:13 - 00000000 ____D C:\Program Files (x86)\Steam
2017-01-11 17:47 - 2016-08-23 20:57 - 03857202 _____ C:\Windows\system32\PerfStringBackup.INI
2017-01-11 17:47 - 2016-07-16 23:51 - 01791982 _____ C:\Windows\system32\perfh007.dat
2017-01-11 17:47 - 2016-07-16 23:51 - 00464366 _____ C:\Windows\system32\perfc007.dat
2017-01-11 17:42 - 2016-10-21 20:29 - 00250816 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-01-11 17:42 - 2016-10-21 20:27 - 00043968 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-01-11 17:42 - 2016-08-23 21:09 - 00000000 ____D C:\Program Files (x86)\SpeedFan
2017-01-11 17:41 - 2016-09-07 18:18 - 00065536 _____ C:\Windows\system32\spu_storage.bin
2017-01-11 17:41 - 2016-08-23 20:51 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-01-11 17:41 - 2016-07-16 07:04 - 00524288 _____ C:\Windows\system32\config\BBI
2017-01-11 17:31 - 2016-10-21 20:10 - 00000000 ____D C:\AdwCleaner
2017-01-11 17:07 - 2016-10-21 20:27 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-01-11 16:36 - 2016-07-16 12:45 - 00000000 ____D C:\Windows\INF
2017-01-11 16:35 - 2016-08-23 20:55 - 00000000 __RHD C:\Users\Public\AccountPictures
2017-01-11 16:35 - 2016-08-23 20:51 - 00194296 _____ C:\Windows\system32\FNTCACHE.DAT
2017-01-11 16:33 - 2016-07-16 12:47 - 00000000 ___RD C:\Windows\ImmersiveControlPanel
2017-01-11 16:33 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\WinBioPlugIns
2017-01-11 16:33 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\oobe
2017-01-11 16:33 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\ShellExperiences
2017-01-11 16:33 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\Provisioning
2017-01-11 16:33 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\PolicyDefinitions
2017-01-11 15:36 - 2016-08-23 20:51 - 00000000 ____D C:\Windows\system32\SleepStudy
2017-01-11 05:53 - 2016-07-16 12:36 - 00000000 ____D C:\Windows\CbsTemp
2017-01-11 05:51 - 2016-08-24 00:26 - 00000000 ____D C:\Windows\system32\MRT
2017-01-11 05:50 - 2016-08-24 00:26 - 135657872 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-01-11 05:50 - 2016-08-23 20:52 - 00000000 ____D C:\Users\defaultuser0
2017-01-11 03:29 - 2016-09-03 05:11 - 00000000 ____D C:\ProgramData\Unified Remote
2017-01-11 03:28 - 2016-08-25 01:04 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2017-01-11 03:28 - 2016-08-23 20:54 - 00000000 ____D C:\Users\habob
2017-01-11 01:13 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2017-01-11 01:13 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\Macromed
2017-01-10 18:10 - 2016-07-16 12:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-01-09 22:43 - 2016-10-24 13:10 - 00000000 ____D C:\Users\habob\Desktop\p64
2017-01-09 21:57 - 2016-12-06 13:08 - 00000000 ____D C:\Users\habob\AppData\Local\ElevatedDiagnostics
2016-12-28 08:31 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\LiveKernelReports
2016-12-27 03:59 - 2016-08-23 20:52 - 00000000 ____D C:\Windows\SoftwareDistribution
2016-12-27 00:47 - 2016-08-23 20:55 - 00000000 ____D C:\Users\habob\AppData\Local\Packages
2016-12-27 00:46 - 2016-09-07 17:57 - 00000000 __SHD C:\Config.Msi
2016-12-27 00:46 - 2016-08-25 19:16 - 00000000 ____D C:\Users\habob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2016-12-27 00:46 - 2016-07-16 12:47 - 00000000 __SHD C:\Windows\Installer
2016-12-26 12:04 - 2016-09-25 10:30 - 00000000 ____D C:\Users\habob\AppData\Roaming\DAEMON Tools Lite
2016-12-25 14:01 - 2016-09-01 10:53 - 00000000 ____D C:\Users\habob\AppData\Roaming\vlc
2016-12-24 22:20 - 2016-08-25 19:20 - 00000000 ____D C:\Users\habob\Documents\My Games
2016-12-23 00:13 - 2016-07-16 12:49 - 00835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-12-23 00:13 - 2016-07-16 12:49 - 00177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-12-21 19:37 - 2016-10-10 23:10 - 00000000 ____D C:\Users\habob\Desktop\bitcch
2016-12-21 17:51 - 2016-07-16 07:04 - 00000000 ____D C:\Windows\system32\CatRoot
2016-12-20 19:45 - 2016-09-23 14:30 - 00000000 ____D C:\Users\habob\AppData\LocalLow\AMD
2016-12-20 17:38 - 2016-08-23 20:54 - 00000000 ____D C:\Users\habob\AppData\Roaming
2016-12-20 17:31 - 2016-08-23 20:56 - 00000000 ____D C:\AMD
2016-12-20 17:00 - 2016-07-16 07:04 - 00000000 ____D C:\Program Files\Common Files
2016-12-19 08:36 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\rescache
2016-12-18 23:12 - 2016-07-16 07:04 - 00000000 ____D C:\Windows\Logs
2016-12-18 23:06 - 2016-08-30 19:09 - 00000863 _____ C:\Users\Public\Desktop\CCleaner.lnk
2016-12-18 23:06 - 2016-08-30 19:08 - 00000000 ____D C:\Program Files\CCleaner
2016-12-17 16:12 - 2016-11-17 21:08 - 00000000 ____D C:\Users\habob\AppData\Local\UnrealEngine
2016-12-16 05:14 - 2016-08-25 19:14 - 00000000 ____D C:\Users\habob\AppData\Local\Steam
2016-12-16 05:12 - 2016-12-01 02:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-12-16 05:12 - 2016-08-23 20:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-12-16 05:12 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\SysWOW64\de-DE
2016-12-16 05:12 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\de-DE
2016-12-16 05:12 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\Boot
2016-12-16 05:12 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\AppPatch
2016-12-16 05:10 - 2016-08-23 20:54 - 00524288 ___SH C:\Users\habob\NTUSER.DAT{f5b13604-4b48-11e6-80cb-e41d2d012050}.TMContainer00000000000000000002.regtrans-ms
2016-12-16 05:10 - 2016-08-23 20:54 - 00524288 ___SH C:\Users\habob\NTUSER.DAT{f5b13604-4b48-11e6-80cb-e41d2d012050}.TMContainer00000000000000000001.regtrans-ms
2016-12-16 05:10 - 2016-08-23 20:54 - 00065536 ___SH C:\Users\habob\NTUSER.DAT{f5b13604-4b48-11e6-80cb-e41d2d012050}.TM.blf
2016-12-13 20:57 - 2016-08-23 20:56 - 00002387 _____ C:\Users\habob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2016-12-13 20:57 - 2016-08-23 20:56 - 00000000 ___RD C:\Users\habob\OneDrive
2016-12-13 20:45 - 2016-08-23 22:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2016-12-13 20:44 - 2016-10-06 22:33 - 00028272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avusbflt.sys
2016-12-13 20:44 - 2016-08-23 22:12 - 00153904 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2016-12-13 20:44 - 2016-08-23 22:12 - 00151352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2016-10-17 20:38 - 2016-10-17 20:38 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Einige Dateien in TEMP:
====================
C:\Users\habob\AppData\Local\Temp\proxy_vole3566938020834228.dll
C:\Users\habob\AppData\Local\Temp\proxy_vole4229924891294842844.dll
C:\Users\habob\AppData\Local\Temp\proxy_vole8267566524826979010.dll
C:\Users\habob\AppData\Local\Temp\sfamcc00001.dll
C:\Users\habob\AppData\Local\Temp\sfareca00001.dll


==================== Bamital & volsnap ======================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert

LastRegBack: 2017-01-09 21:57

==================== Ende von FRST.txt ============================
         

Addition

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 11-01-2017
durchgeführt von habob (12-01-2017 02:16:37)
Gestartet von C:\Users\habob\Desktop\troja
Windows 10 Pro Version 1607 (X64) (2016-08-23 19:53:56)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-1200777665-2148727873-1026762903-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1200777665-2148727873-1026762903-503 - Limited - Disabled)
defaultuser0 (S-1-5-21-1200777665-2148727873-1026762903-1000 - Limited - Disabled) => C:\Users\defaultuser0
Gast (S-1-5-21-1200777665-2148727873-1026762903-501 - Limited - Disabled)
habob (S-1-5-21-1200777665-2148727873-1026762903-1001 - Administrator - Enabled) => C:\Users\habob

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.020.20042 - Adobe Systems Incorporated)
Adobe Flash Player 24 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 24.0.0.194 - Adobe Systems Incorporated)
AMD Software (HKLM\...\AMD Catalyst Install Manager) (Version: 9.0.000.8 - Advanced Micro Devices, Inc.)
Attack on Titan Wings of Freedom MULTi3 - ElAmigos Version 1.0 (HKLM-x32\...\{EAC7611D-5F72-40A3-9AF6-9552FD21054A}_is1) (Version: 1.0 - KOEI TECMO GAMES)
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.24.146 - Avira Operations GmbH & Co. KG)
Avira Connect (HKLM-x32\...\{707e8edf-9482-4417-ae39-c9b5fe605e87}) (Version: 1.2.76.27124 - Avira Operations GmbH & Co. KG)
Avira Connect (x32 Version: 1.2.76.27124 - Avira Operations GmbH & Co. KG) Hidden
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Catalyst Control Center Next Localization BR (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (Version: 2016.1204.1136.20853 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.25 - Piriform)
Classic Shell (HKLM\...\{383BB30A-B4A7-4666-9A83-22CFA8640097}) (Version: 4.3.0 - IvoSoft)
Corsair Utility Engine (HKLM-x32\...\{84BE2927-A017-4DDC-9706-8D1051C23141}) (Version: 2.5.66 - Corsair)
DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 10.4.0.0195 - Disc Soft Ltd)
Dark Souls III Deluxe Edition MULTi12 - ElAmigos Version 1.08 reg. 1.21 (HKLM-x32\...\{C21D00A3-8A5B-489A-801C-DB8388811C16}_is1) (Version: 1.08 reg. 1.21 - FromSoftware)
Dying Light The Following Enhanced Edition Incl. Update 4 MULTi2 1.11.2 (HKLM-x32\...\Dying Light The Following Enhanced Edition Incl. Update 4 MULTi2 1.11.2) (Version:  - )
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Fraps (HKLM-x32\...\Fraps) (Version:  - )
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
Heroes of the Storm (HKLM-x32\...\Heroes of the Storm) (Version:  - Blizzard Entertainment)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.4229 - Intel Corporation)
Java 8 Update 111 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180111F0}) (Version: 8.0.1110.14 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
JDownloader 2 (HKLM\...\jdownloader2-1) (Version: 2.0 - AppWork GmbH)
League of Legends (HKLM-x32\...\League of Legends 4.1.2) (Version: 4.1.2 - Riot Games)
League of Legends (x32 Version: 4.1.2 - Riot Games) Hidden
Left 4 Dead 2 (HKLM\...\Steam App 550) (Version:  - Valve)
Livestreamer 1.12.2 (HKLM-x32\...\Livestreamer) (Version:  - )
Malwarebytes Version 3.0.5.1299 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.0.5.1299 - Malwarebytes)
Microsoft OneDrive (HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\OneDriveSetup.exe) (Version: 17.3.6720.1207 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24210 (HKLM-x32\...\{f144e08f-9cbe-4f09-9a8c-f2b858b7ee7f}) (Version: 14.0.24210.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24210 (HKLM-x32\...\{23658c02-145e-483d-ba6b-1eb82c580529}) (Version: 14.0.24210.0 - Microsoft Corporation)
Mozilla Firefox 50.1.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 50.1.0 (x86 de)) (Version: 50.1.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 50.1.0.6186 - Mozilla)
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version:  - )
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
Overwatch (HKLM-x32\...\Overwatch) (Version:  - Blizzard Entertainment)
Overwatch Test (HKLM-x32\...\Overwatch Test) (Version:  - Blizzard Entertainment)
Overwolf (HKLM-x32\...\Overwolf) (Version: 0.101.26.0 - Overwolf Ltd.)
Project64 Version 2.2 (HKLM-x32\...\{BEB5FB69-4080-466F-96C4-F15DF271718B}_is1) (Version: 2.2 - Henryxs87)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7541 - Realtek Semiconductor Corp.)
ROCCAT Kone Pure Optical Black Edition Driver (HKLM-x32\...\{B39826A3-8B08-40FB-8FCD-AB68A0F2AF4A}) (Version:  - Roccat GmbH)
Rocket League (HKLM\...\Steam App 252950) (Version:  - Psyonix, Inc.)
Shadow Warrior 2 Deluxe Edition Incl. Update 2 MULTi7 1.0 (HKLM-x32\...\Shadow Warrior 2 Deluxe Edition Incl. Update 2 MULTi7 1.0) (Version:  - )
Skype™ 7.30 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.30.105 - Skype Technologies S.A.)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.19 - TeamSpeak Systems GmbH)
The Walking Dead A New Frontier MULTi9 - ElAmigos Version 1.0 (HKLM-x32\...\{519AAAF0-6BA4-4130-9BD8-C3A295811CE5}_is1) (Version: 1.0 - Telltale Games)
Track-o-Bot version 0.8.5 (HKLM-x32\...\Track-o-Bot_is1) (Version: 0.8.5 - spidy.ch)
Virtual Audio Cable 4.13 (HKLM\...\Virtual Audio Cable 4.13) (Version:  - )
VLC media player (HKLM\...\VLC media player) (Version: 2.2.4 - VideoLAN)
Vulkan Run Time Libraries 1.0.26.0 (HKLM\...\VulkanRT1.0.26.0-2) (Version: 1.0.26.0 - LunarG, Inc.)
Vulkan Run Time Libraries 1.0.26.0 (Version: 1.0.26.0 - LunarG, Inc.) Hidden
WinRAR 5.40 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001_Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001_Classes\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001_Classes\CLSID\{00020422-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001_Classes\CLSID\{00020423-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001_Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1200777665-2148727873-1026762903-1001_Classes\CLSID\{00020425-0000-0000-C000-000000000046}\InprocServer32 -> C:\Windows\system32\oleaut32.dll (Microsoft Corporation)

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {0B58CFE7-C727-4EC0-A469-4B1AFF49B3D6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-12-06] (Piriform Ltd)
Task: {12A892D1-B78A-4636-9C7E-92F89674DB61} - System32\Tasks\GyazoUpdateTaskMachineDaily => C:\Program Files (x86)\Gyazo\GyazoUpdate.exe [2016-08-03] ()
Task: {5EA74DCF-9C46-4502-92B5-DA8A14D577A6} - System32\Tasks\Overwolf Updater Task => C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [2016-12-25] (Overwolf LTD)
Task: {87A42A4B-04D3-4050-B533-C90234CF19DC} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-10-21] (Adobe Systems Incorporated)
Task: {925C8AAE-D23C-40A2-8B7F-66164ACB0CD6} - System32\Tasks\GyazoUpdateTaskMachine => C:\Program Files (x86)\Gyazo\GyazoUpdate.exe [2016-08-03] ()
Task: {C433EE6C-77DF-4FCB-85E9-72F9C83BD0A6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWoW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-01-11] (Adobe Systems Incorporated)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWoW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2016-07-16 12:42 - 2016-07-16 12:42 - 00231424 _____ () C:\Windows\SYSTEM32\ism32k.dll
2016-12-14 13:28 - 2016-12-09 11:29 - 02681200 _____ () C:\Windows\system32\CoreUIComponents.dll
2016-12-14 13:28 - 2016-12-09 11:29 - 02681200 _____ () C:\Windows\SYSTEM32\CoreUIComponents.dll
2016-12-13 20:57 - 2016-12-13 20:57 - 01678560 _____ () C:\Users\habob\AppData\Local\Microsoft\OneDrive\17.3.6720.1207\amd64\ClientTelemetry.dll
2017-01-11 17:07 - 2016-12-14 12:55 - 02259232 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll
2017-01-11 17:07 - 2016-12-14 12:55 - 02813904 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\arwlib.dll
2017-01-11 17:07 - 2016-12-14 12:55 - 02247632 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2017-01-11 03:45 - 2016-12-21 07:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-11 03:45 - 2016-12-21 07:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-11 03:45 - 2016-12-21 07:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-11 03:45 - 2016-12-21 07:48 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2017-01-11 03:45 - 2016-12-21 07:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-11 03:45 - 2016-12-21 07:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-09-17 00:40 - 2016-09-07 05:56 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-11 03:45 - 2016-12-21 08:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2016-11-22 20:57 - 2016-11-22 20:57 - 00019456 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.1118.10000.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2016-11-22 20:57 - 2016-11-22 20:57 - 20433408 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.1118.10000.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2016-08-23 21:28 - 2016-08-23 21:29 - 00680448 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.1118.10000.0_x64__8wekyb3d8bbwe\Microsoft.DesignCore.dll
2016-11-22 20:57 - 2016-11-22 20:57 - 01046528 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.1118.10000.0_x64__8wekyb3d8bbwe\Microsoft.Sharing.dll
2016-11-22 20:57 - 2016-11-22 20:57 - 00353792 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.1118.10000.0_x64__8wekyb3d8bbwe\Photos.Inking.dll
2017-01-10 20:27 - 2017-01-10 20:27 - 01448936 _____ () C:\Program Files (x86)\Battle.net\Battle.net.8265\Battle.net Helper.exe
2017-01-10 20:27 - 2017-01-10 20:27 - 37247976 _____ () C:\Program Files (x86)\Battle.net\Battle.net.8265\libcef.dll
2017-01-10 20:27 - 2017-01-10 20:27 - 00540336 _____ () C:\Program Files (x86)\Battle.net\Battle.net.8265\ortp.dll
2017-01-10 20:27 - 2017-01-10 20:27 - 00133632 _____ () C:\Program Files (x86)\Battle.net\Battle.net.8265\libEGL.dll
2017-01-10 20:27 - 2017-01-10 20:27 - 03384832 _____ () C:\Program Files (x86)\Battle.net\Battle.net.8265\libGLESv2.dll
2017-01-10 20:27 - 2017-01-10 20:27 - 03384832 _____ () C:\Program Files (x86)\Battle.net\Battle.net.8265\libglesv2.dll
2017-01-10 20:27 - 2017-01-10 20:27 - 00133632 _____ () C:\Program Files (x86)\Battle.net\Battle.net.8265\libegl.dll
2017-01-10 20:27 - 2017-01-10 20:27 - 00990696 _____ () C:\Program Files (x86)\Battle.net\Battle.net.8265\ffmpegsumo.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PAexec => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PAexec => ""="Service"

==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)


==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2016-07-16 12:47 - 2016-07-16 12:45 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-1200777665-2148727873-1026762903-1000\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\habob\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\StartupApproved\Run: => "Spotify"
HKU\S-1-5-21-1200777665-2148727873-1026762903-1001\...\StartupApproved\Run: => "Spotify Web Helper"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [{538982AA-0771-4CB1-B518-68E7DC9E97D2}] => C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{B6F4FFF3-081B-432B-9849-59F87CCA4978}] => C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [TCP Query User{C4AE1BB5-5002-4AE3-86C1-C48330ACD0DE}C:\program files (x86)\skype\phone\skype.exe] => C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{BFA4A1D3-5A4D-4125-B344-3C4969D41A44}C:\program files (x86)\skype\phone\skype.exe] => C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{48873A9C-466F-4B8D-93B7-768518FE7960}C:\program files (x86)\unified remote 3\remoteserverwin.exe] => C:\program files (x86)\unified remote 3\remoteserverwin.exe
FirewallRules: [UDP Query User{0FB9B621-C39F-4B0E-89F5-1514DE288B6E}C:\program files (x86)\unified remote 3\remoteserverwin.exe] => C:\program files (x86)\unified remote 3\remoteserverwin.exe
FirewallRules: [TCP Query User{EC7CBB32-4D88-476A-A196-8E9070A1F422}C:\program files (x86)\hearthstone\hearthstone.exe] => C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [UDP Query User{DCCEF48A-7E45-4679-B270-C7229497BD3F}C:\program files (x86)\hearthstone\hearthstone.exe] => C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [TCP Query User{1404913B-AC51-4014-BD9D-2579C3C45051}C:\program files (x86)\overwatch\overwatch.exe] => C:\program files (x86)\overwatch\overwatch.exe
FirewallRules: [UDP Query User{3E374C1F-F73F-42AA-8EA3-9A14BAADC0E0}C:\program files (x86)\overwatch\overwatch.exe] => C:\program files (x86)\overwatch\overwatch.exe
FirewallRules: [{4A4F8D0E-8EEC-418A-B5A5-3B8DD4DAD6C9}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{FBF9A9DA-1DE9-499E-80C5-69500C57A2E3}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{FBF05581-30BA-42AB-AAB0-021737BB73C8}C:\program files (x86)\dying light\dyinglightgame.exe] => C:\program files (x86)\dying light\dyinglightgame.exe
FirewallRules: [UDP Query User{E8A651E8-F059-4067-98B5-B23D6FB227F6}C:\program files (x86)\dying light\dyinglightgame.exe] => C:\program files (x86)\dying light\dyinglightgame.exe
FirewallRules: [{D2CA2C98-1166-495D-B246-FE3D98CFA57B}] => C:\program files (x86)\dying light\dyinglightgame.exe
FirewallRules: [{488839D0-2D48-4CBF-B859-1B4F00D02337}] => C:\program files (x86)\dying light\dyinglightgame.exe
FirewallRules: [TCP Query User{6BA9BA64-7997-4C15-9B25-9D4140E4B3DC}E:\hoes\overwatch test\overwatch.exe] => E:\hoes\overwatch test\overwatch.exe
FirewallRules: [UDP Query User{ABB54D8F-227E-44B3-A637-796D5FBB01A7}E:\hoes\overwatch test\overwatch.exe] => E:\hoes\overwatch test\overwatch.exe
FirewallRules: [{72EE8AAB-9AF7-47A7-BB1F-F27728E13CC3}] => E:\hoes\overwatch test\overwatch.exe
FirewallRules: [{E6D3E91C-A0CC-45AF-AC28-BE3844BE824D}] => E:\hoes\overwatch test\overwatch.exe
FirewallRules: [{4BF707C7-4C94-4C70-A310-329DDE4EE036}] => C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{4F698D4D-774A-4D72-AE5B-DE8AB863561A}] => C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{A02BCDF6-2946-44C5-8522-3D3BF81B5F16}] => C:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{4C6FF824-CDA1-4E66-A21E-04E61B39F23A}] => C:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{8BB81C65-F69B-4383-B327-4BB0549095B0}] => E:\steam\steamapps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [{9A317F47-39C5-42B6-B986-A95AA2E970C0}] => E:\steam\steamapps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [TCP Query User{867007AC-A62A-4170-8C42-C8A5C8C60AF2}E:\hoes\heroes of the storm\versions\base49008\heroesofthestorm_x64.exe] => E:\hoes\heroes of the storm\versions\base49008\heroesofthestorm_x64.exe
FirewallRules: [UDP Query User{1A1925E8-DFBA-4A18-AB86-ED32CE81B315}E:\hoes\heroes of the storm\versions\base49008\heroesofthestorm_x64.exe] => E:\hoes\heroes of the storm\versions\base49008\heroesofthestorm_x64.exe
FirewallRules: [{46E4A4E6-0EAF-4B28-87FF-5B9F6679E5C3}] => C:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{3C09D7DE-2485-4694-886D-8967420BC2D9}] => C:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe

==================== Wiederherstellungspunkte =========================

27-12-2016 00:46:42 Removed LogMeIn Hamachi
10-01-2017 11:14:15 Geplanter Prüfpunkt
11-01-2017 17:22:12 JRT Pre-Junkware Removal

==================== Fehlerhafte Geräte im Gerätemanager =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (01/12/2017 02:09:58 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_42191651c6827bb3.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_89c64d28dafea4b9.manifest.

Error: (01/12/2017 01:23:12 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: microsoftedgecp.exe, Version: 11.0.14393.82, Zeitstempel: 0x57a55786
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000604
Fehleroffset: 0x0000000000000000
ID des fehlerhaften Prozesses: 0xfc4
Startzeit der fehlerhaften Anwendung: 0x01d26c6a0c973470
Pfad der fehlerhaften Anwendung: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
Pfad des fehlerhaften Moduls: unknown
Berichtskennung: d6048d82-e387-458f-aafe-4ca0a3573298
Vollständiger Name des fehlerhaften Pakets: Microsoft.MicrosoftEdge_38.14393.0.0_neutral__8wekyb3d8bbwe
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: MicrosoftEdge

Error: (01/12/2017 01:23:08 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: microsoftedgecp.exe, Version: 11.0.14393.82, Zeitstempel: 0x57a55786
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000604
Fehleroffset: 0x0000000000000000
ID des fehlerhaften Prozesses: 0xfc4
Startzeit der fehlerhaften Anwendung: 0x01d26c6a0c973470
Pfad der fehlerhaften Anwendung: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
Pfad des fehlerhaften Moduls: unknown
Berichtskennung: 2fe18786-c5be-4e0d-91e0-930291254a9e
Vollständiger Name des fehlerhaften Pakets: Microsoft.MicrosoftEdge_38.14393.0.0_neutral__8wekyb3d8bbwe
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: MicrosoftEdge

Error: (01/12/2017 01:06:45 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_42191651c6827bb3.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_89c64d28dafea4b9.manifest.

Error: (01/12/2017 01:05:54 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Users\habob\Desktop\troja\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_42191651c6827bb3.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_89c64d28dafea4b9.manifest.

Error: (01/12/2017 01:05:51 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Users\habob\Desktop\troja\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_42191651c6827bb3.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_89c64d28dafea4b9.manifest.

Error: (01/12/2017 01:05:44 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "E:\1FireFOX DLS\esetsmartinstaller_deu.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_42191651c6827bb3.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_89c64d28dafea4b9.manifest.

Error: (01/12/2017 01:05:18 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm FRST64.exe, Version 11.1.2017.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Systemsteuerung "Sicherheit und Wartung", um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 238c

Startzeit: 01d26c662f50b767

Beendigungszeit: 4294967295

Anwendungspfad: C:\Users\habob\Desktop\troja\FRST64.exe

Berichts-ID: cc7705c0-d85a-11e6-a159-bc5ff4e4f83a

Vollständiger Name des fehlerhaften Pakets: 

Auf das fehlerhafte Paket bezogene Anwendungs-ID:

Error: (01/12/2017 12:55:40 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_42191651c6827bb3.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_89c64d28dafea4b9.manifest.

Error: (01/12/2017 12:55:32 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "c:\program files (x86)\eset\eset online scanner\ESETSmartInstaller.exe". Fehler in Manifest- oder Richtliniendatei "" in Zeile .
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_42191651c6827bb3.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.14393.447_none_89c64d28dafea4b9.manifest.


Systemfehler:
=============
Error: (01/12/2017 01:10:04 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
Der Treiber konnte nicht geladen werden.

Error: (01/12/2017 01:10:04 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\habob\AppData\Local\Temp\ehdrv.sys

Error: (01/12/2017 01:10:04 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
Der Treiber konnte nicht geladen werden.

Error: (01/12/2017 01:10:04 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\habob\AppData\Local\Temp\ehdrv.sys

Error: (01/12/2017 01:10:03 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
Der Treiber konnte nicht geladen werden.

Error: (01/12/2017 01:10:03 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\habob\AppData\Local\Temp\ehdrv.sys

Error: (01/12/2017 01:10:03 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
Der Treiber konnte nicht geladen werden.

Error: (01/12/2017 01:10:03 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\habob\AppData\Local\Temp\ehdrv.sys

Error: (01/12/2017 01:10:03 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
Der Treiber konnte nicht geladen werden.

Error: (01/12/2017 01:10:03 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\habob\AppData\Local\Temp\ehdrv.sys


CodeIntegrity:
===================================
  Date: 2016-10-09 20:27:10.775
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-10-09 17:08:27.981
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-10-09 16:58:20.059
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-09-30 22:53:14.118
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-09-25 20:08:55.098
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-09-25 11:48:03.984
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-09-25 01:22:30.224
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-09-24 09:11:03.969
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-09-23 15:19:31.243
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-09-23 15:05:26.305
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Speicherinformationen =========================== 

Prozessor: Intel(R) Core(TM) i7-2600K CPU @ 3.40GHz
Prozentuale Nutzung des RAM: 38%
Installierter physikalischer RAM: 8074.74 MB
Verfügbarer physikalischer RAM: 4945.79 MB
Summe virtueller Speicher: 9354.74 MB
Verfügbarer virtueller Speicher: 5088.94 MB

==================== Laufwerke ================================

Drive c: () (Fixed) (Total:111.3 GB) (Free:6.08 GB) NTFS
Drive e: (TOSHIBA EXT) (Fixed) (Total:931.51 GB) (Free:96.59 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: EAE69DB8)
Partition 1: (Active) - (Size=500 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=111.3 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 931.5 GB) (Disk ID: 97F01B21)
Partition 1: (Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== Ende von Addition.txt ============================
         

Servus,


MBAM würde ich drauflassen und ab und zu damit scannen, ist ja kostenlos.

Alle anderen Tools werden mit DelFix (siehe weiter unten) automatisch entfernt.






Wenn du keine Probleme mehr mit Malware hast, dann sind wir hier fertig. Deine Logdateien sind sauber.
Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern.





Cleanup:
Alle Logs gepostet? Dann lade Dir bitte DelFix herunter.

• Schließe alle offenen Programme.
• Starte die delfix.exe mit einem Doppelklick.
• Setze vor jede Funktion ein Häkchen.
• Klicke auf Start.

Hinweis:
DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner anschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.





Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:
[/url] Java
Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.




Sofern du noch unentschieden bist, verwende ein einziges der folgenden Antivirusprogramme mit Echtzeitscanner und stets aktueller Signaturendatenbank:

	Emsisoft	Microsoft Security Essentials	ESET

Microsoft Security Essentials (MSE) / Windows Defender (WD) ist ab Windows 8 fest eingebaut, wenn du also Windows 8, 8.1 oder 10 und dich für MSE/WD entschieden hast, brauchst du nicht extra MSE/WD zu installieren. Bei Windows 7 muss es aber manuell installiert oder über die Windows Updates als optionales Update bezogen werden. Selbstverständlich ist ein legales/aktiviertes Windows Voraussetzung dafür.




Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.




Optional:
Adblock Plus Kann Banner, Pop-ups, Videowerbung, Tracking und Malware-Seiten blockieren.
NoScript Verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.

Lade Software von einem sauberen Portal wie .
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .




Abschließend noch ein paar grundsätzliche Bemerkungen:

• Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
• Lade keine Software von Chip, Softonic oder SourceForge. Die dort angebotene Software wird häufig mit einem sog. "Installer" verteilt, mit dem man sich nur unerwünschte Software oder Adware installiert.
• Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Selbst Microsoft unterstützt sog. Registry-Cleaner nicht. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...und/oder das Forum mit einer kleinen Spende unterstützen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.

Ok bin durch, ich bedanke mich recht herzlich bei dir für deine Klasse Hilfe und Tips, die Mühe die du dir gemacht hast einfach Nice.

Feedback hab ich dir auch Hinterlassen.

Nochmal

Vielen Dank!!

lg Kranich