Werbebanner im Steamclient

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-02-2017
Ran by ezztr (21-02-2017 14:20:39)
Running from C:\Users\ezztr\Desktop
Windows 10 Home Version 1607 (X64) (2016-08-03 05:57:06)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3515307565-1161031247-3300353082-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-3515307565-1161031247-3300353082-503 - Limited - Disabled)
elsia (S-1-5-21-3515307565-1161031247-3300353082-1002 - Limited - Enabled) => C:\Users\elsia
ezztr (S-1-5-21-3515307565-1161031247-3300353082-1001 - Administrator - Enabled) => C:\Users\ezztr
Guest (S-1-5-21-3515307565-1161031247-3300353082-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

. . . (Version: 2.1.28.3 - Intel) Hidden
. . . (x32 Version: 2.6.2.4 - Intel) Hidden
7-Zip 16.00 (x64) (HKLM\...\7-Zip) (Version: 16.00 - Igor Pavlov)
Adobe Audition CC 2015 (HKLM-x32\...\{839A3566-AED6-4787-A849-5CBE2B1DC6AE}) (Version: 8.0 - Adobe Systems Incorporated)
Adobe Dreamweaver CC 2015 (HKLM-x32\...\{EE2A0AA8-0386-11E5-8603-BC82F5DB1A71}) (Version: 16.0.0 - Adobe Systems Incorporated)
Ansel (Version: 378.66 - NVIDIA Corporation) Hidden
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Asmedia USB Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.16.41.3 - Asmedia Technology)
Audacity 2.1.2 (HKLM-x32\...\Audacity®_is1) (Version: 2.1.2 - Audacity Team)
AviSynth 2.6 (HKLM-x32\...\AviSynth) (Version: 2.6.0.6 - GPL Public release.)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Bitrix24 for Windows (HKLM-x32\...\Bitrix24) (Version: 4.1.76.36 - Bitrix, Inc)
bl (x32 Version: 1.0.0 - Your Company Name) Hidden
Citrix Online Launcher (HKLM-x32\...\{48947098-A67C-46D4-90C5-9F2F6F0F96FE}) (Version: 1.0.449 - Citrix)
Conan Exiles (HKLM\...\Steam App 440900) (Version:  - Funcom)
Craft The World (HKLM\...\Steam App 248390) (Version:  - Dekovir Entertainment)
Darkest Dungeon (HKLM\...\Steam App 262060) (Version:  - Red Hook Studios)
DebugMode FrameServer (HKLM-x32\...\DebugMode FrameServer) (Version:  - )
Dell App Launcher for Unifying Software (HKLM\...\Unifying Software Launcher) (Version: 1.00.44 - Logitech)
Dell Customer Connect (HKLM-x32\...\{4FA72FF9-DD64-43A8-8704-6380A11F11D5}) (Version: 1.4.15.0 - Dell Inc.)
Dell Data Vault (Version: 4.3.9.0 - Dell Inc.) Hidden
Dell Digital Delivery (HKLM-x32\...\{AB7F2792-2ED1-4C5C-9F28-680E5110BF72}) (Version: 3.1.1018.0 - Dell Products, LP)
Dell Dock Update (HKLM-x32\...\{6C4547B7-084A-4992-BFBF-9F6C6E2DC3EA}) (Version: 1.0.115.0 - Dell Inc.)
Dell Foundation Services (HKLM\...\{BDB50421-E961-42F3-B803-6DAC6F173834}) (Version: 3.4.16100.0 - Dell Inc.)
Dell PremierColor (HKLM\...\{5CA2B02F-FC89-4F42-A3DA-7649B8EFF194}) (Version: 2.0.140 - Portrait Displays, Inc.)
Dell SupportAssist (HKLM\...\PC-Doctor for Windows) (Version: 1.3.6855.61 - Dell)
Dell SupportAssistAgent (HKLM-x32\...\{27130E51-9555-408B-8134-7BFF54EDE27B}) (Version: 1.3.0.72 - Dell)
Dell System Detect (HKU\S-1-5-21-3515307565-1161031247-3300353082-1001\...\58d94f3ce2c27db0) (Version: 7.6.0.17 - Dell)
Dell Update - SupportAssist Update Plugin (HKLM\...\{92F651D9-4431-469E-9B11-299D007AF656}) (Version: 2.0.2.1835 - Dell Inc.)
Dell Update (HKLM-x32\...\{FE901F1A-B3D5-4BCE-AAFB-694DC51DC522}) (Version: 1.9.5.0 - Dell Inc.)
Drakonia Configurator (HKLM-x32\...\{2EAD3327-2F92-455F-A675-E5CC4980B67A}}_is1) (Version:  - )
Dropbox 20 GB (HKLM-x32\...\{736A97C6-8766-3699-84A9-71736C5E0CE3}) (Version: 3.1.11.0 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.59.1 - Dropbox, Inc.) Hidden
DW WLAN Card (HKLM\...\DW WLAN Card) (Version: 1.566.0.0 - Dell Inc.)
Dxtory version 2.0.139 (HKLM-x32\...\Dxtory2.0_is1) (Version: 2.0.139 - ExKode Co. Ltd.)
Factorio (HKLM\...\Steam App 427520) (Version:  - Wube Software LTD.)
Faeria (HKLM\...\Steam App 397060) (Version:  - Abrakam SA)
FileZilla Client 3.24.0 (HKU\S-1-5-21-3515307565-1161031247-3300353082-1001\...\FileZilla Client) (Version: 3.24.0 - Tim Kosse)
Gameforge Live 2.0.12 (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 2.0.12 - Gameforge)
GIMP 2.8.18 (HKLM\...\GIMP-2_is1) (Version: 2.8.18 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 56.0.2924.87 - Google Inc.)
Google Drive (HKLM-x32\...\{07A12123-B717-496B-B471-48AF6407B433}) (Version: 1.32.4066.7445 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
GoToMeeting 8.0.0.6441 (HKU\S-1-5-21-3515307565-1161031247-3300353082-1001\...\GoToMeeting) (Version: 8.0.0.6441 - CitrixOnline)
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
Hearthstone Deck Tracker (HKU\S-1-5-21-3515307565-1161031247-3300353082-1001\...\HearthstoneDeckTracker) (Version: 1.1.6 - HearthSim)
HearthstoneTracker (HKLM-x32\...\HearthstoneTracker) (Version: 1.9.23.39449 - HearthstoneTracker.com)
Innkeeper (HKU\S-1-5-21-3515307565-1161031247-3300353082-1001\...\Innkeeper) (Version: 0.3.4 - Curse Inc.)
Intel Extreme Tuning Utility (HKLM-x32\...\{281badd0-7e11-494b-bdf7-34d6a2615c3c}) (Version: 6.2.0.19 - Intel Corporation)
Intel Extreme Tuning Utility (x32 Version: 6.2.0.19 - Intel Corporation) Hidden
Intel(R) Chipset Device Software (x32 Version: 10.1.1.13 - Intel(R) Corporation) Hidden
Intel(R) Dynamic Platform and Thermal Framework (HKLM-x32\...\{654EE65D-FAA4-4EA6-8C07-DC94E6A304D4}) (Version: 8.2.10900.330 - Intel Corporation)
Intel(R) HID Event Filter (HKLM-x32\...\3FB06EEC-013D-4366-9918-71B97DFB84EB) (Version: 1.1.0.310 - Intel Corporation)
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.5.0.1020 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4531 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 15.2.2.1030 - Intel Corporation)
Intel(R) Serial IO (HKLM\...\{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 30.100.1633.3 - Intel Corporation)
Intel® Driver Update Utility (HKLM-x32\...\{66307462-7d19-4f1a-af82-aa04b6017f05}) (Version: 2.6.2.4 - Intel)
Intel® Security Assist (HKLM-x32\...\{4B230374-6475-4A73-BA6E-41015E9C5013}) (Version: 1.0.0.532 - Intel Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
Keebles (HKLM\...\Steam App 347040) (Version:  - Burnt Fuse)
Lagarith Lossless Codec (1.3.27) (HKLM-x32\...\{F59AC46C-10C3-4023-882C-4212A92283B3}_is1) (Version:  - )
Life Is Strange™ (HKLM\...\Steam App 319630) (Version:  - DONTNOD Entertainment)
Logitech Unifying-Software 2.10 (HKLM\...\Logitech Unifying) (Version: 2.10.37 - Logitech)
MagicYUV Lossless Video Codec - Standard version 2.0.0rc1 (HKLM-x32\...\{90410593-E0EB-4F9B-B984-65BEA8F07B91}_is1) (Version: 2.0.0rc1 - INNOMAGIC Bt.)
MediaInfo 0.7.87 (HKLM\...\MediaInfo) (Version: 0.7.87 - MediaArea.net)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 16.0.7571.2109 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3515307565-1161031247-3300353082-1001\...\OneDriveSetup.exe) (Version: 17.3.6743.1212 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24212 (HKLM-x32\...\{323dad84-0974-4d90-a1c1-e006c7fdbb7d}) (Version: 14.0.24212.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Mini Metro (HKLM\...\Steam App 287980) (Version:  - Dinosaur Polo Club)
Mozilla Firefox 51.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 51.0.1 (x86 de)) (Version: 51.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 51.0.1.6234 - Mozilla)
MPC-HC 1.7.10 (64-bit) (HKLM\...\{2ACBF1FA-F5C3-4B19-A774-B22A31F231B9}_is1) (Version: 1.7.10 - MPC-HC Team)
MSI Afterburner 4.3.0 (HKLM-x32\...\Afterburner) (Version: 4.3.0 - MSI Co., LTD)
Music Manager (HKU\S-1-5-21-3515307565-1161031247-3300353082-1001\...\MusicManager) (Version:  - Google, Inc.)
Notepad++ (64-bit x64) (HKLM\...\Notepad++) (Version: 7.2.2 - Notepad++ Team)
NVIDIA 3D Vision Treiber 378.66 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 378.66 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.3.0.95 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.3.0.95 - NVIDIA Corporation)
NVIDIA Grafiktreiber 378.66 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 378.66 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}) (Version: 9.10.0513 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.16.0318 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.16.0318 - NVIDIA Corporation)
NvNodejs (Version: 3.3.0.95 - NVIDIA Corporation) Hidden
NvTelemetry (Version: 2.3.5.0 - NVIDIA Corporation) Hidden
NvvHci (Version: 2.02.0.5 - NVIDIA Corporation) Hidden
OBS Studio (HKLM-x32\...\OBS Studio) (Version: 17.0.2 - OBS Project)
Office 16 Click-to-Run Extensibility Component (x32 Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (x32 Version: 16.0.7571.2109 - Microsoft Corporation) Hidden
Oracle VM VirtualBox 5.1.12 (HKLM\...\{C212962C-71C4-4D9F-B8E0-D2CD00C8B8FE}) (Version: 5.1.12 - Oracle Corporation)
Origin (HKLM-x32\...\Origin) (Version: 10.3.3.1921 - Electronic Arts, Inc.)
ph (x32 Version: 1.0.0 - Your Company Name) Hidden
Pismo File Mount Audit Package (HKLM\...\PismoFileMountAuditPackage) (Version:  - )
PrivateTunnel (HKLM-x32\...\PrivateTunnel) (Version: 2.8.2.0 - OpenVPN Technologies)
ProjectLibre (HKLM-x32\...\{4E352A24-AE3C-482F-9409-3E1C2B7ABED8}) (Version: 1.7.0.0 - ProjectLibre)
QuickTime 7 (HKLM-x32\...\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)
Realtek USB Audio (HKLM-x32\...\{0A46A65D-89AC-464C-8026-3CD44960BD04}) (Version: 6.3.9600.44 - Realtek Semiconductor Corp.)
Registrierung eines Dell Produkts (HKLM-x32\...\InstallShield_{85B14AE3-1624-45BE-942B-A528DF6F1CCE}) (Version: 3.0.123.0 - Dell Inc.)
Registrierung eines Produkts (Version: 3.0.123.0 - Dell Inc.) Hidden
RimWorld (HKLM\...\Steam App 294100) (Version:  - Ludeon Studios)
RivaTuner Statistics Server 6.6.0 (HKLM-x32\...\RTSS) (Version: 6.6.0 - Unwinder)
SagaraS Scriptmaker v6.1 (HKLM-x32\...\SagaraS Scriptmaker_is1) (Version:  - )
SHIELD Streaming (Version: 7.1.0351 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 3.3.0.95 - NVIDIA Corporation) Hidden
Spotify (HKU\S-1-5-21-3515307565-1161031247-3300353082-1001\...\Spotify) (Version: 1.0.31.56.g526cfefe - Spotify AB)
ST Microelectronics 3 Axis Digital Accelerometer Solution (HKLM-x32\...\{9C24F411-9CA7-4A8A-91F3-F08A4A38EB31}) (Version: 4.10.0067 - ST Microelectronics)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Tavern Tycoon (HKLM\...\Steam App 439340) (Version:  - Terapoly)
TeamViewer 11 (HKLM-x32\...\TeamViewer) (Version: 11.0.66695 - TeamViewer)
The Universim version 1.0 (HKLM-x32\...\{77E2F6D6-85F9-4A73-8FC6-5A6CB3C816C1}_is1) (Version: 1.0 - Crytivo Games)
This War of Mine (HKLM\...\Steam App 282070) (Version:  - 11 bit studios)
Thunderbolt(TM) Software (HKLM-x32\...\{B0E8A8CA-5A40-49C3-BE5E-9076664DB9AA}) (Version: 15.3.39.250 - Intel Corporation)
TMPGEnc Video Mastering Works 6 Testversion (HKLM\...\{C21B422E-CA43-4CE9-B5E3-BA9D641EB047}) (Version: 6.1.5.26 - Pegasys Inc.)
Transmission-Qt (HKLM\...\Transmission-Qt) (Version: 2.84.9 - Transmission)
Transport Fever (HKLM\...\Steam App 446800) (Version:  - Urban Games)
TreeSize Free V3.4.5 (HKLM-x32\...\TreeSize Free_is1) (Version: 3.4.5 - JAM Software)
UE4 Prerequisites (x64) (Version: 1.0.11.0 - Epic Games, Inc.) Hidden
UE4 Prerequisites (x64) (x32 Version: 1.0.13.0 - Epic Games, Inc.) Hidden
Ut Video Codec Suite (HKLM\...\utvideo_is1) (Version: 17.0.0 - UMEZAWA Takeshi)
Vegas Pro 13.0 (64-bit) (HKLM\...\{1F8D8040-0BC8-11E5-85C5-F04DA23A5C58}) (Version: 13.0.453 - Sony)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
VPN Manager 1.8.10.0 (HKLM-x32\...\VPN Manager) (Version: 1.8.10.0 - Perfect-Privacy)
Vulkan Run Time Libraries 1.0.39.1 (HKLM\...\VulkanRT1.0.39.1) (Version: 1.0.39.1 - LunarG, Inc.)
WIDCOMM Bluetooth Software (HKLM\...\{C6D9ED03-6FCF-4410-9CB7-45CA285F9E11}) (Version: 12.0.1.730 - Broadcom Corporation)
WinRAR 5.40 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
x264vfw - H.264/MPEG-4 AVC codec (remove only) (HKLM-x32\...\x264vfw) (Version:  - )
YouPloader Version 0.9.1 (HKLM-x32\...\{DC552D9B-15C9-4F51-B0B2-D8AB7791DBFF}_is1) (Version: 0.9.1 - BeCast)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3515307565-1161031247-3300353082-1001_Classes\CLSID\{59B55F04-DE14-4BB8-92FF-C4A22EF2E5F4}\InprocServer32 -> C:\Users\ezztr\AppData\Local\Google\Update\1.3.31.5\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-3515307565-1161031247-3300353082-1001_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\ezztr\AppData\Local\Citrix\GoToMeeting\6291\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)
CustomCLSID: HKU\S-1-5-21-3515307565-1161031247-3300353082-1001_Classes\CLSID\{CB492AF1-2CEF-4E58-BE47-471C77D0C8BA}\InprocServer32 -> C:\Users\ezztr\AppData\Local\Google\Update\1.3.32.7\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3515307565-1161031247-3300353082-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\ezztr\AppData\Local\Google\Update\1.3.32.7\psuser_64.dll (Google Inc.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {04CB2EF6-C5EE-46A5-80FE-E0E2140C4D1B} - System32\Tasks\USER_ESRV_SVC_QUEENCREEK => Wscript.exe //B //NoLogo "C:\Program Files\Intel\SUR\QUEENCREEK\task.vbs"
Task: {0D55ABF1-CE90-436D-AEC9-21E996067D93} - System32\Tasks\Intel\Intel Telemetry 2 => C:\Program Files\Intel\Telemetry 2.0\lrio.exe [2016-03-17] (Intel Corporation)
Task: {163E6DF7-9A42-4E71-B7CB-A7FC00FC613B} - System32\Tasks\G2MUploadTask-S-1-5-21-3515307565-1161031247-3300353082-1001 => C:\Users\ezztr\AppData\Local\Citrix\GoToMeeting\6441\g2mupload.exe [2017-02-18] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {1A48F5F1-A4FA-448D-8F88-774F9DF2371A} - System32\Tasks\Dell SupportAssistAgent AutoUpdate => C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssist.exe [2016-09-09] (Dell Inc.)
Task: {1B343C47-9E8F-43A0-A524-1984379BAFA2} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\Dell\SupportAssist\sessionchecker.exe [2016-09-13] (PC-Doctor, Inc.)
Task: {207D147E-E73E-44B4-88E1-B9559DF26B1A} - System32\Tasks\Intel\Thunderbolt\Start Thunderbolt application when hardware is detected => Thunderbolt.exe 
Task: {29CF4F40-5921-43C7-B8DC-B282ED50165D} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-01-21] (NVIDIA Corporation)
Task: {2E5F1938-4478-4009-9A8C-8CF974952D7B} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-01-21] (NVIDIA Corporation)
Task: {33E7D8B0-1D68-4EDD-B7D0-92E87A4F3C09} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-04-10] (Google Inc.)
Task: {4D23204F-0E2E-4838-8154-9CE740A0241A} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-01-21] (NVIDIA Corporation)
Task: {50DA9037-6E4B-4CD0-BA09-BAAAD604AAF2} - System32\Tasks\Intel PTT EK Recertification => C:\Program Files\Intel\iCLS Client\IntelPTTEKRecertification.exe [2016-06-14] (Intel(R) Corporation)
Task: {5A30115F-FF80-4AA1-9E90-E33417862FD6} - System32\Tasks\Intel\Thunderbolt\Start Thunderbolt service when hardware is detected => sc.exe start ThunderboltService
Task: {5AF67BBA-EAEC-46AF-827B-314EB7D6A46C} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-01-21] (NVIDIA Corporation)
Task: {5B109A0B-823B-48E0-8DE2-E2DAB8E52FA6} - System32\Tasks\Adobe Uninstaller => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe 
Task: {60B633A5-BC32-4179-84FB-9FF44A397776} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3515307565-1161031247-3300353082-1001Core => C:\Users\ezztr\AppData\Local\Google\Update\GoogleUpdate.exe [2016-07-26] (Google Inc.)
Task: {6488574D-F798-462F-88D7-C0457AE6A5BC} - System32\Tasks\Intel\Intel Telemetry 2 (x86) => C:\Program Files (x86)\Intel\Telemetry 2.0\lrio.exe [2015-11-20] (Intel Corporation)
Task: {652DF692-C7F7-459F-BDF5-F55E4A777E78} - System32\Tasks\G2MUpdateTask-S-1-5-21-3515307565-1161031247-3300353082-1001 => C:\Users\ezztr\AppData\Local\Citrix\GoToMeeting\6441\g2mupdate.exe [2017-02-18] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {65D9B6CA-FACA-4EDA-98B7-4904A5253B48} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2017-01-21] (NVIDIA Corporation)
Task: {86472F58-B053-402E-9BAA-663541F0AA59} - System32\Tasks\Intel\Thunderbolt\Start Thunderbolt application on login if service is up => Thunderbolt.exe 
Task: {8750A57D-9BFA-4D2B-A981-3BED95846E00} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-01-21] (NVIDIA Corporation)
Task: {9791F492-8F48-4F99-8CD6-F9CB6B50BEF9} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3515307565-1161031247-3300353082-1001UA => C:\Users\ezztr\AppData\Local\Google\Update\GoogleUpdate.exe [2016-07-26] (Google Inc.)
Task: {9B95B377-96BA-41DB-AD06-B0954F989609} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-12-28] (Microsoft Corporation)
Task: {9EA39A14-9FB0-418C-AC71-EDEE85799B18} - System32\Tasks\CreateExplorerShellUnelevatedTask => C:\WINDOWS\explorer.exe /NOUACCHECK
Task: {AB031289-0E5D-4509-8F19-A8B1322905C8} - System32\Tasks\Intel\Thunderbolt\Start Thunderbolt service on boot if driver is up => tbtsvc.exe 
Task: {B4776765-14D6-4572-B8DE-B6EDD52B4990} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe 
Task: {C33EBE27-3732-4579-B29F-79D01F362757} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-04-10] (Google Inc.)
Task: {CAA1D9C6-1233-4DC7-879F-EC161AE71991} - System32\Tasks\PCDDataUploadTask => uaclauncher.exe 
Task: {D220BA68-269C-41EB-8A54-13A110A70A70} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3515307565-1161031247-3300353082-1001UA1d25f0055f52a8c => C:\Users\ezztr\AppData\Local\Google\Update\GoogleUpdate.exe [2016-07-26] (Google Inc.)
Task: {D2D43FD7-AA72-433B-9313-037A3C38A991} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-11-17] (Dropbox, Inc.)
Task: {D6A9151A-612D-4C84-88AF-370ECA981488} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3515307565-1161031247-3300353082-1001Core1d25f0055f0e153 => C:\Users\ezztr\AppData\Local\Google\Update\GoogleUpdate.exe [2016-07-26] (Google Inc.)
Task: {D84FABA7-EA17-4A74-807C-81C7620DB5A7} - System32\Tasks\DropboxOEM => C:\Program Files (x86)\Dropbox\DropboxOEM\DropboxOEM.exe [2016-04-04] ()
Task: {DCF517FB-4549-4BB6-A95A-EE96C2716380} - System32\Tasks\AdobeAAMUpdater-1.0-MicrosoftAccount-ezztro@yahoo.de => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2015-08-05] (Adobe Systems Incorporated)
Task: {E09D2D97-0118-4A48-AC63-32397DFF4F6E} - System32\Tasks\{2F9E6DA4-2C8B-428B-A4BE-2A050C4CB698} => msiexec.exe /l*vx "C:\ProgramData\Dell\Dell Customer Connect\Logs\OTBSurvey.1.4.15.0.msi_install_log.txt" ALLUSERS=1 /qn /norestart /i "C:\ProgramData\Dell\Dell Customer Connect\Downloads\OTBSurvey.1.4.15.0\OTBSurvey.1.4.15.0.msi"
Task: {EC5937FE-8585-4CE3-8694-02DDC49EE896} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2017-02-04] (Microsoft Corporation)
Task: {F35D6EB5-3FEE-49C9-8EE2-CFAB94043E72} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-11-17] (Dropbox, Inc.)
Task: {F43A5D40-7ED4-4E59-8B77-352C08D88260} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2017-01-21] (NVIDIA Corporation)
Task: {FC38FDB1-3888-400F-AB12-D2D387A163F4} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-12-28] (Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\G2MUpdateTask-S-1-5-21-3515307565-1161031247-3300353082-1001.job => C:\Users\ezztr\AppData\Local\Citrix\GoToMeeting\6441\g2mupdate.exe
Task: C:\WINDOWS\Tasks\G2MUploadTask-S-1-5-21-3515307565-1161031247-3300353082-1001.job => C:\Users\ezztr\AppData\Local\Citrix\GoToMeeting\6441\g2mupload.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-3515307565-1161031247-3300353082-1001Core.job => C:\Users\ezztr\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-3515307565-1161031247-3300353082-1001UA.job => C:\Users\ezztr\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

ShortcutWithArgument: C:\Users\ezztr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome-Apps\Google Play Musik.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --profile-directory=Default --app-id=fahmaaghhglfmonjliepjlchgpgfmobi

==================== Loaded Modules (Whitelisted) ==============

2016-12-31 17:22 - 2016-11-17 22:16 - 00805632 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\esrv_svc.exe
2016-12-31 17:22 - 2016-11-17 22:18 - 01981184 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\intel_modeler.dll
2016-12-31 17:22 - 2016-11-17 22:11 - 00247552 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\acpi_battery_input.dll
2016-12-31 17:22 - 2016-11-17 22:10 - 00212736 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\wifi_input.dll
2016-12-31 17:22 - 2016-11-17 22:11 - 00174848 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\devices_use_input.dll
2016-12-31 17:22 - 2016-11-17 22:10 - 00203520 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\intel_system_power_state_input.dll
2016-12-31 17:22 - 2016-11-17 22:09 - 00206592 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\intel_disktrace_input.dll
2016-12-31 17:22 - 2016-11-17 22:09 - 00336640 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\intel_process_input.dll
2016-12-31 17:22 - 2016-11-17 22:06 - 00147712 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\intel_winstat_input.dll
2016-12-31 17:22 - 2016-11-17 22:11 - 00213248 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\sema_thermal_input.dll
2016-12-31 17:22 - 2016-11-17 22:07 - 00229120 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\intel_quality_and_reliability_input.dll
2016-12-31 17:22 - 2016-11-17 22:08 - 00224000 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\intel_sampler_input.dll
2016-12-31 17:22 - 2016-11-17 22:06 - 00211712 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\intel_stress_odometer_input.dll
2016-12-31 17:22 - 2016-11-17 22:08 - 00219904 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\intel_turbo_input.dll
2015-08-21 08:47 - 2015-08-21 08:47 - 00049408 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btwleapi.dll
2016-07-03 16:54 - 2017-01-21 01:39 - 04489152 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\Poco.dll
2016-07-03 16:54 - 2017-01-21 01:39 - 01147328 _____ () C:\Program Files\NVIDIA Corporation\NvContainer\libprotobuf.dll
2017-01-10 14:59 - 2017-01-10 14:59 - 00125808 _____ () C:\Program Files (x86)\Dell Dock Update\DUWrapperService.exe
2016-11-17 22:05 - 2016-11-17 22:05 - 00156928 _____ () C:\Program Files\Intel Driver Update Utility\SUR\SurSvc.exe
2016-08-30 00:31 - 2016-08-30 00:31 - 00949480 _____ () C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\ovpnagent.exe
2016-07-16 18:42 - 2016-07-16 18:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-12-20 20:18 - 2016-12-09 17:29 - 02681200 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2017-01-09 00:13 - 2017-02-10 05:57 - 00134712 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2016-12-20 20:18 - 2016-12-09 17:29 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-04-16 19:02 - 2013-10-29 18:43 - 00248832 _____ () C:\Program Files (x86)\Drakonia Configurator\hid.exe
2017-01-14 02:10 - 2017-01-14 02:10 - 00052400 _____ () C:\Program Files\FileZilla FTP Client\fzshellext_64.dll
2016-12-31 17:22 - 2016-11-17 22:14 - 00730880 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\esrv.exe
2016-12-31 17:22 - 2016-11-17 22:12 - 00237824 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\foreground_window_input.dll
2016-12-31 17:22 - 2016-11-17 22:08 - 00217344 _____ () C:\Program Files\Intel\SUR\QUEENCREEK\intel_user_waiting_input.dll
2016-12-22 23:27 - 2016-12-22 23:27 - 00017408 _____ () C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe
2016-04-16 19:02 - 2012-12-11 16:14 - 00240640 _____ () C:\Program Files (x86)\Drakonia Configurator\trayicon.exe
2016-12-20 20:18 - 2016-12-09 17:29 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2016-11-02 17:31 - 2016-11-02 17:31 - 00230064 _____ () C:\Program Files\Notepad++\NppShell_06.dll
2016-09-16 18:25 - 2016-09-07 11:56 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-14 11:17 - 2016-12-21 14:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-01-14 11:17 - 2016-12-21 13:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-02-19 16:59 - 2017-02-19 16:59 - 00073728 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.109.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-02-19 16:59 - 2017-02-19 16:59 - 00179712 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.109.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-02-19 16:59 - 2017-02-19 16:59 - 42895360 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.109.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-02-07 16:50 - 2017-02-07 16:50 - 02215424 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.109.0_x64__kzf8qxf38zg5c\roottools.dll
2017-01-14 11:17 - 2016-12-21 13:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-14 11:17 - 2016-12-21 13:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-14 11:17 - 2016-12-21 13:48 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2017-01-14 11:17 - 2016-12-21 13:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-14 11:17 - 2016-12-21 13:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-09-12 22:57 - 2017-01-09 19:08 - 02493440 _____ () C:\games\Origin\libGLESv2.dll
2015-06-24 07:26 - 2015-06-24 07:26 - 00155888 _____ () c:\Program Files (x86)\Dell Digital Delivery\ServiceTagPlusPlus.dll
2016-05-13 14:10 - 2016-05-13 14:10 - 00134144 _____ () C:\Program Files (x86)\Dell Update\ServiceTagPlusPlus.dll
2016-07-18 15:14 - 2016-07-18 15:14 - 01243936 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2016-12-21 10:24 - 2016-12-21 10:24 - 00134008 _____ () C:\Program Files (x86)\Dell Customer Connect\ServiceTagPlusPlus.dll
2016-07-03 16:54 - 2017-01-21 01:39 - 00018880 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2016-07-03 16:54 - 2017-01-21 01:39 - 03774400 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\Poco.dll
2016-07-03 16:54 - 2017-01-21 01:39 - 00900032 _____ () C:\Program Files (x86)\NVIDIA Corporation\NvContainer\libprotobuf.dll
2016-07-03 16:55 - 2017-01-21 01:38 - 64245184 _____ () C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\libcef.dll
2016-07-22 01:42 - 2017-01-20 20:36 - 00338488 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVAccountAPINode.node
2016-07-22 01:42 - 2017-01-20 20:36 - 00254008 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\DriverInstall.node
2016-07-22 01:42 - 2017-01-20 20:36 - 02808888 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\Downloader.node
2016-07-22 01:42 - 2017-01-20 20:36 - 00384568 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NvGameShareAPINode.node
2016-07-22 01:42 - 2017-01-20 20:36 - 00537656 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NvSpCapsAPINode.node
2016-07-22 01:42 - 2017-01-20 20:36 - 00468024 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NvGalleryAPINode.node
2016-08-29 22:56 - 2017-01-20 20:36 - 01066552 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NvCameraAPINode.node
2016-12-23 17:59 - 2017-01-20 20:36 - 01014840 _____ () \\?\C:\Program Files (x86)\NVIDIA Corporation\NvNode\NvSDKAPINode.node
2017-02-18 19:30 - 2017-02-18 19:30 - 00098816 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\win32api.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00110080 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\pywintypes27.dll
2017-02-18 19:30 - 2017-02-18 19:30 - 00364544 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\pythoncom27.dll
2017-02-18 19:30 - 2017-02-18 19:30 - 00320512 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\win32com.shell.shell.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00914432 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\_hashlib.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 01176576 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\wx._core_.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00806400 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\wx._gdi_.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00816128 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\wx._windows_.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 01067008 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\wx._controls_.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00733184 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\wx._misc_.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00682496 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\pysqlite2._sqlite.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00088064 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\_ctypes.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00686080 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\unicodedata.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00119808 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\win32file.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00108544 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\win32security.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00007168 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\hashobjs_ext.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00017920 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\thumbnails_ext.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00088064 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\usb_ext.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00012800 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\common.time34.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00018432 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\win32event.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00167936 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\win32gui.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00046080 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\_socket.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 01303552 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\_ssl.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00128512 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\_elementtree.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00127488 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\pyexpat.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00038912 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\win32inet.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00036864 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\_psutil_windows.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00524248 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\windows._lib_cacheinvalidation.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00011264 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\win32crypt.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00123392 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\wx._wizard.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00077312 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\wx._html2.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00027648 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\_multiprocessing.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00020480 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\_yappi.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00035840 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\win32process.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00078848 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\wx._animate.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00024064 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\win32pipe.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00010240 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\select.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00025600 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\win32pdh.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00017408 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\win32profile.pyd
2017-02-18 19:30 - 2017-02-18 19:30 - 00022528 ____R () C:\Users\ezztr\AppData\Local\Temp\_MEI94762\win32ts.pyd
2016-04-16 19:02 - 2013-01-15 22:06 - 00061952 _____ () C:\Program Files (x86)\Drakonia Configurator\HidDevice.dll
2016-12-22 23:27 - 2016-12-22 23:27 - 12163072 _____ () C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe\Microsoft.Msn.Weather.dll
2016-12-20 20:05 - 2016-12-20 20:06 - 00958464 _____ () C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe\SQLite3Wrapper.dll
2016-07-16 21:31 - 2016-07-16 21:31 - 00645120 _____ () C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe\Microsoft.Aria.ClientTelemetry.dll
2016-08-24 09:13 - 2016-08-24 09:14 - 03312024 _____ () C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe\Microsoft.Advertising.dll
2016-04-16 19:02 - 2011-11-22 19:18 - 00249856 _____ () C:\Program Files (x86)\Drakonia Configurator\language.dll
2016-04-11 23:08 - 2016-12-24 01:28 - 00657184 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2016-04-11 23:08 - 2016-09-01 08:02 - 04969248 _____ () C:\Program Files (x86)\Steam\v8.dll
2016-04-11 23:08 - 2017-01-19 08:30 - 02327840 _____ () C:\Program Files (x86)\Steam\video.dll
2016-04-11 23:07 - 2016-01-27 14:49 - 02549760 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2016-04-11 23:07 - 2016-01-27 14:49 - 00491008 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2016-04-11 23:07 - 2016-01-27 14:49 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2016-04-11 23:07 - 2016-01-27 14:49 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2016-04-11 23:07 - 2016-01-27 14:49 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2016-04-11 23:08 - 2016-09-01 08:02 - 01563936 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2016-04-11 23:08 - 2016-09-01 08:02 - 01195296 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2016-04-11 23:07 - 2017-01-19 08:30 - 00838432 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2016-04-11 23:07 - 2016-07-05 05:17 - 00266560 _____ () C:\Program Files (x86)\Steam\openvr_api.dll
2016-12-21 12:18 - 2017-01-05 10:12 - 68813088 _____ () C:\Program Files (x86)\Steam\bin\cef\cef.win7\libcef.dll
2016-04-11 23:08 - 2017-01-19 08:30 - 00383776 _____ () C:\Program Files (x86)\Steam\steam.dll
2016-04-11 23:07 - 2015-09-25 06:52 - 00119208 _____ () C:\Program Files (x86)\Steam\winh264.dll
2017-02-07 21:49 - 2017-02-01 16:01 - 01870168 _____ () C:\Program Files (x86)\Google\Chrome\Application\56.0.2924.87\libglesv2.dll
2017-02-07 21:49 - 2017-02-01 16:01 - 00085848 _____ () C:\Program Files (x86)\Google\Chrome\Application\56.0.2924.87\libegl.dll
         

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-07-10 18:04 - 2016-11-20 23:07 - 00001025 ____A C:\WINDOWS\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3515307565-1161031247-3300353082-1001\Control Panel\Desktop\\Wallpaper -> 
DNS Servers: 8.8.8.8 - 118.98.44.10
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

HKLM\...\StartupApproved\Run: => "PremierColor"
HKU\S-1-5-21-3515307565-1161031247-3300353082-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-3515307565-1161031247-3300353082-1001\...\StartupApproved\Run: => "Steam"
HKU\S-1-5-21-3515307565-1161031247-3300353082-1001\...\StartupApproved\Run: => "Spotify"
HKU\S-1-5-21-3515307565-1161031247-3300353082-1001\...\StartupApproved\Run: => "Spotify Web Helper"
HKU\S-1-5-21-3515307565-1161031247-3300353082-1001\...\StartupApproved\Run: => "MusicManager"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{C17F5659-1505-42DE-BB05-2C756F24B829}] => (Allow) C:\games\GameforgeLive\gfl_client.exe
FirewallRules: [{7D93B344-EB13-4E7A-BD61-0863CBF13D34}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{BC4F5E12-EC9F-4AE8-8BF6-6A514710F95C}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [UDP Query User{D45226D3-5DCE-42F4-AF3B-76C8FA1D5F26}C:\users\ezztr\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\ezztr\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{F8D0FD33-645D-4886-83F4-F10F91E60F23}C:\users\ezztr\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\ezztr\appdata\roaming\spotify\spotify.exe
FirewallRules: [{277B7182-EF76-4E43-829A-DB3743D4FAC3}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\This War of Mine\Storyteller.exe
FirewallRules: [{B805154D-E775-4E97-9110-F33FB0C6EB51}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\This War of Mine\Storyteller.exe
FirewallRules: [{3E397DCD-0DD7-4044-A1A0-149701EB7C32}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\This War of Mine\This War of Mine.exe
FirewallRules: [{64BCF33C-B757-440E-A2CC-FDC496463331}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\This War of Mine\This War of Mine.exe
FirewallRules: [{A16F6B7B-70F3-4576-BBA2-9E1E3119F4AE}] => (Block) %ProgramFiles%\Sony\Vegas Pro 13.0\vegas130.exe
FirewallRules: [UDP Query User{C0B1816F-734A-411A-8D6B-5A9ECC77EBD0}C:\program files\transmission\transmission-qt.exe] => (Allow) C:\program files\transmission\transmission-qt.exe
FirewallRules: [TCP Query User{4A8B2546-03FA-4EB8-85AE-EEE23DCA4046}C:\program files\transmission\transmission-qt.exe] => (Allow) C:\program files\transmission\transmission-qt.exe
FirewallRules: [{7E700728-1A46-474F-A9DF-5D1B31DC547F}] => (Allow) C:\Games\World_of_Tanks\worldoftanks.exe
FirewallRules: [{58091464-702B-4BA8-9722-9DD3019824F8}] => (Allow) C:\Games\World_of_Tanks\worldoftanks.exe
FirewallRules: [{08E43E94-6562-4C54-9538-7F4D3376D598}] => (Allow) C:\Games\World_of_Tanks\WoTLauncher.exe
FirewallRules: [{A402605C-2125-4DB3-8463-845F1AE0558B}] => (Allow) C:\Games\World_of_Tanks\WoTLauncher.exe
FirewallRules: [UDP Query User{278854EE-DCAC-4D46-8EC7-65836AB565F4}C:\games\hearthstone\hearthstone.exe] => (Allow) C:\games\hearthstone\hearthstone.exe
FirewallRules: [TCP Query User{E61457E3-0841-4B8B-94B0-053B3D1F6B38}C:\games\hearthstone\hearthstone.exe] => (Allow) C:\games\hearthstone\hearthstone.exe
FirewallRules: [{3BC96CDD-1BE2-4378-8C34-7A5046B8C829}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\MiniMetro\MiniMetro.exe
FirewallRules: [{E77BCB3B-19C5-4D11-9163-2CA9772CC215}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\MiniMetro\MiniMetro.exe
FirewallRules: [{EF88B2AE-1A5B-412C-9EA7-F3ED89932447}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{60C82DF7-A1E1-4BB3-A84C-B52A3E7614A5}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{C3E3F344-96BD-4E3A-888F-14A4B964F289}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{5346CA20-8F67-4AAA-B93F-438A67350DF6}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{9215639A-8497-44BD-BDEE-EE065DA52BB3}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Faeria\Faeria.exe
FirewallRules: [{759CA9DD-D5CA-46F1-8E91-207742295A67}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Faeria\Faeria.exe
FirewallRules: [{E064189B-3782-4E35-96D9-BDFF9F499639}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\CraftTheWorld\CraftWorld.exe
FirewallRules: [{4EDFA684-A6F6-4A6F-861F-7E2E4B482CD4}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\CraftTheWorld\CraftWorld.exe
FirewallRules: [{6D6E6B78-D454-4C1E-A5F6-CE16D2B53576}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\RimWorld\RimWorldWin.exe
FirewallRules: [{548CD056-BF5E-46D5-BC7E-F178EB7A5529}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\RimWorld\RimWorldWin.exe
FirewallRules: [TCP Query User{37DE9295-1AE0-44E7-B1FD-6BFA0CCEFC64}C:\tmp\avencolony\binaries\win64\avencolony.exe] => (Allow) C:\tmp\avencolony\binaries\win64\avencolony.exe
FirewallRules: [UDP Query User{C7C3E257-C7A8-48E3-B179-5AF3FFD5E209}C:\tmp\avencolony\binaries\win64\avencolony.exe] => (Allow) C:\tmp\avencolony\binaries\win64\avencolony.exe
FirewallRules: [{5F381414-7E4A-4DAC-94AE-B7A20CA69DA4}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Transport Fever\TransportFever.exe
FirewallRules: [{0AB262A1-F86A-4AFF-83CB-8B3A3529E830}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Transport Fever\TransportFever.exe
FirewallRules: [{2CBFE8D9-02EE-41FB-9141-A88122B77815}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{06A7C478-0B02-49CC-92AA-B7AC95D45EE4}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{143E3176-9C1F-4EEE-884B-2B2E43C93E9D}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{C3BA8D08-41A0-4F93-93AA-7C230B171825}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{296F8C72-669A-49B9-8773-F2AC39257571}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{EC9DBA8F-965B-4AB6-B13E-271A19A65802}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{3434F424-1A3C-4AD5-B67D-C23403F1BBD8}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\NvContainer.exe
FirewallRules: [{6E7C318E-CC99-461A-B692-E86AB2D4BF26}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\NvContainer.exe
FirewallRules: [{5BBDDEC7-BD03-4FB6-8599-F39D2F0E8EA6}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{3D6782B4-E800-471A-8B72-1DB780B0BAC4}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{39F896B1-29FE-421F-A4A8-80F8D572DA07}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{FE4F29E9-EA06-412B-BD0C-1B870D1786C3}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Life Is Strange\Binaries\Win32\LifeIsStrange.exe
FirewallRules: [{D7DA5ABD-DA9B-4E12-BA51-E6BF0F9A8B93}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Life Is Strange\Binaries\Win32\LifeIsStrange.exe
FirewallRules: [{AC18BE33-A7F2-4DB0-BDDC-E2116D8FDDF4}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Keebles\Keebles.exe
FirewallRules: [{9096EF1A-E968-4508-BACA-60833687AB10}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Keebles\Keebles.exe
FirewallRules: [TCP Query User{D451319D-13B5-473B-801E-92390E465CD5}C:\games\the universim\the universim.exe] => (Allow) C:\games\the universim\the universim.exe
FirewallRules: [UDP Query User{A6AED956-641B-4A06-BBAA-7977D3B1941F}C:\games\the universim\the universim.exe] => (Allow) C:\games\the universim\the universim.exe
FirewallRules: [{6B46C0AA-404C-4F8A-B269-84321A873B0A}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe
FirewallRules: [{591828EE-75B0-416D-AFAA-62FE66304C38}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{D5D7ECAA-0C2C-4298-80FC-2AD8E3625F5A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Conan Exiles\ConanSandbox\Binaries\Win64\ConanSandbox_BE.exe
FirewallRules: [{70EC9924-39A9-4327-8E29-3CD9B1362085}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Conan Exiles\ConanSandbox\Binaries\Win64\ConanSandbox_BE.exe
FirewallRules: [{B00BFF46-3023-40B2-9937-81068549DE27}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Conan Exiles\ConanSandbox\Binaries\Win64\ConanSandbox.exe
FirewallRules: [{E4AA0E3E-2558-4129-B7D5-1408B426A7FB}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Conan Exiles\ConanSandbox\Binaries\Win64\ConanSandbox.exe
FirewallRules: [{111ADE00-A556-4F6E-A162-7F624AA421B0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Factorio\bin\x64\factorio.exe
FirewallRules: [{16B5D7C8-1CB3-4968-98F2-525DC7767CE2}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Factorio\bin\x64\factorio.exe
FirewallRules: [{AA4AAE9D-EDF8-43EE-8366-32E1596BE4E0}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{84BB91C0-D0D8-46B8-9CA1-532F4D95BDDA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\DarkestDungeon\_windows\Darkest.exe
FirewallRules: [{4BD0509B-4734-4336-8AF3-401A75059318}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\DarkestDungeon\_windows\Darkest.exe
FirewallRules: [TCP Query User{32B7101D-B91C-4BB3-A713-F192C26BDCD8}C:\program files\transmission\transmission-qt.exe] => (Allow) C:\program files\transmission\transmission-qt.exe
FirewallRules: [UDP Query User{FA4A5112-CD38-43C8-8F26-C8BC71256DD9}C:\program files\transmission\transmission-qt.exe] => (Allow) C:\program files\transmission\transmission-qt.exe
FirewallRules: [{80F768F5-5B72-4F0B-9BB8-B88918DD446F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\DarkestDungeon\_windows\Darkest.exe
FirewallRules: [{40F29920-31F6-4CCF-B886-D83E03E8E8A0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\DarkestDungeon\_windows\Darkest.exe
FirewallRules: [{C143464E-F3C5-4B1E-AE6C-388C4C2FA335}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Tavern Tycoon\TavernTycoon.exe
FirewallRules: [{41D652DD-FA31-4F36-AFAD-6083D1AA8D2F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Tavern Tycoon\TavernTycoon.exe

==================== Restore Points =========================

30-01-2017 00:01:57 Installed QuickTime 7
06-02-2017 14:41:00 Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24210
14-02-2017 18:10:57 Removed LibreOffice 5.0.5.2
16-02-2017 14:00:18 Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24212

==================== Faulty Device Manager Devices =============

Name: Intel High Definition DSP
Description: Intel High Definition DSP
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/20/2017 11:55:26 AM) (Source: DellUpService.exe) (EventID: 0) (User: )
Description: [32] ERROR- DoUpdateCheck manifestsSuccessful is invalid, stop updating! #StackInfo#

Error: (02/20/2017 12:02:58 AM) (Source: DellUpService.exe) (EventID: 0) (User: )
Description: [14] ERROR- DoUpdateCheck manifestsSuccessful is invalid, stop updating! #StackInfo#

Error: (02/19/2017 06:24:13 PM) (Source: Perflib) (EventID: 1023) (User: )
Description: Die erweiterbare Leistungsindikator-DLL rdyboost kann nicht geladen werden. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Windows-Fehlercode.

Error: (02/19/2017 04:56:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 10.0.14393.479, Zeitstempel: 0x58258a90
Name des fehlerhaften Moduls: ntdll.dll, Version: 10.0.14393.479, Zeitstempel: 0x5825887f
Ausnahmecode: 0xc0000264
Fehleroffset: 0x00000000000a5aa0
ID des fehlerhaften Prozesses: 0x59c
Startzeit der fehlerhaften Anwendung: 0x01d289e2b6e1f25d
Pfad der fehlerhaften Anwendung: C:\WINDOWS\Explorer.EXE
Pfad des fehlerhaften Moduls: C:\WINDOWS\SYSTEM32\ntdll.dll
Berichtskennung: 93a2185f-82d8-4abb-ac02-c01c5e26d8a5
Vollständiger Name des fehlerhaften Pakets: 
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (02/17/2017 04:49:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ShellExperienceHost.exe, Version: 10.0.14393.447, Zeitstempel: 0x5819bf85
Name des fehlerhaften Moduls: igd10iumd64.dll, Version: 20.19.15.4531, Zeitstempel: 0x57ed27c8
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000003c9a45
ID des fehlerhaften Prozesses: 0x2c90
Startzeit der fehlerhaften Anwendung: 0x01d2861abadb856e
Pfad der fehlerhaften Anwendung: C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
Pfad des fehlerhaften Moduls: C:\WINDOWS\SYSTEM32\igd10iumd64.dll
Berichtskennung: dbfb7ed5-2566-40fd-b77e-c8ff41f53d3d
Vollständiger Name des fehlerhaften Pakets: Microsoft.Windows.ShellExperienceHost_10.0.14393.693_neutral_neutral_cw5n1h2txyewy
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App

Error: (02/17/2017 12:02:59 AM) (Source: DellUpService.exe) (EventID: 0) (User: )
Description: [25] ERROR- DoUpdateCheck manifestsSuccessful is invalid, stop updating! #StackInfo#

Error: (02/16/2017 02:00:20 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:
Access is denied.
.

Error: (02/16/2017 12:13:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: privatetunnel2.8.2.exe, Version: 2.8.2.0, Zeitstempel: 0x5894bb53
Name des fehlerhaften Moduls: privatetunnel2.8.2.exe, Version: 2.8.2.0, Zeitstempel: 0x5894bb53
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00017cf7
ID des fehlerhaften Prozesses: 0x4dc4
Startzeit der fehlerhaften Anwendung: 0x01d28807db4cae19
Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\privatetunnel2.8.2.exe
Pfad des fehlerhaften Moduls: C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\privatetunnel2.8.2.exe
Berichtskennung: 97926ac6-6211-467d-acb9-67439f3d0a31
Vollständiger Name des fehlerhaften Pakets: 
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (02/16/2017 10:35:37 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: VPNManager.exe, Version: 1.8.10.0, Zeitstempel: 0x57c9c628
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 10.0.14393.479, Zeitstempel: 0x58256d37
Ausnahmecode: 0xe0434352
Fehleroffset: 0x000da832
ID des fehlerhaften Prozesses: 0x3740
Startzeit der fehlerhaften Anwendung: 0x01d2880402a4e047
Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Perfect Privacy VPN Manager\VPNManager.exe
Pfad des fehlerhaften Moduls: C:\WINDOWS\System32\KERNELBASE.dll
Berichtskennung: 073d6fb4-49ae-4a83-a036-7c899636f4fb
Vollständiger Name des fehlerhaften Pakets: 
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (02/16/2017 10:35:37 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: VPNManager.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.ComponentModel.InvalidAsynchronousStateException
   bei System.Windows.Forms.Control.WaitForWaitHandle(System.Threading.WaitHandle)
   bei System.Windows.Forms.Control.MarshaledInvoke(System.Windows.Forms.Control, System.Delegate, System.Object[], Boolean)
   bei System.Windows.Forms.Control.Invoke(System.Delegate, System.Object[])
   bei VPNManager.FrmGlobalStatus.setLabelText(System.Windows.Forms.Label, System.String)
   bei VPNManager.FrmGlobalStatus.setStatusLines()
   bei VPNManager.FrmGlobalStatus.checkAdvancedProtection(System.String)
   bei VPNManager.VpnConfig.connect_thread(Int32)
   bei VPNManager.VpnConfig+<>c__DisplayClass73_0.<Connect>b__0()
   bei System.Threading.ThreadHelper.ThreadStart_Context(System.Object)
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   bei System.Threading.ThreadHelper.ThreadStart()


System errors:
=============
Error: (02/21/2017 01:34:21 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 4003) (User: NT AUTHORITY)
Description: Bei der automatischen WLAN-Konfiguration wurde eine eingeschränkte Konnektivität erkannt, "Reset/Recover.adapter" wird ausgeführt.

 Code: 8 0x0 0x0

Error: (02/21/2017 01:34:18 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 4003) (User: NT AUTHORITY)
Description: Bei der automatischen WLAN-Konfiguration wurde eine eingeschränkte Konnektivität erkannt, "Reset/Recover.adapter" wird ausgeführt.

 Code: 2 0xdeaddeed 0xeeec

Error: (02/21/2017 01:34:18 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 4003) (User: NT AUTHORITY)
Description: Bei der automatischen WLAN-Konfiguration wurde eine eingeschränkte Konnektivität erkannt, "Reset/Recover.adapter" wird ausgeführt.

 Code: 1 0xc 0x4

Error: (02/21/2017 01:12:34 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Activation" für die COM-Serveranwendung mit der CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (02/21/2017 02:14:07 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Activation" für die COM-Serveranwendung mit der CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (02/20/2017 06:56:01 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Activation" für die COM-Serveranwendung mit der CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (02/20/2017 04:15:08 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Activation" für die COM-Serveranwendung mit der CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (02/20/2017 02:49:45 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Durch die Berechtigungseinstellungen für "application-specific" wird dem Benutzer "NT AUTHORITY\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (Using LRPC)" keine Berechtigung vom Typ "Local Activation" für die COM-Serveranwendung mit der CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Unavailable" (SID: Unavailable) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (02/20/2017 12:54:05 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 4003) (User: NT AUTHORITY)
Description: Bei der automatischen WLAN-Konfiguration wurde eine eingeschränkte Konnektivität erkannt, "Reset/Recover.adapter" wird ausgeführt.

 Code: 8 0x0 0x0

Error: (02/20/2017 12:54:02 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 4003) (User: NT AUTHORITY)
Description: Bei der automatischen WLAN-Konfiguration wurde eine eingeschränkte Konnektivität erkannt, "Reset/Recover.adapter" wird ausgeführt.

 Code: 2 0xdeaddeed 0xeeec


CodeIntegrity:
===================================
  Date: 2017-02-08 20:01:07.700
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\DriverStore\FileRepository\nvdmi.inf_amd64_fd06216336fcf4a2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-02-07 22:40:22.555
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\vfilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2017-02-07 21:00:35.766
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\DriverStore\FileRepository\nvdmi.inf_amd64_fd06216336fcf4a2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-02-06 20:47:49.537
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\vfilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2017-01-28 13:57:26.188
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\DriverStore\FileRepository\nvdmi.inf_amd64_fd06216336fcf4a2\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-01-28 09:49:07.891
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\vfilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2017-01-22 17:51:25.453
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\DriverStore\FileRepository\nvdmi.inf_amd64_abcfc5746cfa0cc0\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-01-22 11:49:02.271
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\vfilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2017-01-21 18:20:43.708
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\DriverStore\FileRepository\nvdmi.inf_amd64_abcfc5746cfa0cc0\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-01-21 10:40:12.341
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\vfilter.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz
Percentage of memory in use: 34%
Total physical RAM: 16238.91 MB
Available physical RAM: 10616.37 MB
Total Virtual: 18670.91 MB
Available Virtual: 11437.8 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:461.56 GB) (Free:153.94 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 476.9 GB) (Disk ID: A4A7D5DC)

Partition: GPT.

==================== End of Addition.txt ====