Hallo, ich habe eine Phishing Mail von Online Pay AG erhalten. Ich habe leider überstürzt gehandelt, den Anhang heruntergeladen und geöffnet. Es war eine Zip Datei. Diese hat eine weiter Zip Datei beinhaltet, aber soweit ich mich erinnern kann keine exe Datei.
Ich habe jetzt schon ein paar kostenlose Antivirus Programme durchlaufen lassen. Die haben bisher nichts angezeigt. Ich würde gerne noch meine Logdatein von euch durschauen lassen.
Ich habe schon mit HijackThis ein Logfile erstellt und hier https://www.hijackthis.de/ eingetragen. Leider finde ich die Logfile nicht mehr.

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 15-03-2017
durchgeführt von Sergio (19-03-2017 01:44:38)
Gestartet von E:\Internet Downloads
Windows 10 Pro Version 1607 (X64) (2016-09-29 19:16:19)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-1478414814-3749218601-3539646535-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1478414814-3749218601-3539646535-503 - Limited - Disabled)
Gast (S-1-5-21-1478414814-3749218601-3539646535-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1478414814-3749218601-3539646535-1003 - Limited - Enabled)
postgres (S-1-5-21-1478414814-3749218601-3539646535-1007 - Limited - Enabled) => C:\Users\postgres
Sergio (S-1-5-21-1478414814-3749218601-3539646535-1001 - Administrator - Enabled) => C:\Users\Sergio

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {A16C3F68-9280-E053-1818-342707FECF4D}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Disabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

adaware antivirus (HKLM\...\{BECD7155-DC57-4F89-B1A8-A90B033C6209}_AdAwareUpdater) (Version: 12.0.649.11190 - adaware)
AdAwareInstaller (Version: 12.0.649.11190 - adaware) Hidden
AdAwareUpdater (Version: 12.0.649.11190 - adaware) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 25.0.0.134 - Adobe Systems Incorporated)
Adobe Flash Player 25 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 25.0.0.127 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.19) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.19 - Adobe Systems Incorporated)
AMD Install Manager (HKLM\...\AMD Catalyst Install Manager) (Version: 5.00 - Advanced Micro Devices, Inc.)
AntimalwareEngine (Version: 3.0.144.0 - adaware) Hidden
Apple Application Support (32-Bit) (HKLM-x32\...\{9BA1A894-B42F-4805-BC8C-349C905A3930}) (Version: 5.3.1 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{7EAC8A42-9FAC-4F6B-AABF-C08C9F2E0F13}) (Version: 5.3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{55BB2110-FB43-49B3-93F4-945A0CFB0A6C}) (Version: 10.0.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Ashampoo WinOptimizer 2017 (HKLM-x32\...\{4209F371-6CE9-533C-2CDC-94E053273B35}_is1) (Version: 14.00.04 - Ashampoo GmbH & Co. KG)
Avast Free Antivirus (HKLM-x32\...\Avast Antivirus) (Version: 17.2.2288 - AVAST Software)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
calibre 64bit (HKLM\...\{DD84AFA7-867C-428A-8FA4-59A98AB60A1F}) (Version: 2.7.0 - Kovid Goyal)
Catalyst Control Center Next Localization BR (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.28 - Piriform)
chip 1-click download service (HKLM-x32\...\{503CA94E-0834-4CEE-AD92-BA17AF4E809A}) (Version: 3.6.9.0 - Chip Digital GmbH)
ComicRack v0.9.176 (HKLM\...\ComicRack) (Version: v0.9.176 - cYo Soft)
Dragon Ball Xenoverse 2 Digitale Deluxe Edition MULTi9 1.0 (HKLM-x32\...\Dragon Ball Xenoverse 2 Digitale Deluxe Edition MULTi9 1.0) (Version:  - )
Evernote v. 6.4.2 (HKLM-x32\...\{E74F0DCA-9FC8-11E6-9D98-005056950253}) (Version: 6.4.2.3788 - Evernote Corp.)
f.lux (HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Flux) (Version:  - )
FocalFilter (HKLM-x32\...\{78156F61-016D-402A-9EF9-C2AA253DB22A}) (Version: 0.9.00 - FocalFilter)
FreeMind (HKLM-x32\...\B991B020-2968-11D8-AF23-444553540000_is1) (Version: 1.0.1 - )
GeoGebra 5 (HKLM-x32\...\GeoGebra 5) (Version: 5.0.177.0 - International GeoGebra Institute)
Google Chrome (HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Google Chrome) (Version: 56.0.2924.87 - Google Inc.)
iTunes (HKLM\...\{9D0D2A8B-7E7B-4D88-8D50-24286ED6A5EB}) (Version: 12.5.5.5 - Apple Inc.)
Java 8 Update 121 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180121F0}) (Version: 8.0.1210.13 - Oracle Corporation)
Java 8 Update 92 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418092F0}) (Version: 8.0.920.14 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
JetBrains PyCharm Community Edition 2016.3.2 (HKLM-x32\...\PyCharm Community Edition 2016.3.2) (Version: 163.10154.50 - JetBrains s.r.o.)
Maltego CE 4.0.11 (HKLM-x32\...\MaltegoCE 4.0.11) (Version: 4.0.11 - Paterva)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\OneDriveSetup.exe) (Version: 17.3.6743.1212 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50905.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23506 (HKLM-x32\...\{3ee5e5bb-b7cc-4556-8861-a00a82977d6c}) (Version: 14.0.23506.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24212 (HKLM-x32\...\{462f63a8-6347-4894-a1b3-dbfe3a4c981d}) (Version: 14.0.24212.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 47.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 47.0.2 (x86 de)) (Version: 47.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 42.0.0.5780 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
NVIDIA PhysX (HKLM-x32\...\{B455E95A-B804-439F-B533-336B1635AE97}) (Version: 9.14.0702 - NVIDIA Corporation)
Oracle VM VirtualBox 5.1.14 (HKLM\...\{6AE61854-0F78-49E3-ABCC-586FB43CE709}) (Version: 5.1.14 - Oracle Corporation)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PokerStars.eu (HKLM-x32\...\PokerStars.eu) (Version:  - PokerStars.eu)
Python 3.6.0 (64-bit) (HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\{37a4e38b-baf7-4500-97f1-0f7c51d9a395}) (Version: 3.6.150.0 - Python Software Foundation)
Python 3.6.0 Core Interpreter (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Development Libraries (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Documentation (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Executables (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 pip Bootstrap (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Standard Library (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Tcl/Tk Support (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Test Suite (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Utility Scripts (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python Launcher (HKLM-x32\...\{A674B2CB-13CA-437B-A215-9DD257959A49}) (Version: 3.6.5835.0 - Python Software Foundation)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7535 - Realtek Semiconductor Corp.)
SafeZone Stable 3.55.2393.561 (x32 Version: 3.55.2393.561 - Avast Software) Hidden
Sandboxie 5.16 (64-bit) (HKLM\...\Sandboxie) (Version: 5.16 - Sandboxie Holdings, LLC)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version:  - Microsoft) Hidden
Skype™ 7.6 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.6.105 - Skype Technologies S.A.)
Soda PDF Desktop Asian Fonts Pack (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Convert Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Create Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Edit Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Forms Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Insert Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop OCR Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Review Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Secure Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop View Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
South Park Der Stab der Wahrheit Incl. Ultimate Fellowship Pack MULTI-2 1.00 (HKLM-x32\...\South Park Der Stab der Wahrheit Incl. Ultimate Fellowship Pack MULTI-2 1.00) (Version:  - )
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Spotify (HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Spotify) (Version: 1.0.50.41368.gbd68dbef - Spotify AB)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
SumatraPDF (HKLM-x32\...\SumatraPDF) (Version: 3.0 - Krzysztof Kowalczyk)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.19 - TeamSpeak Systems GmbH)
Tenable Nessus (x64) (HKLM\...\{BD1A3F84-26A0-4B77-9441-A25A9456D05D}) (Version: 6.10.2.20085 - Tenable Network Security, Inc.)
The Elder Scrolls V Skyrim Total Conversion Enderal Edition 1.0.0.9 (HKLM-x32\...\The Elder Scrolls V Skyrim Total Conversion Enderal Edition 1.0.0.9) (Version:  - )
The Swapper (HKLM\...\Steam App 231160) (Version:  - Olli Harjola, Otto Hantula, Tom Jubert, Carlo Castellano)
The Talos Principle MULTi12 244371 (HKLM-x32\...\The Talos Principle MULTi12 244371) (Version:  - )
The Witness MULTi2 1.0 (HKLM-x32\...\The Witness MULTi2 1.0) (Version:  - )
The Witness Update 3 MULTi2 1.0 (HKLM-x32\...\The Witness Update 3 MULTi2 1.0) (Version:  - )
Transmissions: Element 120 (HKLM\...\Steam App 365300) (Version:  - Shokunin)
Update for Skype for Business 2015 (KB3039776) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{5D2260D6-DB16-41DC-915B-A39BF4F66362}) (Version:  - Microsoft)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: 5.4.7.0 - Elaborate Bytes)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.4 - VideoLAN)
VMware Player (HKLM-x32\...\VMware_Player) (Version: 6.0.7 - VMware, Inc)
VMware Player (Version: 6.0.7 - VMware, Inc.) Hidden
WinRAR 5.40 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
Wise Registry Cleaner 9.41 (HKLM-x32\...\Wise Registry Cleaner_is1) (Version: 9.41 - WiseCleaner.com, Inc.)
XMind 7 (Update 1) (v3.6.1) (HKLM-x32\...\XMind_is1) (Version: 3.6.1.201512240104 - XMind Ltd.)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001_Classes\CLSID\{CB492AF1-2CEF-4E58-BE47-471C77D0C8BA}\InprocServer32 -> C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\psuser_64.dll (Google Inc.)

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {05866645-3760-4F4E-BC6C-3BBDEDFB310F} - System32\Tasks\AMD Updater => C:\Program Files\AMD\CIM\\Bin64\InstallManagerApp.exe [2016-02-26] (Advanced Micro Devices, Inc.)
Task: {05C0574D-989C-4495-8DE8-D6246D77AF3C} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {12154CA5-8F42-4B2F-A33E-3A02C98490B3} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {1BFBFA70-D3C6-4DB6-A3D3-6A34F0996C8F} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001Core => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe [2015-03-26] (Google Inc.)
Task: {1CF529C5-D29F-43AE-92FD-82A50EC964BA} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001Core1d2597b6c57f2c5 => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe [2015-03-26] (Google Inc.)
Task: {2AA358D6-9F4F-48E9-916F-1A0EDC6BE390} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {30F3058C-0415-4F77-84D4-B602143DF305} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => %SystemRoot%\System32\AutoWorkplace.exe 
Task: {377CB5EC-1FF1-4320-9889-A0AB77542A9E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-03-18] (Adobe Systems Incorporated)
Task: {3D20A507-D104-4CED-89A4-AF8E3F5AAC5C} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {41AE71CD-3633-4445-9DD8-8E56D5BB7919} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2017-03-18] (AVAST Software)
Task: {43B97978-A6E7-44F8-B307-9CD98822E46C} - System32\Tasks\{B009C1D4-4FB9-4DE4-AEC7-12D4889EE128} => pcalua.exe -a "F:\Life Is Strange\Binaries\Win32\LifeIsStrange.exe" -d "F:\Life Is Strange\Binaries\Win32"
Task: {4828E74B-9E89-46CC-9738-CB90DB87849F} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {4A698CF9-7317-4812-B893-2ED3C387B5BE} - System32\Tasks\WiseCleaner\WRCSkipUAC => C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe [2017-02-24] (WiseCleaner.com)
Task: {4ACAD694-0240-4765-BA30-2BC16F8E9EB3} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {4E5192E3-4E39-4011-A759-A7FC60E97131} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {56BD91C2-7935-449E-9A59-5C3704317F6F} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {57033CC7-D3A0-4EAD-A992-F3900D9707E6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2017-03-03] (Piriform Ltd)
Task: {5BC97B11-E50F-4910-B8EA-B069DA4F7BBE} - System32\Tasks\SafeZone scheduled Autoupdate 1489876984 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2017-02-15] (Avast Software)
Task: {6324C092-090C-47D8-9DC5-45B732284B97} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {75AAB113-5325-48D5-B655-732CC5E749E4} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {7996838F-3C7C-4E99-88CF-527934FEDA39} - System32\Tasks\Auto Re-Aktivierung => C:\WINDOWS\Re-Aktivierung\TriggerKMS.exe [2013-01-23] ()
Task: {838F70AE-67A7-4327-AB01-D85A7E6734B1} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {9148DF24-37DC-4805-9F26-DF5BCE9715A9} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001UA => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe [2015-03-26] (Google Inc.)
Task: {A145E2BD-13DB-446C-8821-33AC603DDDE2} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {A85DBF88-3373-427A-9A4E-5749730B3413} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {BD98A2E4-0C6E-4836-9C3D-16F4843C32DC} - System32\Tasks\Wise Registry Cleaner Schedule Task => C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe [2017-02-24] (WiseCleaner.com)
Task: {BE8DAB0C-5FAF-45A6-A5E7-BE07970E0515} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG
Task: {C2240968-5C24-4A71-816D-7A321E9E1A2F} - System32\Tasks\{DD5EF7D6-65B6-4080-B57C-5810676A3FEA} => Firefox.exe hxxp://ui.skype.com/ui/0/6.21.60.104/de/abandoninstall?page=tsBing
Task: {D7E2333E-A177-4BF2-9C9E-4A5584D13208} - System32\Tasks\Launch HTC Sync Loader => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe 
Task: {D80DA320-B7AE-4200-9C6D-6CD0EC753296} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Task: {E03FB901-52D3-453C-A2C8-E048E8DE5B75} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {E4015168-5F3B-4C32-93EC-98E3B5132F6A} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2017-03-18] (AVAST Software)
Task: {EF679536-F393-428B-947B-09BA2A858E4D} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {F56BBAD0-3E2C-46C1-AE47-78A3F2DDE496} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {F69F380B-C6CC-4E25-85D7-5A95585509AF} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001UA1d2597b6c617c32 => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe [2015-03-26] (Google Inc.)
Task: {FA1C89C0-1F9A-4401-9AE3-5C5284B8138A} - System32\Tasks\OneDrive Standalone Update Task => C:\Users\Sergio\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\OneDriveStandaloneUpdater.exe 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001Core.job => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001UA.job => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2016-07-16 12:42 - 2016-07-16 12:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-12-18 23:02 - 2016-12-09 11:29 - 02681200 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2016-12-18 23:02 - 2016-12-09 11:29 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-12-18 23:02 - 2016-12-09 11:29 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2016-09-30 08:34 - 2016-09-07 05:56 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-16 14:57 - 2016-12-21 08:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-01-16 14:57 - 2016-12-21 07:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-16 14:57 - 2016-12-21 07:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-16 14:57 - 2016-12-21 07:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-16 14:57 - 2016-12-21 07:48 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2017-01-16 14:57 - 2016-12-21 07:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-16 14:57 - 2016-12-21 07:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2017-03-13 18:23 - 2017-03-13 18:23 - 00077312 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-03-13 18:23 - 2017-03-13 18:23 - 00182784 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-03-13 18:23 - 2017-03-13 18:23 - 41048064 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-03-13 18:23 - 2017-03-13 18:23 - 02236896 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\roottools.dll
2015-06-25 16:34 - 2015-06-25 16:34 - 00014336 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick.2\qtquick2plugin.dll
2015-06-25 16:37 - 2015-06-25 16:37 - 00739840 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-06-25 16:35 - 2015-06-25 16:35 - 00014336 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Window.2\windowplugin.dll
2015-06-25 16:38 - 2015-06-25 16:38 - 00071168 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Layouts\qquicklayoutsplugin.dll
2015-06-25 15:53 - 2015-06-25 15:53 - 00011776 _____ () C:\Program Files\AMD\CNext\CNext\libEGL.dll
2015-06-25 15:51 - 2015-06-25 15:51 - 02013696 _____ () C:\Program Files\AMD\CNext\CNext\libGLESv2.dll
2017-02-27 19:37 - 2017-02-27 19:37 - 00019456 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.214.10010.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2017-02-27 19:37 - 2017-02-27 19:37 - 21149696 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.214.10010.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2017-02-27 19:37 - 2017-02-27 19:37 - 05380096 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.214.10010.0_x64__8wekyb3d8bbwe\MediaEngine.dll
2016-06-09 18:30 - 2016-06-09 18:30 - 00680448 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.214.10010.0_x64__8wekyb3d8bbwe\Microsoft.DesignCore.dll
2017-02-27 19:37 - 2017-02-27 19:37 - 00387584 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.214.10010.0_x64__8wekyb3d8bbwe\Microsoft.RichMedia.Ink.Controls.dll
2017-02-27 19:37 - 2017-02-27 19:37 - 01047552 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.214.10010.0_x64__8wekyb3d8bbwe\Microsoft.Sharing.dll
2016-03-03 17:58 - 2016-03-03 17:58 - 00291328 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.214.10010.0_x64__8wekyb3d8bbwe\StoreRatingPromotion.dll
2016-09-01 17:12 - 2016-09-01 17:12 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2017-01-13 13:56 - 2017-01-13 13:56 - 01353528 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2017-02-21 14:45 - 2017-02-21 14:45 - 00585784 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareService.exe
2017-02-21 14:50 - 2017-02-21 14:50 - 00121816 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\boost_thread-vc140-mt-1_61.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 00030680 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\boost_system-vc140-mt-1_61.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 00067544 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\boost_date_time-vc140-mt-1_61.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 00144856 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\boost_filesystem-vc140-mt-1_61.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 00733144 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\boost_log-vc140-mt-1_61.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 00524760 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\boost_locale-vc140-mt-1_61.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 00039384 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\boost_chrono-vc140-mt-1_61.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 11554264 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\rpc_server.dll
2017-02-21 14:51 - 2017-02-21 14:51 - 03712984 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\RCF.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 01000920 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\boost_regex-vc140-mt-1_61.dll
2017-02-21 14:49 - 2017-02-21 14:49 - 01142232 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareActivation.dll
2017-02-21 14:49 - 2017-02-21 14:49 - 00633816 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareApplicationUpdater.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 00843736 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareGamingMode.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 00120280 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareReset.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 00142296 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareTime.dll
2017-02-21 14:49 - 2017-02-21 14:49 - 01024472 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareDefinitionsUpdater.dll
2017-02-21 14:49 - 2017-02-21 14:49 - 00906712 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareDefinitionsUpdaterScheduler.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 01468376 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareIgnoreList.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 00261080 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareQuarantine.dll
2017-02-21 14:49 - 2017-02-21 14:49 - 01652184 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareAntiMalwareEngine.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 01194456 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareScannerHistory.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 01553880 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareScanner.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 00039384 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\boost_timer-vc140-mt-1_61.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 01032152 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareScannerScheduler.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 01183192 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareRealTimeProtection.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 02887640 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareIncompatibles.dll
2017-02-21 14:49 - 2017-02-21 14:49 - 01525208 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareAntiSpam.dll
2017-02-21 14:49 - 2017-02-21 14:49 - 01456600 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareAntiPhishing.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 03464664 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareParentalControl.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 01653720 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareWebProtection.dll
2017-02-21 14:49 - 2017-02-21 14:49 - 01598936 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareEmailProtection.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 00073176 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\boost_iostreams-vc140-mt-1_61.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 01712088 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareNetworkProtection.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 01067480 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwarePromo.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 00475096 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareFeedback.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 03166168 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareThreatWorkAlliance.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 00667096 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwarePinCode.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 01069528 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareNotice.dll
2017-02-21 14:49 - 2017-02-21 14:49 - 01598424 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareAvcEngine.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 01496536 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareRealTimeProtectionHistory.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 00774104 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareStatistics.dll
2017-02-21 14:50 - 2017-02-21 14:50 - 04461016 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareTray.exe
2017-02-21 14:50 - 2017-02-21 14:50 - 11717592 _____ () C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\rpc_client.dll
2016-07-16 12:42 - 2016-07-16 12:42 - 01872384 _____ () C:\Windows\System32\speech_onecore\engines\tts\MSTTSEngine_OneCore.dll
2015-06-24 14:28 - 2015-06-24 14:28 - 01301720 _____ () C:\Program Files (x86)\VMware\VMware Player\libxml2.dll
2016-10-31 17:45 - 2016-10-31 17:45 - 00148664 _____ () C:\Program Files (x86)\Evernote\Evernote\zlibwapi.dll
2016-10-31 17:45 - 2016-10-31 17:45 - 26137272 _____ () C:\Program Files (x86)\Evernote\Evernote\libcef.dll
2016-10-31 17:45 - 2016-10-31 17:45 - 00212664 _____ () C:\Program Files (x86)\Evernote\Evernote\websockets.dll
2016-10-31 17:45 - 2016-10-31 17:45 - 00321208 _____ () C:\Program Files (x86)\Evernote\Evernote\libtidy.dll
2016-10-31 17:17 - 2016-10-31 17:17 - 00740352 _____ () C:\Program Files (x86)\Evernote\Evernote\libglesv2.dll
2016-10-31 17:17 - 2016-10-31 17:17 - 00130048 _____ () C:\Program Files (x86)\Evernote\Evernote\libegl.dll
2017-03-18 23:41 - 2017-03-18 23:41 - 00170216 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2017-03-18 23:41 - 2017-03-18 23:41 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2017-03-18 23:40 - 2017-03-18 23:40 - 00290352 _____ () C:\Program Files\AVAST Software\Avast\gaming_mode_ui.dll
2017-03-18 23:41 - 2017-03-18 23:41 - 00655056 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2017-03-19 01:07 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2017-03-19 01:07 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2017-03-19 01:07 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2017-03-19 01:07 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2017-03-19 01:07 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)

AlternateDataStreams: C:\Users\Sergio\Desktop\2014-06-09 12.36.44.jpg:com.dropbox.attributes [912]
AlternateDataStreams: C:\Users\Sergio\Desktop\2014-06-09 12.41.14.jpg:com.dropbox.attributes [225]

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\adawareantivirusservice => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\adawareantivirusservice => ""="Service"

==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE trusted site: HKU\.DEFAULT\...\localhost -> localhost
IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com
IE trusted site: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\localhost -> localhost

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2013-08-22 14:25 - 2016-12-13 20:23 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\AvGeneric_S-1-5-21-1478414814-3749218601-3539646535-1007\Control Panel\Desktop\\Wallpaper -> 
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Sergio\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\img2.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

HKLM\...\StartupApproved\StartupFolder: => "Audible Download Manager.lnk"
HKLM\...\StartupApproved\StartupFolder: => "FocalFilterHelper.lnk"
HKLM\...\StartupApproved\Run: => "RTHDVCPL"
HKLM\...\StartupApproved\Run: => "iTunesHelper"
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKLM\...\StartupApproved\Run: => "StartCN"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "Razer Synapse"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "VirtualCloneDrive"
HKLM\...\StartupApproved\Run32: => "Raptr"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\StartupFolder: => "An OneNote senden.lnk"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\StartupFolder: => "EvernoteClipper.lnk"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\Run: => "Spotify Web Helper"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\Run: => "Google Update"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\Run: => "adaware browser dock"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\Run: => "Ad-Aware Search Companion"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{4C815F25-BA44-4DF0-A139-B4513592AB11}] => (Allow) E:\Programme\Steam\SteamApps\common\Transmissions Element 120\hl2.exe
FirewallRules: [{4AF4DBE9-2A28-45E8-A394-CF9DDBF7E046}] => (Allow) E:\Programme\Steam\SteamApps\common\Transmissions Element 120\hl2.exe
FirewallRules: [{47A0FAEC-0EED-465B-B623-8E03A2EF9F4A}] => (Allow) E:\Programme\Steam\SteamApps\common\The Swapper\TheSwapper.exe
FirewallRules: [{32189D55-9C1C-46C4-B9DB-0392B2032C1D}] => (Allow) E:\Programme\Steam\SteamApps\common\The Swapper\TheSwapper.exe
FirewallRules: [{23A94911-6B0C-4AD2-9CF3-1E3C4DF42CEF}] => (Allow) E:\Programme\Steam\SteamApps\common\Source SDK Base\hl2.exe
FirewallRules: [{14CD92EA-C74F-46A5-8AE1-1256A02B73B5}] => (Allow) E:\Programme\Steam\SteamApps\common\Source SDK Base\hl2.exe
FirewallRules: [{9A299CDF-8BB6-4808-855F-F7C6CFD167A7}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{6675D4DE-F544-4B9B-A575-E6846DD19E20}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{B0C6423F-1101-4D9A-8753-70A726AF5D5C}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{87D07077-0624-4F4D-900A-D386616BC2AD}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{009303E8-3CA0-4E1E-820F-CDE4AD59A1D6}] => (Block) C:\users\sergio\appdata\local\google\chrome\application\chrome.exe
FirewallRules: [{1855B2DC-993E-44BF-B82A-82A401F84346}] => (Block) C:\users\sergio\appdata\local\google\chrome\application\chrome.exe
FirewallRules: [UDP Query User{B08CCC1D-249D-415A-8AF7-DFE695CC02A4}C:\users\sergio\appdata\local\google\chrome\application\chrome.exe] => (Allow) C:\users\sergio\appdata\local\google\chrome\application\chrome.exe
FirewallRules: [TCP Query User{92FC82E6-BB8B-4FDB-BB0C-D66610CC6E81}C:\users\sergio\appdata\local\google\chrome\application\chrome.exe] => (Allow) C:\users\sergio\appdata\local\google\chrome\application\chrome.exe
FirewallRules: [UDP Query User{584B85C8-235C-45FB-9319-87EF691E539D}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{33DFD8A9-855F-4E8B-90E4-926E8A79B917}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{65CD0DC4-573A-4AB2-A279-A06DDCD94042}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{9B5CB91F-B20C-496F-8460-B7BE1F4AFC7B}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{CDB31AB7-B993-4463-991F-B3EB167A3E23}] => (Block) C:\users\sergio\appdata\roaming\spotify\spotify.exe
FirewallRules: [{85CE2457-1383-4B34-BC70-5CA7C0BC5A85}] => (Block) C:\users\sergio\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{18FD3C22-8C57-4B91-97BC-F02E9C848220}C:\users\sergio\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\sergio\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{0D0FB75B-A70C-402D-A16F-3513F8A6413B}C:\users\sergio\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\sergio\appdata\roaming\spotify\spotify.exe
FirewallRules: [{582F26A3-1FAD-42CB-BFB8-DB77E40EC5A5}] => (Allow) LPort=5432
FirewallRules: [{9E7793F6-2CCD-44F1-8D81-F075D049DDB3}] => (Block) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [{CAEB2973-36B7-4F35-A65A-7C4651A0FA4A}] => (Block) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [UDP Query User{7F4C7349-2C86-498A-86FB-BC98B46CEB17}C:\program files\videolan\vlc\vlc.exe] => (Allow) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [TCP Query User{24433994-3951-43D1-84CA-58C7E56D128C}C:\program files\videolan\vlc\vlc.exe] => (Allow) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [{896305FD-B8F2-4767-A7D4-AF7AE2FC10A1}] => (Allow) E:\Programme\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{ED008F0A-3699-49D8-BB63-729B1FEBE9C5}] => (Allow) E:\Programme\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{1DBD2A9C-E0C4-4A62-82B9-695C77AC5539}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{A1280161-B9C7-48B9-9966-18A895246AC7}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [UDP Query User{B6018279-DBCC-44F5-A85B-7F0E7FD3C508}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{C60CA2E5-E012-46D7-A014-68EB519DEC77}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{BA017C2C-61FD-4A8E-9A4B-B19C5F76EC42}C:\program files\comicrack\comicrack.exe] => (Allow) C:\program files\comicrack\comicrack.exe
FirewallRules: [TCP Query User{8A02E307-EB1C-4D12-882F-FF81FACC0914}C:\program files\comicrack\comicrack.exe] => (Allow) C:\program files\comicrack\comicrack.exe
FirewallRules: [UDP Query User{A26D4721-8F6B-4D4A-B429-722CF1A9DDF4}C:\program files\comicrack\comicrack.exe] => (Allow) C:\program files\comicrack\comicrack.exe
FirewallRules: [TCP Query User{B9867C9B-0E8C-4B86-8DD7-AB4AD89674A9}C:\program files\comicrack\comicrack.exe] => (Allow) C:\program files\comicrack\comicrack.exe
FirewallRules: [UDP Query User{0DE25D3A-A50D-4640-A918-C97C3D1E4E4F}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{B46581C9-E59C-4D84-BFB1-6C9C1CF619D5}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{3D1D317E-92BE-4AD7-AE40-DCEF97EE6F30}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{DCDF178F-94BA-423C-93AF-32ABA338F5B2}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{3BFDC46F-7EF3-4D7B-BADF-37C1CD73DBA8}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{71A620CB-4170-4016-8DE5-6BD6C5B280BA}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{51E9595D-0B58-445E-8FF9-D91A0E2B56C3}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{89FA8679-D274-40D5-8BCA-C4F7FAECC288}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{17602036-2F09-45C4-96DE-81E103792C0C}C:\program files (x86)\xmind\xmind.exe] => (Allow) C:\program files (x86)\xmind\xmind.exe
FirewallRules: [UDP Query User{47B0516F-37FD-411C-ABF4-31E6FF92ABAE}C:\program files (x86)\xmind\xmind.exe] => (Allow) C:\program files (x86)\xmind\xmind.exe
FirewallRules: [{E2AFCA20-7814-40F8-A2E4-A56B54B2B703}] => (Block) C:\program files (x86)\xmind\xmind.exe
FirewallRules: [{FFE14415-8CB9-46A2-93AE-FCA222B3FEB6}] => (Block) C:\program files (x86)\xmind\xmind.exe
FirewallRules: [{DF131065-E096-470C-B6C4-0BDC3B7AD887}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{39AA17E3-BFDE-40D5-9EB3-CC8F488F2791}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{C462C04B-0D25-49B1-BF38-97DB80556660}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{1317C778-FF74-44DB-B012-C987FF732B42}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [TCP Query User{C665D105-55D0-4485-9F8F-98BFAFC4277A}C:\program files (x86)\jetbrains\pycharm community edition 2016.3.2\bin\pycharm.exe] => (Allow) C:\program files (x86)\jetbrains\pycharm community edition 2016.3.2\bin\pycharm.exe
FirewallRules: [UDP Query User{89F44F37-EE89-49AC-9CF0-D7A984CC4463}C:\program files (x86)\jetbrains\pycharm community edition 2016.3.2\bin\pycharm.exe] => (Allow) C:\program files (x86)\jetbrains\pycharm community edition 2016.3.2\bin\pycharm.exe
FirewallRules: [{FCA6B532-4E95-469C-95E1-E58DA1577D22}] => (Block) C:\program files (x86)\jetbrains\pycharm community edition 2016.3.2\bin\pycharm.exe
FirewallRules: [{8DB45E81-EE46-454C-9C3B-8822B06D4867}] => (Block) C:\program files (x86)\jetbrains\pycharm community edition 2016.3.2\bin\pycharm.exe
FirewallRules: [{646A70D8-16BB-4ADD-8797-DF653A94BB69}] => (Allow) C:\Program Files\AVAST Software\SZBrowser\3.55.2393.561\SZBrowser.exe
FirewallRules: [{87A747CA-FD99-4796-8585-B3AE0E5C1AFE}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{2A3FF431-1752-43AF-8AD1-087AA8AB8B45}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{F7438A7F-5156-4022-A304-F2ED32707A1D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{1D667304-E1AC-41D7-AE98-239DD24636D3}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{94A6CFFB-2252-4515-94E5-28245AD1CBF7}] => (Allow) C:\Program Files\iTunes\iTunes.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service

==================== Wiederherstellungspunkte =========================

ACHTUNG: Systemwiederherstellung ist deaktiviert

==================== Fehlerhafte Geräte im Gerätemanager =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (03/19/2017 12:00:09 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: microsoftedgecp.exe, Version: 11.0.14393.82, Zeitstempel: 0x57a55786
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000604
Fehleroffset: 0x0000000000000000
ID des fehlerhaften Prozesses: 0x2a9c
Startzeit der fehlerhaften Anwendung: 0x01d2a03b629d3174
Pfad der fehlerhaften Anwendung: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
Pfad des fehlerhaften Moduls: unknown
Berichtskennung: e1005bb4-b07d-4cfd-a84f-5673e4768a0d
Vollständiger Name des fehlerhaften Pakets: Microsoft.MicrosoftEdge_38.14393.0.0_neutral__8wekyb3d8bbwe
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: MicrosoftEdge

Error: (03/19/2017 12:00:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: microsoftedgecp.exe, Version: 11.0.14393.82, Zeitstempel: 0x57a55786
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000604
Fehleroffset: 0x0000000000000000
ID des fehlerhaften Prozesses: 0x2a9c
Startzeit der fehlerhaften Anwendung: 0x01d2a03b629d3174
Pfad der fehlerhaften Anwendung: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
Pfad des fehlerhaften Moduls: unknown
Berichtskennung: 1502f4c6-37e3-4962-9115-0c4bb8d94caf
Vollständiger Name des fehlerhaften Pakets: Microsoft.MicrosoftEdge_38.14393.0.0_neutral__8wekyb3d8bbwe
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: MicrosoftEdge

Error: (03/18/2017 11:58:52 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/18/2017 11:48:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 42.0.0.5780, Zeitstempel: 0x5632d0a4
Name des fehlerhaften Moduls: mozglue.dll, Version: 42.0.0.5780, Zeitstempel: 0x5632ba58
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000ed50
ID des fehlerhaften Prozesses: 0x1784
Startzeit der fehlerhaften Anwendung: 0x01d2a036e51d7f29
Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
Pfad des fehlerhaften Moduls: C:\Program Files (x86)\Mozilla Firefox\mozglue.dll
Berichtskennung: e823e1c5-594e-4361-be5e-c0c8886034cd
Vollständiger Name des fehlerhaften Pakets: 
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (03/18/2017 11:42:00 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\AVAST Software\Avast\setup\iplugins\IStats.dll".
Die abhängige Assemblierung "Avast.VC110.CRT,processorArchitecture="x86",publicKeyToken="2036b14a11e83e4a",type="win32",version="11.0.60610.1"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (03/18/2017 09:58:00 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/18/2017 09:12:47 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/18/2017 09:00:04 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Event-ID 0

Error: (03/18/2017 12:21:03 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: Die Open-Prozedur für den Dienst "BITS" in der DLL "C:\Windows\System32\bitsperf.dll" war nicht erfolgreich. Die Leistungsdaten für diesen Dienst sind nicht verfügbar. Die ersten vier Bytes (DWORD) des Datenbereichs enthalten den Fehlercode.

Error: (03/17/2017 11:57:42 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.


Systemfehler:
=============
Error: (03/19/2017 12:39:10 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Soda PDF Desktop Creator" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/19/2017 12:38:19 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (03/18/2017 11:43:40 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (03/18/2017 11:41:20 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (03/18/2017 10:53:29 PM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: Der Dienst "chip 1-click download service" hat einen ungültigen aktuellen Status gemeldet: 0

Error: (03/18/2017 10:53:29 PM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: Der Dienst "chip 1-click download service" hat einen ungültigen aktuellen Status gemeldet: 0

Error: (03/18/2017 10:51:49 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (03/18/2017 09:15:28 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: Der Server "{784E29F4-5EBE-4279-9948-1E8FE941646D}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (03/18/2017 09:12:28 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 und der APPID 
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (03/18/2017 01:05:16 AM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 5


CodeIntegrity:
===================================
  Date: 2017-03-18 00:15:51.902
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-03-08 20:41:44.737
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-03-07 16:07:59.583
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-03-05 12:03:31.285
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-03-03 17:01:58.393
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-03-01 22:16:13.030
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-02-28 23:26:03.401
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-02-28 12:36:19.913
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-02-04 18:13:32.823
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-01-25 14:45:21.281
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Speicherinformationen =========================== 

Prozessor: AMD Phenom(tm) II X4 945 Processor
Prozentuale Nutzung des RAM: 31%
Installierter physikalischer RAM: 16383.17 MB
Verfügbarer physikalischer RAM: 11175.08 MB
Summe virtueller Speicher: 18815.17 MB
Verfügbarer virtueller Speicher: 13238.09 MB

==================== Laufwerke ================================

Drive c: () (Fixed) (Total:100.21 GB) (Free:2.2 GB) NTFS
Drive d: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive e: () (Fixed) (Total:931.41 GB) (Free:44.85 GB) NTFS
Drive f: () (Fixed) (Total:156.25 GB) (Free:30.61 GB) NTFS
Drive h: () (Fixed) (Total:100 GB) (Free:99.68 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: FEBD6380)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: 01EE8E42)
Partition 1: (Not Active) - (Size=100.2 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=450 MB) - (Type=27)

========================================================
Disk: 2 (Size: 335.4 GB) (Disk ID: F261F55D)
Partition 1: (Active) - (Size=100 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=156.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=79.1 GB) - (Type=05)

==================== Ende von Addition.txt ============================
         

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 15-03-2017
durchgeführt von Sergio (Administrator) auf SERGIOS-PC (19-03-2017 01:43:45)
Gestartet von E:\Internet Downloads
Geladene Profile: Sergio (Verfügbare Profile: Sergio & postgres)
Platform: Windows 10 Pro Version 1607 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
(Tenable Network Security, Inc) C:\Program Files\Tenable\Nessus\nessus-service.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(Tenable Network Security, Inc) C:\Program Files\Tenable\Nessus\nessusd.exe
(AMD) C:\Windows\System32\atieclxx.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\cnext.exe
(Flux Software LLC) C:\Users\Sergio\AppData\Local\FluxSoftware\Flux\flux.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.214.10010.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\Evernote.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteTray.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
(Krzysztof Kowalczyk) C:\Program Files (x86)\SumatraPDF\SumatraPDF.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Chip Digital GmbH) C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(AVAST Software s.r.o.) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
() C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareService.exe
() C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareTray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe

==================== Registry (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8492800 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\cnext.exe [4926664 2016-02-26] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2016-09-07] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176440 2017-01-19] (Apple Inc.)
HKLM\...\Run: [AdAwareTray] => C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareTray.exe [4461016 2017-02-21] ()
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [205512 2017-03-18] (AVAST Software)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1160408 2016-12-17] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\AvGeneric_S-1-5-21-1478414814-3749218601-3539646535-1007\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [516608 2016-07-16] (Microsoft Corporation)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [Spotify Web Helper] => C:\Users\Sergio\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1446000 2017-03-11] (Spotify Ltd)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [Google Update] => C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\GoogleUpdateCore.exe [601752 2016-12-18] (Google Inc.)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [f.lux] => C:\Users\Sergio\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9364696 2017-03-03] (Piriform Ltd)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [799376 2016-12-14] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\MountPoints2: {b52f257e-9541-11e6-82b3-485b39c9a198} - "K:\HiSuiteDownLoader.exe" 
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-03-18] (AVAST Software)
ShellIconOverlayIdentifiers: [00ExpanDriveExt1] -> {C955792B-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [00ExpanDriveExt2] -> {C955792C-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [00ExpanDriveExt1] -> {C955792B-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [00ExpanDriveExt2] -> {C955792C-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Audible Download Manager.lnk [2015-05-07]
ShortcutTarget: Audible Download Manager.lnk -> C:\Program Files (x86)\Audible\Bin\AudibleDownloadHelper.exe (Keine Datei)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FocalFilterHelper.lnk [2016-02-26]
ShortcutTarget: FocalFilterHelper.lnk -> C:\Program Files (x86)\FocalFilter\FocalFilterHelper.exe (Microsoft)
Startup: C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2015-08-09]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2016-04-20]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BootExecute: autocheck autochk * sdnclean64.exe
GroupPolicy\User: Beschränkung <======= ACHTUNG

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{65462354-7EE1-4401-902C-4D58B7DBDA87}: [DhcpNameServer] 7.254.254.254
Tcpip\..\Interfaces\{8c608b9e-9074-4d1b-b1db-702840d39f03}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{aa6288ab-a4c6-4734-8fa6-9d9b694d76cd}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.com/?bcutc=sp-006
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\AvGeneric_S-1-5-21-1478414814-3749218601-3539646535-1007 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_121\bin\ssv.dll [2017-03-18] (Oracle Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-03-18] (Oracle Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2016-10-31] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2016-05-17] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default [2017-03-19]
FF NewTab: Mozilla\Firefox\Profiles\0fihcjle.default -> about:newtab
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\0fihcjle.default -> Google
FF DefaultSearchUrl: Mozilla\Firefox\Profiles\0fihcjle.default -> hxxps://www.google.com/search?bcutc=sp-006
FF SearchEngineOrder.1: Mozilla\Firefox\Profiles\0fihcjle.default -> Google
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\0fihcjle.default -> Google
FF Homepage: Mozilla\Firefox\Profiles\0fihcjle.default -> hxxps://www.google.com/?bcutc=sp-006
FF Keyword.URL: Mozilla\Firefox\Profiles\0fihcjle.default -> hxxps://www.google.com/search?bcutc=sp-006
FF Extension: (BeeLine Reader) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\beelinereader-firefox@beelinereader.com.xpi [2016-03-08]
FF Extension: (FoxyProxy Standard) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\foxyproxy@eric.h.jung [2017-02-07]
FF Extension: (convert2mp3.net YouTube2MP3 Converter) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\info@convert2mp3.net.xpi [2016-12-15]
FF Extension: (pdf updater) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{34840d80-0446-4a42-83ce-5c0fa22cd4e3}.xpi [2016-05-18] [ist nicht signiert]
FF Extension: (NoScript) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2016-08-13]
FF Extension: (LeechBlock) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{a95d8332-e4b4-6e7f-98ac-20b733364387} [2017-01-22]
FF Extension: (Adblock Plus) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-24]
FF Extension: (DownThemAll!) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2016-04-15]
FF SearchPlugin: C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\searchplugins\google-avast.xml [2017-03-18]
FF HKLM\...\Firefox\Extensions: [soda_pdf_desktop_conv@sodapdf.com] - C:\Program Files\Soda PDF Desktop\resources\sodapdfdesktopfirefoxextension => nicht gefunden
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_25_0_0_127.dll [2017-03-18] ()
FF Plugin: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-03-18] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-03-18] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50905.0\npctrl.dll [2017-02-10] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_25_0_0_127.dll [2017-03-18] ()
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-07-19] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50905.0\npctrl.dll [2017-02-10] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2016-12-17] (Adobe Systems Inc.)
FF Plugin-x32: Soda PDF Desktop -> C:\Program Files (x86)\Soda PDF Desktop\np-previewer.dll [2016-10-21] (LULU SOFTWARE LIMITED)
FF Plugin HKU\S-1-5-21-1478414814-3749218601-3539646535-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-18] (Google Inc.)
FF Plugin HKU\S-1-5-21-1478414814-3749218601-3539646535-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-18] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2016-07-19] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-12-17] (Adobe Systems Inc.)

Chrome: 
=======
CHR DefaultProfile: Default
CHR Profile: C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default [2017-03-18]
CHR Extension: (Google Präsentationen) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-03-26]
CHR Extension: (Google Docs) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-03-26]
CHR Extension: (Google Drive) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-03-11]
CHR Extension: (YouTube) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-03-11]
CHR Extension: (Google-Suche) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-03-11]
CHR Extension: (Google Tabellen) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-03-26]
CHR Extension: (Google Docs Offline) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-21]
CHR Extension: (AMZ Seller Browser) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\klgpelgeohjghmccooegimcfhanlnngc [2016-05-09]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-12]
CHR Extension: (Google Mail) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-01]
CHR Extension: (Chrome Media Router) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-03-11]

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 adawareantivirusservice; C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareService.exe [585784 2017-02-21] ()
R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-08-04] (Advanced Micro Devices, Inc.) [Datei ist nicht signiert]
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)
R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7147320 2017-03-18] (AVAST Software s.r.o.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [262736 2017-03-18] (AVAST Software)
R2 chip1click; C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe [91136 2016-10-27] (Chip Digital GmbH) [Datei ist nicht signiert]
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [197776 2016-12-14] (Sandboxie Holdings, LLC)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [4088608 2016-09-21] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [235984 2016-11-24] (Safer-Networking Ltd.)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-09-15] (Microsoft Corporation)
R2 Tenable Nessus; C:\Program Files\Tenable\Nessus\nessus-service.exe [17376 2017-02-15] (Tenable Network Security, Inc)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
S3 Soda PDF Desktop; "C:\Program Files\Soda PDF Desktop\ws.exe" [X]
S3 Soda PDF Desktop CrashHandler; "C:\Program Files\Soda PDF Desktop\crash-handler-ws.exe" [X]
S2 Soda PDF Desktop Creator; "C:\Program Files\Soda PDF Desktop\creator-ws.exe" [X]

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S0 amdkmafd; C:\WINDOWS\System32\drivers\amdkmafd.sys [23240 2016-02-26] (Advanced Micro Devices, Inc.)
R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R1 aswbidsdriver; C:\WINDOWS\system32\drivers\aswbidsdrivera.sys [309272 2017-03-18] (AVAST Software s.r.o.)
R0 aswbidsh; C:\WINDOWS\system32\drivers\aswbidsha.sys [189768 2017-03-18] (AVAST Software s.r.o.)
R0 aswblog; C:\WINDOWS\system32\drivers\aswbloga.sys [334600 2017-03-18] (AVAST Software s.r.o.)
R0 aswbuniv; C:\WINDOWS\system32\drivers\aswbuniva.sys [48528 2017-03-18] (AVAST Software s.r.o.)
S3 aswHwid; C:\WINDOWS\system32\drivers\aswHwid.sys [38296 2017-03-18] (AVAST Software)
R1 aswKbd; C:\WINDOWS\system32\drivers\aswKbd.sys [32088 2017-03-18] (AVAST Software)
R2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [126600 2017-03-18] (AVAST Software)
R1 aswRdr; C:\WINDOWS\system32\drivers\aswRdr2.sys [100640 2017-03-18] (AVAST Software)
S0 aswRvrt; C:\WINDOWS\system32\drivers\aswRvrt.sys [75704 2017-03-18] (AVAST Software)
R1 aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [993608 2017-03-18] (AVAST Software)
R1 aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [548928 2017-03-18] (AVAST Software)
R2 aswStm; C:\WINDOWS\system32\drivers\aswStm.sys [162528 2017-03-18] (AVAST Software)
R0 aswVmm; C:\WINDOWS\system32\drivers\aswVmm.sys [337592 2017-03-18] (AVAST Software)
R3 AtiHDAudioService; C:\WINDOWS\system32\drivers\AtihdWT6.sys [102400 2016-02-26] (Advanced Micro Devices)
S3 HTCAND64; C:\WINDOWS\System32\Drivers\ANDROIDUSB.sys [33736 2009-11-02] (HTC, Corporation) [Datei ist nicht signiert]
S3 HtcVCom32; C:\WINDOWS\system32\DRIVERS\HtcVComV64.sys [121800 2010-03-09] (QUALCOMM Incorporated) [Datei ist nicht signiert]
R3 MTsensor; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [17280 2013-05-17] ()
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [589824 2016-07-16] (Realtek                                            )
S3 RtlWlanu_OldIC; C:\WINDOWS\System32\drivers\rtwlanu_oldIC.sys [3814400 2016-07-16] (Realtek Semiconductor Corporation                           )
S3 rzdaendpt; C:\WINDOWS\System32\drivers\rzdaendpt.sys [33448 2014-09-05] (Razer Inc)
S3 rzvkeyboard; C:\WINDOWS\System32\drivers\rzvkeyboard.sys [31912 2014-09-05] (Razer Inc)
S3 SaiK0728; C:\WINDOWS\system32\DRIVERS\SaiK0728.sys [129024 2008-01-21] (Saitek)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [205968 2016-12-14] (Sandboxie Holdings, LLC)
S3 Trufos; C:\WINDOWS\System32\DRIVERS\Trufos.sys [442848 2017-02-08] (BitDefender S.R.L.)
R1 VBoxNetAdp; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys [131144 2017-01-16] (Oracle Corporation)
R1 VBoxNetLwf; C:\WINDOWS\system32\DRIVERS\VBoxNetLwf.sys [205440 2017-01-16] (Oracle Corporation)
R0 vsock; C:\WINDOWS\System32\drivers\vsock.sys [73296 2013-10-08] (VMware, Inc.)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
U3 DfSdkS; kein ImagePath

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-03-19 01:43 - 2017-03-19 01:43 - 00000000 ____D C:\FRST
2017-03-19 01:12 - 2017-03-19 01:12 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\adaware
2017-03-19 01:12 - 2017-03-19 01:12 - 00000000 ____D C:\Users\Sergio\AppData\Local\AdAwareDesktop
2017-03-19 01:11 - 2017-03-19 01:11 - 00002416 _____ C:\Users\Public\Desktop\adaware antivirus.lnk
2017-03-19 01:11 - 2017-03-19 01:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\adaware
2017-03-19 01:11 - 2017-03-19 01:11 - 00000000 ____D C:\Program Files\adaware
2017-03-19 01:10 - 2017-03-19 01:10 - 00000000 ____D C:\Users\Sergio\AppData\Local\AdAwareUpdater
2017-03-19 01:10 - 2017-03-19 01:10 - 00000000 ____D C:\Program Files\Common Files\adaware
2017-03-19 01:09 - 2017-03-19 01:09 - 00000000 ____D C:\ProgramData\adaware
2017-03-19 01:07 - 2017-03-19 01:32 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2017-03-19 01:07 - 2017-03-19 01:07 - 00001464 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2017-03-19 01:07 - 2017-03-19 01:07 - 00001452 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2017-03-19 01:07 - 2017-03-19 01:07 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2017-03-19 01:07 - 2017-03-19 01:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2017-03-19 01:07 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean64.exe
2017-03-19 01:05 - 2017-03-19 01:06 - 00001748 _____ C:\WINDOWS\Sandboxie.ini
2017-03-19 01:05 - 2017-03-19 01:04 - 00000955 _____ C:\Users\Sergio\Desktop\Sandboxed Web Browser.lnk
2017-03-19 01:04 - 2017-03-19 01:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2017-03-19 01:04 - 2017-03-19 01:04 - 00000000 ____D C:\Program Files\Sandboxie
2017-03-19 01:02 - 2017-03-19 01:02 - 00000000 ___HD C:\$SysReset
2017-03-19 01:02 - 2017-03-19 01:02 - 00000000 ____D C:\WINDOWS\Panther
2017-03-19 00:06 - 2017-03-19 00:06 - 00217088 _____ C:\Users\postgres\NTUSER.rhk
2017-03-19 00:03 - 2017-03-19 00:03 - 00015836 _____ C:\Users\Sergio\Documents\cc_20170319_000336.reg
2017-03-18 23:51 - 2017-03-18 23:51 - 00001822 _____ C:\Users\Public\Desktop\iTunes.lnk
2017-03-18 23:51 - 2017-03-18 23:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2017-03-18 23:50 - 2017-03-18 23:51 - 00000000 ____D C:\Program Files\iTunes
2017-03-18 23:50 - 2017-03-18 23:50 - 00000000 ____D C:\Program Files\iPod
2017-03-18 23:49 - 2017-03-18 23:49 - 00000000 ____D C:\Program Files\Bonjour
2017-03-18 23:49 - 2017-03-18 23:49 - 00000000 ____D C:\Program Files (x86)\Bonjour
2017-03-18 23:43 - 2017-03-18 23:43 - 00004034 _____ C:\WINDOWS\System32\Tasks\SafeZone scheduled Autoupdate 1489876984
2017-03-18 23:43 - 2017-03-18 23:43 - 00001088 _____ C:\Users\Public\Desktop\Avast SafeZone Browser.lnk
2017-03-18 23:43 - 2017-03-18 23:43 - 00001088 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast SafeZone Browser.lnk
2017-03-18 23:42 - 2017-03-18 23:42 - 00032088 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswKbd.sys
2017-03-18 23:42 - 2017-03-18 23:42 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\AVAST Software
2017-03-18 23:41 - 2017-03-18 23:41 - 00548928 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswsp.sys
2017-03-18 23:41 - 2017-03-18 23:41 - 00547904 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswsp.sys.148987690906204
2017-03-18 23:41 - 2017-03-18 23:41 - 00398408 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2017-03-18 23:41 - 2017-03-18 23:41 - 00337592 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswvmm.sys.148987691079606
2017-03-18 23:41 - 2017-03-18 23:41 - 00337592 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswvmm.sys
2017-03-18 23:41 - 2017-03-18 23:41 - 00162528 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2017-03-18 23:41 - 2017-03-18 23:41 - 00126600 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2017-03-18 23:41 - 2017-03-18 23:41 - 00100640 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2017-03-18 23:41 - 2017-03-18 23:41 - 00075704 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRvrt.sys
2017-03-18 23:41 - 2017-03-18 23:41 - 00038296 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHwid.sys
2017-03-18 23:41 - 2017-03-18 23:41 - 00003994 _____ C:\WINDOWS\System32\Tasks\Avast Emergency Update
2017-03-18 23:41 - 2017-03-18 23:41 - 00001979 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Free Antivirus.lnk
2017-03-18 23:41 - 2017-03-18 23:41 - 00001967 _____ C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2017-03-18 23:41 - 2017-03-18 23:41 - 00000000 ____D C:\WINDOWS\System32\Tasks\AVAST Software
2017-03-18 23:41 - 2017-03-18 23:41 - 00000000 ____D C:\Program Files\Common Files\AV
2017-03-18 23:41 - 2017-03-18 23:40 - 00993608 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
2017-03-18 23:41 - 2017-03-18 23:40 - 00334600 _____ (AVAST Software s.r.o.) C:\WINDOWS\system32\Drivers\aswbloga.sys
2017-03-18 23:41 - 2017-03-18 23:40 - 00309272 _____ (AVAST Software s.r.o.) C:\WINDOWS\system32\Drivers\aswbidsdrivera.sys
2017-03-18 23:41 - 2017-03-18 23:40 - 00189768 _____ (AVAST Software s.r.o.) C:\WINDOWS\system32\Drivers\aswbidsha.sys
2017-03-18 23:41 - 2017-03-18 23:40 - 00048528 _____ (AVAST Software s.r.o.) C:\WINDOWS\system32\Drivers\aswbuniva.sys
2017-03-18 23:40 - 2017-03-18 23:42 - 00000000 ____D C:\Program Files\AVAST Software
2017-03-18 23:39 - 2017-03-18 23:56 - 00000000 ____D C:\ProgramData\AVAST Software
2017-03-18 23:01 - 2017-03-19 00:06 - 04333568 _____ C:\Users\Sergio\NTUSER.rhk
2017-03-18 23:01 - 2017-03-18 23:01 - 00004058 _____ C:\WINDOWS\System32\Tasks\Wise Registry Cleaner Schedule Task
2017-03-18 22:57 - 2017-03-18 22:57 - 00763016 _____ C:\Users\Sergio\Documents\cc_20170318_225706.reg
2017-03-18 22:55 - 2017-03-18 22:55 - 00001329 _____ C:\Users\Public\Desktop\Ashampoo WinOptimizer 2017.lnk
2017-03-18 22:55 - 2017-03-18 22:55 - 00000237 _____ C:\Users\Public\Desktop\Ashampoo Deals.url
2017-03-18 22:55 - 2017-03-18 22:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
2017-03-18 22:55 - 2017-03-18 22:55 - 00000000 ____D C:\ProgramData\Ashampoo
2017-03-18 22:55 - 2017-03-18 22:55 - 00000000 ____D C:\Program Files (x86)\Ashampoo
2017-03-18 22:55 - 2009-08-24 21:13 - 00034304 _____ (mst software GmbH, Germany) C:\WINDOWS\system32\DfSdkBt.exe
2017-03-18 22:53 - 2017-03-18 23:01 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Wise Registry Cleaner
2017-03-18 22:53 - 2017-03-18 23:01 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Wise Euask
2017-03-18 22:53 - 2017-03-18 22:53 - 00001304 _____ C:\Users\Public\Desktop\Wise Registry Cleaner.lnk
2017-03-18 22:53 - 2017-03-18 22:53 - 00000000 ____D C:\WINDOWS\System32\Tasks\WiseCleaner
2017-03-18 22:53 - 2017-03-18 22:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Registry Cleaner
2017-03-18 22:53 - 2017-03-18 22:53 - 00000000 ____D C:\Program Files (x86)\Wise
2017-03-18 22:53 - 2017-03-18 22:53 - 00000000 ____D C:\Program Files (x86)\Chip Digital GmbH
2017-03-18 22:48 - 2017-03-18 22:48 - 00002862 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2017-03-18 22:48 - 2017-03-18 22:48 - 00000863 _____ C:\Users\Public\Desktop\CCleaner.lnk
2017-03-18 22:48 - 2017-03-18 22:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2017-03-18 22:48 - 2017-03-18 22:48 - 00000000 ____D C:\Program Files\CCleaner
2017-03-18 22:25 - 2016-06-05 07:42 - 00000000 ____D C:\Users\Sergio\Desktop\Python 3 - Intensivkurs  Projekte erfolgreich realisieren By Mark Pilgrim
2017-03-18 21:48 - 2016-09-01 12:09 - 00000000 ____D C:\Users\Sergio\Desktop\Yael Adler - Haut nah. Alles über unser größtes Organ inkl. pdf
2017-03-18 21:47 - 2016-10-17 16:46 - 00000000 ____D C:\Users\Sergio\Desktop\Nadja Hermann - Fettlogik überwinden
2017-03-18 01:04 - 2017-03-17 21:06 - 00000000 ____D C:\Users\Sergio\Desktop\Gunter Dueck - Flachsinn_ Ich habe Hirn, ich will hier raus
2017-03-16 21:27 - 2016-11-24 02:24 - 00000000 ____D C:\Users\Sergio\Desktop\Haiyti - Nightliner (2016)
2017-03-13 20:44 - 2017-03-13 20:44 - 14966655 _____ C:\Users\Sergio\Desktop\3662536676.psychologie.der.maerchen.2017.by.www.lul.to.pdf
2017-03-12 12:29 - 2017-03-12 12:26 - 00074345 ____N C:\Users\Sergio\Desktop\11057856.pdf
2017-03-11 11:55 - 2017-03-11 11:55 - 00000000 ____D C:\Users\Sergio\AppData\Local\TeamSpeak 3
2017-03-11 11:55 - 2017-03-11 11:55 - 00000000 ____D C:\Users\Sergio\.TeamSpeak 3
2017-03-10 22:56 - 2017-03-10 22:56 - 00000000 ____D C:\Users\Sergio\PycharmProjects
2017-03-10 22:55 - 2017-03-10 22:55 - 00001078 _____ C:\Users\Sergio\Desktop\JetBrains PyCharm Community Edition 2016.3.2.lnk
2017-03-10 22:55 - 2017-03-10 22:55 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\JetBrains
2017-03-10 22:55 - 2017-03-10 22:55 - 00000000 ____D C:\Users\Sergio\.PyCharmCE2016.3
2017-03-10 22:54 - 2017-03-10 22:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JetBrains
2017-03-10 22:54 - 2017-03-10 22:54 - 00000000 ____D C:\Program Files (x86)\JetBrains
2017-03-09 16:03 - 2017-03-09 16:03 - 00002713 _____ C:\Users\Sergio\Desktop\IDLE (Python 3.6 64-bit).lnk
2017-03-09 16:03 - 2017-03-09 16:03 - 00001520 _____ C:\Users\Sergio\Desktop\Python 3.6 (64-bit).lnk
2017-03-09 15:59 - 2017-03-09 15:59 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Python 3.6
2017-03-09 15:59 - 2017-03-09 15:59 - 00000000 ____D C:\Users\Sergio\AppData\Local\Package Cache
2017-03-08 16:00 - 2017-03-08 16:00 - 06744873 ____R C:\Users\Sergio\Desktop\3658108576.ich.glaube.es.hackt.2016.4.auflage.by.www.lul.to.pdf
2017-03-06 19:08 - 2017-03-06 19:08 - 00004296 _____ C:\WINDOWS\System32\Tasks\AMD Updater
2017-03-06 19:07 - 2017-03-06 19:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Radeon Settings
2017-03-06 18:50 - 2017-03-06 18:50 - 00000000 ____D C:\Users\Sergio\.QtWebEngineProcess
2017-03-06 18:50 - 2017-03-06 18:50 - 00000000 ____D C:\Users\Sergio\.Plays.tv
2017-03-05 18:37 - 2017-01-01 17:08 - 00000000 ____D C:\Users\Sergio\Desktop\Tory Lanez - Chixtape 4 (DatPiff.com)
2017-03-05 18:27 - 2017-03-05 18:27 - 00000000 ____D C:\ProgramData\GeoComply
2017-03-04 21:04 - 2017-03-04 21:06 - 00000000 ____D C:\Users\Sergio\VirtualBox VMs
2017-03-04 20:55 - 2017-03-05 14:02 - 00000000 ____D C:\Users\Sergio\.VirtualBox
2017-03-04 20:55 - 2017-03-04 20:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2017-03-04 20:55 - 2017-03-04 20:55 - 00000000 ____D C:\Program Files\Oracle
2017-03-04 20:55 - 2017-01-16 17:38 - 00959720 _____ (Oracle Corporation) C:\WINDOWS\system32\Drivers\VBoxDrv.sys
2017-03-04 20:55 - 2017-01-16 17:38 - 00149304 _____ (Oracle Corporation) C:\WINDOWS\system32\Drivers\VBoxUSBMon.sys
2017-03-01 23:49 - 2017-03-17 23:57 - 00001024 _____ C:\.rnd
2017-03-01 23:49 - 2017-03-01 23:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tenable Network Security
2017-03-01 23:48 - 2017-03-01 23:48 - 00000000 ____D C:\ProgramData\Tenable
2017-03-01 23:48 - 2017-03-01 23:48 - 00000000 ____D C:\Program Files\Tenable
2017-02-28 21:46 - 2017-03-05 11:48 - 00000000 ____D C:\Users\Sergio\Desktop\Ethic Hacking
2017-02-28 21:33 - 2017-02-28 21:33 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\.maltego
2017-02-28 21:33 - 2017-02-28 21:33 - 00000000 ____D C:\ProgramData\Paterva
2017-02-28 21:33 - 2017-02-28 21:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paterva
2017-02-28 21:32 - 2017-02-28 21:32 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Sun
2017-02-28 21:32 - 2017-02-28 21:32 - 00000000 ____D C:\Program Files (x86)\Paterva
2017-02-28 21:31 - 2017-03-18 23:51 - 00110144 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll
2017-02-28 21:31 - 2017-03-18 23:51 - 00000000 ____D C:\Program Files\Java
2017-02-27 22:16 - 2015-06-24 14:30 - 00064728 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vmx86.sys
2017-02-27 22:16 - 2013-10-08 18:21 - 00073296 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vsock.sys
2017-02-27 22:16 - 2013-10-08 18:21 - 00067664 _____ (VMware, Inc.) C:\WINDOWS\system32\vsocklib.dll
2017-02-27 22:16 - 2013-10-08 18:21 - 00063568 _____ (VMware, Inc.) C:\WINDOWS\SysWOW64\vsocklib.dll
2017-02-27 22:15 - 2015-06-24 14:30 - 00437976 _____ (VMware, Inc.) C:\WINDOWS\SysWOW64\vmnat.exe
2017-02-27 22:15 - 2015-06-24 14:30 - 00359128 _____ (VMware, Inc.) C:\WINDOWS\SysWOW64\vmnetdhcp.exe
2017-02-27 22:15 - 2015-06-24 14:27 - 00031448 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vmnetuserif.sys
2017-02-27 22:14 - 2017-02-27 22:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware
2017-02-27 22:14 - 2017-02-27 22:14 - 00000000 ____D C:\Program Files\Common Files\VMware
2017-02-27 22:14 - 2017-02-27 22:14 - 00000000 ____D C:\Program Files (x86)\VMware
2017-02-27 22:14 - 2015-06-24 14:27 - 00931032 _____ (VMware, Inc.) C:\WINDOWS\system32\vnetlib64.dll
2017-02-27 22:14 - 2014-08-21 08:07 - 00054976 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\hcmon.sys
2017-02-27 22:14 - 2014-08-21 08:06 - 00058048 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vmusb.sys
2017-02-27 22:11 - 2017-02-27 22:42 - 00000000 ____D C:\Users\Sergio\Documents\Virtual Machines
2017-02-27 19:48 - 2017-02-27 19:48 - 00000000 ____D C:\Users\Sergio\.idlerc

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-03-19 00:55 - 2016-07-16 12:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-03-19 00:48 - 2015-06-02 19:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-03-19 00:37 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-03-19 00:07 - 2016-07-16 12:45 - 00000000 ____D C:\WINDOWS\INF
2017-03-19 00:06 - 2016-09-29 20:05 - 00000000 ____D C:\Users\Sergio
2017-03-19 00:06 - 2016-09-29 20:05 - 00000000 ____D C:\Users\postgres
2017-03-18 23:52 - 2016-09-29 20:14 - 00004440 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2017-03-18 23:52 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2017-03-18 23:52 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\Macromed
2017-03-18 23:52 - 2014-10-27 17:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-03-18 23:52 - 2014-10-26 12:23 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-03-18 23:52 - 2014-10-26 12:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-03-18 23:52 - 2014-10-26 12:23 - 00000000 ____D C:\Program Files\WinRAR
2017-03-18 23:51 - 2014-10-26 12:41 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2017-03-18 23:50 - 2015-05-06 18:27 - 00000000 ____D C:\Program Files\Common Files\Apple
2017-03-18 23:49 - 2014-10-26 00:07 - 00001151 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-03-18 23:44 - 2016-07-16 07:04 - 00032768 _____ C:\WINDOWS\system32\config\ELAM
2017-03-18 23:02 - 2015-03-10 17:03 - 00000000 ____D C:\Users\Sergio\AppData\LocalLow\Temp
2017-03-18 22:59 - 2014-10-26 12:50 - 00000000 ____D C:\Users\Sergio\AppData\Local\JDownloader v2.0
2017-03-18 22:55 - 2016-09-23 20:37 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\TS3Client
2017-03-18 22:55 - 2014-11-05 17:58 - 00000000 ____D C:\Program Files (x86)\Steam
2017-03-18 22:50 - 2014-10-26 10:16 - 00000000 ____D C:\Users\Sergio\AppData\Local\Razer
2017-03-18 22:50 - 2014-10-26 00:15 - 00000000 ____D C:\ProgramData\Razer
2017-03-18 22:50 - 2014-10-26 00:15 - 00000000 ____D C:\Program Files (x86)\Razer
2017-03-18 22:34 - 2016-09-29 20:02 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-03-18 21:23 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2017-03-18 00:59 - 2014-10-27 09:42 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\vlc
2017-03-18 00:21 - 2014-10-29 14:39 - 00000000 ____D C:\WINDOWS\system32\MRT
2017-03-18 00:19 - 2015-04-16 15:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2017-03-18 00:19 - 2014-10-29 14:39 - 138634176 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-03-18 00:18 - 2015-04-16 15:08 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2017-03-18 00:18 - 2015-04-16 15:08 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2017-03-18 00:18 - 2014-10-26 12:31 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2017-03-18 00:15 - 2016-11-05 15:37 - 00000000 ____D C:\Users\Sergio\AppData\Local\ElevatedDiagnostics
2017-03-18 00:14 - 2016-07-16 12:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-03-18 00:00 - 2016-07-16 23:51 - 01032822 _____ C:\WINDOWS\system32\perfh007.dat
2017-03-18 00:00 - 2016-07-16 23:51 - 00243530 _____ C:\WINDOWS\system32\perfc007.dat
2017-03-18 00:00 - 2015-08-09 20:57 - 02469750 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-03-17 23:52 - 2014-10-27 17:10 - 00000000 ____D C:\ProgramData\VMware
2017-03-17 23:51 - 2016-09-29 20:14 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-03-16 22:25 - 2016-07-16 07:04 - 00786432 _____ C:\WINDOWS\system32\config\BBI
2017-03-16 21:23 - 2013-08-22 14:25 - 00000167 _____ C:\WINDOWS\win.ini
2017-03-14 19:22 - 2014-12-23 17:29 - 00000000 ____D C:\Users\Sergio\AppData\Local\Spotify
2017-03-13 20:27 - 2014-10-27 17:14 - 00000000 ____D C:\Users\Sergio\AppData\Local\VMware
2017-03-13 19:32 - 2014-12-23 17:28 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Spotify
2017-03-13 19:07 - 2014-10-27 17:14 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\VMware
2017-03-11 14:19 - 2016-10-23 19:11 - 00000000 ____D C:\Users\Sergio\Documents\Soda PDF Files
2017-03-11 14:19 - 2016-10-23 19:11 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Soda PDF Desktop
2017-03-11 12:13 - 2014-12-13 14:35 - 00000000 ____D C:\Users\Sergio\AppData\Local\PokerStars.EU
2017-03-11 12:12 - 2014-12-13 14:34 - 00000000 ____D C:\Program Files (x86)\PokerStars.EU
2017-03-11 11:55 - 2016-09-23 20:37 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2017-03-10 06:17 - 2016-07-16 12:49 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-03-10 06:17 - 2016-07-16 12:49 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-03-06 19:07 - 2016-09-29 20:03 - 00000000 ____D C:\Program Files\AMD
2017-03-06 19:07 - 2015-05-19 18:55 - 00000000 ____D C:\Program Files (x86)\AMD
2017-03-06 19:07 - 2014-10-26 00:19 - 00000000 ____D C:\Users\Sergio\AppData\Local\AMD
2017-03-06 19:04 - 2014-10-26 00:14 - 00000000 ____D C:\AMD
2017-03-06 18:50 - 2016-09-29 20:03 - 00000000 ____D C:\ProgramData\Package Cache
2017-03-06 18:48 - 2016-09-29 20:03 - 00000000 ____D C:\ProgramData\AMD
2017-03-04 23:55 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\NDF
2017-02-28 21:32 - 2016-02-14 18:43 - 00000000 ____D C:\Users\Sergio\.oracle_jre_usage
2017-02-27 22:14 - 2014-10-27 17:10 - 02053002 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2017-02-25 11:31 - 2014-10-25 23:53 - 00000000 ____D C:\Users\Sergio\AppData\Local\Packages

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2015-07-20 16:32 - 2015-07-20 16:32 - 0923401 _____ () C:\Program Files (x86)\WinDlg_124.zip
2015-07-12 10:02 - 2015-07-12 10:02 - 0000000 ___SH () C:\Users\Sergio\AppData\Local\LumaEmu
2016-07-03 18:51 - 2016-07-03 18:51 - 0000733 _____ () C:\Users\Sergio\AppData\Local\recently-used.xbel
2016-09-29 20:03 - 2016-09-29 20:03 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2015-07-06 20:11 - 2015-07-06 20:11 - 0005036 _____ () C:\ProgramData\flwjycbm.bab

==================== Bamital & volsnap ======================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert

LastRegBack: 2017-03-18 21:07

==================== Ende von FRST.txt ============================
         

Vielen dank schonmal im vorraus.

Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.



Um die Bereinigung möchlichst effektiv und schnell gestalten zu können, bitte ich um Beachtung der folgenden Hinweise:

1. Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support unterbrechen bis jegliche Art von illegaler Software vom Rechner entfernt wurde.
   
2. Lies dir meine Anleitungen immer sorgfältig durch, arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste immer alle Logdateien (auch wenn nichts gefunden wurde). Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
   
3. Solltest du mir nicht innerhalb von 3 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo. Solltest du einmal länger abwesend sein, so gib mir bitte Bescheid!
   
4. Während der Bereinigung bitte nichts installieren oder deinstallieren, außer ich bitte dich darum!
   
5. Bitte beachten: Download bei filepony.de: So ladet Ihr unsere Tools richtig!
   
6. Alle zu verwendenen Programme sind auf dem Desktop ( C:\users\dein Benutzername\Desktop\ ) abzuspeichern und von dort als Administrator zu starten!
   
7. Einige Programme, die wir hier verwenden, können unter Umständen von deinem Antiviren- oder Anti-Malwareprogramm fälschlicherweise als Bedrohung eingestuft werden. Die Sicherheitsprogramme können aufgrund eines bestimmten Programmverhaltens nicht zwischen "gut" oder "böse" unterscheiden und schlagen Alarm. Dabei handelt es sich um Fehlalarme, welche du getrost ignorieren kannst. Gegebenenfalls musst du deine Sicherheitssoftware vor der Ausführung eines Programms deaktivieren, damit unsere Bereinigungsvorgänge nicht beeinträchtigt werden.
   
8. Sollten die Logdateien einmal die zulässige Länge (~ 120.000 Zeichen) überschreiten, so teile die Logdateien auf mehrere Posts auf.
   Zur Not kannst du die Logdateien dann auch zippen (in ein .zip Archiv packen) und als Anhang hochladen.
   
9. Bitte arbeite so lange mit mir zusammen, bis ich dir sage, dass wir fertig sind und dein Rechner "sauber" ist. Das vorzeitige Verschwinden von Symptomen heißt nicht automatisch, dass dein Rechner bereits vollständig sauber ist.
   
10. In der Regel antworte ich dir innerhalb von 24 Stunden, oft sogar wesentlich schneller.
    Jedoch habe auch ich einen normalen Beruf und Familie. Ich bin daher nicht jeden Tag stundenlag hier im Forum unterwegs. Es kann unter Umständen bis zu 2 Tage dauern, bis du eine Antwort von mir erhältst. Sollte diese Zeit überschritten sein, so kannst du mir gerne eine PM als Erinnerung schicken.

Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags:

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke aauf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Danke für deine Mitarbeit!







Schritt 1
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Schritt 2
Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop

• Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
• Drücke Start Scan
  
• Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
  TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
  Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.







Bitte poste mit deiner nächsten Antwort

• die Logdatei von TDSS-Killer,
• die beiden neuen Logdateien von FRST.

Hallo Matthias, vielen dank für deine schnelle Hilfe.
Ich habe über Nacht die den Windows Defender durchlaufen lassen und der hat auf jeden fall etwas gefunden leider kann ich nicht mehr einsehen was. Ich habe auf Löschen geklickt und dabei habe ich den Verlauf gelöscht.. Ich hoffe das ist nicht weiter schlimm.


Hier der TDSS-Killer Log

13:44:46.0474 0x0440  TDSS rootkit removing tool 3.1.0.12 Nov  7 2016 07:10:01
13:44:50.0513 0x0440  ============================================================
13:44:50.0513 0x0440  Current date / time: 2017/03/19 13:44:50.0513
13:44:50.0513 0x0440  SystemInfo:
13:44:50.0543 0x0440  
13:44:50.0543 0x0440  OS Version: 10.0.14393 ServicePack: 0.0
13:44:50.0543 0x0440  Product type: Workstation
13:44:50.0543 0x0440  ComputerName: SERGIOS-PC
13:44:50.0543 0x0440  UserName: Sergio
13:44:50.0543 0x0440  Windows directory: C:\WINDOWS
13:44:50.0543 0x0440  System windows directory: C:\WINDOWS
13:44:50.0543 0x0440  Running under WOW64
13:44:50.0543 0x0440  Processor architecture: Intel x64
13:44:50.0543 0x0440  Number of processors: 4
13:44:50.0543 0x0440  Page size: 0x1000
13:44:50.0543 0x0440  Boot type: Normal boot
13:44:50.0543 0x0440  CodeIntegrityOptions = 0x00000001
13:44:50.0543 0x0440  ============================================================
13:44:50.0913 0x0440  KLMD registered as C:\WINDOWS\system32\drivers\13766342.sys
13:44:50.0914 0x0440  KLMD ARK init status: drvProperties = 0xFFF00, osBuild = 14393.693, osProperties = 0x19
13:44:52.0059 0x0440  System UUID: {3B441CB5-699C-2BC2-2078-741C976A80E1}
13:44:53.0071 0x0440  Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
13:44:53.0158 0x0440  Drive \Device\Harddisk1\DR1 - Size: 0x1DCF856000 ( 119.24 Gb ), SectorSize: 0x200, Cylinders: 0x3CCE, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
13:44:53.0171 0x0440  Drive \Device\Harddisk2\DR2 - Size: 0x53D67B6000 ( 335.35 Gb ), SectorSize: 0x200, Cylinders: 0xAB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
13:44:53.0187 0x0440  ============================================================
13:44:53.0187 0x0440  \Device\Harddisk0\DR0:
13:44:53.0216 0x0440  MBR partitions:
13:44:53.0216 0x0440  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
13:44:53.0216 0x0440  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x746D3800
13:44:53.0216 0x0440  \Device\Harddisk1\DR1:
13:44:53.0247 0x0440  MBR partitions:
13:44:53.0247 0x0440  \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0xC869DB3
13:44:53.0247 0x0440  \Device\Harddisk2\DR2:
13:44:53.0254 0x0440  MBR partitions:
13:44:53.0254 0x0440  \Device\Harddisk2\DR2\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0xC7FF800
13:44:53.0254 0x0440  \Device\Harddisk2\DR2\Partition2: MBR, Type 0x7, StartLBA 0xC800000, BlocksNum 0x13880000
13:44:53.0296 0x0440  ============================================================
13:44:53.0402 0x0440  C: <-> \Device\Harddisk1\DR1\Partition1
13:44:53.0557 0x0440  D: <-> \Device\Harddisk0\DR0\Partition1
13:44:53.0835 0x0440  E: <-> \Device\Harddisk0\DR0\Partition2
13:44:53.0869 0x0440  F: <-> \Device\Harddisk2\DR2\Partition2
13:44:53.0906 0x0440  H: <-> \Device\Harddisk2\DR2\Partition1
13:44:53.0906 0x0440  ============================================================
13:44:53.0906 0x0440  Initialize success
13:44:53.0906 0x0440  ============================================================
13:45:27.0517 0x26f4  ============================================================
13:45:27.0517 0x26f4  Scan started
13:45:27.0517 0x26f4  Mode: Manual; SigCheck; TDLFS; 
13:45:27.0517 0x26f4  ============================================================
13:45:27.0517 0x26f4  KSN ping started
13:45:27.0583 0x26f4  KSN ping finished: true
13:45:30.0246 0x26f4  ================ Scan system memory ========================
13:45:30.0246 0x26f4  System memory - ok
13:45:30.0247 0x26f4  ================ Scan services =============================
13:45:30.0412 0x26f4  1394ohci - ok
13:45:30.0422 0x26f4  3ware - ok
13:45:30.0458 0x26f4  ACPI - ok
13:45:30.0478 0x26f4  AcpiDev - ok
13:45:30.0482 0x26f4  acpiex - ok
13:45:30.0495 0x26f4  acpipagr - ok
13:45:30.0544 0x26f4  AcpiPmi - ok
13:45:30.0554 0x26f4  acpitime - ok
13:45:30.0752 0x26f4  [ 52997B1282BDAFC4275874B8990F9BE3, CFC4CD1EA75ADFC94E0B5623DDBBE38FC72162217DBEDB07EF5243CE5EEBEA4E ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
13:45:30.0852 0x26f4  AdobeARMservice - ok
13:45:33.0661 0x26f4  [ 7EB7A3B01751889C6459C51A74CC87FA, 088EF5CA10D439905822A3DFFEFD2D3416198F10EAAF8C235771CDB3DF86E82C ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
13:45:33.0680 0x26f4  AdobeFlashPlayerUpdateSvc - ok
13:45:33.0723 0x26f4  ADP80XX - ok
13:45:33.0749 0x26f4  AFD - ok
13:45:33.0775 0x26f4  ahcache - ok
13:45:33.0808 0x26f4  AJRouter - ok
13:45:33.0841 0x26f4  ALG - ok
13:45:33.0957 0x26f4  [ D7A72B9BA6AB996DADB37BFCB0363D63, A223684978928B59D39DFB49F6658E0CF04ADD15AD8ACFCEC384DBD4D8C8CBCA ] AMD External Events Utility C:\WINDOWS\system32\atiesrxx.exe
13:45:34.0075 0x26f4  AMD External Events Utility - ok
13:45:34.0411 0x26f4  [ B12D8F8A42080B955D027EE56F5BD1C3, AA4763AF1D77F7F1FF3BFEC5B800E7E38F954C1488B19ED645B04FEC4D771A1C ] AMD FUEL Service C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
13:45:34.0524 0x26f4  AMD FUEL Service - detected UnsignedFile.Multi.Generic ( 1 )
13:45:34.0610 0x26f4  Detect skipped due to KSN trusted
13:45:34.0610 0x26f4  AMD FUEL Service - ok
13:45:34.0633 0x26f4  AmdK8 - ok
13:45:34.0708 0x26f4  [ 83ADF64C5BEAC0A065D7D2811E9A79CA, C724DC6EC9CB0E93DC034054FFB79284E70502FA155EFF624E112243F6C8D8E8 ] amdkmafd        C:\WINDOWS\system32\drivers\amdkmafd.sys
13:45:34.0733 0x26f4  amdkmafd - ok
13:45:34.0774 0x26f4  amdkmdag - ok
13:45:35.0004 0x26f4  [ C14D7E5F24381BC8F333C4EB77892400, 8B8EF49D2398AF39E36EFFE6D1E0489727D5612DEFA43C71E3C7E4C0650010A5 ] amdkmdap        C:\WINDOWS\system32\DRIVERS\atikmpag.sys
13:45:35.0209 0x26f4  amdkmdap - ok
13:45:35.0237 0x26f4  AmdPPM - ok
13:45:35.0242 0x26f4  amdsata - ok
13:45:35.0261 0x26f4  amdsbs - ok
13:45:35.0265 0x26f4  amdxata - ok
13:45:35.0346 0x26f4  [ C3D487827E48CC5EC17994FEC5BDFF87, 5FCEA3EEA583755D0C9F6005ED3032E9DFECB57F504DC67701AE7D2D2631C30E ] AODDriver4.3    C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys
13:45:35.0435 0x26f4  AODDriver4.3 - ok
13:45:35.0463 0x26f4  AppID - ok
13:45:35.0500 0x26f4  AppIDSvc - ok
13:45:35.0522 0x26f4  Appinfo - ok
13:45:35.0750 0x26f4  [ 7D811EA7A2AAA49B0446D42CBC1CD338, AFECE5E44E48F756C7EB81D95C9237552AF8A9C02CBE756E0F3D3C6524DE49AD ] Apple Mobile Device Service C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
13:45:35.0778 0x26f4  Apple Mobile Device Service - ok
13:45:35.0783 0x26f4  applockerfltr - ok
13:45:35.0790 0x26f4  AppMgmt - ok
13:45:35.0804 0x26f4  AppReadiness - ok
13:45:35.0852 0x26f4  AppVClient - ok
13:45:35.0885 0x26f4  AppvStrm - ok
13:45:35.0947 0x26f4  AppvVemgr - ok
13:45:35.0970 0x26f4  AppvVfs - ok
13:45:36.0028 0x26f4  AppXSvc - ok
13:45:36.0095 0x26f4  arcsas - ok
13:45:36.0101 0x26f4  AsyncMac - ok
13:45:36.0144 0x26f4  atapi - ok
13:45:36.0197 0x26f4  [ 4A90468E458443382578EF66CDB4A0FD, 7CEA0ADDC2916169ED9C925738A5A5F88F8ECF518855F659EB72B17CA10A8A6C ] AtiHDAudioService C:\WINDOWS\system32\drivers\AtihdWT6.sys
13:45:36.0400 0x26f4  AtiHDAudioService - ok
13:45:36.0445 0x26f4  AudioEndpointBuilder - ok
13:45:36.0491 0x26f4  Audiosrv - ok
13:45:36.0566 0x26f4  AxInstSV - ok
13:45:36.0594 0x26f4  b06bdrv - ok
13:45:36.0651 0x26f4  BasicDisplay - ok
13:45:36.0684 0x26f4  BasicRender - ok
13:45:36.0751 0x26f4  bcmfn - ok
13:45:36.0792 0x26f4  bcmfn2 - ok
13:45:36.0860 0x26f4  BDESVC - ok
13:45:36.0902 0x26f4  Beep - ok
13:45:36.0927 0x26f4  BFE - ok
13:45:36.0978 0x26f4  BITS - ok
13:45:37.0181 0x26f4  [ B5C2F92EE1106DFE7BB1CCE4D35B6037, E399C390687589194D8AAD385055F0CFA7D52AD9E837D8FF95008B8EB2B34E50 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
13:45:37.0369 0x26f4  Bonjour Service - ok
13:45:37.0399 0x26f4  bowser - ok
13:45:37.0441 0x26f4  BrokerInfrastructure - ok
13:45:37.0449 0x26f4  Browser - ok
13:45:37.0496 0x26f4  BthAvrcpTg - ok
13:45:37.0558 0x26f4  BthEnum - ok
13:45:37.0592 0x26f4  BthHFEnum - ok
13:45:37.0659 0x26f4  bthhfhid - ok
13:45:37.0726 0x26f4  BthHFSrv - ok
13:45:37.0751 0x26f4  BTHMODEM - ok
13:45:37.0778 0x26f4  BthPan - ok
13:45:37.0803 0x26f4  BTHPORT - ok
13:45:37.0837 0x26f4  bthserv - ok
13:45:37.0842 0x26f4  BTHUSB - ok
13:45:37.0871 0x26f4  buttonconverter - ok
13:45:37.0904 0x26f4  CapImg - ok
13:45:37.0938 0x26f4  cdfs - ok
13:45:37.0963 0x26f4  CDPSvc - ok
13:45:38.0021 0x26f4  CDPUserSvc - ok
13:45:38.0242 0x26f4  cdrom - ok
13:45:38.0346 0x26f4  CertPropSvc - ok
13:45:38.0521 0x26f4  [ 59B4AB79011957DD3B83F0C2E63741BD, 5DE68785D701DBA0F98452B7D5CC407BEECD51685F39516157733CED2EF2FA19 ] chip1click      C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe
13:45:39.0245 0x26f4  chip1click - detected UnsignedFile.Multi.Generic ( 1 )
13:45:39.0552 0x26f4  Detect skipped due to KSN trusted
13:45:39.0552 0x26f4  chip1click - ok
13:45:39.0574 0x26f4  cht4iscsi - ok
13:45:39.0598 0x26f4  cht4vbd - ok
13:45:39.0645 0x26f4  circlass - ok
13:45:39.0650 0x26f4  CLFS - ok
13:45:39.0679 0x26f4  ClipSVC - ok
13:45:39.0691 0x26f4  clreg - ok
13:45:39.0724 0x26f4  CmBatt - ok
13:45:39.0749 0x26f4  CNG - ok
13:45:39.0754 0x26f4  cnghwassist - ok
13:45:41.0069 0x26f4  CompositeBus - ok
13:45:41.0074 0x26f4  COMSysApp - ok
13:45:41.0112 0x26f4  condrv - ok
13:45:41.0134 0x26f4  CoreMessagingRegistrar - ok
13:45:41.0143 0x26f4  CryptSvc - ok
13:45:41.0156 0x26f4  CSC - ok
13:45:41.0161 0x26f4  CscService - ok
13:45:41.0166 0x26f4  dam - ok
13:45:41.0172 0x26f4  DcomLaunch - ok
13:45:41.0177 0x26f4  DcpSvc - ok
13:45:41.0183 0x26f4  defragsvc - ok
13:45:41.0196 0x26f4  DeviceAssociationService - ok
13:45:41.0205 0x26f4  DeviceInstall - ok
13:45:41.0210 0x26f4  DevQueryBroker - ok
13:45:41.0227 0x26f4  Dfsc - ok
13:45:41.0268 0x26f4  [ 73BDD44A6088916964945886F9025409, 8E2ECC9AAEF3C6EBA2E61D25F657FDFCC72AB517CC4FD5FFF992E1F9EB942662 ] dg_ssudbus      C:\WINDOWS\system32\DRIVERS\ssudbus.sys
13:45:41.0281 0x26f4  dg_ssudbus - ok
13:45:41.0360 0x26f4  Dhcp - ok
13:45:41.0454 0x26f4  diagnosticshub.standardcollector.service - ok
13:45:41.0519 0x26f4  DiagTrack - ok
13:45:41.0562 0x26f4  disk - ok
13:45:41.0624 0x26f4  DmEnrollmentSvc - ok
13:45:41.0654 0x26f4  dmvsc - ok
13:45:41.0668 0x26f4  dmwappushservice - ok
13:45:41.0703 0x26f4  Dnscache - ok
13:45:41.0730 0x26f4  dot3svc - ok
13:45:41.0772 0x26f4  DPS - ok
13:45:41.0828 0x26f4  drmkaud - ok
13:45:41.0896 0x26f4  DsmSvc - ok
13:45:41.0908 0x26f4  DsSvc - ok
13:45:41.0932 0x26f4  DXGKrnl - ok
13:45:41.0965 0x26f4  EapHost - ok
13:45:41.0990 0x26f4  ebdrv - ok
13:45:42.0049 0x26f4  EFS - ok
13:45:42.0075 0x26f4  EhStorClass - ok
13:45:42.0142 0x26f4  EhStorTcgDrv - ok
13:45:42.0177 0x26f4  [ BE2902E13CA69383F449B6BF927844FB, F092785E305D8E1FE795AF98A7A7B7B4548A0D6687060568C9E078FFA8D65C1C ] ElbyCDIO        C:\WINDOWS\system32\Drivers\ElbyCDIO.sys
13:45:42.0187 0x26f4  ElbyCDIO - ok
13:45:42.0210 0x26f4  embeddedmode - ok
13:45:42.0259 0x26f4  EntAppSvc - ok
13:45:42.0284 0x26f4  ErrDev - ok
13:45:42.0310 0x26f4  EventSystem - ok
13:45:42.0343 0x26f4  exfat - ok
13:45:42.0368 0x26f4  fastfat - ok
13:45:42.0394 0x26f4  Fax - ok
13:45:42.0429 0x26f4  fdc - ok
13:45:42.0463 0x26f4  fdPHost - ok
13:45:42.0496 0x26f4  FDResPub - ok
13:45:42.0571 0x26f4  fhsvc - ok
13:45:42.0580 0x26f4  FileCrypt - ok
13:45:42.0605 0x26f4  FileInfo - ok
13:45:42.0615 0x26f4  Filetrace - ok
13:45:42.0632 0x26f4  flpydisk - ok
13:45:42.0644 0x26f4  FltMgr - ok
13:45:42.0649 0x26f4  FontCache - ok
13:45:42.0780 0x26f4  FontCache3.0.0.0 - ok
13:45:42.0838 0x26f4  FrameServer - ok
13:45:42.0843 0x26f4  FsDepends - ok
13:45:42.0848 0x26f4  Fs_Rec - ok
13:45:42.0861 0x26f4  fvevol - ok
13:45:42.0872 0x26f4  [ 8E98D21EE06192492A5671A6144D092F, B8F656B34D361EA5AFB47F3A67AB2221580DADA59C8CD0CB83181E4AD8B562B4 ] GEARAspiWDM     C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
13:45:42.0881 0x26f4  GEARAspiWDM - ok
13:45:42.0933 0x26f4  gencounter - ok
13:45:42.0995 0x26f4  genericusbfn - ok
13:45:43.0017 0x26f4  GPIOClx0101 - ok
13:45:43.0026 0x26f4  gpsvc - ok
13:45:43.0041 0x26f4  GpuEnergyDrv - ok
13:45:43.0064 0x26f4  [ 9932E254656DF50C514B8AE61EF12CCC, 502C06A9FE869CF65508155ABCD29640D5A0097FBF199DF0D61D9193D98C978B ] hcmon           C:\WINDOWS\system32\drivers\hcmon.sys
13:45:43.0093 0x26f4  hcmon - ok
13:45:43.0103 0x26f4  HDAudBus - ok
13:45:43.0172 0x26f4  HidBatt - ok
13:45:43.0223 0x26f4  HidBth - ok
13:45:43.0239 0x26f4  hidi2c - ok
13:45:43.0243 0x26f4  hidinterrupt - ok
13:45:43.0257 0x26f4  HidIr - ok
13:45:43.0279 0x26f4  hidserv - ok
13:45:43.0325 0x26f4  HidUsb - ok
13:45:43.0366 0x26f4  HomeGroupListener - ok
13:45:43.0391 0x26f4  HomeGroupProvider - ok
13:45:43.0433 0x26f4  HpSAMD - ok
13:45:43.0488 0x26f4  [ F47CEC45FB85791D4AB237563AD0FA8F, 1035066D48BD179855BCA7F62EFA1B951E6E839D2E29E15A31844E18A126DD41 ] HTCAND64        C:\WINDOWS\System32\Drivers\ANDROIDUSB.sys
13:45:43.0496 0x26f4  HTCAND64 - detected UnsignedFile.Multi.Generic ( 1 )
13:45:43.0555 0x26f4  Detect skipped due to KSN trusted
13:45:43.0555 0x26f4  HTCAND64 - ok
13:45:43.0621 0x26f4  [ 7C7C986776D00E575BFBDE5DCBDC615D, 4CF12851A5A45917C3A9139B19D79434F2038611B617F83A714506CC7A1A6C61 ] HtcVCom32       C:\WINDOWS\system32\DRIVERS\HtcVComV64.sys
13:45:43.0646 0x26f4  HtcVCom32 - detected UnsignedFile.Multi.Generic ( 1 )
13:45:43.0945 0x26f4  Detect skipped due to KSN trusted
13:45:43.0945 0x26f4  HtcVCom32 - ok
13:45:43.0963 0x26f4  HTTP - ok
13:45:44.0006 0x26f4  HvHost - ok
13:45:44.0072 0x26f4  hvservice - ok
13:45:44.0114 0x26f4  hwpolicy - ok
13:45:44.0139 0x26f4  hyperkbd - ok
13:45:44.0213 0x26f4  i8042prt - ok
13:45:44.0217 0x26f4  iagpio - ok
13:45:44.0277 0x26f4  iai2c - ok
13:45:44.0283 0x26f4  iaLPSS2i_GPIO2 - ok
13:45:44.0320 0x26f4  iaLPSS2i_I2C - ok
13:45:44.0325 0x26f4  iaLPSSi_GPIO - ok
13:45:44.0359 0x26f4  iaLPSSi_I2C - ok
13:45:44.0401 0x26f4  iaStorAV - ok
13:45:44.0406 0x26f4  iaStorV - ok
13:45:44.0435 0x26f4  ibbus - ok
13:45:44.0490 0x26f4  icssvc - ok
13:45:44.0526 0x26f4  IKEEXT - ok
13:45:44.0566 0x26f4  IndirectKmd - ok
13:45:45.0101 0x26f4  [ 622868E4BAE8FBCD22CB1A5901A2C824, C1A2264C0984DD16C83B663C9CE43E049E1356E32C5771C3ACE225F285699138 ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RTKVHD64.sys
13:45:45.0208 0x26f4  IntcAzAudAddService - ok
13:45:45.0261 0x26f4  intelide - ok
13:45:45.0286 0x26f4  intelpep - ok
13:45:45.0312 0x26f4  intelppm - ok
13:45:45.0347 0x26f4  iorate - ok
13:45:45.0380 0x26f4  IpFilterDriver - ok
13:45:45.0432 0x26f4  iphlpsvc - ok
13:45:45.0436 0x26f4  IPMIDRV - ok
13:45:45.0440 0x26f4  IPNAT - ok
13:45:45.0777 0x26f4  [ 97C9EBB84A761D48DC17E0E6B913C164, D195A8410E1FEED1A0EE9C5F5AF6F5FC861284765A38D460D496CE1048501905 ] iPod Service    C:\Program Files\iPod\bin\iPodService.exe
13:45:45.0836 0x26f4  iPod Service - ok
13:45:45.0841 0x26f4  irda - ok
13:45:45.0867 0x26f4  IRENUM - ok
13:45:45.0909 0x26f4  irmon - ok
13:45:45.0947 0x26f4  isapnp - ok
13:45:45.0987 0x26f4  iScsiPrt - ok
13:45:46.0054 0x26f4  [ BD5BF20EC242E003A2F570B8754A56D1, B4B3492222E98BF8E6EC453E727187FF4AA50A508D1E88A0CBBD5C46355AE492 ] ivusb           C:\WINDOWS\System32\drivers\ivusb.sys
13:45:46.0076 0x26f4  ivusb - ok
13:45:46.0146 0x26f4  kbdclass - ok
13:45:46.0179 0x26f4  kbdhid - ok
13:45:46.0205 0x26f4  kdnic - ok
13:45:46.0209 0x26f4  KeyIso - ok
13:45:46.0238 0x26f4  KSecDD - ok
13:45:46.0280 0x26f4  KSecPkg - ok
13:45:46.0313 0x26f4  ksthunk - ok
13:45:46.0355 0x26f4  KtmRm - ok
13:45:46.0381 0x26f4  LanmanServer - ok
13:45:46.0414 0x26f4  LanmanWorkstation - ok
13:45:46.0448 0x26f4  lfsvc - ok
13:45:46.0490 0x26f4  LicenseManager - ok
13:45:46.0494 0x26f4  lltdio - ok
13:45:46.0508 0x26f4  lltdsvc - ok
13:45:46.0532 0x26f4  lmhosts - ok
13:45:46.0565 0x26f4  LSI_SAS - ok
13:45:46.0570 0x26f4  LSI_SAS2i - ok
13:45:46.0577 0x26f4  LSI_SAS3i - ok
13:45:46.0634 0x26f4  LSI_SSS - ok
13:45:46.0676 0x26f4  LSM - ok
13:45:46.0710 0x26f4  luafv - ok
13:45:46.0730 0x26f4  MapsBroker - ok
13:45:46.0785 0x26f4  megasas - ok
13:45:46.0868 0x26f4  megasas2i - ok
13:45:46.0882 0x26f4  megasr - ok
13:45:46.0915 0x26f4  MessagingService - ok
13:45:47.0045 0x26f4  mlx4_bus - ok
13:45:47.0055 0x26f4  MMCSS - ok
13:45:47.0083 0x26f4  Modem - ok
13:45:47.0129 0x26f4  monitor - ok
13:45:47.0179 0x26f4  mouclass - ok
13:45:47.0205 0x26f4  mouhid - ok
13:45:47.0209 0x26f4  mountmgr - ok
13:45:47.0481 0x26f4  [ 0DE2474F316C515482ABAD3B697F8714, 62862AE7432F5350068E96AD466093359C6CF444EB517AE6D09134FAF78C49F5 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
13:45:47.0494 0x26f4  MozillaMaintenance - ok
13:45:47.0516 0x26f4  mpsdrv - ok
13:45:47.0536 0x26f4  MpsSvc - ok
13:45:47.0604 0x26f4  MRxDAV - ok
13:45:47.0626 0x26f4  mrxsmb - ok
13:45:47.0667 0x26f4  mrxsmb10 - ok
13:45:47.0693 0x26f4  mrxsmb20 - ok
13:45:47.0739 0x26f4  MsBridge - ok
13:45:47.0793 0x26f4  MSDTC - ok
13:45:47.0801 0x26f4  Msfs - ok
13:45:47.0862 0x26f4  msgpiowin32 - ok
13:45:47.0896 0x26f4  mshidkmdf - ok
13:45:47.0921 0x26f4  mshidumdf - ok
13:45:47.0955 0x26f4  msisadrv - ok
13:45:47.0999 0x26f4  MSiSCSI - ok
13:45:48.0003 0x26f4  msiserver - ok
13:45:48.0008 0x26f4  MSKSSRV - ok
13:45:48.0012 0x26f4  MsLldp - ok
13:45:48.0017 0x26f4  MSPCLOCK - ok
13:45:48.0039 0x26f4  MSPQM - ok
13:45:48.0043 0x26f4  MsRPC - ok
13:45:48.0080 0x26f4  MsSecFlt - ok
13:45:48.0107 0x26f4  mssmbios - ok
13:45:48.0111 0x26f4  MSTEE - ok
13:45:48.0164 0x26f4  MTConfig - ok
13:45:48.0223 0x26f4  [ 640617B6E682A150C36BE39D78547F6C, 784F712E9DC3EEE81F07946BBA08AA2BEAC7B3961E430B75043645EF7ECA715C ] MTsensor        C:\WINDOWS\system32\DRIVERS\ASACPI.sys
13:45:48.0232 0x26f4  MTsensor - ok
13:45:48.0236 0x26f4  Mup - ok
13:45:48.0249 0x26f4  mvumis - ok
13:45:48.0298 0x26f4  NativeWifiP - ok
13:45:48.0324 0x26f4  NcaSvc - ok
13:45:48.0373 0x26f4  NcbService - ok
13:45:48.0377 0x26f4  NcdAutoSetup - ok
13:45:48.0409 0x26f4  ndfltr - ok
13:45:48.0436 0x26f4  NDIS - ok
13:45:48.0469 0x26f4  NdisCap - ok
13:45:48.0545 0x26f4  NdisImPlatform - ok
13:45:48.0549 0x26f4  NdisTapi - ok
13:45:48.0586 0x26f4  Ndisuio - ok
13:45:48.0628 0x26f4  NdisVirtualBus - ok
13:45:48.0632 0x26f4  NdisWan - ok
13:45:48.0636 0x26f4  ndiswanlegacy - ok
13:45:48.0662 0x26f4  ndproxy - ok
13:45:48.0687 0x26f4  Ndu - ok
13:45:48.0737 0x26f4  NetAdapterCx - ok
13:45:48.0742 0x26f4  NetBIOS - ok
13:45:48.0748 0x26f4  NetBT - ok
13:45:48.0752 0x26f4  Netlogon - ok
13:45:48.0786 0x26f4  Netman - ok
13:45:48.0820 0x26f4  netprofm - ok
13:45:48.0864 0x26f4  NetSetupSvc - ok
13:45:49.0445 0x26f4  NetTcpPortSharing - ok
13:45:49.0519 0x26f4  NgcCtnrSvc - ok
13:45:49.0552 0x26f4  NgcSvc - ok
13:45:49.0585 0x26f4  NlaSvc - ok
13:45:49.0611 0x26f4  Npfs - ok
13:45:49.0673 0x26f4  npsvctrig - ok
13:45:49.0718 0x26f4  nsi - ok
13:45:49.0731 0x26f4  nsiproxy - ok
13:45:49.0778 0x26f4  NTFS - ok
13:45:49.0814 0x26f4  Null - ok
13:45:49.0880 0x26f4  nvraid - ok
13:45:49.0884 0x26f4  nvstor - ok
13:45:49.0939 0x26f4  OneSyncSvc - ok
13:45:50.0126 0x26f4  [ 11E0B35479C895888BA3D7F619DCFFF3, 6ED82C19898101EC00BD64A9F90595C3D20AD2D2902AA8765B740FB3B9312DDF ] ose64           C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
13:45:50.0142 0x26f4  ose64 - ok
13:45:50.0177 0x26f4  p2pimsvc - ok
13:45:50.0191 0x26f4  p2psvc - ok
13:45:50.0266 0x26f4  Parport - ok
13:45:50.0275 0x26f4  partmgr - ok
13:45:50.0318 0x26f4  PcaSvc - ok
13:45:50.0325 0x26f4  pci - ok
13:45:50.0371 0x26f4  pciide - ok
13:45:50.0407 0x26f4  pcmcia - ok
13:45:50.0411 0x26f4  pcw - ok
13:45:50.0428 0x26f4  pdc - ok
13:45:50.0469 0x26f4  PEAUTH - ok
13:45:50.0503 0x26f4  PeerDistSvc - ok
13:45:50.0570 0x26f4  percsas2i - ok
13:45:50.0574 0x26f4  percsas3i - ok
13:45:53.0296 0x26f4  PerfHost - ok
13:45:53.0317 0x26f4  PhoneSvc - ok
13:45:53.0333 0x26f4  PimIndexMaintenanceSvc - ok
13:45:53.0362 0x26f4  pla - ok
13:45:53.0381 0x26f4  PlugPlay - ok
13:45:53.0431 0x26f4  PNRPAutoReg - ok
13:45:53.0435 0x26f4  PNRPsvc - ok
13:45:53.0474 0x26f4  PolicyAgent - ok
13:45:53.0480 0x26f4  Power - ok
13:45:53.0516 0x26f4  PptpMiniport - ok
13:45:54.0877 0x26f4  [ 7196D3C2E2E3129814C8DAB91F9A7D1E, 6763E4BF8E846B597E78778E520F5BADC95608BAA4EA0AC84971384B5D976DD7 ] PrintNotify     C:\WINDOWS\system32\spool\drivers\x64\3\PrintConfig.dll
13:45:55.0024 0x26f4  PrintNotify - ok
13:45:55.0071 0x26f4  Processor - ok
13:45:55.0129 0x26f4  ProfSvc - ok
13:45:55.0161 0x26f4  Psched - ok
13:45:55.0181 0x26f4  QWAVE - ok
13:45:55.0214 0x26f4  QWAVEdrv - ok
13:45:55.0239 0x26f4  RasAcd - ok
13:45:55.0306 0x26f4  RasAgileVpn - ok
13:45:55.0348 0x26f4  RasAuto - ok
13:45:55.0352 0x26f4  Rasl2tp - ok
13:45:55.0373 0x26f4  RasMan - ok
13:45:55.0377 0x26f4  RasPppoe - ok
13:45:55.0382 0x26f4  RasSstp - ok
13:45:55.0407 0x26f4  rdbss - ok
13:45:55.0488 0x26f4  rdpbus - ok
13:45:55.0492 0x26f4  RDPDR - ok
13:45:55.0551 0x26f4  RdpVideoMiniport - ok
13:45:55.0592 0x26f4  rdyboost - ok
13:45:55.0596 0x26f4  ReFSv1 - ok
13:45:55.0625 0x26f4  RemoteAccess - ok
13:45:55.0661 0x26f4  RemoteRegistry - ok
13:45:55.0691 0x26f4  RetailDemo - ok
13:45:55.0725 0x26f4  RFCOMM - ok
13:45:55.0743 0x26f4  RmSvc - ok
13:45:55.0768 0x26f4  RpcEptMapper - ok
13:45:55.0793 0x26f4  RpcLocator - ok
13:45:55.0819 0x26f4  RpcSs - ok
13:45:55.0852 0x26f4  rspndr - ok
13:45:55.0920 0x26f4  rt640x64 - ok
13:45:55.0928 0x26f4  RtlWlanu_OldIC - ok
13:45:55.0951 0x26f4  [ 0988FECD9D924F5B4855D049E68BAAD3, 788B379B01F26C7C46DF0D3E9E37F9964831AAFD0762DDD17345478A97ADE83D ] rzdaendpt       C:\WINDOWS\System32\drivers\rzdaendpt.sys
13:45:55.0961 0x26f4  rzdaendpt - ok
13:45:56.0036 0x26f4  [ C2A49525F6CEEED97A1D9FC950AAF863, DAA57C1C446861C733D3BE668EB247E40CE3871EF8FA0BB91CEB074B7357E0D8 ] rzudd           C:\WINDOWS\System32\drivers\rzudd.sys
13:45:56.0048 0x26f4  rzudd - ok
13:45:56.0058 0x26f4  [ 2AD977273D8B3F2169411E8AED7C8702, FCC3D579AFC9958C0CE3FB202061D36C66FC6803AFD7B99DBFC41412F9131E34 ] rzvkeyboard     C:\WINDOWS\System32\drivers\rzvkeyboard.sys
13:45:56.0067 0x26f4  rzvkeyboard - ok
13:45:56.0081 0x26f4  s3cap - ok
13:45:56.0092 0x26f4  [ 476BAA3EEBE9DB94BF6BDFAF46747E5D, 6E8FB06225341989B88C1F554800724F5DFE16A359C3E019CA63D6C2FAA22F72 ] SaiK0728        C:\WINDOWS\system32\DRIVERS\SaiK0728.sys
13:45:56.0118 0x26f4  SaiK0728 - ok
13:45:56.0135 0x26f4  SamSs - ok
13:45:56.0202 0x26f4  [ 186151BC8CEE2CF3E942E81527AAFF1A, 33D68239D655054CE8822438E96D2648193419D8D94F979A4B67AF57BCEF6CBD ] SbieDrv         C:\Program Files\Sandboxie\SbieDrv.sys
13:45:56.0315 0x26f4  SbieDrv - ok
13:45:56.0430 0x26f4  [ 12820DA4BB0079BBC709C7028A22BA63, C15EDCC83CC4931C871D04F09A6FC6199C9DCD4332CDF4C80D1E6E5A2AFD4DE1 ] SbieSvc         C:\Program Files\Sandboxie\SbieSvc.exe
13:45:56.0495 0x26f4  SbieSvc - ok
13:45:56.0500 0x26f4  sbp2port - ok
13:45:56.0518 0x26f4  SCardSvr - ok
13:45:56.0523 0x26f4  ScDeviceEnum - ok
13:45:56.0541 0x26f4  scfilter - ok
13:45:56.0559 0x26f4  Schedule - ok
13:45:56.0626 0x26f4  scmbus - ok
13:45:56.0659 0x26f4  scmdisk0101 - ok
13:45:56.0734 0x26f4  SCPolicySvc - ok
13:45:56.0776 0x26f4  sdbus - ok
13:45:56.0817 0x26f4  SDRSVC - ok
13:45:56.0853 0x26f4  sdstor - ok
13:45:56.0886 0x26f4  seclogon - ok
13:45:56.0920 0x26f4  SENS - ok
13:45:57.0080 0x26f4  Sense - ok
13:45:57.0144 0x26f4  SensorDataService - ok
13:45:57.0174 0x26f4  SensorService - ok
13:45:57.0198 0x26f4  SensrSvc - ok
13:45:57.0203 0x26f4  SerCx - ok
13:45:57.0265 0x26f4  SerCx2 - ok
13:45:57.0306 0x26f4  Serenum - ok
13:45:57.0324 0x26f4  Serial - ok
13:45:57.0329 0x26f4  sermouse - ok
13:45:57.0382 0x26f4  SessionEnv - ok
13:45:57.0457 0x26f4  sfloppy - ok
13:45:57.0533 0x26f4  SharedAccess - ok
13:45:57.0615 0x26f4  ShellHWDetection - ok
13:45:57.0670 0x26f4  shpamsvc - ok
13:45:57.0683 0x26f4  SiSRaid2 - ok
13:45:57.0700 0x26f4  SiSRaid4 - ok
13:45:57.0802 0x26f4  [ 0B70786BD1062CD4C6B58E412B9C3E55, 60ED027642FFF97BFFA55AE3EFFCCBB6D6AD8196D35E9ED06F9AF431E3C0402A ] SkypeUpdate     C:\Program Files (x86)\Skype\Updater\Updater.exe
13:45:57.0820 0x26f4  SkypeUpdate - ok
13:45:57.0870 0x26f4  smphost - ok
13:45:57.0897 0x26f4  SmsRouter - ok
13:45:57.0946 0x26f4  SNMPTRAP - ok
13:45:57.0948 0x26f4  Soda PDF Desktop - ok
13:45:57.0953 0x26f4  Soda PDF Desktop CrashHandler - ok
13:45:57.0957 0x26f4  Soda PDF Desktop Creator - ok
13:45:58.0021 0x26f4  spaceport - ok
13:45:58.0054 0x26f4  SpbCx - ok
13:46:00.0139 0x26f4  [ 0FFE35F0B0CD5A324BBE22F02569AE3B, F4EE803EEFDB4EAEEDB3024C3516F1F9A202C77F4870D6B74356BBDE32B3B560 ] speedfan        C:\WINDOWS\SysWoW64\speedfan.sys
13:46:00.0174 0x26f4  speedfan - ok
13:46:00.0199 0x26f4  Spooler - ok
13:46:00.0223 0x26f4  sppsvc - ok
13:46:00.0231 0x26f4  srv - ok
13:46:00.0257 0x26f4  srv2 - ok
13:46:00.0282 0x26f4  srvnet - ok
13:46:00.0309 0x26f4  SSDPSRV - ok
13:46:00.0334 0x26f4  SstpSvc - ok
13:46:00.0416 0x26f4  [ 5252D7BC56E5E0ED715AEA8FE173A455, 1408B3E98B35A449434718777EE70595F0D306197A428279C6281D2F1953F259 ] ssudmdm         C:\WINDOWS\system32\DRIVERS\ssudmdm.sys
13:46:00.0429 0x26f4  ssudmdm - ok
13:46:00.0476 0x26f4  StateRepository - ok
13:46:00.0735 0x26f4  [ 5CBCEB3FF7C232ACC8891C8197BF3353, B1FE57C61E62B1FEC81B219551DAD68DC5DF17FC1603CDC0CBA097A3E687A027 ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe
13:46:00.0916 0x26f4  Steam Client Service - ok
13:46:00.0942 0x26f4  stexstor - ok
13:46:00.0975 0x26f4  stisvc - ok
13:46:01.0009 0x26f4  storahci - ok
13:46:01.0042 0x26f4  storflt - ok
13:46:01.0076 0x26f4  stornvme - ok
13:46:01.0109 0x26f4  storqosflt - ok
13:46:01.0127 0x26f4  StorSvc - ok
13:46:01.0143 0x26f4  storufs - ok
13:46:01.0161 0x26f4  storvsc - ok
13:46:01.0166 0x26f4  svsvc - ok
13:46:01.0226 0x26f4  swenum - ok
13:46:01.0230 0x26f4  swprv - ok
13:46:01.0246 0x26f4  Synth3dVsc - ok
13:46:01.0272 0x26f4  SysMain - ok
13:46:01.0315 0x26f4  SystemEventsBroker - ok
13:46:01.0348 0x26f4  TabletInputService - ok
13:46:01.0382 0x26f4  TapiSrv - ok
13:46:01.0416 0x26f4  Tcpip - ok
13:46:01.0420 0x26f4  Tcpip6 - ok
13:46:01.0426 0x26f4  tcpipreg - ok
13:46:01.0441 0x26f4  tdx - ok
13:46:01.0614 0x26f4  [ BDE17782D06393AFD522C4B0D1B7E1F5, 735ED2C0E7AA324FE7919ADCAEDE8321CB506F33E7A2C713EFB6B7694E3E8BEF ] Tenable Nessus  C:\Program Files\Tenable\Nessus\nessus-service.exe
13:46:01.0638 0x26f4  Tenable Nessus - ok
13:46:01.0673 0x26f4  terminpt - ok
13:46:01.0698 0x26f4  TermService - ok
13:46:01.0739 0x26f4  Themes - ok
13:46:01.0790 0x26f4  TieringEngineService - ok
13:46:01.0832 0x26f4  tiledatamodelsvc - ok
13:46:01.0878 0x26f4  TimeBrokerSvc - ok
13:46:01.0917 0x26f4  TPM - ok
13:46:01.0942 0x26f4  TrkWks - ok
13:46:02.0057 0x26f4  TrustedInstaller - ok
13:46:02.0063 0x26f4  tsusbflt - ok
13:46:02.0081 0x26f4  TsUsbGD - ok
13:46:02.0085 0x26f4  tsusbhub - ok
13:46:02.0089 0x26f4  tunnel - ok
13:46:02.0135 0x26f4  tzautoupdate - ok
13:46:02.0203 0x26f4  UASPStor - ok
13:46:02.0208 0x26f4  UcmCx0101 - ok
13:46:02.0237 0x26f4  UcmTcpciCx0101 - ok
13:46:02.0262 0x26f4  UcmUcsi - ok
13:46:02.0266 0x26f4  Ucx01000 - ok
13:46:02.0295 0x26f4  UdeCx - ok
13:46:02.0299 0x26f4  udfs - ok
13:46:02.0329 0x26f4  UEFI - ok
13:46:02.0333 0x26f4  UevAgentDriver - ok
13:46:02.0362 0x26f4  UevAgentService - ok
13:46:02.0367 0x26f4  Ufx01000 - ok
13:46:02.0385 0x26f4  UfxChipidea - ok
13:46:02.0430 0x26f4  ufxsynopsys - ok
13:46:02.0469 0x26f4  UI0Detect - ok
13:46:02.0474 0x26f4  umbus - ok
13:46:02.0493 0x26f4  UmPass - ok
13:46:02.0523 0x26f4  UmRdpService - ok
13:46:02.0556 0x26f4  UnistoreSvc - ok
13:46:02.0583 0x26f4  upnphost - ok
13:46:02.0617 0x26f4  UrsChipidea - ok
13:46:02.0642 0x26f4  UrsCx01000 - ok
13:46:02.0646 0x26f4  UrsSynopsys - ok
13:46:02.0693 0x26f4  [ F957092C63CD71D85903CA0D8370F473, 4DEC2FC20329F248135DA24CB6694FD972DCCE8B1BBEA8D872FDE41939E96AAF ] USBAAPL64       C:\WINDOWS\System32\Drivers\usbaapl64.sys
13:46:02.0799 0x26f4  USBAAPL64 - ok
13:46:02.0813 0x26f4  usbccgp - ok
13:46:02.0844 0x26f4  usbcir - ok
13:46:02.0887 0x26f4  usbehci - ok
13:46:02.0891 0x26f4  usbhub - ok
13:46:02.0924 0x26f4  USBHUB3 - ok
13:46:02.0938 0x26f4  usbohci - ok
13:46:02.0962 0x26f4  usbprint - ok
13:46:03.0005 0x26f4  usbscan - ok
13:46:03.0013 0x26f4  usbser - ok
13:46:03.0053 0x26f4  USBSTOR - ok
13:46:03.0076 0x26f4  usbuhci - ok
13:46:03.0089 0x26f4  USBXHCI - ok
13:46:03.0124 0x26f4  UserDataSvc - ok
13:46:03.0149 0x26f4  UserManager - ok
13:46:03.0183 0x26f4  UsoSvc - ok
13:46:03.0250 0x26f4  VaultSvc - ok
13:46:03.0430 0x26f4  [ 0D9780E8495C84911491AE1603711E39, 4D9E1157CA84E0DE1A1BFB9A75576AA49B37BD02F780CC84012A79720B183F0F ] VBoxDrv         C:\WINDOWS\system32\DRIVERS\VBoxDrv.sys
13:46:03.0524 0x26f4  VBoxDrv - ok
13:46:03.0589 0x26f4  [ 45633D58D5DB28E5F210CF51588E537D, DF88F66E360535966557249127AC17EC11746F478DC73210526E2545422C77FF ] VBoxNetAdp      C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys
13:46:03.0625 0x26f4  VBoxNetAdp - ok
13:46:03.0680 0x26f4  [ B802AC859F5BEF61FFB24F1513755106, 54A75B61946D7B8B4A61C15BE79D81E8D10B08D8BE4F6F02BB6A4DC0DF9A6B76 ] VBoxNetLwf      C:\WINDOWS\system32\DRIVERS\VBoxNetLwf.sys
13:46:03.0719 0x26f4  VBoxNetLwf - ok
13:46:03.0767 0x26f4  [ FEB686C223F7EA10B530108C81BB110B, 79AAAE2345694617F7A35068F0614E256B179A803C14639591B1DC796CB92F47 ] VBoxUSBMon      C:\WINDOWS\system32\DRIVERS\VBoxUSBMon.sys
13:46:03.0799 0x26f4  VBoxUSBMon - ok
13:46:03.0850 0x26f4  [ 3C8E2C591345F38149C69FE8E5DF8C90, 9F4BB9BDA09CB2E99A6A888B288F322AE5C460B5D124CD714C6F00FF5029144B ] VClone          C:\WINDOWS\System32\drivers\VClone.sys
13:46:03.0866 0x26f4  VClone - ok
13:46:03.0871 0x26f4  vdrvroot - ok
13:46:03.0896 0x26f4  vds - ok
13:46:03.0924 0x26f4  VerifierExt - ok
13:46:03.0961 0x26f4  vhdmp - ok
13:46:03.0965 0x26f4  vhf - ok
13:46:04.0112 0x26f4  [ BD00A8CFB76E6BB0E89DB191E3712528, 870664951D908772454E30042E2CD464722DF7331AFAC016B0884EC375FEA5C3 ] VMAuthdService  C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
13:46:04.0179 0x26f4  VMAuthdService - ok
13:46:04.0204 0x26f4  vmbus - ok
13:46:04.0223 0x26f4  VMBusHID - ok
13:46:04.0260 0x26f4  [ BE8E5E5D53ACF71D4E8E686B68C99B04, 4F30A360095FCB2627068FA6A65A951688058E8FDDF5CE895E2AE39500A413B1 ] vmci            C:\WINDOWS\system32\drivers\vmci.sys
13:46:04.0290 0x26f4  vmci - ok
13:46:04.0314 0x26f4  vmgid - ok
13:46:04.0349 0x26f4  vmicguestinterface - ok
13:46:04.0353 0x26f4  vmicheartbeat - ok
13:46:04.0358 0x26f4  vmickvpexchange - ok
13:46:04.0390 0x26f4  vmicrdv - ok
13:46:04.0394 0x26f4  vmicshutdown - ok
13:46:04.0399 0x26f4  vmictimesync - ok
13:46:04.0403 0x26f4  vmicvmsession - ok
13:46:04.0408 0x26f4  vmicvss - ok
13:46:04.0457 0x26f4  [ 18AA5F4A3B1204AD00045EE5AD39BCDB, 0211A8E94F169A2A52CD39CD580293907EBE104E52038DC36B988DE1CA7F2392 ] VMnetAdapter    C:\WINDOWS\system32\DRIVERS\vmnetadapter.sys
13:46:04.0504 0x26f4  VMnetAdapter - ok
13:46:04.0524 0x26f4  [ 04CD4347CD9E8C40F78AD51F7FF426D0, BCA3E593E118BCA30142B23CD1CBE6905442D31C3DEB4C71B06D721E601F7BD8 ] VMnetBridge     C:\WINDOWS\system32\DRIVERS\vmnetbridge.sys
13:46:04.0636 0x26f4  VMnetBridge - ok
13:46:06.0211 0x26f4  [ 338CD01BD29805A93902B9237A39CAC5, AB667D0BD54FFCAA997F97755CE576E47D361EEA21E45B95DEA1E912693B4CE2 ] VMnetDHCP       C:\WINDOWS\SYSWOW64\VMNETDHCP.EXE
13:46:06.0342 0x26f4  VMnetDHCP - ok
13:46:06.0381 0x26f4  [ 76C4CFAC694A581EA5C8DE89B6AEBD4B, B6D19529223BD20AA2A17D93A8F0D2D32369FDE4E8535F6D1191B065B0755EE4 ] VMnetuserif     C:\WINDOWS\system32\drivers\vmnetuserif.sys
13:46:06.0426 0x26f4  VMnetuserif - ok
13:46:06.0450 0x26f4  [ 69741000F15F2F0CE85E5EE0DD3EB78A, 485C1D410ADDDFACF3518FDDAE0D23B972F270031805EDCB3D40B17F216641E1 ] vmusb           C:\WINDOWS\System32\drivers\vmusb.sys
13:46:06.0533 0x26f4  vmusb - ok
13:46:06.0821 0x26f4  [ 9D88591D3B97D30234F5B965B8E0ABD6, 42ECDD6D789645242E4640F10C1FB91BF0C2B37CDE3CF864B8175EE3E05DB2DB ] VMUSBArbService C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe
13:46:06.0870 0x26f4  VMUSBArbService - ok
13:46:06.0978 0x26f4  [ 2B2BB1F8BFEBE6B847FDB32F89EA2A3E, 743EBF3EF12067A77454B04559E266EFB306A454AF765A0821193C646A952F2E ] VMware NAT Service C:\WINDOWS\SYSWOW64\VMNAT.EXE
13:46:07.0138 0x26f4  VMware NAT Service - ok
13:46:07.0163 0x26f4  [ F6B89D7078138FE6E9C00CF311FFE517, 701A33BB32A0289B2878268A27A5F4D36167C126601D51DC6EEE1C109E990868 ] vmx86           C:\WINDOWS\system32\drivers\vmx86.sys
13:46:07.0191 0x26f4  vmx86 - ok
13:46:07.0240 0x26f4  volmgr - ok
13:46:07.0245 0x26f4  volmgrx - ok
13:46:07.0249 0x26f4  volsnap - ok
13:46:07.0279 0x26f4  volume - ok
13:46:07.0302 0x26f4  vpci - ok
13:46:07.0318 0x26f4  vsmraid - ok
13:46:07.0386 0x26f4  [ CB4D2E3C5E8BFA3CF6AFFF6DDC6CC70D, 32A891045AF36FEAC62373894B98ABDCEA437978BDE027169C22EBC2C72D586E ] vsock           C:\WINDOWS\system32\drivers\vsock.sys
13:46:07.0448 0x26f4  vsock - ok
13:46:07.0454 0x26f4  VSS - ok
13:46:07.0482 0x26f4  VSTXRAID - ok
13:46:07.0503 0x26f4  vwifibus - ok
13:46:07.0508 0x26f4  vwififlt - ok
13:46:07.0513 0x26f4  vwifimp - ok
13:46:07.0536 0x26f4  W32Time - ok
13:46:07.0561 0x26f4  WacomPen - ok
13:46:07.0606 0x26f4  WalletService - ok
13:46:07.0629 0x26f4  wanarp - ok
13:46:07.0634 0x26f4  wanarpv6 - ok
13:46:07.0662 0x26f4  wbengine - ok
13:46:07.0712 0x26f4  WbioSrvc - ok
13:46:07.0728 0x26f4  wcifs - ok
13:46:07.0746 0x26f4  Wcmsvc - ok
13:46:07.0788 0x26f4  wcncsvc - ok
13:46:07.0802 0x26f4  wcnfs - ok
13:46:07.0839 0x26f4  WdBoot - ok
13:46:07.0845 0x26f4  Wdf01000 - ok
13:46:07.0850 0x26f4  WdFilter - ok
13:46:07.0865 0x26f4  WdiServiceHost - ok
13:46:07.0870 0x26f4  WdiSystemHost - ok
13:46:07.0907 0x26f4  wdiwifi - ok
13:46:07.0941 0x26f4  WdNisDrv - ok
13:46:07.0986 0x26f4  WdNisSvc - ok
13:46:08.0012 0x26f4  WebClient - ok
13:46:08.0025 0x26f4  Wecsvc - ok
13:46:08.0067 0x26f4  WEPHOSTSVC - ok
13:46:08.0125 0x26f4  wercplsupport - ok
13:46:08.0167 0x26f4  WerSvc - ok
13:46:08.0173 0x26f4  WFPLWFS - ok
13:46:08.0210 0x26f4  WiaRpc - ok
13:46:08.0223 0x26f4  WIMMount - ok
13:46:08.0226 0x26f4  WinDefend - ok
13:46:08.0280 0x26f4  WindowsTrustedRT - ok
13:46:08.0310 0x26f4  WindowsTrustedRTProxy - ok
13:46:08.0328 0x26f4  WinHttpAutoProxySvc - ok
13:46:08.0394 0x26f4  WinMad - ok
13:46:08.0487 0x26f4  Winmgmt - ok
13:46:08.0521 0x26f4  WinRM - ok
13:46:08.0581 0x26f4  WINUSB - ok
13:46:08.0596 0x26f4  WinVerbs - ok
13:46:08.0636 0x26f4  wisvc - ok
13:46:08.0691 0x26f4  WlanSvc - ok
13:46:08.0724 0x26f4  wlidsvc - ok
13:46:08.0729 0x26f4  WmiAcpi - ok
13:46:08.0757 0x26f4  wmiApSrv - ok
13:46:08.0761 0x26f4  WMPNetworkSvc - ok
13:46:08.0799 0x26f4  Wof - ok
13:46:08.0842 0x26f4  workfolderssvc - ok
13:46:08.0892 0x26f4  WPDBusEnum - ok
13:46:08.0936 0x26f4  WpdUpFltr - ok
13:46:08.0974 0x26f4  WpnService - ok
13:46:08.0996 0x26f4  WpnUserService - ok
13:46:09.0013 0x26f4  ws2ifsl - ok
13:46:09.0029 0x26f4  wscsvc - ok
13:46:09.0035 0x26f4  WSearch - ok
13:46:09.0071 0x26f4  wuauserv - ok
13:46:09.0105 0x26f4  WudfPf - ok
13:46:09.0115 0x26f4  WUDFRd - ok
13:46:09.0131 0x26f4  wudfsvc - ok
13:46:09.0136 0x26f4  WUDFWpdFs - ok
13:46:09.0141 0x26f4  WUDFWpdMtp - ok
13:46:09.0164 0x26f4  WwanSvc - ok
13:46:09.0189 0x26f4  XblAuthManager - ok
13:46:09.0224 0x26f4  XblGameSave - ok
13:46:09.0231 0x26f4  xboxgip - ok
13:46:09.0269 0x26f4  XboxNetApiSvc - ok
13:46:09.0308 0x26f4  xinputhid - ok
13:46:09.0352 0x26f4  xusb22 - ok
13:46:09.0352 0x26f4  ================ Scan global ===============================
13:46:09.0462 0x26f4  [ Global ] - ok
13:46:09.0487 0x26f4  ================ Scan MBR ==================================
13:46:09.0541 0x26f4  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
13:46:19.0064 0x26f4  \Device\Harddisk0\DR0 - ok
13:46:19.0078 0x26f4  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk1\DR1
13:46:20.0220 0x26f4  \Device\Harddisk1\DR1 - ok
13:46:20.0234 0x26f4  [ EA923EB0EC0060F1451E9AD7B5762CFE ] \Device\Harddisk2\DR2
13:46:20.0378 0x26f4  \Device\Harddisk2\DR2 - ok
13:46:20.0379 0x26f4  ================ Scan VBR ==================================
13:46:20.0410 0x26f4  [ 49584FC3CEF718E95383334BBE44A26C ] \Device\Harddisk0\DR0\Partition1
13:46:20.0444 0x26f4  \Device\Harddisk0\DR0\Partition1 - ok
13:46:20.0471 0x26f4  [ 9CC34D5839F14F91915221DC674E9829 ] \Device\Harddisk0\DR0\Partition2
13:46:20.0558 0x26f4  \Device\Harddisk0\DR0\Partition2 - ok
13:46:20.0566 0x26f4  [ 2342137B7D2E664AFD8F47ED92D9666C ] \Device\Harddisk1\DR1\Partition1
13:46:20.0589 0x26f4  \Device\Harddisk1\DR1\Partition1 - ok
13:46:20.0593 0x26f4  [ 46E119D11DD0764FF2F5BC8653170BAD ] \Device\Harddisk2\DR2\Partition1
13:46:20.0594 0x26f4  \Device\Harddisk2\DR2\Partition1 - ok
13:46:20.0632 0x26f4  [ 5866AC64B6DF731BD073909F7DF5C6FA ] \Device\Harddisk2\DR2\Partition2
13:46:20.0633 0x26f4  \Device\Harddisk2\DR2\Partition2 - ok
13:46:20.0634 0x26f4  ================ Scan generic autorun ======================
13:46:21.0231 0x26f4  [ 22EBD5AE3B3220D713E544D1D3AB3FEE, 9EF058B096DAA5C6242FBEB3DF509108180B1EB1EA252E63C437CF6C1B743BE0 ] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
13:46:21.0414 0x26f4  RTHDVCPL - ok
13:46:21.0941 0x26f4  [ 739D7E0025F5CE97309695D3081E3823, 46A4B51123992B2FA3DF51F80C3E9E7118C6CCB6A68B6EDA3585BF87208B7DFC ] C:\Program Files\AMD\CNext\CNext\cnext.exe
13:46:22.0163 0x26f4  StartCN - ok
13:46:22.0172 0x26f4  WindowsDefender - ok
13:46:22.0267 0x26f4  [ 64D89BDA981ECD2BC9B547E4210CA6E0, 403F685FBC8A71896F550476C3E3CAAC0D593F7CF25D4A2F61ED62D576E62F12 ] C:\Program Files\iTunes\iTunesHelper.exe
13:46:22.0318 0x26f4  iTunesHelper - ok
13:46:22.0428 0x26f4  [ 3BD79A1F6D2EA0FDDEA3F8914B2A6A0C, 332E6806EFF846A2E6D0DC04A70D3503855DABFA83E6EC27F37E2D9103E80E51 ] C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
13:46:22.0437 0x26f4  VirtualCloneDrive - ok
13:46:22.0567 0x26f4  [ 6F59A10A04D5B76903118C38C15B629C, 766763C1E291178A2EEE66341BF1F59C30CA62A90E86CFD95408346991773A5D ] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
13:46:22.0895 0x26f4  Adobe ARM - ok
13:46:23.0073 0x26f4  [ 56831CF0D755103BB0E7EA141A4895D9, 496A4EA8F84C0A9E79E1267B16B10F60F737F79BECBEECE593416D79F03B1063 ] C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
13:46:23.0255 0x26f4  SunJavaUpdateSched - ok
13:46:24.0553 0x26f4  OneDriveSetup - ok
13:46:24.0556 0x26f4  OneDriveSetup - ok
13:46:24.0945 0x26f4  [ F0B461FB820595E8BAF1161F55BE3E74, B8022060E7280DC568BFC230CA99D37C09092152D0CEE91B08401ACD725E82A2 ] C:\Users\Sergio\AppData\Roaming\Spotify\SpotifyWebHelper.exe
13:46:25.0204 0x26f4  Spotify Web Helper - ok
13:46:25.0545 0x26f4  [ FE9E6388A039441098EB09C070EA5049, 3888822AF992F3BE27E9F973E31EBEE5302901E4A8260A9A6CF6B2BB2A12D173 ] C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\GoogleUpdateCore.exe
13:46:25.0566 0x26f4  Google Update - ok
13:46:26.0118 0x26f4  [ CD7DC286D2FDFACB965C3E10967B2199, 30FFB133E70D694BE6968E86E999C797EE7349DCC4E9ACFB338412C039374388 ] C:\Users\Sergio\AppData\Local\Microsoft\OneDrive\OneDrive.exe
13:46:26.0161 0x26f4  OneDrive - ok
13:46:26.0816 0x26f4  [ 44A9229022A519ED45294A1934C05EEC, 6DEF0DB5F9B50E9B0AFEE1CF50066BEB4FB7E15E2DC829A499509925660D6992 ] C:\Users\Sergio\AppData\Local\FluxSoftware\Flux\flux.exe
13:46:27.0109 0x26f4  f.lux - ok
13:46:28.0518 0x26f4  [ 8D3D5BA1638778DE87503E5FEA68DC9F, D54C2B375A6F8A49BC53CAA3ED8A0EEBF53FD113BB47622F4AE6DA762D194FE7 ] C:\Program Files\CCleaner\CCleaner64.exe
13:46:28.0830 0x26f4  CCleaner Monitoring - ok
13:46:29.0061 0x26f4  [ 1A2214CF882CE18EF513BF2A33907C51, C1E9349EA50A239F440F0353CEEE544322F2C7F731166B3256F68108F1448C1A ] C:\Program Files\Sandboxie\SbieCtrl.exe
13:46:29.0107 0x26f4  SandboxieControl - ok
13:46:29.0111 0x26f4  OneDriveSetup - ok
13:46:29.0172 0x26f4  WAB Migrate - ok
13:46:29.0173 0x26f4  Waiting for KSN requests completion. In queue: 12
13:46:30.0185 0x26f4  AV detected via SS2: Windows Defender, C:\Program Files\Windows Defender\MSASCui.exe ( 4.10.14393.187 ), 0x61100 ( enabled : updated )
13:46:30.0190 0x26f4  Win FW state via NFP2: enabled ( trusted )
13:46:30.0301 0x26f4  ============================================================
13:46:30.0301 0x26f4  Scan finished
13:46:30.0301 0x26f4  ============================================================
13:46:30.0311 0x1510  Detected object count: 0
13:46:30.0311 0x1510  Actual detected object count: 0
         

Hier die FRST.txt

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 15-03-2017
durchgeführt von Sergio (Administrator) auf SERGIOS-PC (19-03-2017 13:51:53)
Gestartet von C:\Users\Sergio\Desktop
Geladene Profile: Sergio (Verfügbare Profile: Sergio & postgres)
Platform: Windows 10 Pro Version 1607 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
(Tenable Network Security, Inc) C:\Program Files\Tenable\Nessus\nessus-service.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(Tenable Network Security, Inc) C:\Program Files\Tenable\Nessus\nessusd.exe
(AMD) C:\Windows\System32\atieclxx.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\cnext.exe
(Flux Software LLC) C:\Users\Sergio\AppData\Local\FluxSoftware\Flux\flux.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.214.10010.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\Evernote.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteTray.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Chip Digital GmbH) C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
() C:\Program Files (x86)\SpeedFan\speedfan.exe
() C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8008.42007.0_x64__8wekyb3d8bbwe\HxMail.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8008.42007.0_x64__8wekyb3d8bbwe\HxTsr.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8492800 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\cnext.exe [4926664 2016-02-26] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2016-09-07] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176440 2017-01-19] (Apple Inc.)
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1160408 2016-12-17] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation)
HKU\AvGeneric_S-1-5-21-1478414814-3749218601-3539646535-1007\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [516608 2016-07-16] (Microsoft Corporation)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [Spotify Web Helper] => C:\Users\Sergio\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1446000 2017-03-11] (Spotify Ltd)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [Google Update] => C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\GoogleUpdateCore.exe [601752 2016-12-18] (Google Inc.)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [f.lux] => C:\Users\Sergio\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9364696 2017-03-03] (Piriform Ltd)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [799376 2016-12-14] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\MountPoints2: {b52f257e-9541-11e6-82b3-485b39c9a198} - "K:\HiSuiteDownLoader.exe" 
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [00ExpanDriveExt1] -> {C955792B-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [00ExpanDriveExt2] -> {C955792C-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [00ExpanDriveExt1] -> {C955792B-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [00ExpanDriveExt2] -> {C955792C-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Audible Download Manager.lnk [2015-05-07]
ShortcutTarget: Audible Download Manager.lnk -> C:\Program Files (x86)\Audible\Bin\AudibleDownloadHelper.exe (Keine Datei)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FocalFilterHelper.lnk [2016-02-26]
ShortcutTarget: FocalFilterHelper.lnk -> C:\Program Files (x86)\FocalFilter\FocalFilterHelper.exe (Microsoft)
Startup: C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2015-08-09]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2016-04-20]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BootExecute: autocheck autochk * sdnclean64.exe
GroupPolicy\User: Beschränkung <======= ACHTUNG

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{65462354-7EE1-4401-902C-4D58B7DBDA87}: [DhcpNameServer] 7.254.254.254
Tcpip\..\Interfaces\{8c608b9e-9074-4d1b-b1db-702840d39f03}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{aa6288ab-a4c6-4734-8fa6-9d9b694d76cd}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131343881188462559&GUID=D7BDAEA9-5712-40E5-A2B9-98992E8B0FDB
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131343881188468475&GUID=D7BDAEA9-5712-40E5-A2B9-98992E8B0FDB
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\AvGeneric_S-1-5-21-1478414814-3749218601-3539646535-1007 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_121\bin\ssv.dll [2017-03-18] (Oracle Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-03-18] (Oracle Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2016-10-31] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2016-05-17] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default [2017-03-19]
FF NewTab: Mozilla\Firefox\Profiles\0fihcjle.default -> about:newtab
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\0fihcjle.default -> Google
FF DefaultSearchUrl: Mozilla\Firefox\Profiles\0fihcjle.default -> hxxps://www.google.com/search?bcutc=sp-006
FF SearchEngineOrder.1: Mozilla\Firefox\Profiles\0fihcjle.default -> Google
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\0fihcjle.default -> Google
FF Homepage: Mozilla\Firefox\Profiles\0fihcjle.default -> about:home
FF Keyword.URL: Mozilla\Firefox\Profiles\0fihcjle.default -> hxxps://www.google.com/search?bcutc=sp-006
FF Extension: (BeeLine Reader) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\beelinereader-firefox@beelinereader.com.xpi [2016-03-08]
FF Extension: (FoxyProxy Standard) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\foxyproxy@eric.h.jung [2017-02-07]
FF Extension: (convert2mp3.net YouTube2MP3 Converter) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\info@convert2mp3.net.xpi [2016-12-15]
FF Extension: (pdf updater) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{34840d80-0446-4a42-83ce-5c0fa22cd4e3}.xpi [2016-05-18] [ist nicht signiert]
FF Extension: (NoScript) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2016-08-13]
FF Extension: (LeechBlock) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{a95d8332-e4b4-6e7f-98ac-20b733364387} [2017-01-22]
FF Extension: (Adblock Plus) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-24]
FF Extension: (DownThemAll!) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2016-04-15]
FF SearchPlugin: C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\searchplugins\google-avast.xml [2017-03-18]
FF HKLM\...\Firefox\Extensions: [soda_pdf_desktop_conv@sodapdf.com] - C:\Program Files\Soda PDF Desktop\resources\sodapdfdesktopfirefoxextension => nicht gefunden
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_25_0_0_127.dll [2017-03-18] ()
FF Plugin: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-03-18] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-03-18] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50905.0\npctrl.dll [2017-02-10] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_25_0_0_127.dll [2017-03-18] ()
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-07-19] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50905.0\npctrl.dll [2017-02-10] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2016-12-17] (Adobe Systems Inc.)
FF Plugin-x32: Soda PDF Desktop -> C:\Program Files (x86)\Soda PDF Desktop\np-previewer.dll [Keine Datei]
FF Plugin HKU\S-1-5-21-1478414814-3749218601-3539646535-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-18] (Google Inc.)
FF Plugin HKU\S-1-5-21-1478414814-3749218601-3539646535-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-18] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2016-07-19] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-12-17] (Adobe Systems Inc.)

Chrome: 
=======
CHR DefaultProfile: Default
CHR Profile: C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default [2017-03-18]
CHR Extension: (Google Präsentationen) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-03-26]
CHR Extension: (Google Docs) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-03-26]
CHR Extension: (Google Drive) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-03-11]
CHR Extension: (YouTube) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-03-11]
CHR Extension: (Google-Suche) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-03-11]
CHR Extension: (Google Tabellen) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-03-26]
CHR Extension: (Google Docs Offline) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-21]
CHR Extension: (AMZ Seller Browser) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\klgpelgeohjghmccooegimcfhanlnngc [2016-05-09]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-12]
CHR Extension: (Google Mail) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-01]
CHR Extension: (Chrome Media Router) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-03-11]

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-08-04] (Advanced Micro Devices, Inc.) [Datei ist nicht signiert]
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)
R2 chip1click; C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe [91136 2016-10-27] (Chip Digital GmbH) [Datei ist nicht signiert]
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [197776 2016-12-14] (Sandboxie Holdings, LLC)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-09-15] (Microsoft Corporation)
R2 Tenable Nessus; C:\Program Files\Tenable\Nessus\nessus-service.exe [17376 2017-02-15] (Tenable Network Security, Inc)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
S3 Soda PDF Desktop; "C:\Program Files\Soda PDF Desktop\ws.exe" [X]
S3 Soda PDF Desktop CrashHandler; "C:\Program Files\Soda PDF Desktop\crash-handler-ws.exe" [X]
S2 Soda PDF Desktop Creator; "C:\Program Files\Soda PDF Desktop\creator-ws.exe" [X]

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S0 amdkmafd; C:\WINDOWS\System32\drivers\amdkmafd.sys [23240 2016-02-26] (Advanced Micro Devices, Inc.)
R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R3 AtiHDAudioService; C:\WINDOWS\system32\drivers\AtihdWT6.sys [102400 2016-02-26] (Advanced Micro Devices)
S3 HTCAND64; C:\WINDOWS\System32\Drivers\ANDROIDUSB.sys [33736 2009-11-02] (HTC, Corporation) [Datei ist nicht signiert]
S3 HtcVCom32; C:\WINDOWS\system32\DRIVERS\HtcVComV64.sys [121800 2010-03-09] (QUALCOMM Incorporated) [Datei ist nicht signiert]
R3 MTsensor; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [17280 2013-05-17] ()
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [589824 2016-07-16] (Realtek                                            )
S3 RtlWlanu_OldIC; C:\WINDOWS\System32\drivers\rtwlanu_oldIC.sys [3814400 2016-07-16] (Realtek Semiconductor Corporation                           )
S3 rzdaendpt; C:\WINDOWS\System32\drivers\rzdaendpt.sys [33448 2014-09-05] (Razer Inc)
S3 rzvkeyboard; C:\WINDOWS\System32\drivers\rzvkeyboard.sys [31912 2014-09-05] (Razer Inc)
S3 SaiK0728; C:\WINDOWS\system32\DRIVERS\SaiK0728.sys [129024 2008-01-21] (Saitek)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [205968 2016-12-14] (Sandboxie Holdings, LLC)
R1 VBoxNetAdp; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys [131144 2017-01-16] (Oracle Corporation)
R1 VBoxNetLwf; C:\WINDOWS\system32\DRIVERS\VBoxNetLwf.sys [205440 2017-01-16] (Oracle Corporation)
R0 vsock; C:\WINDOWS\System32\drivers\vsock.sys [73296 2013-10-08] (VMware, Inc.)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
U3 DfSdkS; kein ImagePath

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-03-19 13:51 - 2017-03-19 13:52 - 00022199 _____ C:\Users\Sergio\Desktop\FRST.txt
2017-03-19 13:44 - 2017-03-19 13:49 - 00082710 _____ C:\TDSSKiller.3.1.0.12_19.03.2017_13.44.46_log.txt
2017-03-19 13:44 - 2017-03-19 13:44 - 04747704 _____ (AO Kaspersky Lab) C:\Users\Sergio\Desktop\tdsskiller.exe
2017-03-19 11:34 - 2017-03-19 11:34 - 00000085 _____ C:\WINDOWS\wininit.ini
2017-03-19 11:34 - 2017-03-19 11:34 - 00000000 ____D C:\WINDOWS\System32\Tasks\Safer-Networking
2017-03-19 10:13 - 2017-03-18 23:42 - 00032088 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswCD5C.tmp
2017-03-19 10:13 - 2017-03-18 23:41 - 00548928 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswCE6B.tmp
2017-03-19 10:13 - 2017-03-18 23:41 - 00337592 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswCE8B.tmp
2017-03-19 10:13 - 2017-03-18 23:41 - 00162528 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswCEFA.tmp
2017-03-19 10:13 - 2017-03-18 23:41 - 00126600 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswCE4A.tmp
2017-03-19 10:13 - 2017-03-18 23:41 - 00100640 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswCDBB.tmp
2017-03-19 10:13 - 2017-03-18 23:41 - 00075704 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswCE5B.tmp
2017-03-19 10:13 - 2017-03-18 23:41 - 00038296 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswCE39.tmp
2017-03-19 10:13 - 2017-03-18 23:40 - 00993608 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswCD8B.tmp
2017-03-19 10:13 - 2017-03-18 23:40 - 00334600 _____ (AVAST Software s.r.o.) C:\WINDOWS\system32\Drivers\aswCC50.tmp
2017-03-19 10:13 - 2017-03-18 23:40 - 00309272 _____ (AVAST Software s.r.o.) C:\WINDOWS\system32\Drivers\aswCC0F.tmp
2017-03-19 10:13 - 2017-03-18 23:40 - 00189768 _____ (AVAST Software s.r.o.) C:\WINDOWS\system32\Drivers\aswCC30.tmp
2017-03-19 10:13 - 2017-03-18 23:40 - 00048528 _____ (AVAST Software s.r.o.) C:\WINDOWS\system32\Drivers\aswCC70.tmp
2017-03-19 02:00 - 2017-03-19 02:00 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\QuickScan
2017-03-19 01:43 - 2017-03-19 13:51 - 00000000 ____D C:\FRST
2017-03-19 01:42 - 2017-03-19 01:42 - 02424832 _____ (Farbar) C:\Users\Sergio\Desktop\FRST64.exe
2017-03-19 01:12 - 2017-03-19 01:12 - 00000000 ____D C:\Users\Sergio\AppData\Local\AdAwareDesktop
2017-03-19 01:10 - 2017-03-19 01:10 - 00000000 ____D C:\Users\Sergio\AppData\Local\AdAwareUpdater
2017-03-19 01:10 - 2017-03-19 01:10 - 00000000 ____D C:\Program Files\Common Files\adaware
2017-03-19 01:07 - 2017-03-19 11:34 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2017-03-19 01:07 - 2017-03-19 11:34 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2017-03-19 01:05 - 2017-03-19 01:06 - 00001748 _____ C:\WINDOWS\Sandboxie.ini
2017-03-19 01:05 - 2017-03-19 01:04 - 00000955 _____ C:\Users\Sergio\Desktop\Sandboxed Web Browser.lnk
2017-03-19 01:04 - 2017-03-19 01:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2017-03-19 01:04 - 2017-03-19 01:04 - 00000000 ____D C:\Program Files\Sandboxie
2017-03-19 01:02 - 2017-03-19 01:02 - 00000000 ___HD C:\$SysReset
2017-03-19 01:02 - 2017-03-19 01:02 - 00000000 ____D C:\WINDOWS\Panther
2017-03-19 00:06 - 2017-03-19 00:06 - 00217088 _____ C:\Users\postgres\NTUSER.rhk
2017-03-19 00:03 - 2017-03-19 00:03 - 00015836 _____ C:\Users\Sergio\Documents\cc_20170319_000336.reg
2017-03-18 23:51 - 2017-03-18 23:51 - 00001822 _____ C:\Users\Public\Desktop\iTunes.lnk
2017-03-18 23:51 - 2017-03-18 23:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2017-03-18 23:50 - 2017-03-18 23:51 - 00000000 ____D C:\Program Files\iTunes
2017-03-18 23:50 - 2017-03-18 23:50 - 00000000 ____D C:\Program Files\iPod
2017-03-18 23:49 - 2017-03-18 23:49 - 00000000 ____D C:\Program Files\Bonjour
2017-03-18 23:49 - 2017-03-18 23:49 - 00000000 ____D C:\Program Files (x86)\Bonjour
2017-03-18 23:42 - 2017-03-18 23:42 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\AVAST Software
2017-03-18 23:41 - 2017-03-18 23:41 - 00547904 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswsp.sys.148987690906204
2017-03-18 23:41 - 2017-03-18 23:41 - 00337592 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswvmm.sys.148987691079606
2017-03-18 23:41 - 2017-03-18 23:41 - 00000000 ____D C:\WINDOWS\System32\Tasks\AVAST Software
2017-03-18 23:41 - 2017-03-18 23:41 - 00000000 ____D C:\Program Files\Common Files\AV
2017-03-18 23:40 - 2017-03-18 23:42 - 00000000 ____D C:\Program Files\AVAST Software
2017-03-18 23:39 - 2017-03-19 10:14 - 00000000 ____D C:\ProgramData\AVAST Software
2017-03-18 23:01 - 2017-03-19 00:06 - 04333568 _____ C:\Users\Sergio\NTUSER.rhk
2017-03-18 23:01 - 2017-03-18 23:01 - 00004058 _____ C:\WINDOWS\System32\Tasks\Wise Registry Cleaner Schedule Task
2017-03-18 22:57 - 2017-03-18 22:57 - 00763016 _____ C:\Users\Sergio\Documents\cc_20170318_225706.reg
2017-03-18 22:55 - 2017-03-18 22:55 - 00001329 _____ C:\Users\Public\Desktop\Ashampoo WinOptimizer 2017.lnk
2017-03-18 22:55 - 2017-03-18 22:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
2017-03-18 22:55 - 2017-03-18 22:55 - 00000000 ____D C:\ProgramData\Ashampoo
2017-03-18 22:55 - 2017-03-18 22:55 - 00000000 ____D C:\Program Files (x86)\Ashampoo
2017-03-18 22:55 - 2009-08-24 21:13 - 00034304 _____ (mst software GmbH, Germany) C:\WINDOWS\system32\DfSdkBt.exe
2017-03-18 22:53 - 2017-03-18 23:01 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Wise Registry Cleaner
2017-03-18 22:53 - 2017-03-18 23:01 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Wise Euask
2017-03-18 22:53 - 2017-03-18 22:53 - 00001304 _____ C:\Users\Public\Desktop\Wise Registry Cleaner.lnk
2017-03-18 22:53 - 2017-03-18 22:53 - 00000000 ____D C:\WINDOWS\System32\Tasks\WiseCleaner
2017-03-18 22:53 - 2017-03-18 22:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Registry Cleaner
2017-03-18 22:53 - 2017-03-18 22:53 - 00000000 ____D C:\Program Files (x86)\Wise
2017-03-18 22:53 - 2017-03-18 22:53 - 00000000 ____D C:\Program Files (x86)\Chip Digital GmbH
2017-03-18 22:48 - 2017-03-18 22:48 - 00002862 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2017-03-18 22:48 - 2017-03-18 22:48 - 00000863 _____ C:\Users\Public\Desktop\CCleaner.lnk
2017-03-18 22:48 - 2017-03-18 22:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2017-03-18 22:48 - 2017-03-18 22:48 - 00000000 ____D C:\Program Files\CCleaner
2017-03-18 22:25 - 2016-06-05 07:42 - 00000000 ____D C:\Users\Sergio\Desktop\Python 3 - Intensivkurs  Projekte erfolgreich realisieren By Mark Pilgrim
2017-03-18 21:48 - 2016-09-01 12:09 - 00000000 ____D C:\Users\Sergio\Desktop\Yael Adler - Haut nah. Alles über unser größtes Organ inkl. pdf
2017-03-18 21:47 - 2016-10-17 16:46 - 00000000 ____D C:\Users\Sergio\Desktop\Nadja Hermann - Fettlogik überwinden
2017-03-18 01:04 - 2017-03-17 21:06 - 00000000 ____D C:\Users\Sergio\Desktop\Gunter Dueck - Flachsinn_ Ich habe Hirn, ich will hier raus
2017-03-16 21:27 - 2016-11-24 02:24 - 00000000 ____D C:\Users\Sergio\Desktop\Haiyti - Nightliner (2016)
2017-03-13 20:44 - 2017-03-13 20:44 - 14966655 _____ C:\Users\Sergio\Desktop\3662536676.psychologie.der.maerchen.2017.by.www.lul.to.pdf
2017-03-12 12:29 - 2017-03-12 12:26 - 00074345 ____N C:\Users\Sergio\Desktop\11057856.pdf
2017-03-11 11:55 - 2017-03-11 11:55 - 00000000 ____D C:\Users\Sergio\AppData\Local\TeamSpeak 3
2017-03-11 11:55 - 2017-03-11 11:55 - 00000000 ____D C:\Users\Sergio\.TeamSpeak 3
2017-03-10 22:56 - 2017-03-10 22:56 - 00000000 ____D C:\Users\Sergio\PycharmProjects
2017-03-10 22:55 - 2017-03-10 22:55 - 00001078 _____ C:\Users\Sergio\Desktop\JetBrains PyCharm Community Edition 2016.3.2.lnk
2017-03-10 22:55 - 2017-03-10 22:55 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\JetBrains
2017-03-10 22:55 - 2017-03-10 22:55 - 00000000 ____D C:\Users\Sergio\.PyCharmCE2016.3
2017-03-10 22:54 - 2017-03-10 22:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JetBrains
2017-03-10 22:54 - 2017-03-10 22:54 - 00000000 ____D C:\Program Files (x86)\JetBrains
2017-03-09 16:03 - 2017-03-09 16:03 - 00002713 _____ C:\Users\Sergio\Desktop\IDLE (Python 3.6 64-bit).lnk
2017-03-09 16:03 - 2017-03-09 16:03 - 00001520 _____ C:\Users\Sergio\Desktop\Python 3.6 (64-bit).lnk
2017-03-09 15:59 - 2017-03-09 15:59 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Python 3.6
2017-03-09 15:59 - 2017-03-09 15:59 - 00000000 ____D C:\Users\Sergio\AppData\Local\Package Cache
2017-03-08 16:00 - 2017-03-08 16:00 - 06744873 ____R C:\Users\Sergio\Desktop\3658108576.ich.glaube.es.hackt.2016.4.auflage.by.www.lul.to.pdf
2017-03-06 19:08 - 2017-03-06 19:08 - 00004296 _____ C:\WINDOWS\System32\Tasks\AMD Updater
2017-03-06 19:07 - 2017-03-06 19:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Radeon Settings
2017-03-06 18:50 - 2017-03-06 18:50 - 00000000 ____D C:\Users\Sergio\.Plays.tv
2017-03-05 18:37 - 2017-01-01 17:08 - 00000000 ____D C:\Users\Sergio\Desktop\Tory Lanez - Chixtape 4 (DatPiff.com)
2017-03-05 18:27 - 2017-03-05 18:27 - 00000000 ____D C:\ProgramData\GeoComply
2017-03-04 21:04 - 2017-03-04 21:06 - 00000000 ____D C:\Users\Sergio\VirtualBox VMs
2017-03-04 20:55 - 2017-03-05 14:02 - 00000000 ____D C:\Users\Sergio\.VirtualBox
2017-03-04 20:55 - 2017-03-04 20:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2017-03-04 20:55 - 2017-03-04 20:55 - 00000000 ____D C:\Program Files\Oracle
2017-03-04 20:55 - 2017-01-16 17:38 - 00959720 _____ (Oracle Corporation) C:\WINDOWS\system32\Drivers\VBoxDrv.sys
2017-03-04 20:55 - 2017-01-16 17:38 - 00149304 _____ (Oracle Corporation) C:\WINDOWS\system32\Drivers\VBoxUSBMon.sys
2017-03-01 23:49 - 2017-03-17 23:57 - 00001024 _____ C:\.rnd
2017-03-01 23:49 - 2017-03-01 23:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tenable Network Security
2017-03-01 23:48 - 2017-03-01 23:48 - 00000000 ____D C:\ProgramData\Tenable
2017-03-01 23:48 - 2017-03-01 23:48 - 00000000 ____D C:\Program Files\Tenable
2017-02-28 21:46 - 2017-03-05 11:48 - 00000000 ____D C:\Users\Sergio\Desktop\Ethic Hacking
2017-02-28 21:33 - 2017-02-28 21:33 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\.maltego
2017-02-28 21:33 - 2017-02-28 21:33 - 00000000 ____D C:\ProgramData\Paterva
2017-02-28 21:33 - 2017-02-28 21:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paterva
2017-02-28 21:32 - 2017-02-28 21:32 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Sun
2017-02-28 21:32 - 2017-02-28 21:32 - 00000000 ____D C:\Program Files (x86)\Paterva
2017-02-28 21:31 - 2017-03-18 23:51 - 00110144 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll
2017-02-28 21:31 - 2017-03-18 23:51 - 00000000 ____D C:\Program Files\Java
2017-02-27 22:16 - 2015-06-24 14:30 - 00064728 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vmx86.sys
2017-02-27 22:16 - 2013-10-08 18:21 - 00073296 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vsock.sys
2017-02-27 22:16 - 2013-10-08 18:21 - 00067664 _____ (VMware, Inc.) C:\WINDOWS\system32\vsocklib.dll
2017-02-27 22:16 - 2013-10-08 18:21 - 00063568 _____ (VMware, Inc.) C:\WINDOWS\SysWOW64\vsocklib.dll
2017-02-27 22:15 - 2015-06-24 14:30 - 00437976 _____ (VMware, Inc.) C:\WINDOWS\SysWOW64\vmnat.exe
2017-02-27 22:15 - 2015-06-24 14:30 - 00359128 _____ (VMware, Inc.) C:\WINDOWS\SysWOW64\vmnetdhcp.exe
2017-02-27 22:15 - 2015-06-24 14:27 - 00031448 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vmnetuserif.sys
2017-02-27 22:14 - 2017-02-27 22:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware
2017-02-27 22:14 - 2017-02-27 22:14 - 00000000 ____D C:\Program Files\Common Files\VMware
2017-02-27 22:14 - 2017-02-27 22:14 - 00000000 ____D C:\Program Files (x86)\VMware
2017-02-27 22:14 - 2015-06-24 14:27 - 00931032 _____ (VMware, Inc.) C:\WINDOWS\system32\vnetlib64.dll
2017-02-27 22:14 - 2014-08-21 08:07 - 00054976 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\hcmon.sys
2017-02-27 22:14 - 2014-08-21 08:06 - 00058048 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vmusb.sys
2017-02-27 22:11 - 2017-02-27 22:42 - 00000000 ____D C:\Users\Sergio\Documents\Virtual Machines
2017-02-27 19:48 - 2017-02-27 19:48 - 00000000 ____D C:\Users\Sergio\.idlerc

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-03-19 13:41 - 2016-09-29 20:02 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-03-19 11:34 - 2016-09-29 20:05 - 00000000 ____D C:\Users\Sergio
2017-03-19 11:34 - 2016-07-16 07:04 - 00032768 _____ C:\WINDOWS\system32\config\ELAM
2017-03-19 11:34 - 2015-06-02 19:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-03-19 03:10 - 2016-10-04 16:41 - 00000000 ____D C:\Program Files (x86)\SpeedFan
2017-03-19 00:55 - 2016-07-16 12:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-03-19 00:37 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-03-19 00:07 - 2016-07-16 12:45 - 00000000 ____D C:\WINDOWS\INF
2017-03-19 00:06 - 2016-09-29 20:05 - 00000000 ____D C:\Users\postgres
2017-03-18 23:52 - 2016-09-29 20:14 - 00004440 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2017-03-18 23:52 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2017-03-18 23:52 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\Macromed
2017-03-18 23:52 - 2014-10-27 17:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-03-18 23:52 - 2014-10-26 12:23 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-03-18 23:52 - 2014-10-26 12:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-03-18 23:52 - 2014-10-26 12:23 - 00000000 ____D C:\Program Files\WinRAR
2017-03-18 23:51 - 2014-10-26 12:41 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2017-03-18 23:50 - 2015-05-06 18:27 - 00000000 ____D C:\Program Files\Common Files\Apple
2017-03-18 23:49 - 2014-10-26 00:07 - 00001151 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-03-18 23:02 - 2015-03-10 17:03 - 00000000 ____D C:\Users\Sergio\AppData\LocalLow\Temp
2017-03-18 22:59 - 2014-10-26 12:50 - 00000000 ____D C:\Users\Sergio\AppData\Local\JDownloader v2.0
2017-03-18 22:55 - 2016-09-23 20:37 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\TS3Client
2017-03-18 22:55 - 2014-11-05 17:58 - 00000000 ____D C:\Program Files (x86)\Steam
2017-03-18 22:50 - 2014-10-26 10:16 - 00000000 ____D C:\Users\Sergio\AppData\Local\Razer
2017-03-18 22:50 - 2014-10-26 00:15 - 00000000 ____D C:\ProgramData\Razer
2017-03-18 22:50 - 2014-10-26 00:15 - 00000000 ____D C:\Program Files (x86)\Razer
2017-03-18 21:23 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2017-03-18 00:59 - 2014-10-27 09:42 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\vlc
2017-03-18 00:21 - 2014-10-29 14:39 - 00000000 ____D C:\WINDOWS\system32\MRT
2017-03-18 00:19 - 2015-04-16 15:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2017-03-18 00:19 - 2014-10-29 14:39 - 138634176 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-03-18 00:18 - 2015-04-16 15:08 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2017-03-18 00:18 - 2015-04-16 15:08 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2017-03-18 00:18 - 2014-10-26 12:31 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2017-03-18 00:15 - 2016-11-05 15:37 - 00000000 ____D C:\Users\Sergio\AppData\Local\ElevatedDiagnostics
2017-03-18 00:14 - 2016-07-16 12:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-03-18 00:00 - 2016-07-16 23:51 - 01032822 _____ C:\WINDOWS\system32\perfh007.dat
2017-03-18 00:00 - 2016-07-16 23:51 - 00243530 _____ C:\WINDOWS\system32\perfc007.dat
2017-03-18 00:00 - 2015-08-09 20:57 - 02469750 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-03-17 23:52 - 2014-10-27 17:10 - 00000000 ____D C:\ProgramData\VMware
2017-03-17 23:51 - 2016-09-29 20:14 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-03-16 22:25 - 2016-07-16 07:04 - 00786432 _____ C:\WINDOWS\system32\config\BBI
2017-03-16 21:23 - 2013-08-22 14:25 - 00000167 _____ C:\WINDOWS\win.ini
2017-03-14 19:22 - 2014-12-23 17:29 - 00000000 ____D C:\Users\Sergio\AppData\Local\Spotify
2017-03-13 20:27 - 2014-10-27 17:14 - 00000000 ____D C:\Users\Sergio\AppData\Local\VMware
2017-03-13 19:32 - 2014-12-23 17:28 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Spotify
2017-03-13 19:07 - 2014-10-27 17:14 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\VMware
2017-03-11 14:19 - 2016-10-23 19:11 - 00000000 ____D C:\Users\Sergio\Documents\Soda PDF Files
2017-03-11 14:19 - 2016-10-23 19:11 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Soda PDF Desktop
2017-03-11 12:13 - 2014-12-13 14:35 - 00000000 ____D C:\Users\Sergio\AppData\Local\PokerStars.EU
2017-03-11 12:12 - 2014-12-13 14:34 - 00000000 ____D C:\Program Files (x86)\PokerStars.EU
2017-03-11 11:55 - 2016-09-23 20:37 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2017-03-10 06:17 - 2016-07-16 12:49 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-03-10 06:17 - 2016-07-16 12:49 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-03-06 19:07 - 2016-09-29 20:03 - 00000000 ____D C:\Program Files\AMD
2017-03-06 19:07 - 2015-05-19 18:55 - 00000000 ____D C:\Program Files (x86)\AMD
2017-03-06 19:07 - 2014-10-26 00:19 - 00000000 ____D C:\Users\Sergio\AppData\Local\AMD
2017-03-06 19:04 - 2014-10-26 00:14 - 00000000 ____D C:\AMD
2017-03-06 18:50 - 2016-09-29 20:03 - 00000000 ____D C:\ProgramData\Package Cache
2017-03-06 18:48 - 2016-09-29 20:03 - 00000000 ____D C:\ProgramData\AMD
2017-03-04 23:55 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\NDF
2017-02-28 21:32 - 2016-02-14 18:43 - 00000000 ____D C:\Users\Sergio\.oracle_jre_usage
2017-02-27 22:14 - 2014-10-27 17:10 - 02053002 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2017-02-25 11:31 - 2014-10-25 23:53 - 00000000 ____D C:\Users\Sergio\AppData\Local\Packages

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2015-07-20 16:32 - 2015-07-20 16:32 - 0923401 _____ () C:\Program Files (x86)\WinDlg_124.zip
2015-07-12 10:02 - 2015-07-12 10:02 - 0000000 ___SH () C:\Users\Sergio\AppData\Local\LumaEmu
2016-07-03 18:51 - 2016-07-03 18:51 - 0000733 _____ () C:\Users\Sergio\AppData\Local\recently-used.xbel
2016-09-29 20:03 - 2016-09-29 20:03 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2015-07-06 20:11 - 2015-07-06 20:11 - 0005036 _____ () C:\ProgramData\flwjycbm.bab

Einige Dateien in TEMP:
====================
2017-03-19 03:10 - 2017-03-19 03:10 - 0192512 _____ () C:\Users\Sergio\AppData\Local\Temp\sfamcc00001.dll
2017-03-19 03:10 - 2017-03-19 03:10 - 0158720 _____ () C:\Users\Sergio\AppData\Local\Temp\sfareca00001.dll

==================== Bamital & volsnap ======================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert

LastRegBack: 2017-03-18 21:07

==================== Ende von FRST.txt ============================
         

Und hier die Addition.txt Da der Beitrag zu lang wurde

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 15-03-2017
durchgeführt von Sergio (19-03-2017 13:52:39)
Gestartet von C:\Users\Sergio\Desktop
Windows 10 Pro Version 1607 (X64) (2016-09-29 19:16:19)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-1478414814-3749218601-3539646535-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1478414814-3749218601-3539646535-503 - Limited - Disabled)
Gast (S-1-5-21-1478414814-3749218601-3539646535-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1478414814-3749218601-3539646535-1003 - Limited - Enabled)
postgres (S-1-5-21-1478414814-3749218601-3539646535-1007 - Limited - Enabled) => C:\Users\postgres
Sergio (S-1-5-21-1478414814-3749218601-3539646535-1001 - Administrator - Enabled) => C:\Users\Sergio

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Disabled - Up to date) {A16C3F68-9280-E053-1818-342707FECF4D}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Disabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 25.0.0.134 - Adobe Systems Incorporated)
Adobe Flash Player 25 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 25.0.0.127 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.19) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.19 - Adobe Systems Incorporated)
AMD Install Manager (HKLM\...\AMD Catalyst Install Manager) (Version: 5.00 - Advanced Micro Devices, Inc.)
Apple Application Support (32-Bit) (HKLM-x32\...\{9BA1A894-B42F-4805-BC8C-349C905A3930}) (Version: 5.3.1 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{7EAC8A42-9FAC-4F6B-AABF-C08C9F2E0F13}) (Version: 5.3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{55BB2110-FB43-49B3-93F4-945A0CFB0A6C}) (Version: 10.0.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Ashampoo WinOptimizer 2017 (HKLM-x32\...\{4209F371-6CE9-533C-2CDC-94E053273B35}_is1) (Version: 14.00.04 - Ashampoo GmbH & Co. KG)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
calibre 64bit (HKLM\...\{DD84AFA7-867C-428A-8FA4-59A98AB60A1F}) (Version: 2.7.0 - Kovid Goyal)
Catalyst Control Center Next Localization BR (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.28 - Piriform)
chip 1-click download service (HKLM-x32\...\{503CA94E-0834-4CEE-AD92-BA17AF4E809A}) (Version: 3.6.9.0 - Chip Digital GmbH)
ComicRack v0.9.176 (HKLM\...\ComicRack) (Version: v0.9.176 - cYo Soft)
Dragon Ball Xenoverse 2 Digitale Deluxe Edition MULTi9 1.0 (HKLM-x32\...\Dragon Ball Xenoverse 2 Digitale Deluxe Edition MULTi9 1.0) (Version:  - )
Evernote v. 6.4.2 (HKLM-x32\...\{E74F0DCA-9FC8-11E6-9D98-005056950253}) (Version: 6.4.2.3788 - Evernote Corp.)
f.lux (HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Flux) (Version:  - )
FocalFilter (HKLM-x32\...\{78156F61-016D-402A-9EF9-C2AA253DB22A}) (Version: 0.9.00 - FocalFilter)
FreeMind (HKLM-x32\...\B991B020-2968-11D8-AF23-444553540000_is1) (Version: 1.0.1 - )
GeoGebra 5 (HKLM-x32\...\GeoGebra 5) (Version: 5.0.177.0 - International GeoGebra Institute)
Google Chrome (HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Google Chrome) (Version: 56.0.2924.87 - Google Inc.)
iTunes (HKLM\...\{9D0D2A8B-7E7B-4D88-8D50-24286ED6A5EB}) (Version: 12.5.5.5 - Apple Inc.)
Java 8 Update 121 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180121F0}) (Version: 8.0.1210.13 - Oracle Corporation)
Java 8 Update 92 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418092F0}) (Version: 8.0.920.14 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
JetBrains PyCharm Community Edition 2016.3.2 (HKLM-x32\...\PyCharm Community Edition 2016.3.2) (Version: 163.10154.50 - JetBrains s.r.o.)
Maltego CE 4.0.11 (HKLM-x32\...\MaltegoCE 4.0.11) (Version: 4.0.11 - Paterva)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\OneDriveSetup.exe) (Version: 17.3.6743.1212 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50905.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23506 (HKLM-x32\...\{3ee5e5bb-b7cc-4556-8861-a00a82977d6c}) (Version: 14.0.23506.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24212 (HKLM-x32\...\{462f63a8-6347-4894-a1b3-dbfe3a4c981d}) (Version: 14.0.24212.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 47.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 47.0.2 (x86 de)) (Version: 47.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 42.0.0.5780 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
NVIDIA PhysX (HKLM-x32\...\{B455E95A-B804-439F-B533-336B1635AE97}) (Version: 9.14.0702 - NVIDIA Corporation)
Oracle VM VirtualBox 5.1.14 (HKLM\...\{6AE61854-0F78-49E3-ABCC-586FB43CE709}) (Version: 5.1.14 - Oracle Corporation)
Outils de vérification linguistique 2013 de Microsoft Office - Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PokerStars.eu (HKLM-x32\...\PokerStars.eu) (Version:  - PokerStars.eu)
Python 3.6.0 (64-bit) (HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\{37a4e38b-baf7-4500-97f1-0f7c51d9a395}) (Version: 3.6.150.0 - Python Software Foundation)
Python 3.6.0 Core Interpreter (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Development Libraries (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Documentation (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Executables (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 pip Bootstrap (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Standard Library (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Tcl/Tk Support (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Test Suite (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Utility Scripts (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python Launcher (HKLM-x32\...\{A674B2CB-13CA-437B-A215-9DD257959A49}) (Version: 3.6.5835.0 - Python Software Foundation)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7535 - Realtek Semiconductor Corp.)
Sandboxie 5.16 (64-bit) (HKLM\...\Sandboxie) (Version: 5.16 - Sandboxie Holdings, LLC)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version:  - Microsoft) Hidden
Skype™ 7.6 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.6.105 - Skype Technologies S.A.)
Soda PDF Desktop Asian Fonts Pack (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Convert Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Create Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Edit Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Forms Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Insert Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop OCR Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Review Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Secure Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop View Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
South Park Der Stab der Wahrheit Incl. Ultimate Fellowship Pack MULTI-2 1.00 (HKLM-x32\...\South Park Der Stab der Wahrheit Incl. Ultimate Fellowship Pack MULTI-2 1.00) (Version:  - )
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Spotify (HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Spotify) (Version: 1.0.50.41368.gbd68dbef - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
SumatraPDF (HKLM-x32\...\SumatraPDF) (Version: 3.0 - Krzysztof Kowalczyk)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.19 - TeamSpeak Systems GmbH)
Tenable Nessus (x64) (HKLM\...\{BD1A3F84-26A0-4B77-9441-A25A9456D05D}) (Version: 6.10.2.20085 - Tenable Network Security, Inc.)
The Elder Scrolls V Skyrim Total Conversion Enderal Edition 1.0.0.9 (HKLM-x32\...\The Elder Scrolls V Skyrim Total Conversion Enderal Edition 1.0.0.9) (Version:  - )
The Swapper (HKLM\...\Steam App 231160) (Version:  - Olli Harjola, Otto Hantula, Tom Jubert, Carlo Castellano)
The Talos Principle MULTi12 244371 (HKLM-x32\...\The Talos Principle MULTi12 244371) (Version:  - )
The Witness MULTi2 1.0 (HKLM-x32\...\The Witness MULTi2 1.0) (Version:  - )
The Witness Update 3 MULTi2 1.0 (HKLM-x32\...\The Witness Update 3 MULTi2 1.0) (Version:  - )
Transmissions: Element 120 (HKLM\...\Steam App 365300) (Version:  - Shokunin)
Update for Skype for Business 2015 (KB3039776) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{5D2260D6-DB16-41DC-915B-A39BF4F66362}) (Version:  - Microsoft)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: 5.4.7.0 - Elaborate Bytes)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.4 - VideoLAN)
VMware Player (HKLM-x32\...\VMware_Player) (Version: 6.0.7 - VMware, Inc)
VMware Player (Version: 6.0.7 - VMware, Inc.) Hidden
WinRAR 5.40 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
Wise Registry Cleaner 9.41 (HKLM-x32\...\Wise Registry Cleaner_is1) (Version: 9.41 - WiseCleaner.com, Inc.)
XMind 7 (Update 1) (v3.6.1) (HKLM-x32\...\XMind_is1) (Version: 3.6.1.201512240104 - XMind Ltd.)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001_Classes\CLSID\{CB492AF1-2CEF-4E58-BE47-471C77D0C8BA}\InprocServer32 -> C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\psuser_64.dll (Google Inc.)

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {05866645-3760-4F4E-BC6C-3BBDEDFB310F} - System32\Tasks\AMD Updater => C:\Program Files\AMD\CIM\\Bin64\InstallManagerApp.exe [2016-02-26] (Advanced Micro Devices, Inc.)
Task: {05C0574D-989C-4495-8DE8-D6246D77AF3C} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {12154CA5-8F42-4B2F-A33E-3A02C98490B3} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {1BFBFA70-D3C6-4DB6-A3D3-6A34F0996C8F} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001Core => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe [2015-03-26] (Google Inc.)
Task: {1CF529C5-D29F-43AE-92FD-82A50EC964BA} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001Core1d2597b6c57f2c5 => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe [2015-03-26] (Google Inc.)
Task: {2AA358D6-9F4F-48E9-916F-1A0EDC6BE390} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {30F3058C-0415-4F77-84D4-B602143DF305} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => %SystemRoot%\System32\AutoWorkplace.exe 
Task: {377CB5EC-1FF1-4320-9889-A0AB77542A9E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-03-18] (Adobe Systems Incorporated)
Task: {3D20A507-D104-4CED-89A4-AF8E3F5AAC5C} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {43B97978-A6E7-44F8-B307-9CD98822E46C} - System32\Tasks\{B009C1D4-4FB9-4DE4-AEC7-12D4889EE128} => pcalua.exe -a "F:\Life Is Strange\Binaries\Win32\LifeIsStrange.exe" -d "F:\Life Is Strange\Binaries\Win32"
Task: {4828E74B-9E89-46CC-9738-CB90DB87849F} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {4A698CF9-7317-4812-B893-2ED3C387B5BE} - System32\Tasks\WiseCleaner\WRCSkipUAC => C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe [2017-02-24] (WiseCleaner.com)
Task: {4ACAD694-0240-4765-BA30-2BC16F8E9EB3} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {4E5192E3-4E39-4011-A759-A7FC60E97131} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {56BD91C2-7935-449E-9A59-5C3704317F6F} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {57033CC7-D3A0-4EAD-A992-F3900D9707E6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2017-03-03] (Piriform Ltd)
Task: {6324C092-090C-47D8-9DC5-45B732284B97} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {75AAB113-5325-48D5-B655-732CC5E749E4} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {7996838F-3C7C-4E99-88CF-527934FEDA39} - System32\Tasks\Auto Re-Aktivierung => C:\WINDOWS\Re-Aktivierung\TriggerKMS.exe [2013-01-23] ()
Task: {838F70AE-67A7-4327-AB01-D85A7E6734B1} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {9148DF24-37DC-4805-9F26-DF5BCE9715A9} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001UA => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe [2015-03-26] (Google Inc.)
Task: {A145E2BD-13DB-446C-8821-33AC603DDDE2} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {A85DBF88-3373-427A-9A4E-5749730B3413} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {BD98A2E4-0C6E-4836-9C3D-16F4843C32DC} - System32\Tasks\Wise Registry Cleaner Schedule Task => C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe [2017-02-24] (WiseCleaner.com)
Task: {BE8DAB0C-5FAF-45A6-A5E7-BE07970E0515} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG
Task: {C2240968-5C24-4A71-816D-7A321E9E1A2F} - System32\Tasks\{DD5EF7D6-65B6-4080-B57C-5810676A3FEA} => Firefox.exe hxxp://ui.skype.com/ui/0/6.21.60.104/de/abandoninstall?page=tsBing
Task: {D7E2333E-A177-4BF2-9C9E-4A5584D13208} - System32\Tasks\Launch HTC Sync Loader => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe 
Task: {D80DA320-B7AE-4200-9C6D-6CD0EC753296} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Task: {E03FB901-52D3-453C-A2C8-E048E8DE5B75} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {E4015168-5F3B-4C32-93EC-98E3B5132F6A} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2017-03-18] (AVAST Software)
Task: {EF679536-F393-428B-947B-09BA2A858E4D} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {F56BBAD0-3E2C-46C1-AE47-78A3F2DDE496} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {F69F380B-C6CC-4E25-85D7-5A95585509AF} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001UA1d2597b6c617c32 => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe [2015-03-26] (Google Inc.)
Task: {FA1C89C0-1F9A-4401-9AE3-5C5284B8138A} - System32\Tasks\OneDrive Standalone Update Task => C:\Users\Sergio\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\OneDriveStandaloneUpdater.exe 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001Core.job => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001UA.job => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2016-07-16 12:42 - 2016-07-16 12:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-12-18 23:02 - 2016-12-09 11:29 - 02681200 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2016-12-18 23:02 - 2016-12-09 11:29 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-12-18 23:02 - 2016-12-09 11:29 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2016-09-30 08:34 - 2016-09-07 05:56 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-16 14:57 - 2016-12-21 08:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-01-16 14:57 - 2016-12-21 07:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-16 14:57 - 2016-12-21 07:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-16 14:57 - 2016-12-21 07:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-16 14:57 - 2016-12-21 07:48 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2017-01-16 14:57 - 2016-12-21 07:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-16 14:57 - 2016-12-21 07:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2017-03-13 18:23 - 2017-03-13 18:23 - 00077312 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-03-13 18:23 - 2017-03-13 18:23 - 00182784 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-03-13 18:23 - 2017-03-13 18:23 - 41048064 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-03-13 18:23 - 2017-03-13 18:23 - 02236896 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\roottools.dll
2015-06-25 16:34 - 2015-06-25 16:34 - 00014336 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick.2\qtquick2plugin.dll
2015-06-25 16:37 - 2015-06-25 16:37 - 00739840 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-06-25 16:35 - 2015-06-25 16:35 - 00014336 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Window.2\windowplugin.dll
2015-06-25 16:38 - 2015-06-25 16:38 - 00071168 _____ () C:\Program Files\AMD\CNext\CNext\QtQuick\Layouts\qquicklayoutsplugin.dll
2015-06-25 15:53 - 2015-06-25 15:53 - 00011776 _____ () C:\Program Files\AMD\CNext\CNext\libEGL.dll
2015-06-25 15:51 - 2015-06-25 15:51 - 02013696 _____ () C:\Program Files\AMD\CNext\CNext\libGLESv2.dll
2017-02-27 19:37 - 2017-02-27 19:37 - 00019456 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.214.10010.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2017-02-27 19:37 - 2017-02-27 19:37 - 21149696 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.214.10010.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2017-02-27 19:37 - 2017-02-27 19:37 - 05380096 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.214.10010.0_x64__8wekyb3d8bbwe\MediaEngine.dll
2016-06-09 18:30 - 2016-06-09 18:30 - 00680448 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.214.10010.0_x64__8wekyb3d8bbwe\Microsoft.DesignCore.dll
2017-02-27 19:37 - 2017-02-27 19:37 - 00387584 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.214.10010.0_x64__8wekyb3d8bbwe\Microsoft.RichMedia.Ink.Controls.dll
2017-02-27 19:37 - 2017-02-27 19:37 - 01047552 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.214.10010.0_x64__8wekyb3d8bbwe\Microsoft.Sharing.dll
2016-03-03 17:58 - 2016-03-03 17:58 - 00291328 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.214.10010.0_x64__8wekyb3d8bbwe\StoreRatingPromotion.dll
2016-09-01 17:12 - 2016-09-01 17:12 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2017-01-13 13:56 - 2017-01-13 13:56 - 01353528 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2016-06-29 19:01 - 2016-06-29 19:01 - 08166536 _____ () C:\Program Files (x86)\SpeedFan\speedfan.exe
2017-03-16 21:21 - 2017-03-16 21:21 - 01710080 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8008.42007.0_x64__8wekyb3d8bbwe\HxMail.exe
2017-03-16 21:21 - 2017-03-16 21:21 - 13327552 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8008.42007.0_x64__8wekyb3d8bbwe\Office.UI.Xaml.Core.dll
2016-07-16 12:42 - 2016-07-16 12:42 - 01872384 _____ () C:\Windows\System32\speech_onecore\engines\tts\MSTTSEngine_OneCore.dll
2015-06-24 14:28 - 2015-06-24 14:28 - 01301720 _____ () C:\Program Files (x86)\VMware\VMware Player\libxml2.dll
2016-10-31 17:45 - 2016-10-31 17:45 - 00148664 _____ () C:\Program Files (x86)\Evernote\Evernote\zlibwapi.dll
2016-10-31 17:45 - 2016-10-31 17:45 - 26137272 _____ () C:\Program Files (x86)\Evernote\Evernote\libcef.dll
2016-10-31 17:45 - 2016-10-31 17:45 - 00212664 _____ () C:\Program Files (x86)\Evernote\Evernote\websockets.dll
2016-10-31 17:45 - 2016-10-31 17:45 - 00321208 _____ () C:\Program Files (x86)\Evernote\Evernote\libtidy.dll
2016-10-31 17:17 - 2016-10-31 17:17 - 00740352 _____ () C:\Program Files (x86)\Evernote\Evernote\libglesv2.dll
2016-10-31 17:17 - 2016-10-31 17:17 - 00130048 _____ () C:\Program Files (x86)\Evernote\Evernote\libegl.dll
2017-03-19 03:10 - 2017-03-19 03:10 - 00158720 _____ () C:\Users\Sergio\AppData\Local\Temp\sfareca00001.dll
2017-03-19 03:10 - 2017-03-19 03:10 - 00192512 _____ () C:\Users\Sergio\AppData\Local\Temp\sfamcc00001.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)

AlternateDataStreams: C:\Users\Sergio\Desktop\2014-06-09 12.36.44.jpg:com.dropbox.attributes [912]
AlternateDataStreams: C:\Users\Sergio\Desktop\2014-06-09 12.41.14.jpg:com.dropbox.attributes [225]

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE trusted site: HKU\.DEFAULT\...\localhost -> localhost
IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com
IE trusted site: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\localhost -> localhost

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2013-08-22 14:25 - 2016-12-13 20:23 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\AvGeneric_S-1-5-21-1478414814-3749218601-3539646535-1007\Control Panel\Desktop\\Wallpaper -> 
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Sergio\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\img2.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

HKLM\...\StartupApproved\StartupFolder: => "Audible Download Manager.lnk"
HKLM\...\StartupApproved\StartupFolder: => "FocalFilterHelper.lnk"
HKLM\...\StartupApproved\Run: => "RTHDVCPL"
HKLM\...\StartupApproved\Run: => "iTunesHelper"
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKLM\...\StartupApproved\Run: => "StartCN"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "Razer Synapse"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "VirtualCloneDrive"
HKLM\...\StartupApproved\Run32: => "Raptr"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\StartupFolder: => "An OneNote senden.lnk"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\StartupFolder: => "EvernoteClipper.lnk"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\Run: => "Spotify Web Helper"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\Run: => "Google Update"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\Run: => "adaware browser dock"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\Run: => "Ad-Aware Search Companion"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{4C815F25-BA44-4DF0-A139-B4513592AB11}] => (Allow) E:\Programme\Steam\SteamApps\common\Transmissions Element 120\hl2.exe
FirewallRules: [{4AF4DBE9-2A28-45E8-A394-CF9DDBF7E046}] => (Allow) E:\Programme\Steam\SteamApps\common\Transmissions Element 120\hl2.exe
FirewallRules: [{47A0FAEC-0EED-465B-B623-8E03A2EF9F4A}] => (Allow) E:\Programme\Steam\SteamApps\common\The Swapper\TheSwapper.exe
FirewallRules: [{32189D55-9C1C-46C4-B9DB-0392B2032C1D}] => (Allow) E:\Programme\Steam\SteamApps\common\The Swapper\TheSwapper.exe
FirewallRules: [{23A94911-6B0C-4AD2-9CF3-1E3C4DF42CEF}] => (Allow) E:\Programme\Steam\SteamApps\common\Source SDK Base\hl2.exe
FirewallRules: [{14CD92EA-C74F-46A5-8AE1-1256A02B73B5}] => (Allow) E:\Programme\Steam\SteamApps\common\Source SDK Base\hl2.exe
FirewallRules: [{9A299CDF-8BB6-4808-855F-F7C6CFD167A7}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{6675D4DE-F544-4B9B-A575-E6846DD19E20}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{B0C6423F-1101-4D9A-8753-70A726AF5D5C}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{87D07077-0624-4F4D-900A-D386616BC2AD}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{009303E8-3CA0-4E1E-820F-CDE4AD59A1D6}] => (Block) C:\users\sergio\appdata\local\google\chrome\application\chrome.exe
FirewallRules: [{1855B2DC-993E-44BF-B82A-82A401F84346}] => (Block) C:\users\sergio\appdata\local\google\chrome\application\chrome.exe
FirewallRules: [UDP Query User{B08CCC1D-249D-415A-8AF7-DFE695CC02A4}C:\users\sergio\appdata\local\google\chrome\application\chrome.exe] => (Allow) C:\users\sergio\appdata\local\google\chrome\application\chrome.exe
FirewallRules: [TCP Query User{92FC82E6-BB8B-4FDB-BB0C-D66610CC6E81}C:\users\sergio\appdata\local\google\chrome\application\chrome.exe] => (Allow) C:\users\sergio\appdata\local\google\chrome\application\chrome.exe
FirewallRules: [UDP Query User{584B85C8-235C-45FB-9319-87EF691E539D}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{33DFD8A9-855F-4E8B-90E4-926E8A79B917}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{65CD0DC4-573A-4AB2-A279-A06DDCD94042}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{9B5CB91F-B20C-496F-8460-B7BE1F4AFC7B}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{CDB31AB7-B993-4463-991F-B3EB167A3E23}] => (Block) C:\users\sergio\appdata\roaming\spotify\spotify.exe
FirewallRules: [{85CE2457-1383-4B34-BC70-5CA7C0BC5A85}] => (Block) C:\users\sergio\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{18FD3C22-8C57-4B91-97BC-F02E9C848220}C:\users\sergio\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\sergio\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{0D0FB75B-A70C-402D-A16F-3513F8A6413B}C:\users\sergio\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\sergio\appdata\roaming\spotify\spotify.exe
FirewallRules: [{582F26A3-1FAD-42CB-BFB8-DB77E40EC5A5}] => (Allow) LPort=5432
FirewallRules: [{9E7793F6-2CCD-44F1-8D81-F075D049DDB3}] => (Block) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [{CAEB2973-36B7-4F35-A65A-7C4651A0FA4A}] => (Block) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [UDP Query User{7F4C7349-2C86-498A-86FB-BC98B46CEB17}C:\program files\videolan\vlc\vlc.exe] => (Allow) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [TCP Query User{24433994-3951-43D1-84CA-58C7E56D128C}C:\program files\videolan\vlc\vlc.exe] => (Allow) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [{896305FD-B8F2-4767-A7D4-AF7AE2FC10A1}] => (Allow) E:\Programme\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{ED008F0A-3699-49D8-BB63-729B1FEBE9C5}] => (Allow) E:\Programme\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{1DBD2A9C-E0C4-4A62-82B9-695C77AC5539}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{A1280161-B9C7-48B9-9966-18A895246AC7}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [UDP Query User{B6018279-DBCC-44F5-A85B-7F0E7FD3C508}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{C60CA2E5-E012-46D7-A014-68EB519DEC77}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{BA017C2C-61FD-4A8E-9A4B-B19C5F76EC42}C:\program files\comicrack\comicrack.exe] => (Allow) C:\program files\comicrack\comicrack.exe
FirewallRules: [TCP Query User{8A02E307-EB1C-4D12-882F-FF81FACC0914}C:\program files\comicrack\comicrack.exe] => (Allow) C:\program files\comicrack\comicrack.exe
FirewallRules: [UDP Query User{A26D4721-8F6B-4D4A-B429-722CF1A9DDF4}C:\program files\comicrack\comicrack.exe] => (Allow) C:\program files\comicrack\comicrack.exe
FirewallRules: [TCP Query User{B9867C9B-0E8C-4B86-8DD7-AB4AD89674A9}C:\program files\comicrack\comicrack.exe] => (Allow) C:\program files\comicrack\comicrack.exe
FirewallRules: [UDP Query User{0DE25D3A-A50D-4640-A918-C97C3D1E4E4F}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{B46581C9-E59C-4D84-BFB1-6C9C1CF619D5}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{3D1D317E-92BE-4AD7-AE40-DCEF97EE6F30}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{DCDF178F-94BA-423C-93AF-32ABA338F5B2}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{3BFDC46F-7EF3-4D7B-BADF-37C1CD73DBA8}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{71A620CB-4170-4016-8DE5-6BD6C5B280BA}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{51E9595D-0B58-445E-8FF9-D91A0E2B56C3}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{89FA8679-D274-40D5-8BCA-C4F7FAECC288}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{17602036-2F09-45C4-96DE-81E103792C0C}C:\program files (x86)\xmind\xmind.exe] => (Allow) C:\program files (x86)\xmind\xmind.exe
FirewallRules: [UDP Query User{47B0516F-37FD-411C-ABF4-31E6FF92ABAE}C:\program files (x86)\xmind\xmind.exe] => (Allow) C:\program files (x86)\xmind\xmind.exe
FirewallRules: [{E2AFCA20-7814-40F8-A2E4-A56B54B2B703}] => (Block) C:\program files (x86)\xmind\xmind.exe
FirewallRules: [{FFE14415-8CB9-46A2-93AE-FCA222B3FEB6}] => (Block) C:\program files (x86)\xmind\xmind.exe
FirewallRules: [{DF131065-E096-470C-B6C4-0BDC3B7AD887}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{39AA17E3-BFDE-40D5-9EB3-CC8F488F2791}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{C462C04B-0D25-49B1-BF38-97DB80556660}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{1317C778-FF74-44DB-B012-C987FF732B42}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [TCP Query User{C665D105-55D0-4485-9F8F-98BFAFC4277A}C:\program files (x86)\jetbrains\pycharm community edition 2016.3.2\bin\pycharm.exe] => (Allow) C:\program files (x86)\jetbrains\pycharm community edition 2016.3.2\bin\pycharm.exe
FirewallRules: [UDP Query User{89F44F37-EE89-49AC-9CF0-D7A984CC4463}C:\program files (x86)\jetbrains\pycharm community edition 2016.3.2\bin\pycharm.exe] => (Allow) C:\program files (x86)\jetbrains\pycharm community edition 2016.3.2\bin\pycharm.exe
FirewallRules: [{FCA6B532-4E95-469C-95E1-E58DA1577D22}] => (Block) C:\program files (x86)\jetbrains\pycharm community edition 2016.3.2\bin\pycharm.exe
FirewallRules: [{8DB45E81-EE46-454C-9C3B-8822B06D4867}] => (Block) C:\program files (x86)\jetbrains\pycharm community edition 2016.3.2\bin\pycharm.exe
FirewallRules: [{87A747CA-FD99-4796-8585-B3AE0E5C1AFE}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{2A3FF431-1752-43AF-8AD1-087AA8AB8B45}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{F7438A7F-5156-4022-A304-F2ED32707A1D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{1D667304-E1AC-41D7-AE98-239DD24636D3}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{94A6CFFB-2252-4515-94E5-28245AD1CBF7}] => (Allow) C:\Program Files\iTunes\iTunes.exe

==================== Wiederherstellungspunkte =========================

ACHTUNG: Systemwiederherstellung ist deaktiviert

==================== Fehlerhafte Geräte im Gerätemanager =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (03/19/2017 11:58:59 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/19/2017 09:58:51 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/19/2017 07:58:52 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/19/2017 05:58:52 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/19/2017 04:54:06 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Event-ID 0

Error: (03/19/2017 03:58:51 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/19/2017 03:16:19 AM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Fehler beim Aktualisieren des -Status auf SECURITY_PRODUCT_STATE_OFF (Fehler %3).

Error: (03/19/2017 03:16:19 AM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Fehler beim Aktualisieren des -Status auf SECURITY_PRODUCT_STATE_OFF (Fehler %3).

Error: (03/19/2017 03:16:19 AM) (Source: SecurityCenter) (EventID: 16) (User: )
Description: Fehler beim Aktualisieren des -Status auf SECURITY_PRODUCT_STATE_OFF (Fehler %3).

Error: (03/19/2017 01:58:51 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.


Systemfehler:
=============
Error: (03/19/2017 12:39:10 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Soda PDF Desktop Creator" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/19/2017 12:38:19 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (03/18/2017 11:43:40 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (03/18/2017 11:41:20 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (03/18/2017 10:53:29 PM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: Der Dienst "chip 1-click download service" hat einen ungültigen aktuellen Status gemeldet: 0

Error: (03/18/2017 10:53:29 PM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: Der Dienst "chip 1-click download service" hat einen ungültigen aktuellen Status gemeldet: 0

Error: (03/18/2017 10:51:49 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (03/18/2017 09:15:28 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: Der Server "{784E29F4-5EBE-4279-9948-1E8FE941646D}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (03/18/2017 09:12:28 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 und der APPID 
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (03/18/2017 01:05:16 AM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 5


CodeIntegrity:
===================================
  Date: 2017-03-19 05:34:50.982
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-03-18 00:15:51.902
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-03-08 20:41:44.737
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-03-07 16:07:59.583
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-03-05 12:03:31.285
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-03-03 17:01:58.393
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-03-01 22:16:13.030
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-02-28 23:26:03.401
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-02-28 12:36:19.913
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-02-04 18:13:32.823
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Speicherinformationen =========================== 

Prozessor: AMD Phenom(tm) II X4 945 Processor
Prozentuale Nutzung des RAM: 27%
Installierter physikalischer RAM: 16383.17 MB
Verfügbarer physikalischer RAM: 11876.71 MB
Summe virtueller Speicher: 18815.17 MB
Verfügbarer virtueller Speicher: 14198.45 MB

==================== Laufwerke ================================

Drive c: () (Fixed) (Total:100.21 GB) (Free:3.43 GB) NTFS
Drive d: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive e: () (Fixed) (Total:931.41 GB) (Free:44.85 GB) NTFS
Drive f: () (Fixed) (Total:156.25 GB) (Free:30.61 GB) NTFS
Drive h: () (Fixed) (Total:100 GB) (Free:99.68 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: FEBD6380)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: 01EE8E42)
Partition 1: (Not Active) - (Size=100.2 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=450 MB) - (Type=27)

========================================================
Disk: 2 (Size: 335.4 GB) (Disk ID: F261F55D)
Partition 1: (Active) - (Size=100 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=156.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=79.1 GB) - (Type=05)

==================== Ende von Addition.txt ============================
         

Servus,

Ich habe über Nacht die den Windows Defender durchlaufen lassen und der hat auf jeden fall etwas gefunden leider kann ich nicht mehr einsehen was. Ich habe auf Löschen geklickt und dabei habe ich den Verlauf gelöscht.. Ich hoffe das ist nicht weiter schlimm.

Naja, was heißt "nicht weiter schlimm"... "schlimm" im Sinne von schädlich ist es nicht.

Ich verstehe ehrlich gesagt aber nicht, wozu du hier ein Thema eröffnest, wenn du sowieso deinen Rechner alleine bereinigst und mir dann auch noch wichtige Logdateien vorenthältst...

Macht es überhaupt noch Sinn, dass ich dir helfe?

Entschuldigung, seit deiner ersten Antwort habe ich keinen Schritt mehr alleine unternommen. Ich hatte nur überstürzt gehandelt. Ich wäre sehr dankbar über weiter Hilfe von dir und würde das Board im Anschluss natürlich unterstützen .

Also ja es würde Sinn machen.

Servus,





Schritt 1
Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser.
• Starte die adwcleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Werkzeuge > Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • Image File Execution Options Schlüssel
  • "Tracing" Schlüssel
  • "Prefetch" Dateien
  • Proxy
  • Winsock
  • Firewall
  • Internet Explorer Richtlinien
  • Chrome Richtlinien
• Bestätige die Auswahl mit Ok.
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen (auch dann wenn AdwCleaner sagt, dass nichts gefunden wurde) und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 2
Downloade Dir bitte Malwarebytes Anti-Malware 3

• Installiere das Programm in den vorgegebenen Pfad.
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scan, wähle den Bedrohungs-Scan aus und klicke auf Scan starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Ausgewählte Elemente in die Quarantäne verschieben.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM nach dem Neustart, klicke auf Berichte.
• Wähle den neuesten Scan-Bericht aus, klicke auf Bericht anzeigen und dann auf Export.
• Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 3

• Starte die FRST erneut. Vergewissere dich, dass vor Addition.txt ein Haken gesetzt ist und drücke auf Untersuchen.
• FRST erstellt nun zwei Logdateien (FRST.txt und Addition.txt).
• Poste mir beide Logdateien mit deiner nächsten Antwort.

Bitte poste mit deiner nächsten Antwort

• die Logdatei von AdwCleaner,
• die Logdatei von MBAM,
• die beiden neuen Logdateien von FRST.

Adwcleaner

# AdwCleaner v6.044 - Bericht erstellt am 20/03/2017 um 22:32:17
# Aktualisiert am 28/02/2017 von Malwarebytes
# Datenbank : 2017-03-20.1 [Server]
# Betriebssystem : Windows 10 Pro  (X64)
# Benutzername : Sergio - SERGIOS-PC
# Gestartet von : C:\Users\Sergio\Desktop\AdwCleaner_6.044.exe
# Modus: Löschen
# Unterstützung : https://www.malwarebytes.com/support



***** [ Dienste ] *****



***** [ Ordner ] *****

[-] Ordner gelöscht: C:\Users\Sergio\AppData\Roaming\Wise Registry Cleaner
[-] Ordner gelöscht: C:\ProgramData\Application Data\lavasoft\web companion
[-] Ordner gelöscht: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Registry Cleaner
[-] Ordner gelöscht: C:\Program Files (x86)\Wise\Wise Registry Cleaner
[-] Ordner gelöscht: C:\Users\Sergio\AppData\Local\Temp\DMR


***** [ Dateien ] *****

[-] Datei gelöscht: C:\WINDOWS\SysNative\LavasoftTcpService64.dll
[-] Datei gelöscht: C:\WINDOWS\SysNative\LavasoftTcpServiceOff.ini
[-] Datei gelöscht: C:\END
[-] Datei gelöscht: C:\WINDOWS\SysWoW64\lavasofttcpservice.dll
[-] Datei gelöscht: C:\WINDOWS\SysWoW64\LavasoftTcpServiceOff.ini


***** [ DLL ] *****



***** [ WMI ] *****



***** [ Verknüpfungen ] *****



***** [ Aufgabenplanung ] *****



***** [ Registrierungsdatenbank ] *****

[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.001
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.7z
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.arj
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.bz2
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.bzip2
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.cab
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.cpio
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.deb
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.dmg
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.fat
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.gz
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.gzip
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.hfs
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.iso
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.lha
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.lzh
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.lzma
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.ntfs
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.rar
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.rpm
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.squashfs
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.swm
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.tar
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.taz
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.tbz
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.tbz2
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.tgz
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.tpz
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.txz
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.vhd
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.wim
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.xar
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.xz
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.z
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\WinZipper.zip
[-] Schlüssel gelöscht: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\winzipersvc
[#] Schlüssel mit Neustart gelöscht: [x64] HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\winzipersvc
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\TypeLib\{ED62BC6E-64F1-46BE-866F-4C8DC0DF7057}
[-] Wert gelöscht: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Lavasoft\Web Companion
[-] Schlüssel gelöscht: HKLM\SOFTWARE\WISECLEANER
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wise Registry Cleaner_is1
[-] Schlüssel gelöscht: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\castplatform.com
[-] Schlüssel gelöscht: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\cdn.castplatform.com
[-] Schlüssel gelöscht: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\watch4.de
[-] Schlüssel gelöscht: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\www.watch4.de
[#] Schlüssel mit Neustart gelöscht: [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\castplatform.com
[#] Schlüssel mit Neustart gelöscht: [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\cdn.castplatform.com
[#] Schlüssel mit Neustart gelöscht: [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\watch4.de
[#] Schlüssel mit Neustart gelöscht: [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\www.watch4.de
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinZipper
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinZipper
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinZipper
[-] Schlüssel gelöscht: HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinZipper


***** [ Browser ] *****



*************************

:: "Tracing" Schlüssel gelöscht
:: Winsock Einstellungen zurückgesetzt
:: "Image File Execution Options" Schlüssel gelöscht
:: "Prefetch" Dateien gelöscht
:: Proxy Einstellungen zurückgesetzt
:: Firewall Einstellungen zurückgesetzt
:: Internet Explorer Richtlinien gelöscht
:: Chrome Richtlinien gelöscht

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [5955 Bytes] - [20/03/2017 22:32:17]
C:\AdwCleaner\AdwCleaner[S0].txt - [5722 Bytes] - [20/03/2017 22:31:18]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [6101 Bytes] ##########
         

mbam

Malwarebytes
www.malwarebytes.com

-Protokolldetails-
Scan-Datum: 20.03.17
Scan-Zeit: 22:37
Protokolldatei: mbam.txt
Administrator: Ja

-Softwaredaten-
Version: 3.0.6.1469
Komponentenversion: 1.0.75
Version des Aktualisierungspakets: 1.0.1549
Lizenz: Testversion

-Systemdaten-
Betriebssystem: Windows 10
CPU: x64
Dateisystem: NTFS
Benutzer: SERGIOS-PC\Sergio

-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Ergebnis: Abgeschlossen
Gescannte Objekte: 556839
Abgelaufene Zeit: 5 Min., 48 Sek.

-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

-Scan-Details-
Prozess: 0
(keine bösartigen Elemente erkannt)

Modul: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 1
PUP.Optional.WiseRC, HKLM\SOFTWARE\CLASSES\CLSID\{D4EF86C3-77D7-4F82-BBB8-6DFFAB6E2D32}, In Quarantäne, [2565], [349250],1.0.1549

Registrierungswert: 1
PUP.Optional.WiseRC, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION|WISEREGCLEANER.EXE, In Quarantäne, [2565], [349251],1.0.1549

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Daten-Stream: 0
(keine bösartigen Elemente erkannt)

Ordner: 1
PUP.Optional.WiseRC, C:\USERS\SERGIO\APPDATA\ROAMING\Wise Euask, In Quarantäne, [2565], [379114],1.0.1549

Datei: 4
PUP.Optional.WiseRC, C:\Users\Sergio\AppData\Roaming\Wise Euask\TipIds.ini, In Quarantäne, [2565], [379114],1.0.1549
PUP.Optional.AshampooDriverUpdater, C:\PROGRAMDATA\ASHAMPOO\ICO_ASHAMPOO_DEALS.ICO, In Quarantäne, [2832], [354924],1.0.1549
PUP.Optional.WiseRC, C:\USERS\PUBLIC\DESKTOP\WISE REGISTRY CLEANER.LNK, In Quarantäne, [2565], [349248],1.0.1549
PUP.Optional.WiseRC, C:\WINDOWS\SYSTEM32\TASKS\WISECLEANER\WRCSKIPUAC, In Quarantäne, [2565], [379147],1.0.1549

Physischer Sektor: 0
(keine bösartigen Elemente erkannt)


(end)
         

FRST

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 15-03-2017
durchgeführt von Sergio (Administrator) auf SERGIOS-PC (20-03-2017 22:50:16)
Gestartet von C:\Users\Sergio\Desktop
Geladene Profile: Sergio (Verfügbare Profile: Sergio & postgres)
Platform: Windows 10 Pro Version 1607 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Chip Digital GmbH) C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Tenable Network Security, Inc) C:\Program Files\Tenable\Nessus\nessus-service.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(Tenable Network Security, Inc) C:\Program Files\Tenable\Nessus\nessusd.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(ByELDI) C:\Windows\Re-Aktivierung\KMSnano.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Flux Software LLC) C:\Users\Sergio\AppData\Local\FluxSoftware\Flux\flux.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(@ByELDI) C:\Windows\Temp\KMSnano\KMSELDI.exe
(hxxp://www.qemu.org/) C:\Windows\Temp\KMSnano\qemu-system-i386.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.1051_none_7f2bf7ea21d201b2\TiWorker.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\PlacesServer.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.17012.10311.0_x64__8wekyb3d8bbwe\Music.UI.exe
() C:\Windows\Temp\KMSnano\KMS Client.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\PlacesServer.exe

==================== Registry (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8492800 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\cnext.exe [4926664 2016-02-26] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2016-09-07] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176440 2017-01-19] (Apple Inc.)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2780112 2017-01-20] (Malwarebytes)
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1160408 2016-12-17] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [Spotify Web Helper] => C:\Users\Sergio\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1446000 2017-03-11] (Spotify Ltd)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [Google Update] => C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\GoogleUpdateCore.exe [601752 2016-12-18] (Google Inc.)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [f.lux] => C:\Users\Sergio\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9364696 2017-03-03] (Piriform Ltd)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [799376 2016-12-14] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\MountPoints2: {b52f257e-9541-11e6-82b3-485b39c9a198} - "K:\HiSuiteDownLoader.exe" 
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [00ExpanDriveExt1] -> {C955792B-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [00ExpanDriveExt2] -> {C955792C-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [00ExpanDriveExt1] -> {C955792B-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [00ExpanDriveExt2] -> {C955792C-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Audible Download Manager.lnk [2015-05-07]
ShortcutTarget: Audible Download Manager.lnk -> C:\Program Files (x86)\Audible\Bin\AudibleDownloadHelper.exe (Keine Datei)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FocalFilterHelper.lnk [2016-02-26]
ShortcutTarget: FocalFilterHelper.lnk -> C:\Program Files (x86)\FocalFilter\FocalFilterHelper.exe (Microsoft)
Startup: C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2015-08-09]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2016-04-20]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{65462354-7EE1-4401-902C-4D58B7DBDA87}: [DhcpNameServer] 7.254.254.254
Tcpip\..\Interfaces\{8c608b9e-9074-4d1b-b1db-702840d39f03}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{aa6288ab-a4c6-4734-8fa6-9d9b694d76cd}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131343881188462559&GUID=D7BDAEA9-5712-40E5-A2B9-98992E8B0FDB
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131343881188468475&GUID=D7BDAEA9-5712-40E5-A2B9-98992E8B0FDB
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_121\bin\ssv.dll [2017-03-18] (Oracle Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-03-18] (Oracle Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2016-10-31] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2016-05-17] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default [2017-03-20]
FF NewTab: Mozilla\Firefox\Profiles\0fihcjle.default -> about:newtab
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\0fihcjle.default -> Google
FF DefaultSearchUrl: Mozilla\Firefox\Profiles\0fihcjle.default -> hxxps://www.google.com/search?bcutc=sp-006
FF SearchEngineOrder.1: Mozilla\Firefox\Profiles\0fihcjle.default -> Google
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\0fihcjle.default -> Google
FF Homepage: Mozilla\Firefox\Profiles\0fihcjle.default -> about:home
FF Keyword.URL: Mozilla\Firefox\Profiles\0fihcjle.default -> hxxps://www.google.com/search?bcutc=sp-006
FF Extension: (BeeLine Reader) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\beelinereader-firefox@beelinereader.com.xpi [2016-03-08]
FF Extension: (FoxyProxy Standard) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\foxyproxy@eric.h.jung [2017-02-07]
FF Extension: (convert2mp3.net YouTube2MP3 Converter) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\info@convert2mp3.net.xpi [2016-12-15]
FF Extension: (pdf updater) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{34840d80-0446-4a42-83ce-5c0fa22cd4e3}.xpi [2016-05-18] [ist nicht signiert]
FF Extension: (NoScript) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2017-03-20]
FF Extension: (LeechBlock) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{a95d8332-e4b4-6e7f-98ac-20b733364387} [2017-03-20]
FF Extension: (Adblock Plus) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-24]
FF Extension: (DownThemAll!) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2016-04-15]
FF SearchPlugin: C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\searchplugins\google-avast.xml [2017-03-18]
FF HKLM\...\Firefox\Extensions: [soda_pdf_desktop_conv@sodapdf.com] - C:\Program Files\Soda PDF Desktop\resources\sodapdfdesktopfirefoxextension => nicht gefunden
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_25_0_0_127.dll [2017-03-18] ()
FF Plugin: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-03-18] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-03-18] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50905.0\npctrl.dll [2017-02-10] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_25_0_0_127.dll [2017-03-18] ()
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-07-19] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50905.0\npctrl.dll [2017-02-10] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2016-12-17] (Adobe Systems Inc.)
FF Plugin-x32: Soda PDF Desktop -> C:\Program Files (x86)\Soda PDF Desktop\np-previewer.dll [Keine Datei]
FF Plugin HKU\S-1-5-21-1478414814-3749218601-3539646535-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-18] (Google Inc.)
FF Plugin HKU\S-1-5-21-1478414814-3749218601-3539646535-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-18] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2016-07-19] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-12-17] (Adobe Systems Inc.)

Chrome: 
=======
CHR DefaultProfile: Default
CHR Profile: C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default [2017-03-18]
CHR Extension: (Google Präsentationen) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-03-26]
CHR Extension: (Google Docs) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-03-26]
CHR Extension: (Google Drive) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-03-11]
CHR Extension: (YouTube) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-03-11]
CHR Extension: (Google-Suche) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-03-11]
CHR Extension: (Google Tabellen) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-03-26]
CHR Extension: (Google Docs Offline) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-21]
CHR Extension: (AMZ Seller Browser) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\klgpelgeohjghmccooegimcfhanlnngc [2016-05-09]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-12]
CHR Extension: (Google Mail) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-01]
CHR Extension: (Chrome Media Router) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-03-11]

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-08-04] (Advanced Micro Devices, Inc.) [Datei ist nicht signiert]
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)
R2 chip1click; C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe [91136 2016-10-27] (Chip Digital GmbH) [Datei ist nicht signiert]
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4355024 2017-01-20] (Malwarebytes)
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [197776 2016-12-14] (Sandboxie Holdings, LLC)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-09-15] (Microsoft Corporation)
R2 Tenable Nessus; C:\Program Files\Tenable\Nessus\nessus-service.exe [17376 2017-02-15] (Tenable Network Security, Inc)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
S3 Soda PDF Desktop; "C:\Program Files\Soda PDF Desktop\ws.exe" [X]
S3 Soda PDF Desktop CrashHandler; "C:\Program Files\Soda PDF Desktop\crash-handler-ws.exe" [X]
S2 Soda PDF Desktop Creator; "C:\Program Files\Soda PDF Desktop\creator-ws.exe" [X]

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S0 amdkmafd; C:\WINDOWS\System32\drivers\amdkmafd.sys [23240 2016-02-26] (Advanced Micro Devices, Inc.)
R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R3 AtiHDAudioService; C:\WINDOWS\system32\drivers\AtihdWT6.sys [102400 2016-02-26] (Advanced Micro Devices)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [77408 2017-02-24] ()
S3 HTCAND64; C:\WINDOWS\System32\Drivers\ANDROIDUSB.sys [33736 2009-11-02] (HTC, Corporation) [Datei ist nicht signiert]
S3 HtcVCom32; C:\WINDOWS\system32\DRIVERS\HtcVComV64.sys [121800 2010-03-09] (QUALCOMM Incorporated) [Datei ist nicht signiert]
R2 MBAMChameleon; C:\WINDOWS\system32\drivers\MBAMChameleon.sys [186304 2017-03-20] (Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\system32\drivers\farflt.sys [111544 2017-03-20] (Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\drivers\mbam.sys [43968 2017-03-20] (Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [251840 2017-03-20] (Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\drivers\mwac.sys [92088 2017-03-20] (Malwarebytes)
R3 MTsensor; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [17280 2013-05-17] ()
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [589824 2016-07-16] (Realtek                                            )
S3 RtlWlanu_OldIC; C:\WINDOWS\System32\drivers\rtwlanu_oldIC.sys [3814400 2016-07-16] (Realtek Semiconductor Corporation                           )
S3 rzdaendpt; C:\WINDOWS\System32\drivers\rzdaendpt.sys [33448 2014-09-05] (Razer Inc)
S3 rzvkeyboard; C:\WINDOWS\System32\drivers\rzvkeyboard.sys [31912 2014-09-05] (Razer Inc)
S3 SaiK0728; C:\WINDOWS\system32\DRIVERS\SaiK0728.sys [129024 2008-01-21] (Saitek)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [205968 2016-12-14] (Sandboxie Holdings, LLC)
R1 VBoxNetAdp; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys [131144 2017-01-16] (Oracle Corporation)
R1 VBoxNetLwf; C:\WINDOWS\system32\DRIVERS\VBoxNetLwf.sys [205440 2017-01-16] (Oracle Corporation)
R0 vsock; C:\WINDOWS\System32\drivers\vsock.sys [73296 2013-10-08] (VMware, Inc.)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
U3 DfSdkS; kein ImagePath

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-03-20 22:50 - 2017-03-20 22:50 - 00022573 _____ C:\Users\Sergio\Desktop\FRST.txt
2017-03-20 22:48 - 2017-03-20 22:48 - 00001984 _____ C:\Users\Sergio\Desktop\mbam.txt
2017-03-20 22:36 - 2017-03-20 22:46 - 00251840 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-03-20 22:36 - 2017-03-20 22:46 - 00186304 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMChameleon.sys
2017-03-20 22:36 - 2017-03-20 22:46 - 00111544 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2017-03-20 22:36 - 2017-03-20 22:46 - 00092088 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2017-03-20 22:36 - 2017-03-20 22:46 - 00043968 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2017-03-20 22:36 - 2017-03-20 22:36 - 00006203 _____ C:\Users\Sergio\Desktop\AdwCleaner[C0].txt
2017-03-20 22:36 - 2017-03-20 22:36 - 00001912 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-03-20 22:36 - 2017-03-20 22:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-03-20 22:36 - 2017-03-20 22:36 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-03-20 22:36 - 2017-03-20 22:36 - 00000000 ____D C:\Program Files\Malwarebytes
2017-03-20 22:36 - 2017-02-24 06:23 - 00077408 _____ C:\WINDOWS\system32\Drivers\mbae64.sys
2017-03-20 22:33 - 2017-03-20 22:33 - 00346096 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-03-20 22:28 - 2017-03-20 22:32 - 00000000 ____D C:\AdwCleaner
2017-03-20 22:27 - 2017-03-20 22:28 - 04031440 _____ C:\Users\Sergio\Desktop\AdwCleaner_6.044.exe
2017-03-19 13:44 - 2017-03-19 13:49 - 00082710 _____ C:\TDSSKiller.3.1.0.12_19.03.2017_13.44.46_log.txt
2017-03-19 13:44 - 2017-03-19 13:44 - 04747704 _____ (AO Kaspersky Lab) C:\Users\Sergio\Desktop\tdsskiller.exe
2017-03-19 11:34 - 2017-03-19 11:34 - 00000085 _____ C:\WINDOWS\wininit.ini
2017-03-19 11:34 - 2017-03-19 11:34 - 00000000 ____D C:\WINDOWS\System32\Tasks\Safer-Networking
2017-03-19 02:00 - 2017-03-19 02:00 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\QuickScan
2017-03-19 01:43 - 2017-03-20 22:50 - 00000000 ____D C:\FRST
2017-03-19 01:42 - 2017-03-19 01:42 - 02424832 _____ (Farbar) C:\Users\Sergio\Desktop\FRST64.exe
2017-03-19 01:12 - 2017-03-19 01:12 - 00000000 ____D C:\Users\Sergio\AppData\Local\AdAwareDesktop
2017-03-19 01:10 - 2017-03-19 01:10 - 00000000 ____D C:\Users\Sergio\AppData\Local\AdAwareUpdater
2017-03-19 01:10 - 2017-03-19 01:10 - 00000000 ____D C:\Program Files\Common Files\adaware
2017-03-19 01:07 - 2017-03-20 22:33 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2017-03-19 01:07 - 2017-03-19 11:34 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2017-03-19 01:05 - 2017-03-20 22:34 - 00001748 _____ C:\WINDOWS\Sandboxie.ini
2017-03-19 01:05 - 2017-03-19 01:04 - 00000955 _____ C:\Users\Sergio\Desktop\Sandboxed Web Browser.lnk
2017-03-19 01:04 - 2017-03-19 01:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2017-03-19 01:04 - 2017-03-19 01:04 - 00000000 ____D C:\Program Files\Sandboxie
2017-03-19 01:02 - 2017-03-19 01:02 - 00000000 ___HD C:\$SysReset
2017-03-19 01:02 - 2017-03-19 01:02 - 00000000 ____D C:\WINDOWS\Panther
2017-03-19 00:06 - 2017-03-19 00:06 - 00217088 _____ C:\Users\postgres\NTUSER.rhk
2017-03-19 00:03 - 2017-03-19 00:03 - 00015836 _____ C:\Users\Sergio\Documents\cc_20170319_000336.reg
2017-03-18 23:51 - 2017-03-18 23:51 - 00001822 _____ C:\Users\Public\Desktop\iTunes.lnk
2017-03-18 23:51 - 2017-03-18 23:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2017-03-18 23:50 - 2017-03-18 23:51 - 00000000 ____D C:\Program Files\iTunes
2017-03-18 23:50 - 2017-03-18 23:50 - 00000000 ____D C:\Program Files\iPod
2017-03-18 23:49 - 2017-03-18 23:49 - 00000000 ____D C:\Program Files\Bonjour
2017-03-18 23:49 - 2017-03-18 23:49 - 00000000 ____D C:\Program Files (x86)\Bonjour
2017-03-18 23:41 - 2017-03-18 23:41 - 00000000 ____D C:\WINDOWS\System32\Tasks\AVAST Software
2017-03-18 23:39 - 2017-03-20 22:33 - 00000000 ____D C:\ProgramData\AVAST Software
2017-03-18 23:01 - 2017-03-19 00:06 - 04333568 _____ C:\Users\Sergio\NTUSER.rhk
2017-03-18 23:01 - 2017-03-18 23:01 - 00004058 _____ C:\WINDOWS\System32\Tasks\Wise Registry Cleaner Schedule Task
2017-03-18 22:57 - 2017-03-18 22:57 - 00763016 _____ C:\Users\Sergio\Documents\cc_20170318_225706.reg
2017-03-18 22:55 - 2017-03-20 22:45 - 00000000 ____D C:\ProgramData\Ashampoo
2017-03-18 22:55 - 2017-03-18 22:55 - 00001329 _____ C:\Users\Public\Desktop\Ashampoo WinOptimizer 2017.lnk
2017-03-18 22:55 - 2017-03-18 22:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
2017-03-18 22:55 - 2017-03-18 22:55 - 00000000 ____D C:\Program Files (x86)\Ashampoo
2017-03-18 22:55 - 2009-08-24 21:13 - 00034304 _____ (mst software GmbH, Germany) C:\WINDOWS\system32\DfSdkBt.exe
2017-03-18 22:53 - 2017-03-20 22:45 - 00000000 ____D C:\WINDOWS\System32\Tasks\WiseCleaner
2017-03-18 22:53 - 2017-03-20 22:31 - 00000000 ____D C:\Program Files (x86)\Wise
2017-03-18 22:53 - 2017-03-18 22:53 - 00000000 ____D C:\Program Files (x86)\Chip Digital GmbH
2017-03-18 22:48 - 2017-03-18 22:48 - 00002862 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2017-03-18 22:48 - 2017-03-18 22:48 - 00000863 _____ C:\Users\Public\Desktop\CCleaner.lnk
2017-03-18 22:48 - 2017-03-18 22:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2017-03-18 22:48 - 2017-03-18 22:48 - 00000000 ____D C:\Program Files\CCleaner
2017-03-18 22:25 - 2016-06-05 07:42 - 00000000 ____D C:\Users\Sergio\Desktop\Python 3 - Intensivkurs  Projekte erfolgreich realisieren By Mark Pilgrim
2017-03-18 21:48 - 2016-09-01 12:09 - 00000000 ____D C:\Users\Sergio\Desktop\Yael Adler - Haut nah. Alles über unser größtes Organ inkl. pdf
2017-03-18 21:47 - 2016-10-17 16:46 - 00000000 ____D C:\Users\Sergio\Desktop\Nadja Hermann - Fettlogik überwinden
2017-03-18 01:04 - 2017-03-17 21:06 - 00000000 ____D C:\Users\Sergio\Desktop\Gunter Dueck - Flachsinn_ Ich habe Hirn, ich will hier raus
2017-03-16 21:27 - 2016-11-24 02:24 - 00000000 ____D C:\Users\Sergio\Desktop\Haiyti - Nightliner (2016)
2017-03-13 20:44 - 2017-03-13 20:44 - 14966655 _____ C:\Users\Sergio\Desktop\3662536676.psychologie.der.maerchen.2017.by.www.lul.to.pdf
2017-03-12 12:29 - 2017-03-12 12:26 - 00074345 ____N C:\Users\Sergio\Desktop\11057856.pdf
2017-03-11 11:55 - 2017-03-11 11:55 - 00000000 ____D C:\Users\Sergio\AppData\Local\TeamSpeak 3
2017-03-11 11:55 - 2017-03-11 11:55 - 00000000 ____D C:\Users\Sergio\.TeamSpeak 3
2017-03-10 22:56 - 2017-03-10 22:56 - 00000000 ____D C:\Users\Sergio\PycharmProjects
2017-03-10 22:55 - 2017-03-10 22:55 - 00001078 _____ C:\Users\Sergio\Desktop\JetBrains PyCharm Community Edition 2016.3.2.lnk
2017-03-10 22:55 - 2017-03-10 22:55 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\JetBrains
2017-03-10 22:55 - 2017-03-10 22:55 - 00000000 ____D C:\Users\Sergio\.PyCharmCE2016.3
2017-03-10 22:54 - 2017-03-10 22:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JetBrains
2017-03-10 22:54 - 2017-03-10 22:54 - 00000000 ____D C:\Program Files (x86)\JetBrains
2017-03-09 16:03 - 2017-03-09 16:03 - 00002713 _____ C:\Users\Sergio\Desktop\IDLE (Python 3.6 64-bit).lnk
2017-03-09 16:03 - 2017-03-09 16:03 - 00001520 _____ C:\Users\Sergio\Desktop\Python 3.6 (64-bit).lnk
2017-03-09 15:59 - 2017-03-09 15:59 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Python 3.6
2017-03-09 15:59 - 2017-03-09 15:59 - 00000000 ____D C:\Users\Sergio\AppData\Local\Package Cache
2017-03-08 16:00 - 2017-03-08 16:00 - 06744873 ____R C:\Users\Sergio\Desktop\3658108576.ich.glaube.es.hackt.2016.4.auflage.by.www.lul.to.pdf
2017-03-06 19:08 - 2017-03-06 19:08 - 00004296 _____ C:\WINDOWS\System32\Tasks\AMD Updater
2017-03-06 19:07 - 2017-03-06 19:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Radeon Settings
2017-03-06 18:50 - 2017-03-06 18:50 - 00000000 ____D C:\Users\Sergio\.Plays.tv
2017-03-05 18:37 - 2017-01-01 17:08 - 00000000 ____D C:\Users\Sergio\Desktop\Tory Lanez - Chixtape 4 (DatPiff.com)
2017-03-05 18:27 - 2017-03-05 18:27 - 00000000 ____D C:\ProgramData\GeoComply
2017-03-04 21:04 - 2017-03-04 21:06 - 00000000 ____D C:\Users\Sergio\VirtualBox VMs
2017-03-04 20:55 - 2017-03-05 14:02 - 00000000 ____D C:\Users\Sergio\.VirtualBox
2017-03-04 20:55 - 2017-03-04 20:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2017-03-04 20:55 - 2017-03-04 20:55 - 00000000 ____D C:\Program Files\Oracle
2017-03-04 20:55 - 2017-01-16 17:38 - 00959720 _____ (Oracle Corporation) C:\WINDOWS\system32\Drivers\VBoxDrv.sys
2017-03-04 20:55 - 2017-01-16 17:38 - 00149304 _____ (Oracle Corporation) C:\WINDOWS\system32\Drivers\VBoxUSBMon.sys
2017-03-01 23:49 - 2017-03-20 22:46 - 00001024 _____ C:\.rnd
2017-03-01 23:49 - 2017-03-01 23:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tenable Network Security
2017-03-01 23:48 - 2017-03-01 23:48 - 00000000 ____D C:\ProgramData\Tenable
2017-03-01 23:48 - 2017-03-01 23:48 - 00000000 ____D C:\Program Files\Tenable
2017-02-28 21:46 - 2017-03-05 11:48 - 00000000 ____D C:\Users\Sergio\Desktop\Ethic Hacking
2017-02-28 21:33 - 2017-02-28 21:33 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\.maltego
2017-02-28 21:33 - 2017-02-28 21:33 - 00000000 ____D C:\ProgramData\Paterva
2017-02-28 21:33 - 2017-02-28 21:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paterva
2017-02-28 21:32 - 2017-02-28 21:32 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Sun
2017-02-28 21:32 - 2017-02-28 21:32 - 00000000 ____D C:\Program Files (x86)\Paterva
2017-02-28 21:31 - 2017-03-18 23:51 - 00110144 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll
2017-02-28 21:31 - 2017-03-18 23:51 - 00000000 ____D C:\Program Files\Java
2017-02-27 22:16 - 2015-06-24 14:30 - 00064728 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vmx86.sys
2017-02-27 22:16 - 2013-10-08 18:21 - 00073296 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vsock.sys
2017-02-27 22:16 - 2013-10-08 18:21 - 00067664 _____ (VMware, Inc.) C:\WINDOWS\system32\vsocklib.dll
2017-02-27 22:16 - 2013-10-08 18:21 - 00063568 _____ (VMware, Inc.) C:\WINDOWS\SysWOW64\vsocklib.dll
2017-02-27 22:15 - 2015-06-24 14:30 - 00437976 _____ (VMware, Inc.) C:\WINDOWS\SysWOW64\vmnat.exe
2017-02-27 22:15 - 2015-06-24 14:30 - 00359128 _____ (VMware, Inc.) C:\WINDOWS\SysWOW64\vmnetdhcp.exe
2017-02-27 22:15 - 2015-06-24 14:27 - 00031448 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vmnetuserif.sys
2017-02-27 22:14 - 2017-02-27 22:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware
2017-02-27 22:14 - 2017-02-27 22:14 - 00000000 ____D C:\Program Files\Common Files\VMware
2017-02-27 22:14 - 2017-02-27 22:14 - 00000000 ____D C:\Program Files (x86)\VMware
2017-02-27 22:14 - 2015-06-24 14:27 - 00931032 _____ (VMware, Inc.) C:\WINDOWS\system32\vnetlib64.dll
2017-02-27 22:14 - 2014-08-21 08:07 - 00054976 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\hcmon.sys
2017-02-27 22:14 - 2014-08-21 08:06 - 00058048 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vmusb.sys
2017-02-27 22:11 - 2017-02-27 22:42 - 00000000 ____D C:\Users\Sergio\Documents\Virtual Machines
2017-02-27 19:48 - 2017-02-27 19:48 - 00000000 ____D C:\Users\Sergio\.idlerc

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-03-20 22:48 - 2016-09-29 20:05 - 00000000 ____D C:\Users\Sergio
2017-03-20 22:46 - 2016-09-29 20:14 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-03-20 22:46 - 2014-10-27 17:10 - 00000000 ____D C:\ProgramData\VMware
2017-03-20 22:45 - 2016-07-16 07:04 - 00786432 _____ C:\WINDOWS\system32\config\BBI
2017-03-20 22:43 - 2016-09-29 20:02 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-03-20 22:41 - 2016-07-16 23:51 - 01048510 _____ C:\WINDOWS\system32\perfh007.dat
2017-03-20 22:41 - 2016-07-16 23:51 - 00248048 _____ C:\WINDOWS\system32\perfc007.dat
2017-03-20 22:41 - 2015-08-09 20:57 - 02498940 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-03-20 22:33 - 2016-07-16 12:45 - 00000000 ____D C:\WINDOWS\INF
2017-03-20 22:33 - 2015-04-16 15:08 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2017-03-20 22:33 - 2015-04-16 15:08 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2017-03-20 22:33 - 2014-10-26 12:23 - 00000000 ____D C:\Program Files\WinRAR
2017-03-20 22:32 - 2016-09-29 20:16 - 00000008 __RSH C:\Users\Sergio\ntuser.pol
2017-03-20 22:28 - 2016-07-16 12:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-03-20 22:28 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-03-19 11:34 - 2016-07-16 07:04 - 00032768 _____ C:\WINDOWS\system32\config\ELAM
2017-03-19 11:34 - 2015-06-02 19:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-03-19 03:10 - 2016-10-04 16:41 - 00000000 ____D C:\Program Files (x86)\SpeedFan
2017-03-19 00:55 - 2016-07-16 12:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-03-19 00:06 - 2016-09-29 20:05 - 00000000 ____D C:\Users\postgres
2017-03-18 23:52 - 2016-09-29 20:14 - 00004440 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2017-03-18 23:52 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2017-03-18 23:52 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\Macromed
2017-03-18 23:52 - 2014-10-27 17:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-03-18 23:52 - 2014-10-26 12:23 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-03-18 23:52 - 2014-10-26 12:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-03-18 23:51 - 2014-10-26 12:41 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2017-03-18 23:50 - 2015-05-06 18:27 - 00000000 ____D C:\Program Files\Common Files\Apple
2017-03-18 23:49 - 2014-10-26 00:07 - 00001151 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-03-18 23:02 - 2015-03-10 17:03 - 00000000 ____D C:\Users\Sergio\AppData\LocalLow\Temp
2017-03-18 22:59 - 2014-10-26 12:50 - 00000000 ____D C:\Users\Sergio\AppData\Local\JDownloader v2.0
2017-03-18 22:55 - 2016-09-23 20:37 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\TS3Client
2017-03-18 22:55 - 2014-11-05 17:58 - 00000000 ____D C:\Program Files (x86)\Steam
2017-03-18 22:50 - 2014-10-26 10:16 - 00000000 ____D C:\Users\Sergio\AppData\Local\Razer
2017-03-18 22:50 - 2014-10-26 00:15 - 00000000 ____D C:\ProgramData\Razer
2017-03-18 22:50 - 2014-10-26 00:15 - 00000000 ____D C:\Program Files (x86)\Razer
2017-03-18 21:23 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2017-03-18 00:59 - 2014-10-27 09:42 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\vlc
2017-03-18 00:21 - 2014-10-29 14:39 - 00000000 ____D C:\WINDOWS\system32\MRT
2017-03-18 00:19 - 2015-04-16 15:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2017-03-18 00:19 - 2014-10-29 14:39 - 138634176 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-03-18 00:18 - 2014-10-26 12:31 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2017-03-18 00:15 - 2016-11-05 15:37 - 00000000 ____D C:\Users\Sergio\AppData\Local\ElevatedDiagnostics
2017-03-16 21:23 - 2013-08-22 14:25 - 00000167 _____ C:\WINDOWS\win.ini
2017-03-14 19:22 - 2014-12-23 17:29 - 00000000 ____D C:\Users\Sergio\AppData\Local\Spotify
2017-03-13 20:27 - 2014-10-27 17:14 - 00000000 ____D C:\Users\Sergio\AppData\Local\VMware
2017-03-13 19:32 - 2014-12-23 17:28 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Spotify
2017-03-13 19:07 - 2014-10-27 17:14 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\VMware
2017-03-11 14:19 - 2016-10-23 19:11 - 00000000 ____D C:\Users\Sergio\Documents\Soda PDF Files
2017-03-11 14:19 - 2016-10-23 19:11 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Soda PDF Desktop
2017-03-11 12:13 - 2014-12-13 14:35 - 00000000 ____D C:\Users\Sergio\AppData\Local\PokerStars.EU
2017-03-11 12:12 - 2014-12-13 14:34 - 00000000 ____D C:\Program Files (x86)\PokerStars.EU
2017-03-11 11:55 - 2016-09-23 20:37 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2017-03-10 06:17 - 2016-07-16 12:49 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-03-10 06:17 - 2016-07-16 12:49 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-03-06 19:07 - 2016-09-29 20:03 - 00000000 ____D C:\Program Files\AMD
2017-03-06 19:07 - 2015-05-19 18:55 - 00000000 ____D C:\Program Files (x86)\AMD
2017-03-06 19:07 - 2014-10-26 00:19 - 00000000 ____D C:\Users\Sergio\AppData\Local\AMD
2017-03-06 19:04 - 2014-10-26 00:14 - 00000000 ____D C:\AMD
2017-03-06 18:50 - 2016-09-29 20:03 - 00000000 ____D C:\ProgramData\Package Cache
2017-03-06 18:48 - 2016-09-29 20:03 - 00000000 ____D C:\ProgramData\AMD
2017-03-04 23:55 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\NDF
2017-02-28 21:32 - 2016-02-14 18:43 - 00000000 ____D C:\Users\Sergio\.oracle_jre_usage
2017-02-27 22:14 - 2014-10-27 17:10 - 02053002 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2017-02-25 11:31 - 2014-10-25 23:53 - 00000000 ____D C:\Users\Sergio\AppData\Local\Packages

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2015-07-20 16:32 - 2015-07-20 16:32 - 0923401 _____ () C:\Program Files (x86)\WinDlg_124.zip
2015-07-12 10:02 - 2015-07-12 10:02 - 0000000 ___SH () C:\Users\Sergio\AppData\Local\LumaEmu
2016-07-03 18:51 - 2016-07-03 18:51 - 0000733 _____ () C:\Users\Sergio\AppData\Local\recently-used.xbel
2016-09-29 20:03 - 2016-09-29 20:03 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2015-07-06 20:11 - 2015-07-06 20:11 - 0005036 _____ () C:\ProgramData\flwjycbm.bab

Einige Dateien in TEMP:
====================
2017-03-19 03:10 - 2017-03-19 03:10 - 0192512 _____ () C:\Users\Sergio\AppData\Local\Temp\sfamcc00001.dll
2017-03-19 03:10 - 2017-03-19 03:10 - 0158720 _____ () C:\Users\Sergio\AppData\Local\Temp\sfareca00001.dll

==================== Bamital & volsnap ======================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert

LastRegBack: 2017-03-18 21:07

==================== Ende von FRST.txt ============================
         

Addition Log

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 15-03-2017
durchgeführt von Sergio (20-03-2017 22:51:30)
Gestartet von C:\Users\Sergio\Desktop
Windows 10 Pro Version 1607 (X64) (2016-09-29 19:16:19)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-1478414814-3749218601-3539646535-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1478414814-3749218601-3539646535-503 - Limited - Disabled)
Gast (S-1-5-21-1478414814-3749218601-3539646535-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1478414814-3749218601-3539646535-1003 - Limited - Enabled)
postgres (S-1-5-21-1478414814-3749218601-3539646535-1007 - Limited - Enabled) => C:\Users\postgres
Sergio (S-1-5-21-1478414814-3749218601-3539646535-1001 - Administrator - Enabled) => C:\Users\Sergio

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 25.0.0.134 - Adobe Systems Incorporated)
Adobe Flash Player 25 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 25.0.0.127 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.19) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.19 - Adobe Systems Incorporated)
AMD Install Manager (HKLM\...\AMD Catalyst Install Manager) (Version: 5.00 - Advanced Micro Devices, Inc.)
Apple Application Support (32-Bit) (HKLM-x32\...\{9BA1A894-B42F-4805-BC8C-349C905A3930}) (Version: 5.3.1 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{7EAC8A42-9FAC-4F6B-AABF-C08C9F2E0F13}) (Version: 5.3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{55BB2110-FB43-49B3-93F4-945A0CFB0A6C}) (Version: 10.0.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Ashampoo WinOptimizer 2017 (HKLM-x32\...\{4209F371-6CE9-533C-2CDC-94E053273B35}_is1) (Version: 14.00.04 - Ashampoo GmbH & Co. KG)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
calibre 64bit (HKLM\...\{DD84AFA7-867C-428A-8FA4-59A98AB60A1F}) (Version: 2.7.0 - Kovid Goyal)
Catalyst Control Center Next Localization BR (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.28 - Piriform)
chip 1-click download service (HKLM-x32\...\{503CA94E-0834-4CEE-AD92-BA17AF4E809A}) (Version: 3.6.9.0 - Chip Digital GmbH)
ComicRack v0.9.176 (HKLM\...\ComicRack) (Version: v0.9.176 - cYo Soft)
Dragon Ball Xenoverse 2 Digitale Deluxe Edition MULTi9 1.0 (HKLM-x32\...\Dragon Ball Xenoverse 2 Digitale Deluxe Edition MULTi9 1.0) (Version:  - )
Evernote v. 6.4.2 (HKLM-x32\...\{E74F0DCA-9FC8-11E6-9D98-005056950253}) (Version: 6.4.2.3788 - Evernote Corp.)
f.lux (HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Flux) (Version:  - )
FocalFilter (HKLM-x32\...\{78156F61-016D-402A-9EF9-C2AA253DB22A}) (Version: 0.9.00 - FocalFilter)
FreeMind (HKLM-x32\...\B991B020-2968-11D8-AF23-444553540000_is1) (Version: 1.0.1 - )
GeoGebra 5 (HKLM-x32\...\GeoGebra 5) (Version: 5.0.177.0 - International GeoGebra Institute)
Google Chrome (HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Google Chrome) (Version: 56.0.2924.87 - Google Inc.)
iTunes (HKLM\...\{9D0D2A8B-7E7B-4D88-8D50-24286ED6A5EB}) (Version: 12.5.5.5 - Apple Inc.)
Java 8 Update 121 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180121F0}) (Version: 8.0.1210.13 - Oracle Corporation)
Java 8 Update 92 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418092F0}) (Version: 8.0.920.14 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
JetBrains PyCharm Community Edition 2016.3.2 (HKLM-x32\...\PyCharm Community Edition 2016.3.2) (Version: 163.10154.50 - JetBrains s.r.o.)
Maltego CE 4.0.11 (HKLM-x32\...\MaltegoCE 4.0.11) (Version: 4.0.11 - Paterva)
Malwarebytes Version 3.0.6.1469 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.0.6.1469 - Malwarebytes)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\OneDriveSetup.exe) (Version: 17.3.6743.1212 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50905.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23506 (HKLM-x32\...\{3ee5e5bb-b7cc-4556-8861-a00a82977d6c}) (Version: 14.0.23506.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24212 (HKLM-x32\...\{462f63a8-6347-4894-a1b3-dbfe3a4c981d}) (Version: 14.0.24212.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 47.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 47.0.2 (x86 de)) (Version: 47.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 42.0.0.5780 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
NVIDIA PhysX (HKLM-x32\...\{B455E95A-B804-439F-B533-336B1635AE97}) (Version: 9.14.0702 - NVIDIA Corporation)
Oracle VM VirtualBox 5.1.14 (HKLM\...\{6AE61854-0F78-49E3-ABCC-586FB43CE709}) (Version: 5.1.14 - Oracle Corporation)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PokerStars.eu (HKLM-x32\...\PokerStars.eu) (Version:  - PokerStars.eu)
Python 3.6.0 (64-bit) (HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\{37a4e38b-baf7-4500-97f1-0f7c51d9a395}) (Version: 3.6.150.0 - Python Software Foundation)
Python 3.6.0 Core Interpreter (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Development Libraries (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Documentation (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Executables (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 pip Bootstrap (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Standard Library (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Tcl/Tk Support (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Test Suite (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Utility Scripts (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python Launcher (HKLM-x32\...\{A674B2CB-13CA-437B-A215-9DD257959A49}) (Version: 3.6.5835.0 - Python Software Foundation)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7535 - Realtek Semiconductor Corp.)
Sandboxie 5.16 (64-bit) (HKLM\...\Sandboxie) (Version: 5.16 - Sandboxie Holdings, LLC)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version:  - Microsoft) Hidden
Skype™ 7.6 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.6.105 - Skype Technologies S.A.)
Soda PDF Desktop Asian Fonts Pack (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Convert Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Create Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Edit Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Forms Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Insert Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop OCR Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Review Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Secure Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop View Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
South Park Der Stab der Wahrheit Incl. Ultimate Fellowship Pack MULTI-2 1.00 (HKLM-x32\...\South Park Der Stab der Wahrheit Incl. Ultimate Fellowship Pack MULTI-2 1.00) (Version:  - )
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Spotify (HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Spotify) (Version: 1.0.50.41368.gbd68dbef - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
SumatraPDF (HKLM-x32\...\SumatraPDF) (Version: 3.0 - Krzysztof Kowalczyk)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.19 - TeamSpeak Systems GmbH)
Tenable Nessus (x64) (HKLM\...\{BD1A3F84-26A0-4B77-9441-A25A9456D05D}) (Version: 6.10.2.20085 - Tenable Network Security, Inc.)
The Elder Scrolls V Skyrim Total Conversion Enderal Edition 1.0.0.9 (HKLM-x32\...\The Elder Scrolls V Skyrim Total Conversion Enderal Edition 1.0.0.9) (Version:  - )
The Swapper (HKLM\...\Steam App 231160) (Version:  - Olli Harjola, Otto Hantula, Tom Jubert, Carlo Castellano)
The Talos Principle MULTi12 244371 (HKLM-x32\...\The Talos Principle MULTi12 244371) (Version:  - )
The Witness MULTi2 1.0 (HKLM-x32\...\The Witness MULTi2 1.0) (Version:  - )
The Witness Update 3 MULTi2 1.0 (HKLM-x32\...\The Witness Update 3 MULTi2 1.0) (Version:  - )
Transmissions: Element 120 (HKLM\...\Steam App 365300) (Version:  - Shokunin)
Update for Skype for Business 2015 (KB3039776) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{5D2260D6-DB16-41DC-915B-A39BF4F66362}) (Version:  - Microsoft)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: 5.4.7.0 - Elaborate Bytes)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.4 - VideoLAN)
VMware Player (HKLM-x32\...\VMware_Player) (Version: 6.0.7 - VMware, Inc)
VMware Player (Version: 6.0.7 - VMware, Inc.) Hidden
WinRAR 5.40 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
XMind 7 (Update 1) (v3.6.1) (HKLM-x32\...\XMind_is1) (Version: 3.6.1.201512240104 - XMind Ltd.)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001_Classes\CLSID\{CB492AF1-2CEF-4E58-BE47-471C77D0C8BA}\InprocServer32 -> C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\psuser_64.dll (Google Inc.)

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {05866645-3760-4F4E-BC6C-3BBDEDFB310F} - System32\Tasks\AMD Updater => C:\Program Files\AMD\CIM\\Bin64\InstallManagerApp.exe [2016-02-26] (Advanced Micro Devices, Inc.)
Task: {05C0574D-989C-4495-8DE8-D6246D77AF3C} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {12154CA5-8F42-4B2F-A33E-3A02C98490B3} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {1BFBFA70-D3C6-4DB6-A3D3-6A34F0996C8F} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001Core => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe [2015-03-26] (Google Inc.)
Task: {1CF529C5-D29F-43AE-92FD-82A50EC964BA} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001Core1d2597b6c57f2c5 => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe [2015-03-26] (Google Inc.)
Task: {2AA358D6-9F4F-48E9-916F-1A0EDC6BE390} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {30F3058C-0415-4F77-84D4-B602143DF305} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => %SystemRoot%\System32\AutoWorkplace.exe 
Task: {377CB5EC-1FF1-4320-9889-A0AB77542A9E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-03-18] (Adobe Systems Incorporated)
Task: {3D20A507-D104-4CED-89A4-AF8E3F5AAC5C} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {43B97978-A6E7-44F8-B307-9CD98822E46C} - System32\Tasks\{B009C1D4-4FB9-4DE4-AEC7-12D4889EE128} => pcalua.exe -a "F:\Life Is Strange\Binaries\Win32\LifeIsStrange.exe" -d "F:\Life Is Strange\Binaries\Win32"
Task: {4828E74B-9E89-46CC-9738-CB90DB87849F} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {4A698CF9-7317-4812-B893-2ED3C387B5BE} - \WiseCleaner\WRCSkipUAC -> Keine Datei <==== ACHTUNG
Task: {4ACAD694-0240-4765-BA30-2BC16F8E9EB3} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {4E5192E3-4E39-4011-A759-A7FC60E97131} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {56BD91C2-7935-449E-9A59-5C3704317F6F} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {57033CC7-D3A0-4EAD-A992-F3900D9707E6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2017-03-03] (Piriform Ltd)
Task: {6324C092-090C-47D8-9DC5-45B732284B97} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {75AAB113-5325-48D5-B655-732CC5E749E4} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {7996838F-3C7C-4E99-88CF-527934FEDA39} - System32\Tasks\Auto Re-Aktivierung => C:\WINDOWS\Re-Aktivierung\TriggerKMS.exe [2013-01-23] ()
Task: {838F70AE-67A7-4327-AB01-D85A7E6734B1} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {9148DF24-37DC-4805-9F26-DF5BCE9715A9} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001UA => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe [2015-03-26] (Google Inc.)
Task: {A145E2BD-13DB-446C-8821-33AC603DDDE2} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {A85DBF88-3373-427A-9A4E-5749730B3413} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {BD98A2E4-0C6E-4836-9C3D-16F4843C32DC} - System32\Tasks\Wise Registry Cleaner Schedule Task => C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe 
Task: {BE8DAB0C-5FAF-45A6-A5E7-BE07970E0515} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG
Task: {C2240968-5C24-4A71-816D-7A321E9E1A2F} - System32\Tasks\{DD5EF7D6-65B6-4080-B57C-5810676A3FEA} => Firefox.exe hxxp://ui.skype.com/ui/0/6.21.60.104/de/abandoninstall?page=tsBing
Task: {D7E2333E-A177-4BF2-9C9E-4A5584D13208} - System32\Tasks\Launch HTC Sync Loader => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe 
Task: {D80DA320-B7AE-4200-9C6D-6CD0EC753296} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Task: {E03FB901-52D3-453C-A2C8-E048E8DE5B75} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {E4015168-5F3B-4C32-93EC-98E3B5132F6A} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe 
Task: {EF679536-F393-428B-947B-09BA2A858E4D} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {F56BBAD0-3E2C-46C1-AE47-78A3F2DDE496} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {F69F380B-C6CC-4E25-85D7-5A95585509AF} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001UA1d2597b6c617c32 => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe [2015-03-26] (Google Inc.)
Task: {FA1C89C0-1F9A-4401-9AE3-5C5284B8138A} - System32\Tasks\OneDrive Standalone Update Task => C:\Users\Sergio\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\OneDriveStandaloneUpdater.exe 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001Core.job => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001UA.job => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2016-07-16 12:42 - 2016-07-16 12:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-12-18 23:02 - 2016-12-09 11:29 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-09-01 17:12 - 2016-09-01 17:12 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2017-01-13 13:56 - 2017-01-13 13:56 - 01353528 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2017-03-20 22:36 - 2017-02-24 06:23 - 02264352 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll
2017-03-20 22:36 - 2017-02-24 06:23 - 02264528 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2016-12-18 23:02 - 2016-12-09 11:29 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2016-09-30 08:34 - 2016-09-07 05:56 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-16 14:57 - 2016-12-21 08:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-01-16 14:57 - 2016-12-21 07:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-16 14:57 - 2016-12-21 07:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-16 14:57 - 2016-12-21 07:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-16 14:57 - 2016-12-21 07:48 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2017-01-16 14:57 - 2016-12-21 07:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-16 14:57 - 2016-12-21 07:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2017-03-13 18:23 - 2017-03-13 18:23 - 00077312 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-03-13 18:23 - 2017-03-13 18:23 - 00182784 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-03-13 18:23 - 2017-03-13 18:23 - 41048064 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-03-13 18:23 - 2017-03-13 18:23 - 02236896 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\roottools.dll
2017-01-16 14:57 - 2016-12-21 07:47 - 00114176 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Dss.BackgroundTask.dll
2017-01-16 14:57 - 2016-12-21 07:49 - 04046848 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Signals.dll
2017-01-16 14:57 - 2016-12-21 07:47 - 01475584 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.IntentExtraction.dll
2017-03-09 15:35 - 2017-03-09 15:35 - 00055808 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.79.0_x64__8wekyb3d8bbwe\WinStoreTasksWrapper.dll
2016-07-16 12:42 - 2016-07-16 12:42 - 01872384 _____ () C:\Windows\System32\speech_onecore\engines\tts\MSTTSEngine_OneCore.dll
2017-03-18 00:04 - 2017-03-18 00:04 - 37021184 _____ () C:\Program Files\WindowsApps\Microsoft.XboxApp_24.27.17008.0_x64__8wekyb3d8bbwe\XboxApp.dll
2016-11-11 15:18 - 2016-11-11 15:18 - 00879104 _____ () C:\Program Files\WindowsApps\Microsoft.XboxApp_24.27.17008.0_x64__8wekyb3d8bbwe\sqlite3.dll
2015-11-21 12:11 - 2015-11-21 12:11 - 00258560 _____ () C:\Program Files\WindowsApps\Microsoft.XboxApp_24.27.17008.0_x64__8wekyb3d8bbwe\StoreRatingPromotion.dll
2017-01-16 14:57 - 2016-12-21 07:47 - 00115712 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\DeviceSideServicesActionUriHandler.dll
2017-01-16 14:57 - 2016-12-21 07:47 - 00522752 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.NodeWinrtWrap.dll
2016-07-16 12:43 - 2016-07-16 23:56 - 00040448 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\dss_service\node_modules\winrt-projections\bin\Winrt_Projections.node
2016-07-16 12:43 - 2016-07-16 23:56 - 00813056 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\dss_service\node_modules\windows.web.http\bin\NodeRT_Windows_Web_Http.node
2016-07-16 12:43 - 2016-07-16 23:56 - 00963584 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\dss_service\node_modules\windows.web.http.headers\bin\NodeRT_Windows_Web_Http_Headers.node
2016-07-16 12:43 - 2016-07-16 23:56 - 00249344 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\dss_service\node_modules\windows.web.http.filters\bin\NodeRT_Windows_Web_Http_Filters.node
2016-07-16 12:43 - 2016-07-16 23:56 - 00572416 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\dss_service\node_modules\windows.storage.streams\bin\NodeRT_Windows_Storage_Streams.node
2016-07-16 12:43 - 2016-07-16 23:56 - 00403968 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\dss_service\node_modules\windows.foundation\bin\NodeRT_Windows_Foundation.node
2016-07-16 12:43 - 2016-07-16 23:56 - 00183296 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\dss_service\node_modules\nodert-buffer-utils\bin\NodeRT_Buffer_Utils.node
2016-07-16 12:43 - 2016-07-16 23:56 - 00288256 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\dss_service\node_modules\windows.cortana.pal\bin\NodeRT_Windows_Cortana_PAL.node
2015-06-24 14:28 - 2015-06-24 14:28 - 01301720 _____ () C:\Program Files (x86)\VMware\VMware Player\libxml2.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)

AlternateDataStreams: C:\Users\Sergio\Desktop\2014-06-09 12.36.44.jpg:com.dropbox.attributes [912]
AlternateDataStreams: C:\Users\Sergio\Desktop\2014-06-09 12.41.14.jpg:com.dropbox.attributes [225]

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE trusted site: HKU\.DEFAULT\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\localhost -> localhost

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2013-08-22 14:25 - 2016-12-13 20:23 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Sergio\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\img2.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

HKLM\...\StartupApproved\StartupFolder: => "Audible Download Manager.lnk"
HKLM\...\StartupApproved\StartupFolder: => "FocalFilterHelper.lnk"
HKLM\...\StartupApproved\Run: => "RTHDVCPL"
HKLM\...\StartupApproved\Run: => "iTunesHelper"
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKLM\...\StartupApproved\Run: => "StartCN"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "Razer Synapse"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "VirtualCloneDrive"
HKLM\...\StartupApproved\Run32: => "Raptr"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\StartupFolder: => "An OneNote senden.lnk"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\StartupFolder: => "EvernoteClipper.lnk"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\Run: => "Spotify Web Helper"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\Run: => "Google Update"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\Run: => "adaware browser dock"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\Run: => "Ad-Aware Search Companion"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [{FC7A4804-3480-408B-AC34-A24EA79DE294}] => (Allow) C:\Windows\Temp\KMSnano\qemu-system-i386.exe
FirewallRules: [{80D80BED-5305-4EEF-8347-D1EB13210F06}] => (Allow) C:\Windows\Temp\KMSnano\qemu-system-i386.exe

==================== Wiederherstellungspunkte =========================

ACHTUNG: Systemwiederherstellung ist deaktiviert

==================== Fehlerhafte Geräte im Gerätemanager =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (03/20/2017 10:48:45 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/20/2017 10:35:43 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/20/2017 10:27:27 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Event-ID 0

Error: (03/20/2017 10:24:33 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/19/2017 01:58:00 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/19/2017 11:58:59 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/19/2017 09:58:51 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/19/2017 07:58:52 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/19/2017 05:58:52 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/19/2017 04:54:06 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Event-ID 0


Systemfehler:
=============
Error: (03/20/2017 10:50:29 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: Der Server "{784E29F4-5EBE-4279-9948-1E8FE941646D}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (03/20/2017 10:47:28 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 und der APPID 
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (03/20/2017 10:46:43 PM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: Der Dienst "chip1click" hat einen ungültigen aktuellen Status gemeldet: 0

Error: (03/20/2017 10:46:43 PM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: Der Dienst "chip1click" hat einen ungültigen aktuellen Status gemeldet: 0

Error: (03/20/2017 10:46:42 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Soda PDF Desktop Creator" wurde aufgrund folgenden Fehlers nicht gestartet: 
Das System kann die angegebene Datei nicht finden.

Error: (03/20/2017 10:45:41 PM) (Source: DCOM) (EventID: 10010) (User: SERGIOS-PC)
Description: Der Server "{D63B10C5-BB46-4990-A94F-E40B9D520160}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (03/20/2017 10:45:36 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (03/20/2017 10:37:11 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: Der Server "{784E29F4-5EBE-4279-9948-1E8FE941646D}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (03/20/2017 10:36:56 PM) (Source: DCOM) (EventID: 10016) (User: SERGIOS-PC)
Description: Durch die Berechtigungseinstellungen für "Computerstandard" wird dem Benutzer "Sergios-PC\Sergio" (SID: S-1-5-21-1478414814-3749218601-3539646535-1001) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 und der APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 im Anwendungscontainer "Microsoft.Windows.Cortana_1.7.0.14393_neutral_neutral_cw5n1h2txyewy" (SID: S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (03/20/2017 10:34:10 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 und der APPID 
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.


CodeIntegrity:
===================================
  Date: 2017-03-19 05:34:50.982
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-03-18 00:15:51.902
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-03-08 20:41:44.737
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-03-07 16:07:59.583
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-03-05 12:03:31.285
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-03-03 17:01:58.393
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-03-01 22:16:13.030
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-02-28 23:26:03.401
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-02-28 12:36:19.913
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-02-04 18:13:32.823
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Speicherinformationen =========================== 

Prozessor: AMD Phenom(tm) II X4 945 Processor
Prozentuale Nutzung des RAM: 19%
Installierter physikalischer RAM: 16383.17 MB
Verfügbarer physikalischer RAM: 13150.43 MB
Summe virtueller Speicher: 18815.17 MB
Verfügbarer virtueller Speicher: 15536.34 MB

==================== Laufwerke ================================

Drive c: () (Fixed) (Total:100.21 GB) (Free:3.95 GB) NTFS
Drive d: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive e: () (Fixed) (Total:931.41 GB) (Free:44.85 GB) NTFS
Drive f: () (Fixed) (Total:156.25 GB) (Free:30.61 GB) NTFS
Drive h: () (Fixed) (Total:100 GB) (Free:99.68 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (Size: 335.4 GB) (Disk ID: F261F55D)
Partition 1: (Active) - (Size=100 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=156.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=79.1 GB) - (Type=05)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: FEBD6380)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: 01EE8E42)
Partition 1: (Not Active) - (Size=100.2 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=450 MB) - (Type=27)

==================== Ende von Addition.txt ============================
         

Vielen Dank für deine weitere Unterstützung .

Servus,





Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

start
CloseProcesses:
2017-03-18 23:01 - 2017-03-18 23:01 - 00004058 _____ C:\WINDOWS\System32\Tasks\Wise Registry Cleaner Schedule Task
2017-03-18 22:53 - 2017-03-20 22:45 - 00000000 ____D C:\WINDOWS\System32\Tasks\WiseCleaner
2017-03-18 22:53 - 2017-03-20 22:31 - 00000000 ____D C:\Program Files (x86)\Wise
Task: {4A698CF9-7317-4812-B893-2ED3C387B5BE} - \WiseCleaner\WRCSkipUAC -> Keine Datei <==== ACHTUNG
Task: {4ACAD694-0240-4765-BA30-2BC16F8E9EB3} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {4E5192E3-4E39-4011-A759-A7FC60E97131} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {56BD91C2-7935-449E-9A59-5C3704317F6F} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {75AAB113-5325-48D5-B655-732CC5E749E4} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {7996838F-3C7C-4E99-88CF-527934FEDA39} - System32\Tasks\Auto Re-Aktivierung => C:\WINDOWS\Re-Aktivierung\TriggerKMS.exe [2013-01-23] ()
C:\WINDOWS\Re-Aktivierung
Task: {A145E2BD-13DB-446C-8821-33AC603DDDE2} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {A85DBF88-3373-427A-9A4E-5749730B3413} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {BD98A2E4-0C6E-4836-9C3D-16F4843C32DC} - System32\Tasks\Wise Registry Cleaner Schedule Task => C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe 
Task: {BE8DAB0C-5FAF-45A6-A5E7-BE07970E0515} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG
Task: {D80DA320-B7AE-4200-9C6D-6CD0EC753296} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Task: {E03FB901-52D3-453C-A2C8-E048E8DE5B75} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {F56BBAD0-3E2C-46C1-AE47-78A3F2DDE496} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\Run: => "adaware browser dock"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\Run: => "Ad-Aware Search Companion"
FirewallRules: [{80D80BED-5305-4EEF-8347-D1EB13210F06}] => (Allow) C:\Windows\Temp\KMSnano\qemu-system-i386.exe
CMD: dir "%ProgramFiles%"
CMD: dir "%ProgramFiles(x86)%"
CMD: dir "%ProgramData%"
CMD: dir "%Appdata%"
CMD: dir "%LocalAppdata%"
CMD: dir "%CommonProgramFiles(x86)%"
CMD: dir "%CommonProgramW6432%"
RemoveProxy:
CMD: ipconfig /flushdns
CMD: netsh winsock reset
EmptyTemp:
end
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Schritt 2
Lade dir die passende Version von SystemLook vom folgenden Spiegel herunter und speichere das Tool auf dem Desktop:
SystemLook (32 bit) | SystemLook (64 bit)

• Doppelklicke auf die SystemLook.exe, um das Tool zu starten.
• Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:
  
  
  

  :filefind
  *Wise*
  *web companion*
  *WinZipper*
  
  :folderfind
  *Wise*
  *web companion*
  *WinZipper*
  
  :regfind
  Wise
  web companion
  WinZipper
           

• Klicke nun auf den Button Look, um den Scan zu starten.
• Der Suchlauf kann einige Zeit dauern.
• Wenn der Suchlauf beendet ist, wird sich dein Editor mit den Ergebnissen öffnen, poste diese in deinen Thread.
• Die Ergebnisse werden auch auf dem Desktop als SystemLook.txt gespeichert.

Schritt 3

• Starte die FRST.exe erneut. Vergewissere dich, dass vor Addition.txt ein Haken gesetzt ist und drücke auf Untersuchen.
• FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
• Poste mir beide Logdateien mit deiner nächsten Antwort.

Bitte poste mit deiner nächsten Antwort

• die Logdatei des FRST-Fix,
• die Logdatei von SystemLook,
• die beiden neuen Logdateien von FRST (FRST.txt und Addition.txt).

Servus, hier die Logs

FRST-Fix

Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version: 15-03-2017
durchgeführt von Sergio (21-03-2017 21:00:13) Run:1
Gestartet von C:\Users\Sergio\Desktop
Geladene Profile: Sergio (Verfügbare Profile: Sergio & postgres)
Start-Modus: Normal
==============================================

fixlist Inhalt:
*****************
start
CloseProcesses:
2017-03-18 23:01 - 2017-03-18 23:01 - 00004058 _____ C:\WINDOWS\System32\Tasks\Wise Registry Cleaner Schedule Task
2017-03-18 22:53 - 2017-03-20 22:45 - 00000000 ____D C:\WINDOWS\System32\Tasks\WiseCleaner
2017-03-18 22:53 - 2017-03-20 22:31 - 00000000 ____D C:\Program Files (x86)\Wise
Task: {4A698CF9-7317-4812-B893-2ED3C387B5BE} - \WiseCleaner\WRCSkipUAC -> Keine Datei <==== ACHTUNG
Task: {4ACAD694-0240-4765-BA30-2BC16F8E9EB3} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {4E5192E3-4E39-4011-A759-A7FC60E97131} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {56BD91C2-7935-449E-9A59-5C3704317F6F} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {75AAB113-5325-48D5-B655-732CC5E749E4} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {7996838F-3C7C-4E99-88CF-527934FEDA39} - System32\Tasks\Auto Re-Aktivierung => C:\WINDOWS\Re-Aktivierung\TriggerKMS.exe [2013-01-23] ()
C:\WINDOWS\Re-Aktivierung
Task: {A145E2BD-13DB-446C-8821-33AC603DDDE2} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {A85DBF88-3373-427A-9A4E-5749730B3413} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {BD98A2E4-0C6E-4836-9C3D-16F4843C32DC} - System32\Tasks\Wise Registry Cleaner Schedule Task => C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe 
Task: {BE8DAB0C-5FAF-45A6-A5E7-BE07970E0515} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG
Task: {D80DA320-B7AE-4200-9C6D-6CD0EC753296} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Task: {E03FB901-52D3-453C-A2C8-E048E8DE5B75} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {F56BBAD0-3E2C-46C1-AE47-78A3F2DDE496} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\Run: => "adaware browser dock"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\Run: => "Ad-Aware Search Companion"
FirewallRules: [{80D80BED-5305-4EEF-8347-D1EB13210F06}] => (Allow) C:\Windows\Temp\KMSnano\qemu-system-i386.exe
CMD: dir "%ProgramFiles%"
CMD: dir "%ProgramFiles(x86)%"
CMD: dir "%ProgramData%"
CMD: dir "%Appdata%"
CMD: dir "%LocalAppdata%"
CMD: dir "%CommonProgramFiles(x86)%"
CMD: dir "%CommonProgramW6432%"
RemoveProxy:
CMD: ipconfig /flushdns
CMD: netsh winsock reset
EmptyTemp:
end
*****************

Prozesse erfolgreich geschlossen.
C:\WINDOWS\System32\Tasks\Wise Registry Cleaner Schedule Task => erfolgreich verschoben
C:\WINDOWS\System32\Tasks\WiseCleaner => erfolgreich verschoben
C:\Program Files (x86)\Wise => erfolgreich verschoben
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4A698CF9-7317-4812-B893-2ED3C387B5BE} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4A698CF9-7317-4812-B893-2ED3C387B5BE} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WiseCleaner\WRCSkipUAC => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4ACAD694-0240-4765-BA30-2BC16F8E9EB3} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4ACAD694-0240-4765-BA30-2BC16F8E9EB3} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4E5192E3-4E39-4011-A759-A7FC60E97131} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4E5192E3-4E39-4011-A759-A7FC60E97131} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{56BD91C2-7935-449E-9A59-5C3704317F6F} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{56BD91C2-7935-449E-9A59-5C3704317F6F} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{75AAB113-5325-48D5-B655-732CC5E749E4} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{75AAB113-5325-48D5-B655-732CC5E749E4} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{7996838F-3C7C-4E99-88CF-527934FEDA39} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7996838F-3C7C-4E99-88CF-527934FEDA39} => Schlüssel erfolgreich entfernt
C:\WINDOWS\System32\Tasks\Auto Re-Aktivierung => erfolgreich verschoben
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Auto Re-Aktivierung => Schlüssel erfolgreich entfernt
C:\WINDOWS\Re-Aktivierung => erfolgreich verschoben
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A145E2BD-13DB-446C-8821-33AC603DDDE2} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A145E2BD-13DB-446C-8821-33AC603DDDE2} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A85DBF88-3373-427A-9A4E-5749730B3413} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A85DBF88-3373-427A-9A4E-5749730B3413} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BD98A2E4-0C6E-4836-9C3D-16F4843C32DC} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BD98A2E4-0C6E-4836-9C3D-16F4843C32DC} => Schlüssel erfolgreich entfernt
C:\WINDOWS\System32\Tasks\Wise Registry Cleaner Schedule Task => nicht gefunden.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Wise Registry Cleaner Schedule Task => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BE8DAB0C-5FAF-45A6-A5E7-BE07970E0515} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BE8DAB0C-5FAF-45A6-A5E7-BE07970E0515} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D80DA320-B7AE-4200-9C6D-6CD0EC753296} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D80DA320-B7AE-4200-9C6D-6CD0EC753296} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{E03FB901-52D3-453C-A2C8-E048E8DE5B75} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E03FB901-52D3-453C-A2C8-E048E8DE5B75} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{F56BBAD0-3E2C-46C1-AE47-78A3F2DDE496} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F56BBAD0-3E2C-46C1-AE47-78A3F2DDE496} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess => Schlüssel erfolgreich entfernt
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\\adaware browser dock => Wert erfolgreich entfernt
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\adaware browser dock => Wert nicht gefunden.
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\\Ad-Aware Search Companion => Wert erfolgreich entfernt
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Ad-Aware Search Companion => Wert nicht gefunden.
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{80D80BED-5305-4EEF-8347-D1EB13210F06} => Wert nicht gefunden.

========= dir "%ProgramFiles%" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: 746C-5BE4

 Verzeichnis von C:\Program Files

20.03.2017  22:36    <DIR>          .
20.03.2017  22:36    <DIR>          ..
06.03.2017  19:07    <DIR>          AMD
29.09.2016  20:03    <DIR>          ATI Technologies
18.03.2017  23:49    <DIR>          Bonjour
30.10.2014  21:59    <DIR>          Calibre2
18.03.2017  22:48    <DIR>          CCleaner
26.10.2014  13:25    <DIR>          ComicRack
20.03.2017  22:33    <DIR>          Common Files
09.01.2015  23:47    <DIR>          DIFX
18.01.2017  11:31    <DIR>          Internet Explorer
18.03.2017  23:50    <DIR>          iPod
18.03.2017  23:51    <DIR>          iTunes
18.03.2017  23:51    <DIR>          Java
20.03.2017  22:36    <DIR>          Malwarebytes
26.10.2014  12:29    <DIR>          Microsoft Analysis Services
26.10.2014  12:31    <DIR>          Microsoft Office
20.03.2017  22:33    <DIR>          Microsoft Silverlight
26.10.2014  12:31    <DIR>          Microsoft SQL Server
29.09.2016  20:07    <DIR>          Microsoft.NET
29.09.2016  20:57    <DIR>          MSBuild
04.03.2017  20:55    <DIR>          Oracle
29.09.2016  20:03    <DIR>          Realtek
29.09.2016  20:57    <DIR>          Reference Assemblies
19.03.2017  01:04    <DIR>          Sandboxie
11.03.2017  11:55    <DIR>          TeamSpeak 3 Client
01.03.2017  23:48    <DIR>          Tenable
27.10.2014  08:51    <DIR>          VideoLAN
30.09.2016  10:05    <DIR>          Windows Defender
30.09.2016  10:05    <DIR>          Windows Defender Advanced Threat Protection
17.10.2016  15:50    <DIR>          Windows Mail
28.10.2016  22:54    <DIR>          Windows Media Player
16.07.2016  12:47    <DIR>          Windows Multimedia Platform
29.09.2016  20:16    <DIR>          Windows NT
17.10.2016  15:50    <DIR>          Windows Photo Viewer
16.07.2016  12:47    <DIR>          Windows Portable Devices
16.07.2016  12:47    <DIR>          WindowsPowerShell
20.03.2017  22:33    <DIR>          WinRAR
               0 Datei(en),              0 Bytes
              38 Verzeichnis(se),  2.280.689.664 Bytes frei

========= Ende von CMD: =========


========= dir "%ProgramFiles(x86)%" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: 746C-5BE4

 Verzeichnis von C:\Program Files (x86)

21.03.2017  21:00    <DIR>          .
21.03.2017  21:00    <DIR>          ..
09.01.2015  22:57    <DIR>          Adobe
04.09.2015  18:02    <DIR>          AGEIA Technologies
06.03.2017  19:07    <DIR>          AMD
19.05.2015  18:56    <DIR>          AMD AVT
01.04.2016  17:03    <DIR>          Apple Software Update
18.03.2017  22:55    <DIR>          Ashampoo
29.09.2016  20:03    <DIR>          ATI Technologies
07.05.2015  16:29    <DIR>          Audible
18.03.2017  23:49    <DIR>          Bonjour
28.11.2014  06:54    <DIR>          BurningStudioPortable
18.03.2017  22:53    <DIR>          Chip Digital GmbH
20.03.2017  22:33    <DIR>          Common Files
27.10.2014  11:24    <DIR>          Elaborate Bytes
20.04.2016  06:41    <DIR>          Evernote
11.10.2015  11:50    <DIR>          FlashFXP 5
26.02.2016  00:14    <DIR>          FocalFilter
09.10.2015  09:57    <DIR>          FreeMind
02.11.2016  00:06    <DIR>          Full Tilt Poker.Eu
03.12.2015  20:58    <DIR>          GeoGebra 5.0
26.04.2015  20:10    <DIR>          HTC
18.01.2017  11:31    <DIR>          Internet Explorer
10.03.2017  22:54    <DIR>          JetBrains
26.10.2014  12:29    <DIR>          Microsoft Analysis Services
26.10.2014  12:29    <DIR>          Microsoft Office
20.03.2017  22:33    <DIR>          Microsoft Silverlight
26.10.2014  12:31    <DIR>          Microsoft SQL Server
29.09.2016  20:07    <DIR>          Microsoft.NET
19.03.2017  11:34    <DIR>          Mozilla Firefox
06.12.2015  21:12    <DIR>          Mozilla Maintenance Service
29.09.2016  20:57    <DIR>          MSBuild
09.01.2015  22:57    <DIR>          MSXML 4.0
04.09.2015  18:02    <DIR>          NVIDIA Corporation
28.02.2017  21:32    <DIR>          Paterva
11.03.2017  12:12    <DIR>          PokerStars.EU
13.12.2014  14:49    <DIR>          PSQLINSTALL
18.03.2017  22:50    <DIR>          Razer
29.09.2016  20:57    <DIR>          Reference Assemblies
03.07.2015  18:08    <DIR>          Skype
10.08.2015  09:39    <DIR>          Sony Mobile
19.03.2017  03:10    <DIR>          SpeedFan
20.03.2017  22:33    <DIR>          Spybot - Search & Destroy 2
18.03.2017  22:55    <DIR>          Steam
26.10.2014  13:02    <DIR>          SumatraPDF
27.02.2017  22:14    <DIR>          VMware
20.07.2015  16:33    <DIR>          Western Digital Corporation
20.07.2015  16:32           923.401 WinDlg_124.zip
30.09.2016  10:05    <DIR>          Windows Defender
30.09.2016  10:05    <DIR>          Windows Mail
28.10.2016  22:54    <DIR>          Windows Media Player
16.07.2016  12:47    <DIR>          Windows Multimedia Platform
16.07.2016  12:47    <DIR>          Windows NT
17.10.2016  15:50    <DIR>          Windows Photo Viewer
16.07.2016  12:47    <DIR>          Windows Portable Devices
16.07.2016  12:47    <DIR>          WindowsPowerShell
26.10.2014  12:31    <DIR>          WinRAR
14.02.2016  18:45    <DIR>          XMind
               1 Datei(en),        923.401 Bytes
              57 Verzeichnis(se),  2.280.214.528 Bytes frei

========= Ende von CMD: =========


========= dir "%ProgramData%" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: 746C-5BE4

 Verzeichnis von C:\ProgramData

09.01.2015  22:57    <DIR>          Adobe
06.03.2017  18:48    <DIR>          AMD
06.05.2015  18:27    <DIR>          Apple
06.05.2015  18:27    <DIR>          Apple Computer
23.10.2016  19:12    <DIR>          Application Data
20.03.2017  22:45    <DIR>          Ashampoo
20.03.2017  22:33    <DIR>          AVAST Software
02.07.2016  16:56    <DIR>          Battle.net
26.10.2014  12:20    <DIR>          Blizzard Entertainment
16.07.2016  12:47    <DIR>          Comms
20.07.2015  10:39    <DIR>          E1864A66-75E3-486a-BD95-D1B7D99A84A7
02.11.2016  00:02    <DIR>          Electronic Arts
06.07.2015  20:11             5.036 flwjycbm.bab
05.03.2017  18:27    <DIR>          GeoComply
25.10.2014  23:46    <DIR>          HP
09.01.2015  23:40    <DIR>          HTC
20.03.2017  22:36    <DIR>          Malwarebytes
26.10.2014  11:39    <DIR>          McAfee
18.03.2017  00:17    <DIR>          Microsoft Help
29.09.2016  20:18    <DIR>          Microsoft OneDrive
31.10.2014  14:55    <DIR>          Mozilla
27.10.2014  17:28    <DIR>          Oracle
02.11.2016  00:02    <DIR>          Origin
06.03.2017  18:50    <DIR>          Package Cache
28.02.2017  21:33    <DIR>          Paterva
18.03.2017  22:50    <DIR>          Razer
29.09.2016  20:10    <DIR>          regid.1991-06.com.microsoft
03.07.2015  18:08    <DIR>          Skype
23.10.2016  19:12    <DIR>          Soda PDF Desktop
16.07.2016  12:47    <DIR>          SoftwareDistribution
10.08.2015  09:39    <DIR>          Sony Mobile
19.03.2017  11:34    <DIR>          Spybot - Search & Destroy
09.04.2015  21:37    <DIR>          Steam
27.10.2014  17:28    <DIR>          Sun
01.03.2017  23:48    <DIR>          Tenable
29.09.2016  20:17    <DIR>          USOPrivate
29.09.2016  20:17    <DIR>          USOShared
20.03.2017  22:46    <DIR>          VMware
13.12.2014  14:49    <DIR>          XHEO INC
               1 Datei(en),          5.036 Bytes
              38 Verzeichnis(se),  2.280.022.016 Bytes frei

========= Ende von CMD: =========


========= dir "%Appdata%" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: 746C-5BE4

 Verzeichnis von C:\Users\Sergio\AppData\Roaming

20.03.2017  22:45    <DIR>          .
20.03.2017  22:45    <DIR>          ..
28.02.2017  21:33    <DIR>          .maltego
11.10.2015  11:47    <DIR>          .minecraft
10.03.2016  18:57    <DIR>          Adobe
19.05.2015  19:00    <DIR>          AMD
20.07.2015  10:40    <DIR>          Apple Computer
26.10.2014  00:19    <DIR>          ATI
28.11.2015  22:52    <DIR>          calibre
13.08.2016  15:05    <DIR>          Crystal Dynamics
26.10.2014  13:28    <DIR>          cYo
17.04.2016  08:33    <DIR>          DarkSoulsIII
11.10.2015  11:49    <DIR>          DVDVideoSoft
26.02.2016  14:24    <DIR>          FocalFilter
19.05.2015  20:54    <DIR>          GeoGebra 5.0
13.12.2014  14:51    <DIR>          HEM Data
06.07.2015  20:05    <DIR>          HoldemManager
09.01.2015  23:40    <DIR>          HTC
25.03.2015  16:30    <DIR>          Identities
03.07.2016  18:48    <DIR>          inkscape
17.05.2015  20:07    <DIR>          java
10.03.2017  22:55    <DIR>          JetBrains
19.05.2015  18:56    <DIR>          library_dir
26.10.2014  00:00    <DIR>          Macromedia
26.10.2014  00:07    <DIR>          Mozilla
11.10.2015  09:57    <DIR>          Origin
26.10.2016  10:22    <DIR>          PDF Producer
19.03.2017  02:00    <DIR>          QuickScan
27.10.2014  20:47    <DIR>          QuiteRss
13.12.2014  14:51    <DIR>          Roaming
11.09.2016  11:44    <DIR>          Skype
08.10.2016  21:19    <DIR>          SmartSteamEmu
11.03.2017  14:19    <DIR>          Soda PDF Desktop
13.03.2017  19:32    <DIR>          Spotify
26.10.2014  13:03    <DIR>          Steam
26.10.2014  13:06    <DIR>          SumatraPDF
28.02.2017  21:32    <DIR>          Sun
15.02.2016  19:49    <DIR>          The Witness
26.04.2015  16:45    <DIR>          Trine3
18.03.2017  22:55    <DIR>          TS3Client
26.06.2015  17:55    <DIR>          Tunngle
18.03.2017  00:59    <DIR>          vlc
13.03.2017  19:07    <DIR>          VMware
25.01.2015  14:12    <DIR>          WinRAR
               0 Datei(en),              0 Bytes
              44 Verzeichnis(se),  2.279.788.544 Bytes frei

========= Ende von CMD: =========


========= dir "%LocalAppdata%" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: 746C-5BE4

 Verzeichnis von C:\Users\Sergio\AppData\Local

20.03.2017  22:32    <DIR>          .
20.03.2017  22:32    <DIR>          ..
08.10.2016  21:20    <DIR>          2K Games
03.07.2016  11:51    <DIR>          ActiveSync
19.03.2017  01:12    <DIR>          AdAwareDesktop
19.03.2017  01:10    <DIR>          AdAwareUpdater
29.01.2015  21:36    <DIR>          Adobe
15.01.2015  20:25    <DIR>          Amazon
06.03.2017  19:07    <DIR>          AMD
06.05.2015  18:27    <DIR>          Apple
06.05.2015  18:27    <DIR>          Apple Computer
26.10.2014  00:19    <DIR>          ATI
18.12.2016  22:59    <DIR>          BANDAI NAMCO Entertainment
01.03.2015  13:07    <DIR>          BANDAI NAMCO Games
26.10.2014  12:20    <DIR>          Blizzard Entertainment
04.01.2015  22:30    <DIR>          cache
21.09.2015  22:33    <DIR>          calibre-cache
25.01.2015  15:49    <DIR>          CAPCOM
22.07.2015  08:28    <DIR>          CEF
21.12.2016  12:08    <DIR>          Chromium
10.08.2015  09:57    <DIR>          Comms
30.09.2016  08:32    <DIR>          ConnectedDevicesPlatform
26.10.2014  13:28    <DIR>          cYo
04.03.2017  23:55    <DIR>          Diagnostics
28.12.2016  12:14    <DIR>          Downloaded Installations
18.03.2017  00:15    <DIR>          ElevatedDiagnostics
18.02.2015  17:28    <DIR>          EMU
20.04.2016  06:41    <DIR>          Evernote
04.06.2016  12:13    <DIR>          EvernoteNW
03.10.2015  16:23    <DIR>          ExpanDrive
24.04.2016  11:04    <DIR>          FluxSoftware
26.02.2016  14:24    <DIR>          FocalFilter
03.07.2016  18:49    <DIR>          fontconfig
04.01.2015  22:30    <DIR>          Full Tilt Poker.Eu
09.04.2015  21:01    <DIR>          FullTiltPoker.eu
03.11.2016  12:41    <DIR>          Google
01.06.2015  08:51    <DIR>          GWX
13.12.2014  15:35    <DIR>          Hold'em_Manager
13.12.2014  14:49    <DIR>          IsolatedStorage
18.03.2017  22:59    <DIR>          JDownloader v2.0
12.07.2015  10:02    <DIR>          LumaEmu_SteamCloud
26.10.2014  12:06    <DIR>          Macromedia
04.03.2017  23:55    <DIR>          Microsoft
05.11.2015  19:30    <DIR>          Microsoft Help
09.08.2015  21:05    <DIR>          MicrosoftEdge
26.10.2014  00:07    <DIR>          Mozilla
03.07.2016  18:33    <DIR>          Ori and the Blind Forest DE
09.03.2017  15:59    <DIR>          Package Cache
25.02.2017  11:31    <DIR>          Packages
28.07.2016  19:24    <DIR>          PDF24
10.08.2015  19:37    <DIR>          PeerDistRepub
11.03.2017  12:13    <DIR>          PokerStars.EU
06.07.2015  20:32    <DIR>          PokerTracker 4
09.03.2017  15:59    <DIR>          Programs
09.08.2015  20:59    <DIR>          Publishers
27.10.2014  20:47    <DIR>          QuiteRss
18.03.2017  22:50    <DIR>          Razer
26.10.2014  00:26    <DIR>          Razer_Inc
03.07.2016  18:51               733 recently-used.xbel
26.10.2014  12:35    <DIR>          Skype
01.08.2016  14:09    <DIR>          Skyrim
09.04.2015  21:38    <DIR>          Sniper3
05.11.2016  15:41    <DIR>          speech
14.03.2017  19:22    <DIR>          Spotify
21.12.2016  12:09    <DIR>          Steam
11.03.2017  11:55    <DIR>          TeamSpeak 3
15.11.2014  09:56    <DIR>          Team_360h
21.03.2017  21:00    <DIR>          Temp
09.08.2015  20:57    <DIR>          TileDataLayer
15.07.2016  21:30    <DIR>          VirtualStore
13.03.2017  20:27    <DIR>          VMware
12.02.2017  23:20    <DIR>          Wunderlist
               1 Datei(en),            733 Bytes
              71 Verzeichnis(se),  2.279.796.736 Bytes frei

========= Ende von CMD: =========


========= dir "%CommonProgramFiles(x86)%" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: 746C-5BE4

 Verzeichnis von C:\Program Files (x86)\Common Files

20.03.2017  22:33    <DIR>          .
20.03.2017  22:33    <DIR>          ..
18.03.2017  23:51    <DIR>          Adobe
18.03.2017  23:48    <DIR>          Adobe AIR
12.11.2014  16:46    <DIR>          Adobe.BackupByPhotoshopPortable
06.05.2015  18:27    <DIR>          Apple
19.05.2015  18:56    <DIR>          ATI Technologies
02.07.2016  16:58    <DIR>          Blizzard Entertainment
18.03.2017  23:52    <DIR>          Java
29.09.2016  20:07    <DIR>          Microsoft Shared
23.10.2016  19:11    <DIR>          PDF Software
16.07.2016  12:47    <DIR>          Services
26.10.2014  12:35    <DIR>          Skype
16.03.2017  21:44    <DIR>          Steam
16.07.2016  23:50    <DIR>          System
27.02.2017  22:14    <DIR>          VMware
               0 Datei(en),              0 Bytes
              16 Verzeichnis(se),  2.279.931.904 Bytes frei

========= Ende von CMD: =========


========= dir "%CommonProgramW6432%" =========

 Volume in Laufwerk C: hat keine Bezeichnung.
 Volumeseriennummer: 746C-5BE4

 Verzeichnis von C:\Program Files\Common Files

20.03.2017  22:33    <DIR>          .
20.03.2017  22:33    <DIR>          ..
19.03.2017  01:10    <DIR>          adaware
18.03.2017  23:50    <DIR>          Apple
29.09.2016  20:03    <DIR>          ATI Technologies
26.10.2014  12:31    <DIR>          DESIGNER
29.09.2016  20:07    <DIR>          microsoft shared
16.07.2016  12:47    <DIR>          Services
29.09.2016  20:07    <DIR>          System
27.02.2017  22:14    <DIR>          VMware
               0 Datei(en),              0 Bytes
              10 Verzeichnis(se),  2.281.562.112 Bytes frei

========= Ende von CMD: =========


========= RemoveProxy: =========

HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt


========= Ende von RemoveProxy: =========


========= ipconfig /flushdns =========


Windows-IP-Konfiguration

Der DNS-Aufl”sungscache wurde geleert.

========= Ende von CMD: =========


========= netsh winsock reset =========


Der Winsock-Katalog wurde zur�ckgesetzt.
Sie m�ssen den Computer neu starten, um den Vorgang abzuschlieáen.


========= Ende von CMD: =========


=========== EmptyTemp: ==========

BITS transfer queue => 284941 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 55614352 B
Java, Flash, Steam htmlcache => 672623728 B
Windows/system/drivers => 47370834 B
Edge => 0 B
Chrome => 319488 B
Firefox => 23887338 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 7680 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 128 B
LocalService => 4868 B
NetworkService => 320694 B
Sergio => 21916876 B
postgres => 0 B

RecycleBin => 0 B
EmptyTemp: => 784.3 MB temporäre Dateien entfernt.

================================


Das System musste neu gestartet werden.

==== Ende von Fixlog 21:00:40 ====
         

SystemLook

SystemLook 30.07.11 by jpshortstuff
Log created at 21:04 on 21/03/2017 by Sergio
Administrator - Elevation successful

========== filefind ==========

Searching for "*Wise*"
C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\WiseRegCleaner.exe	--a---- 4189432 bytes	[21:31 20/03/2017]	[15:44 24/02/2017] FB3AAEEFC129B8CF97E1B5BB33863093
C:\AdwCleaner\quarantine\files\ijzyftyacgnlumrvktifcadvzoscsjim\Wise Registry Cleaner.lnk	--a---- 1322 bytes	[21:31 20/03/2017]	[21:53 18/03/2017] F8267A1338C67FD6A10D27A6064D5B1D
C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\Wise Registry Cleaner Schedule Task.xBAD	--a---- 4058 bytes	[22:01 18/03/2017]	[22:01 18/03/2017] E091936B720E7424DEC9FBC98F7009FF
C:\ProgramData\Tenable\Nessus\nessus\plugins\cisco-sa-20140806-energywise-ios.nasl	--a---- 7071 bytes	[22:56 01/03/2017]	[22:56 01/03/2017] 942BCF9BB1DB39A970432819D28E20F6
C:\ProgramData\Tenable\Nessus\nessus\plugins\cisco-sa-20140806-energywise-iosxe.nasl	--a---- 5307 bytes	[22:56 01/03/2017]	[22:56 01/03/2017] 1708038720B0940D767454A2E301AB45
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_auth_bypass.nasl	--a---- 2346 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 18AAFD3F64DB3A2AEE16EC498C139B8C
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_client_803.nasl	--a---- 3396 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 561C22C06BB0E37488799072452C6186
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_client_803_hp2.nasl	--a---- 4273 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] B3BB866FA60B6563E1A8718B46E8A3CE
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_client_803_hp3.nasl	--a---- 5345 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 22FE7B39BA212813A16BD5287D4B04BA
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_client_803_hp4.nasl	--a---- 3495 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 1624DBE957761BACF0E544FD690A9F8C
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_client_address_book_rce.nasl	--a---- 3259 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 88950CB7D1689278A2738C53E45975EB
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_client_email_access.nasl	--a---- 2928 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] E60CFCAB6B4B32A9592468F01CED3DC3
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_client_installed.nasl	--a---- 4140 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] FD556D19FB5BD4652DB37806D037A875
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_client_mitm.nasl	--a---- 2978 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 57A4B422F08459E909B224A6442570EF
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_client_unsupported.nasl	--a---- 2661 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 3B654496DBD43F5677AA5ED9CFF5E17F
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_cve-2012-0110.nasl	--a---- 5365 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 96A5EC5BF6E322F588496EC3E192C700
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_dva_accessible.nasl	--a---- 3114 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 6383ED96F5274E97EF5E85F6DF980110
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_dva_arbitrary_file_download.nasl	--a---- 4342 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] FC07247AB8AC4E480C4D2242DBCABB3F
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_ia_802_hp1.nasl	--a---- 5512 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 6879222BC9BAEA9E820AF0E8B17A1561
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_ia_802_hp2.nasl	--a---- 3441 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 1705350A656A225C52AF9C779490CE91
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_ia_802_hp3.nasl	--a---- 4861 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 8D384B02DA3126E818370F563D68828F
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_ia_803.nasl	--a---- 4178 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] A4D17BD84969C40EC9CCCE0120894129
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_ia_803_hp1.nasl	--a---- 4487 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 369FFB5AC941E162518E61E0540E2112
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_ia_accessible.nasl	--a---- 2945 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 3F0D7CAA2F39524151A29F6B5FA123F2
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_ia_cve-2012-0271.nbin	--a---- 42126 bytes	[22:59 01/03/2017]	[09:44 12/03/2017] FDB97124C4D43CA1D851EE2E6D3871EF
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_ia_detect.nasl	--a---- 3901 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 04DF3E20AC01F09F9527326C9C50CEBF
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_ia_multiple_overflows.nasl	--a---- 3503 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 2106B3306BFDF689F9E3C46BA437ACD3
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_ia_tzname_vuln.nasl	--a---- 8025 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 92AB2420B0CE33B8C647AAFCBC6DAAEC
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_ia_unsupported.nasl	--a---- 2737 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 965943FF107C1047620796CDFD623655
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_info_disclosure.nasl	--a---- 2456 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 0A6E96D7B83E938DEB212986B929B21E
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_msngr_client_buffer_overflow.nasl	--a---- 5419 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] E3B0D7CA4C78108E92B1B328DFA6F3D6
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_mta_http_accessible.nasl	--a---- 2750 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] B9986AF93B9ABBFA948E7C4428203F12
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_overflow.nasl	--a---- 2316 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 2A677E02B4D46E6E7E5D11647480AA2F
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_unsupported.nasl	--a---- 3540 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] E892B529300C514737DF8C9BA7FC8547
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_webaccess_14_0_2.nasl	--a---- 3145 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] C9EC524ECFF9B5A0036D0D8E33FF4D7F
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_webaccess_802_hp1.nasl	--a---- 6300 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 617E70BC69757052EFA76F33C3D64B18
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_webaccess_802_hp3.nasl	--a---- 6304 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 8608CDE83E7B2C65C1A5EE471949DE86
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_webaccess_803.nasl	--a---- 3855 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 923CC753ED65CBC14D64F148DA943903
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_webaccess_accessible.nasl	--a---- 3148 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 392FEE507B0396463FB5BF5AD1F0FB1B
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_webaccess_arbitrary_file_download.nasl	--a---- 4415 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 01784CB4F8B59894CB98B3D6544B6971
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_webaccess_CVE-2014-0611.nasl	--a---- 3402 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] BA19CCB726AE35BCCAF08EAC5E63042C
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_webaccess_detect.nasl	--a---- 5532 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 358580C88F3A7522A69C49D8C06D0963
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_webaccess_overflow.nasl	--a---- 3280 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 9CCA027F584489AB41C7881D16FDF44F
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_webaccess_userid_xss.nasl	--a---- 4701 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 6A2360A44BB24CDA146B7E3AB1AED2E6
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_webaccess_userinterface_dir_trav.nasl	--a---- 3024 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 582A5CF7E9DB30416A0BBEA062293C72
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_webaccess_userinterface_xss.nasl	--a---- 3527 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] BD7D8CBB779A8131D0EA18F370671577
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_webaccess_userlang_xss.nasl	--a---- 4395 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] B76E318D35838FCD0EE9D7D9293F8147
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_webaccess_xss.nasl	--a---- 4500 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 5F1ACEA78E8126DDDF8C770D749D6D8E
C:\ProgramData\Tenable\Nessus\nessus\plugins\groupwise_xss.nasl	--a---- 2669 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] D41070E4B09CE92DB20918B8E27645F7
C:\ProgramData\Tenable\Nessus\nessus\plugins\novell_groupwise_admin_console_detect.nbin	--a---- 53975 bytes	[23:01 01/03/2017]	[09:44 12/03/2017] 60238DD3E23156297E9C01A80EFBF811
C:\ProgramData\Tenable\Nessus\nessus\plugins\novell_groupwise_admin_console_file_upload_servlet.nasl	--a---- 3508 bytes	[23:01 01/03/2017]	[23:01 01/03/2017] 0527AFBEC9722CEA98BB798D5A6BE3C9
C:\ProgramData\Tenable\Nessus\nessus\plugins\novell_groupwise_servletmanager_default_password.nasl	--a---- 2915 bytes	[23:01 01/03/2017]	[23:01 01/03/2017] 725C6EECBE943F381B77133B27A28A34
C:\ProgramData\Tenable\Nessus\nessus\plugins\suse_novell-groupwise-gwclient-4494.nasl	--a---- 2857 bytes	[23:05 01/03/2017]	[23:05 01/03/2017] 3850E97F0033D0113A23E8AB81FE64EA
C:\Users\All Users\Tenable\Nessus\nessus\plugins\cisco-sa-20140806-energywise-ios.nasl	--a---- 7071 bytes	[22:56 01/03/2017]	[22:56 01/03/2017] 942BCF9BB1DB39A970432819D28E20F6
C:\Users\All Users\Tenable\Nessus\nessus\plugins\cisco-sa-20140806-energywise-iosxe.nasl	--a---- 5307 bytes	[22:56 01/03/2017]	[22:56 01/03/2017] 1708038720B0940D767454A2E301AB45
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_auth_bypass.nasl	--a---- 2346 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 18AAFD3F64DB3A2AEE16EC498C139B8C
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_client_803.nasl	--a---- 3396 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 561C22C06BB0E37488799072452C6186
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_client_803_hp2.nasl	--a---- 4273 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] B3BB866FA60B6563E1A8718B46E8A3CE
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_client_803_hp3.nasl	--a---- 5345 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 22FE7B39BA212813A16BD5287D4B04BA
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_client_803_hp4.nasl	--a---- 3495 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 1624DBE957761BACF0E544FD690A9F8C
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_client_address_book_rce.nasl	--a---- 3259 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 88950CB7D1689278A2738C53E45975EB
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_client_email_access.nasl	--a---- 2928 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] E60CFCAB6B4B32A9592468F01CED3DC3
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_client_installed.nasl	--a---- 4140 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] FD556D19FB5BD4652DB37806D037A875
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_client_mitm.nasl	--a---- 2978 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 57A4B422F08459E909B224A6442570EF
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_client_unsupported.nasl	--a---- 2661 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 3B654496DBD43F5677AA5ED9CFF5E17F
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_cve-2012-0110.nasl	--a---- 5365 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 96A5EC5BF6E322F588496EC3E192C700
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_dva_accessible.nasl	--a---- 3114 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 6383ED96F5274E97EF5E85F6DF980110
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_dva_arbitrary_file_download.nasl	--a---- 4342 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] FC07247AB8AC4E480C4D2242DBCABB3F
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_ia_802_hp1.nasl	--a---- 5512 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 6879222BC9BAEA9E820AF0E8B17A1561
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_ia_802_hp2.nasl	--a---- 3441 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 1705350A656A225C52AF9C779490CE91
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_ia_802_hp3.nasl	--a---- 4861 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 8D384B02DA3126E818370F563D68828F
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_ia_803.nasl	--a---- 4178 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] A4D17BD84969C40EC9CCCE0120894129
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_ia_803_hp1.nasl	--a---- 4487 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 369FFB5AC941E162518E61E0540E2112
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_ia_accessible.nasl	--a---- 2945 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 3F0D7CAA2F39524151A29F6B5FA123F2
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_ia_cve-2012-0271.nbin	--a---- 42126 bytes	[22:59 01/03/2017]	[09:44 12/03/2017] FDB97124C4D43CA1D851EE2E6D3871EF
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_ia_detect.nasl	--a---- 3901 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 04DF3E20AC01F09F9527326C9C50CEBF
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_ia_multiple_overflows.nasl	--a---- 3503 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 2106B3306BFDF689F9E3C46BA437ACD3
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_ia_tzname_vuln.nasl	--a---- 8025 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 92AB2420B0CE33B8C647AAFCBC6DAAEC
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_ia_unsupported.nasl	--a---- 2737 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 965943FF107C1047620796CDFD623655
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_info_disclosure.nasl	--a---- 2456 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 0A6E96D7B83E938DEB212986B929B21E
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_msngr_client_buffer_overflow.nasl	--a---- 5419 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] E3B0D7CA4C78108E92B1B328DFA6F3D6
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_mta_http_accessible.nasl	--a---- 2750 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] B9986AF93B9ABBFA948E7C4428203F12
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_overflow.nasl	--a---- 2316 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 2A677E02B4D46E6E7E5D11647480AA2F
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_unsupported.nasl	--a---- 3540 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] E892B529300C514737DF8C9BA7FC8547
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_webaccess_14_0_2.nasl	--a---- 3145 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] C9EC524ECFF9B5A0036D0D8E33FF4D7F
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_webaccess_802_hp1.nasl	--a---- 6300 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 617E70BC69757052EFA76F33C3D64B18
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_webaccess_802_hp3.nasl	--a---- 6304 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 8608CDE83E7B2C65C1A5EE471949DE86
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_webaccess_803.nasl	--a---- 3855 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 923CC753ED65CBC14D64F148DA943903
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_webaccess_accessible.nasl	--a---- 3148 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 392FEE507B0396463FB5BF5AD1F0FB1B
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_webaccess_arbitrary_file_download.nasl	--a---- 4415 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 01784CB4F8B59894CB98B3D6544B6971
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_webaccess_CVE-2014-0611.nasl	--a---- 3402 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] BA19CCB726AE35BCCAF08EAC5E63042C
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_webaccess_detect.nasl	--a---- 5532 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 358580C88F3A7522A69C49D8C06D0963
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_webaccess_overflow.nasl	--a---- 3280 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 9CCA027F584489AB41C7881D16FDF44F
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_webaccess_userid_xss.nasl	--a---- 4701 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 6A2360A44BB24CDA146B7E3AB1AED2E6
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_webaccess_userinterface_dir_trav.nasl	--a---- 3024 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 582A5CF7E9DB30416A0BBEA062293C72
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_webaccess_userinterface_xss.nasl	--a---- 3527 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] BD7D8CBB779A8131D0EA18F370671577
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_webaccess_userlang_xss.nasl	--a---- 4395 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] B76E318D35838FCD0EE9D7D9293F8147
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_webaccess_xss.nasl	--a---- 4500 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] 5F1ACEA78E8126DDDF8C770D749D6D8E
C:\Users\All Users\Tenable\Nessus\nessus\plugins\groupwise_xss.nasl	--a---- 2669 bytes	[22:59 01/03/2017]	[22:59 01/03/2017] D41070E4B09CE92DB20918B8E27645F7
C:\Users\All Users\Tenable\Nessus\nessus\plugins\novell_groupwise_admin_console_detect.nbin	--a---- 53975 bytes	[23:01 01/03/2017]	[09:44 12/03/2017] 60238DD3E23156297E9C01A80EFBF811
C:\Users\All Users\Tenable\Nessus\nessus\plugins\novell_groupwise_admin_console_file_upload_servlet.nasl	--a---- 3508 bytes	[23:01 01/03/2017]	[23:01 01/03/2017] 0527AFBEC9722CEA98BB798D5A6BE3C9
C:\Users\All Users\Tenable\Nessus\nessus\plugins\novell_groupwise_servletmanager_default_password.nasl	--a---- 2915 bytes	[23:01 01/03/2017]	[23:01 01/03/2017] 725C6EECBE943F381B77133B27A28A34
C:\Users\All Users\Tenable\Nessus\nessus\plugins\suse_novell-groupwise-gwclient-4494.nasl	--a---- 2857 bytes	[23:05 01/03/2017]	[23:05 01/03/2017] 3850E97F0033D0113A23E8AB81FE64EA
C:\Users\Sergio\AppData\Local\Packages\XBMCFoundation.Kodi_4n2hpmxwrvr6p\LocalCache\Roaming\Kodi\addons\script.module.urlresolver\lib\urlresolver\plugins\lib\unwise.py	--a---- 22897 bytes	[18:42 01/01/2017]	[18:42 01/01/2017] 85C42F8E88939C7C722FDC9698F104C6
C:\Users\Sergio\AppData\Local\Packages\XBMCFoundation.Kodi_4n2hpmxwrvr6p\LocalCache\Roaming\Kodi\addons\script.module.urlresolver\lib\urlresolver\plugins\lib\unwise.pyo	--a---- 22815 bytes	[18:44 01/01/2017]	[18:44 01/01/2017] 42E0C0783B040B375FC399EBBCD835C6
C:\Users\Sergio\Application Data\XMind\configuration-cathy_win32\org.eclipse.osgi\1206\0\.cp\icons\prop\structure_anticlockwise.png	--a---- 298 bytes	[17:45 14/02/2016]	[17:45 14/02/2016] A93FDB2D0387DF5736810E105E0EC942
C:\Users\Sergio\Application Data\XMind\configuration-cathy_win32\org.eclipse.osgi\1206\0\.cp\icons\prop\structure_clockwise.png	--a---- 307 bytes	[17:45 14/02/2016]	[17:45 14/02/2016] E7B8CD2EDC5E01254D3488CBF480B169
C:\Users\Sergio\Application Data\XMind\configuration-cathy_win32\org.eclipse.osgi\959\0\.cp\dashboard\new\map_anticlockwise.png	--a---- 3034 bytes	[17:45 14/02/2016]	[17:45 14/02/2016] C4D32FA36E535D3C018A593CE22DF834
C:\Users\Sergio\Application Data\XMind\configuration-cathy_win32\org.eclipse.osgi\959\0\.cp\dashboard\new\map_clockwise.png	--a---- 3051 bytes	[17:45 14/02/2016]	[17:45 14/02/2016] C0731FCFF22B4FA5553B885A07D3B2D2
C:\Users\Sergio\Desktop\Eboosk\Viele Gute Downloadlinks .. mal durschauen\neue ebooks\Richard.Wiseman.Machen.nicht.denken.Die.radikal.einfache.Idee.die.Ihr.Leben.veraendert.Jun.2013-optimized.pdf	--a---- 6531770 bytes	[07:34 27/10/2014]	[22:47 01/04/2013] 54DA352C7F1FCBE422DC1E96255B1582
C:\Users\Sergio\Desktop\Eboosk\Viele Gute Downloadlinks .. mal durschauen\neue ebooks\Richard.Wiseman.Machen.nicht.denken.Die.radikal.einfache.Idee.die.Ihr.Leben.veraendert.Jun.2013.epub	--a---- 500627 bytes	[07:34 27/10/2014]	[22:47 01/04/2013] 616B73A3A8EF20BB4727282007C2AB7B
C:\Users\Sergio\Desktop\Eboosk\Viele Gute Downloadlinks .. mal durschauen\neue ebooks\Richard.Wiseman.Machen.nicht.denken.Die.radikal.einfache.Idee.die.Ihr.Leben.veraendert.Jun.2013.pdf	--a---- 55401407 bytes	[07:34 27/10/2014]	[22:47 01/04/2013] 34B3EB8E48321616E7408C10C9775976
C:\Users\Sergio\SkyDrive\Neuer Ordner\getabstract\brain-wise-churchland-en-4630.pdf	--a---- 286767 bytes	[20:47 05/07/2016]	[20:47 05/07/2016] 322868A133D3906D822D7C43B110E4F3

Searching for "*web companion*"
No files found.

Searching for "*WinZipper*"
No files found.

========== folderfind ==========

Searching for "*Wise*"
C:\FRST\Quarantine\C\Program Files (x86)\Wise	d------	[21:53 18/03/2017]
C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\WiseCleaner	d------	[21:53 18/03/2017]

Searching for "*web companion*"
No folders found.

Searching for "*WinZipper*"
No folders found.

========== regfind ==========

Searching for "Wise"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A677C984-D37C-4C73-B4DD-1B062450B787}]
"AppId"="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Wise\Wise Registry Cleaner\WiseRegCleaner.exe"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\UFH\SHC]
"26"="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Registry Cleaner\Wise Registry Cleaner.lnk C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation]
"AddRemoveApps"="CONTROL.EXE;DELDRV.EXE;DESINSTALADOR.EXE;DESINSTALAR.EXE;DFSVC.EXE;EAUNINSTALL.EXE;GUESTMODEMSG.EXE;HPZSCR01.EXE;HPZSCR40.EXE;INSTALL.EXE;ISUN0407.EXE;ISUNINST.EXE;IUN6002.EXE;LNKSTUB.EXE;MSIEXEC.EXE;MSOOBE.EXE;SETUP.EXE;ST5UNST.EXE;UNINS000.EXE;UNINS001.EXE;UNINS002.EXE;UNINST.EXE;UNINSTAL.EXE;UNINSTALL.EXE;UNINSTALLER.EXE;UNWISE.EXE;UNWISE32.EXE;WERFAULT.EXE;WLRMDR.EXE;WUAPP.EXE;"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\UFH\ARP]
"26"="Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall Wise Registry Cleaner_is1 "C:\Program Files (x86)\Wise\Wise Registry Cleaner\unins000.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009]
"Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object  consists of counters that describe the behavior of physical and virtual memory on the computer.  Physical memory is the amount of random access memory on the computer.  Virtual memory consists of the space in physical memory and on disk.  Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory.  Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processor has an idle thread tha
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WiseCleaner]
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation]
"AddRemoveApps"="CONTROL.EXE;DELDRV.EXE;DESINSTALADOR.EXE;DESINSTALAR.EXE;DFSVC.EXE;EAUNINSTALL.EXE;GUESTMODEMSG.EXE;HPZSCR01.EXE;HPZSCR40.EXE;INSTALL.EXE;ISUN0407.EXE;ISUNINST.EXE;IUN6002.EXE;LNKSTUB.EXE;MSIEXEC.EXE;MSOOBE.EXE;SETUP.EXE;ST5UNST.EXE;UNINS000.EXE;UNINS001.EXE;UNINS002.EXE;UNINST.EXE;UNINSTAL.EXE;UNINSTALL.EXE;UNINSTALLER.EXE;UNWISE.EXE;UNWISE32.EXE;WERFAULT.EXE;WLRMDR.EXE;WUAPP.EXE;"
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Perflib\009]
"Help"="3 The System performance object consists of counters that apply to more than one instance of a component processors on the computer. 5 The Memory performance object  consists of counters that describe the behavior of physical and virtual memory on the computer.  Physical memory is the amount of random access memory on the computer.  Virtual memory consists of the space in physical memory and on disk.  Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory.  Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. 7 % Processor Time is the percentage of elapsed time that the processor spends to execute a non-Idle thread. It is calculated by measuring the percentage of time that the processor spends executing the idle thread and then subtracting that value from 100%. (Each processor has an idl
[HKEY_USERS\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A677C984-D37C-4C73-B4DD-1B062450B787}]
"AppId"="{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Wise\Wise Registry Cleaner\WiseRegCleaner.exe"
[HKEY_USERS\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\UFH\SHC]
"26"="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Registry Cleaner\Wise Registry Cleaner.lnk C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe"

Searching for "web companion"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\AppId_Catalog\2A1442DD]
"AppFullPath"="C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.4.7\LavasoftTcpService.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\AppId_Catalog\2A1442DD]
"AppFullPath"="C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.4.7\LavasoftTcpService.exe"

Searching for "WinZipper"
[HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup\.001]
"Type"="WinZipper.001"
[HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup\.7z]
"Type"="WinZipper.7z"
[HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup\.arj]
"Type"="WinZipper.arj"
[HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup\.bz2]
"Type"="WinZipper.bz2"
[HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup\.cab]
"Type"="WinZipper.cab"
[HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup\.gz]
"Type"="WinZipper.gz"
[HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup\.lha]
"Type"="WinZipper.lha"
[HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup\.lzh]
"Type"="WinZipper.lzh"
[HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup\.rar]
"Type"="WinZipper.rar"
[HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup\.tar]
"Type"="WinZipper.tar"
[HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup\.taz]
"Type"="WinZipper.taz"
[HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup\.tbz]
"Type"="WinZipper.tbz"
[HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup\.tbz2]
"Type"="WinZipper.tbz2"
[HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup\.tgz]
"Type"="WinZipper.tgz"
[HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup\.txz]
"Type"="WinZipper.txz"
[HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup\.xz]
"Type"="WinZipper.xz"
[HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup\.z]
"Type"="WinZipper.z"
[HKEY_CURRENT_USER\SOFTWARE\WinRAR\Setup\.zip]
"Type"="WinZipper.zip"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.001]
@="WinZipper.001"
[HKEY_USERS\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\WinRAR\Setup\.001]
"Type"="WinZipper.001"
[HKEY_USERS\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\WinRAR\Setup\.7z]
"Type"="WinZipper.7z"
[HKEY_USERS\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\WinRAR\Setup\.arj]
"Type"="WinZipper.arj"
[HKEY_USERS\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\WinRAR\Setup\.bz2]
"Type"="WinZipper.bz2"
[HKEY_USERS\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\WinRAR\Setup\.cab]
"Type"="WinZipper.cab"
[HKEY_USERS\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\WinRAR\Setup\.gz]
"Type"="WinZipper.gz"
[HKEY_USERS\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\WinRAR\Setup\.lha]
"Type"="WinZipper.lha"
[HKEY_USERS\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\WinRAR\Setup\.lzh]
"Type"="WinZipper.lzh"
[HKEY_USERS\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\WinRAR\Setup\.rar]
"Type"="WinZipper.rar"
[HKEY_USERS\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\WinRAR\Setup\.tar]
"Type"="WinZipper.tar"
[HKEY_USERS\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\WinRAR\Setup\.taz]
"Type"="WinZipper.taz"
[HKEY_USERS\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\WinRAR\Setup\.tbz]
"Type"="WinZipper.tbz"
[HKEY_USERS\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\WinRAR\Setup\.tbz2]
"Type"="WinZipper.tbz2"
[HKEY_USERS\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\WinRAR\Setup\.tgz]
"Type"="WinZipper.tgz"
[HKEY_USERS\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\WinRAR\Setup\.txz]
"Type"="WinZipper.txz"
[HKEY_USERS\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\WinRAR\Setup\.xz]
"Type"="WinZipper.xz"
[HKEY_USERS\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\WinRAR\Setup\.z]
"Type"="WinZipper.z"
[HKEY_USERS\S-1-5-21-1478414814-3749218601-3539646535-1001\SOFTWARE\WinRAR\Setup\.zip]
"Type"="WinZipper.zip"

Searching for "         "
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell]
"ConfigXML"="             <PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="2" XmlRenderingType="text" Enabled="true" >                 <InitializationParameters>                     <Param Name="PSVersion" Value="5.1"/>                 </InitializationParameters>                 <Resources>                     <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" SupportsOptions="true" ExactMatch="true">                         <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)(A;;GA;;;IU)(A;;GA;;;RM)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/>                         <Capability Type="Shell"/>               
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell.Workflow]
"ConfigXML"="             <PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell.workflow" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="2" XmlRenderingType="text" UseSharedProcess="true" ProcessIdleTimeoutSec="1209600" RunAsUser="" RunAsPassword="" AutoRestart="false"     Enabled="true" >                 <InitializationParameters>                     <Param Name="PSVersion" Value="5.1"/>                     <Param Name="AssemblyName" Value="Microsoft.PowerShell.Workflow.ServiceCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL"/>                     <Param Name="PSSessionConfigurationTypeName" Value="Microsoft.PowerShell.Workflow.PSWorkflowSessionConfiguration"/>                     <Param Name="SessionConfigurationData"                          Value="                       
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell32]
"ConfigXML"="<PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell32" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="2" XmlRenderingType="text" Architecture="32" Enabled="true" >                         <InitializationParameters>                             <Param Name="PSVersion" Value="5.1"/>                         </InitializationParameters>                         <Resources>                             <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell32" SupportsOptions="true" ExactMatch="true">                                 <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell32" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)(A;;GA;;;IU)(A;;GA;;;RM)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/>     
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SWD\WPDBUSENUM\_??_USBSTOR#Disk&Ven_Apple&Prod_iPod&Rev_2.70#000A270023FE085E&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}]
"DeviceDesc"="iPod            "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\SWD\WPDBUSENUM\_??_USBSTOR#Disk&Ven_Apple&Prod_iPod&Rev_2.70#000A270023FE085E&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}]
"DeviceDesc"="iPod            "

-= EOF =-
         

FRST Log

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 15-03-2017
durchgeführt von Sergio (Administrator) auf SERGIOS-PC (21-03-2017 21:19:17)
Gestartet von C:\Users\Sergio\Desktop
Geladene Profile: Sergio (Verfügbare Profile: Sergio & postgres)
Platform: Windows 10 Pro Version 1607 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Chip Digital GmbH) C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe
(Tenable Network Security, Inc) C:\Program Files\Tenable\Nessus\nessus-service.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
(Tenable Network Security, Inc) C:\Program Files\Tenable\Nessus\nessusd.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Flux Software LLC) C:\Users\Sergio\AppData\Local\FluxSoftware\Flux\flux.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgentUserBroker.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe

==================== Registry (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8492800 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\cnext.exe [4926664 2016-02-26] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2016-09-07] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176440 2017-01-19] (Apple Inc.)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2780112 2017-01-20] (Malwarebytes)
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1160408 2016-12-17] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [Spotify Web Helper] => C:\Users\Sergio\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1446000 2017-03-11] (Spotify Ltd)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [Google Update] => C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\GoogleUpdateCore.exe [601752 2016-12-18] (Google Inc.)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [f.lux] => C:\Users\Sergio\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9364696 2017-03-03] (Piriform Ltd)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [799376 2016-12-14] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\MountPoints2: {b52f257e-9541-11e6-82b3-485b39c9a198} - "K:\HiSuiteDownLoader.exe" 
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [00ExpanDriveExt1] -> {C955792B-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [00ExpanDriveExt2] -> {C955792C-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [00ExpanDriveExt1] -> {C955792B-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [00ExpanDriveExt2] -> {C955792C-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Audible Download Manager.lnk [2015-05-07]
ShortcutTarget: Audible Download Manager.lnk -> C:\Program Files (x86)\Audible\Bin\AudibleDownloadHelper.exe (Keine Datei)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FocalFilterHelper.lnk [2016-02-26]
ShortcutTarget: FocalFilterHelper.lnk -> C:\Program Files (x86)\FocalFilter\FocalFilterHelper.exe (Microsoft)
Startup: C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2015-08-09]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2016-04-20]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{65462354-7EE1-4401-902C-4D58B7DBDA87}: [DhcpNameServer] 7.254.254.254
Tcpip\..\Interfaces\{8c608b9e-9074-4d1b-b1db-702840d39f03}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{aa6288ab-a4c6-4734-8fa6-9d9b694d76cd}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131343881188462559&GUID=D7BDAEA9-5712-40E5-A2B9-98992E8B0FDB
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131343881188468475&GUID=D7BDAEA9-5712-40E5-A2B9-98992E8B0FDB
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_121\bin\ssv.dll [2017-03-18] (Oracle Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-03-18] (Oracle Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2016-10-31] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2016-05-17] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default [2017-03-21]
FF NewTab: Mozilla\Firefox\Profiles\0fihcjle.default -> about:newtab
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\0fihcjle.default -> Google
FF DefaultSearchUrl: Mozilla\Firefox\Profiles\0fihcjle.default -> hxxps://www.google.com/search?bcutc=sp-006
FF SearchEngineOrder.1: Mozilla\Firefox\Profiles\0fihcjle.default -> Google
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\0fihcjle.default -> Google
FF Homepage: Mozilla\Firefox\Profiles\0fihcjle.default -> about:home
FF Keyword.URL: Mozilla\Firefox\Profiles\0fihcjle.default -> hxxps://www.google.com/search?bcutc=sp-006
FF Extension: (BeeLine Reader) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\beelinereader-firefox@beelinereader.com.xpi [2016-03-08]
FF Extension: (FoxyProxy Standard) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\foxyproxy@eric.h.jung [2017-02-07]
FF Extension: (convert2mp3.net YouTube2MP3 Converter) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\info@convert2mp3.net.xpi [2016-12-15]
FF Extension: (pdf updater) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{34840d80-0446-4a42-83ce-5c0fa22cd4e3}.xpi [2016-05-18] [ist nicht signiert]
FF Extension: (NoScript) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2017-03-20]
FF Extension: (LeechBlock) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{a95d8332-e4b4-6e7f-98ac-20b733364387} [2017-03-20]
FF Extension: (Adblock Plus) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-24]
FF Extension: (DownThemAll!) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2017-03-21]
FF SearchPlugin: C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\searchplugins\google-avast.xml [2017-03-18]
FF HKLM\...\Firefox\Extensions: [soda_pdf_desktop_conv@sodapdf.com] - C:\Program Files\Soda PDF Desktop\resources\sodapdfdesktopfirefoxextension => nicht gefunden
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_25_0_0_127.dll [2017-03-18] ()
FF Plugin: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-03-18] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-03-18] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50905.0\npctrl.dll [2017-02-10] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_25_0_0_127.dll [2017-03-18] ()
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-07-19] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50905.0\npctrl.dll [2017-02-10] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2016-12-17] (Adobe Systems Inc.)
FF Plugin-x32: Soda PDF Desktop -> C:\Program Files (x86)\Soda PDF Desktop\np-previewer.dll [Keine Datei]
FF Plugin HKU\S-1-5-21-1478414814-3749218601-3539646535-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-18] (Google Inc.)
FF Plugin HKU\S-1-5-21-1478414814-3749218601-3539646535-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-18] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2016-07-19] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-12-17] (Adobe Systems Inc.)

Chrome: 
=======
CHR DefaultProfile: Default
CHR Profile: C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default [2017-03-21]
CHR Extension: (Google Präsentationen) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-03-26]
CHR Extension: (Google Docs) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-03-26]
CHR Extension: (Google Drive) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-03-11]
CHR Extension: (YouTube) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-03-11]
CHR Extension: (Google-Suche) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-03-11]
CHR Extension: (Google Tabellen) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-03-26]
CHR Extension: (Google Docs Offline) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-21]
CHR Extension: (AMZ Seller Browser) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\klgpelgeohjghmccooegimcfhanlnngc [2016-05-09]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-12]
CHR Extension: (Google Mail) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-01]
CHR Extension: (Chrome Media Router) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-03-11]

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-08-04] (Advanced Micro Devices, Inc.) [Datei ist nicht signiert]
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)
R2 chip1click; C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe [91136 2016-10-27] (Chip Digital GmbH) [Datei ist nicht signiert]
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4355024 2017-01-20] (Malwarebytes)
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [197776 2016-12-14] (Sandboxie Holdings, LLC)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-09-15] (Microsoft Corporation)
R2 Tenable Nessus; C:\Program Files\Tenable\Nessus\nessus-service.exe [17376 2017-02-15] (Tenable Network Security, Inc)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
S3 Soda PDF Desktop; "C:\Program Files\Soda PDF Desktop\ws.exe" [X]
S3 Soda PDF Desktop CrashHandler; "C:\Program Files\Soda PDF Desktop\crash-handler-ws.exe" [X]
S2 Soda PDF Desktop Creator; "C:\Program Files\Soda PDF Desktop\creator-ws.exe" [X]

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S0 amdkmafd; C:\WINDOWS\System32\drivers\amdkmafd.sys [23240 2016-02-26] (Advanced Micro Devices, Inc.)
R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R3 AtiHDAudioService; C:\WINDOWS\system32\drivers\AtihdWT6.sys [102400 2016-02-26] (Advanced Micro Devices)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [77408 2017-02-24] ()
S3 HTCAND64; C:\WINDOWS\System32\Drivers\ANDROIDUSB.sys [33736 2009-11-02] (HTC, Corporation) [Datei ist nicht signiert]
S3 HtcVCom32; C:\WINDOWS\system32\DRIVERS\HtcVComV64.sys [121800 2010-03-09] (QUALCOMM Incorporated) [Datei ist nicht signiert]
R2 MBAMChameleon; C:\WINDOWS\system32\drivers\MBAMChameleon.sys [186304 2017-03-21] (Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\system32\drivers\farflt.sys [111544 2017-03-21] (Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\drivers\mbam.sys [43968 2017-03-21] (Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [251840 2017-03-21] (Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\drivers\mwac.sys [92088 2017-03-21] (Malwarebytes)
R3 MTsensor; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [17280 2013-05-17] ()
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [589824 2016-07-16] (Realtek                                            )
S3 RtlWlanu_OldIC; C:\WINDOWS\System32\drivers\rtwlanu_oldIC.sys [3814400 2016-07-16] (Realtek Semiconductor Corporation                           )
S3 rzdaendpt; C:\WINDOWS\System32\drivers\rzdaendpt.sys [33448 2014-09-05] (Razer Inc)
S3 rzvkeyboard; C:\WINDOWS\System32\drivers\rzvkeyboard.sys [31912 2014-09-05] (Razer Inc)
S3 SaiK0728; C:\WINDOWS\system32\DRIVERS\SaiK0728.sys [129024 2008-01-21] (Saitek)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [205968 2016-12-14] (Sandboxie Holdings, LLC)
R1 VBoxNetAdp; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys [131144 2017-01-16] (Oracle Corporation)
R1 VBoxNetLwf; C:\WINDOWS\system32\DRIVERS\VBoxNetLwf.sys [205440 2017-01-16] (Oracle Corporation)
R0 vsock; C:\WINDOWS\System32\drivers\vsock.sys [73296 2013-10-08] (VMware, Inc.)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
U3 DfSdkS; kein ImagePath

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-03-21 21:04 - 2017-03-21 21:15 - 00065072 _____ C:\Users\Sergio\Desktop\SystemLook.txt
2017-03-21 21:03 - 2017-03-21 21:03 - 00165376 _____ C:\Users\Sergio\Desktop\SystemLook_x64.exe
2017-03-21 21:00 - 2017-03-21 21:00 - 00027490 _____ C:\Users\Sergio\Desktop\Fixlog.txt
2017-03-20 22:54 - 2017-03-20 22:54 - 00000000 _____ C:\Users\Sergio\Desktop\Neues Textdokument.txt
2017-03-20 22:51 - 2017-03-20 22:52 - 00047226 _____ C:\Users\Sergio\Desktop\Addition.txt
2017-03-20 22:50 - 2017-03-21 21:19 - 00021962 _____ C:\Users\Sergio\Desktop\FRST.txt
2017-03-20 22:48 - 2017-03-20 22:48 - 00001984 _____ C:\Users\Sergio\Desktop\mbam.txt
2017-03-20 22:36 - 2017-03-21 21:04 - 00092088 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2017-03-20 22:36 - 2017-03-21 21:01 - 00251840 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-03-20 22:36 - 2017-03-21 21:01 - 00186304 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMChameleon.sys
2017-03-20 22:36 - 2017-03-21 21:01 - 00111544 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2017-03-20 22:36 - 2017-03-21 21:01 - 00043968 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2017-03-20 22:36 - 2017-03-20 22:36 - 00006203 _____ C:\Users\Sergio\Desktop\AdwCleaner[C0].txt
2017-03-20 22:36 - 2017-03-20 22:36 - 00001912 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-03-20 22:36 - 2017-03-20 22:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-03-20 22:36 - 2017-03-20 22:36 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-03-20 22:36 - 2017-03-20 22:36 - 00000000 ____D C:\Program Files\Malwarebytes
2017-03-20 22:36 - 2017-02-24 06:23 - 00077408 _____ C:\WINDOWS\system32\Drivers\mbae64.sys
2017-03-20 22:33 - 2017-03-20 22:33 - 00346096 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-03-20 22:28 - 2017-03-20 22:32 - 00000000 ____D C:\AdwCleaner
2017-03-20 22:27 - 2017-03-20 22:28 - 04031440 _____ C:\Users\Sergio\Desktop\AdwCleaner_6.044.exe
2017-03-19 13:44 - 2017-03-19 13:49 - 00082710 _____ C:\TDSSKiller.3.1.0.12_19.03.2017_13.44.46_log.txt
2017-03-19 13:44 - 2017-03-19 13:44 - 04747704 _____ (AO Kaspersky Lab) C:\Users\Sergio\Desktop\tdsskiller.exe
2017-03-19 11:34 - 2017-03-19 11:34 - 00000085 _____ C:\WINDOWS\wininit.ini
2017-03-19 11:34 - 2017-03-19 11:34 - 00000000 ____D C:\WINDOWS\System32\Tasks\Safer-Networking
2017-03-19 02:00 - 2017-03-19 02:00 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\QuickScan
2017-03-19 01:43 - 2017-03-21 21:19 - 00000000 ____D C:\FRST
2017-03-19 01:42 - 2017-03-19 01:42 - 02424832 _____ (Farbar) C:\Users\Sergio\Desktop\FRST64.exe
2017-03-19 01:12 - 2017-03-19 01:12 - 00000000 ____D C:\Users\Sergio\AppData\Local\AdAwareDesktop
2017-03-19 01:10 - 2017-03-19 01:10 - 00000000 ____D C:\Users\Sergio\AppData\Local\AdAwareUpdater
2017-03-19 01:10 - 2017-03-19 01:10 - 00000000 ____D C:\Program Files\Common Files\adaware
2017-03-19 01:07 - 2017-03-20 22:33 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2017-03-19 01:07 - 2017-03-19 11:34 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2017-03-19 01:05 - 2017-03-20 22:34 - 00001748 _____ C:\WINDOWS\Sandboxie.ini
2017-03-19 01:05 - 2017-03-19 01:04 - 00000955 _____ C:\Users\Sergio\Desktop\Sandboxed Web Browser.lnk
2017-03-19 01:04 - 2017-03-19 01:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2017-03-19 01:04 - 2017-03-19 01:04 - 00000000 ____D C:\Program Files\Sandboxie
2017-03-19 01:02 - 2017-03-19 01:02 - 00000000 ___HD C:\$SysReset
2017-03-19 01:02 - 2017-03-19 01:02 - 00000000 ____D C:\WINDOWS\Panther
2017-03-19 00:06 - 2017-03-19 00:06 - 00217088 _____ C:\Users\postgres\NTUSER.rhk
2017-03-19 00:03 - 2017-03-19 00:03 - 00015836 _____ C:\Users\Sergio\Documents\cc_20170319_000336.reg
2017-03-18 23:51 - 2017-03-18 23:51 - 00001822 _____ C:\Users\Public\Desktop\iTunes.lnk
2017-03-18 23:51 - 2017-03-18 23:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2017-03-18 23:50 - 2017-03-18 23:51 - 00000000 ____D C:\Program Files\iTunes
2017-03-18 23:50 - 2017-03-18 23:50 - 00000000 ____D C:\Program Files\iPod
2017-03-18 23:49 - 2017-03-18 23:49 - 00000000 ____D C:\Program Files\Bonjour
2017-03-18 23:49 - 2017-03-18 23:49 - 00000000 ____D C:\Program Files (x86)\Bonjour
2017-03-18 23:41 - 2017-03-18 23:41 - 00000000 ____D C:\WINDOWS\System32\Tasks\AVAST Software
2017-03-18 23:39 - 2017-03-20 22:33 - 00000000 ____D C:\ProgramData\AVAST Software
2017-03-18 23:01 - 2017-03-19 00:06 - 04333568 _____ C:\Users\Sergio\NTUSER.rhk
2017-03-18 22:57 - 2017-03-18 22:57 - 00763016 _____ C:\Users\Sergio\Documents\cc_20170318_225706.reg
2017-03-18 22:55 - 2017-03-20 22:45 - 00000000 ____D C:\ProgramData\Ashampoo
2017-03-18 22:55 - 2017-03-18 22:55 - 00001329 _____ C:\Users\Public\Desktop\Ashampoo WinOptimizer 2017.lnk
2017-03-18 22:55 - 2017-03-18 22:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
2017-03-18 22:55 - 2017-03-18 22:55 - 00000000 ____D C:\Program Files (x86)\Ashampoo
2017-03-18 22:55 - 2009-08-24 21:13 - 00034304 _____ (mst software GmbH, Germany) C:\WINDOWS\system32\DfSdkBt.exe
2017-03-18 22:53 - 2017-03-18 22:53 - 00000000 ____D C:\Program Files (x86)\Chip Digital GmbH
2017-03-18 22:48 - 2017-03-18 22:48 - 00002862 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2017-03-18 22:48 - 2017-03-18 22:48 - 00000863 _____ C:\Users\Public\Desktop\CCleaner.lnk
2017-03-18 22:48 - 2017-03-18 22:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2017-03-18 22:48 - 2017-03-18 22:48 - 00000000 ____D C:\Program Files\CCleaner
2017-03-18 22:25 - 2016-06-05 07:42 - 00000000 ____D C:\Users\Sergio\Desktop\Python 3 - Intensivkurs  Projekte erfolgreich realisieren By Mark Pilgrim
2017-03-18 21:48 - 2016-09-01 12:09 - 00000000 ____D C:\Users\Sergio\Desktop\Yael Adler - Haut nah. Alles über unser größtes Organ inkl. pdf
2017-03-18 21:47 - 2016-10-17 16:46 - 00000000 ____D C:\Users\Sergio\Desktop\Nadja Hermann - Fettlogik überwinden
2017-03-18 01:04 - 2017-03-17 21:06 - 00000000 ____D C:\Users\Sergio\Desktop\Gunter Dueck - Flachsinn_ Ich habe Hirn, ich will hier raus
2017-03-16 21:27 - 2016-11-24 02:24 - 00000000 ____D C:\Users\Sergio\Desktop\Haiyti - Nightliner (2016)
2017-03-13 20:44 - 2017-03-13 20:44 - 14966655 _____ C:\Users\Sergio\Desktop\3662536676.psychologie.der.maerchen.2017.by.www.lul.to.pdf
2017-03-12 12:29 - 2017-03-12 12:26 - 00074345 ____N C:\Users\Sergio\Desktop\11057856.pdf
2017-03-11 11:55 - 2017-03-11 11:55 - 00000000 ____D C:\Users\Sergio\AppData\Local\TeamSpeak 3
2017-03-11 11:55 - 2017-03-11 11:55 - 00000000 ____D C:\Users\Sergio\.TeamSpeak 3
2017-03-10 22:56 - 2017-03-10 22:56 - 00000000 ____D C:\Users\Sergio\PycharmProjects
2017-03-10 22:55 - 2017-03-10 22:55 - 00001078 _____ C:\Users\Sergio\Desktop\JetBrains PyCharm Community Edition 2016.3.2.lnk
2017-03-10 22:55 - 2017-03-10 22:55 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\JetBrains
2017-03-10 22:55 - 2017-03-10 22:55 - 00000000 ____D C:\Users\Sergio\.PyCharmCE2016.3
2017-03-10 22:54 - 2017-03-10 22:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JetBrains
2017-03-10 22:54 - 2017-03-10 22:54 - 00000000 ____D C:\Program Files (x86)\JetBrains
2017-03-09 16:03 - 2017-03-09 16:03 - 00002713 _____ C:\Users\Sergio\Desktop\IDLE (Python 3.6 64-bit).lnk
2017-03-09 16:03 - 2017-03-09 16:03 - 00001520 _____ C:\Users\Sergio\Desktop\Python 3.6 (64-bit).lnk
2017-03-09 15:59 - 2017-03-09 15:59 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Python 3.6
2017-03-09 15:59 - 2017-03-09 15:59 - 00000000 ____D C:\Users\Sergio\AppData\Local\Package Cache
2017-03-08 16:00 - 2017-03-08 16:00 - 06744873 ____R C:\Users\Sergio\Desktop\3658108576.ich.glaube.es.hackt.2016.4.auflage.by.www.lul.to.pdf
2017-03-06 19:08 - 2017-03-06 19:08 - 00004296 _____ C:\WINDOWS\System32\Tasks\AMD Updater
2017-03-06 19:07 - 2017-03-06 19:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Radeon Settings
2017-03-06 18:50 - 2017-03-06 18:50 - 00000000 ____D C:\Users\Sergio\.Plays.tv
2017-03-05 18:37 - 2017-01-01 17:08 - 00000000 ____D C:\Users\Sergio\Desktop\Tory Lanez - Chixtape 4 (DatPiff.com)
2017-03-05 18:27 - 2017-03-05 18:27 - 00000000 ____D C:\ProgramData\GeoComply
2017-03-04 21:04 - 2017-03-04 21:06 - 00000000 ____D C:\Users\Sergio\VirtualBox VMs
2017-03-04 20:55 - 2017-03-05 14:02 - 00000000 ____D C:\Users\Sergio\.VirtualBox
2017-03-04 20:55 - 2017-03-04 20:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2017-03-04 20:55 - 2017-03-04 20:55 - 00000000 ____D C:\Program Files\Oracle
2017-03-04 20:55 - 2017-01-16 17:38 - 00959720 _____ (Oracle Corporation) C:\WINDOWS\system32\Drivers\VBoxDrv.sys
2017-03-04 20:55 - 2017-01-16 17:38 - 00149304 _____ (Oracle Corporation) C:\WINDOWS\system32\Drivers\VBoxUSBMon.sys
2017-03-01 23:49 - 2017-03-21 21:01 - 00001024 _____ C:\.rnd
2017-03-01 23:49 - 2017-03-01 23:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tenable Network Security
2017-03-01 23:48 - 2017-03-01 23:48 - 00000000 ____D C:\ProgramData\Tenable
2017-03-01 23:48 - 2017-03-01 23:48 - 00000000 ____D C:\Program Files\Tenable
2017-02-28 21:46 - 2017-03-05 11:48 - 00000000 ____D C:\Users\Sergio\Desktop\Ethic Hacking
2017-02-28 21:33 - 2017-02-28 21:33 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\.maltego
2017-02-28 21:33 - 2017-02-28 21:33 - 00000000 ____D C:\ProgramData\Paterva
2017-02-28 21:33 - 2017-02-28 21:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paterva
2017-02-28 21:32 - 2017-02-28 21:32 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Sun
2017-02-28 21:32 - 2017-02-28 21:32 - 00000000 ____D C:\Program Files (x86)\Paterva
2017-02-28 21:31 - 2017-03-18 23:51 - 00110144 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll
2017-02-28 21:31 - 2017-03-18 23:51 - 00000000 ____D C:\Program Files\Java
2017-02-27 22:16 - 2015-06-24 14:30 - 00064728 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vmx86.sys
2017-02-27 22:16 - 2013-10-08 18:21 - 00073296 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vsock.sys
2017-02-27 22:16 - 2013-10-08 18:21 - 00067664 _____ (VMware, Inc.) C:\WINDOWS\system32\vsocklib.dll
2017-02-27 22:16 - 2013-10-08 18:21 - 00063568 _____ (VMware, Inc.) C:\WINDOWS\SysWOW64\vsocklib.dll
2017-02-27 22:15 - 2015-06-24 14:30 - 00437976 _____ (VMware, Inc.) C:\WINDOWS\SysWOW64\vmnat.exe
2017-02-27 22:15 - 2015-06-24 14:30 - 00359128 _____ (VMware, Inc.) C:\WINDOWS\SysWOW64\vmnetdhcp.exe
2017-02-27 22:15 - 2015-06-24 14:27 - 00031448 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vmnetuserif.sys
2017-02-27 22:14 - 2017-02-27 22:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware
2017-02-27 22:14 - 2017-02-27 22:14 - 00000000 ____D C:\Program Files\Common Files\VMware
2017-02-27 22:14 - 2017-02-27 22:14 - 00000000 ____D C:\Program Files (x86)\VMware
2017-02-27 22:14 - 2015-06-24 14:27 - 00931032 _____ (VMware, Inc.) C:\WINDOWS\system32\vnetlib64.dll
2017-02-27 22:14 - 2014-08-21 08:07 - 00054976 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\hcmon.sys
2017-02-27 22:14 - 2014-08-21 08:06 - 00058048 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vmusb.sys
2017-02-27 22:11 - 2017-02-27 22:42 - 00000000 ____D C:\Users\Sergio\Documents\Virtual Machines
2017-02-27 19:48 - 2017-02-27 19:48 - 00000000 ____D C:\Users\Sergio\.idlerc

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-03-21 21:18 - 2016-09-29 20:02 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-03-21 21:08 - 2016-07-16 23:51 - 01079886 _____ C:\WINDOWS\system32\perfh007.dat
2017-03-21 21:08 - 2016-07-16 23:51 - 00257084 _____ C:\WINDOWS\system32\perfc007.dat
2017-03-21 21:08 - 2015-08-09 20:57 - 02557320 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-03-21 21:02 - 2016-09-29 20:05 - 00000000 ____D C:\Users\Sergio
2017-03-21 21:01 - 2016-09-29 20:14 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-03-21 21:01 - 2016-07-16 07:04 - 00786432 _____ C:\WINDOWS\system32\config\BBI
2017-03-21 21:01 - 2014-10-27 17:10 - 00000000 ____D C:\ProgramData\VMware
2017-03-21 20:59 - 2016-07-16 12:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-03-20 22:33 - 2016-07-16 12:45 - 00000000 ____D C:\WINDOWS\INF
2017-03-20 22:33 - 2015-04-16 15:08 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2017-03-20 22:33 - 2015-04-16 15:08 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2017-03-20 22:33 - 2014-10-26 12:23 - 00000000 ____D C:\Program Files\WinRAR
2017-03-20 22:32 - 2016-09-29 20:16 - 00000008 __RSH C:\Users\Sergio\ntuser.pol
2017-03-20 22:28 - 2016-07-16 12:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-03-20 22:28 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-03-19 11:34 - 2016-07-16 07:04 - 00032768 _____ C:\WINDOWS\system32\config\ELAM
2017-03-19 11:34 - 2015-06-02 19:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-03-19 03:10 - 2016-10-04 16:41 - 00000000 ____D C:\Program Files (x86)\SpeedFan
2017-03-19 00:06 - 2016-09-29 20:05 - 00000000 ____D C:\Users\postgres
2017-03-18 23:52 - 2016-09-29 20:14 - 00004440 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2017-03-18 23:52 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2017-03-18 23:52 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\Macromed
2017-03-18 23:52 - 2014-10-27 17:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-03-18 23:52 - 2014-10-26 12:23 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-03-18 23:52 - 2014-10-26 12:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-03-18 23:51 - 2014-10-26 12:41 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2017-03-18 23:50 - 2015-05-06 18:27 - 00000000 ____D C:\Program Files\Common Files\Apple
2017-03-18 23:49 - 2014-10-26 00:07 - 00001151 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-03-18 23:02 - 2015-03-10 17:03 - 00000000 ____D C:\Users\Sergio\AppData\LocalLow\Temp
2017-03-18 22:59 - 2014-10-26 12:50 - 00000000 ____D C:\Users\Sergio\AppData\Local\JDownloader v2.0
2017-03-18 22:55 - 2016-09-23 20:37 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\TS3Client
2017-03-18 22:55 - 2014-11-05 17:58 - 00000000 ____D C:\Program Files (x86)\Steam
2017-03-18 22:50 - 2014-10-26 10:16 - 00000000 ____D C:\Users\Sergio\AppData\Local\Razer
2017-03-18 22:50 - 2014-10-26 00:15 - 00000000 ____D C:\ProgramData\Razer
2017-03-18 22:50 - 2014-10-26 00:15 - 00000000 ____D C:\Program Files (x86)\Razer
2017-03-18 21:23 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2017-03-18 00:59 - 2014-10-27 09:42 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\vlc
2017-03-18 00:21 - 2014-10-29 14:39 - 00000000 ____D C:\WINDOWS\system32\MRT
2017-03-18 00:19 - 2015-04-16 15:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2017-03-18 00:19 - 2014-10-29 14:39 - 138634176 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-03-18 00:18 - 2014-10-26 12:31 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2017-03-18 00:15 - 2016-11-05 15:37 - 00000000 ____D C:\Users\Sergio\AppData\Local\ElevatedDiagnostics
2017-03-16 21:23 - 2013-08-22 14:25 - 00000167 _____ C:\WINDOWS\win.ini
2017-03-14 19:22 - 2014-12-23 17:29 - 00000000 ____D C:\Users\Sergio\AppData\Local\Spotify
2017-03-13 20:27 - 2014-10-27 17:14 - 00000000 ____D C:\Users\Sergio\AppData\Local\VMware
2017-03-13 19:32 - 2014-12-23 17:28 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Spotify
2017-03-13 19:07 - 2014-10-27 17:14 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\VMware
2017-03-11 14:19 - 2016-10-23 19:11 - 00000000 ____D C:\Users\Sergio\Documents\Soda PDF Files
2017-03-11 14:19 - 2016-10-23 19:11 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Soda PDF Desktop
2017-03-11 12:13 - 2014-12-13 14:35 - 00000000 ____D C:\Users\Sergio\AppData\Local\PokerStars.EU
2017-03-11 12:12 - 2014-12-13 14:34 - 00000000 ____D C:\Program Files (x86)\PokerStars.EU
2017-03-11 11:55 - 2016-09-23 20:37 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2017-03-10 06:17 - 2016-07-16 12:49 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-03-10 06:17 - 2016-07-16 12:49 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-03-06 19:07 - 2016-09-29 20:03 - 00000000 ____D C:\Program Files\AMD
2017-03-06 19:07 - 2015-05-19 18:55 - 00000000 ____D C:\Program Files (x86)\AMD
2017-03-06 19:07 - 2014-10-26 00:19 - 00000000 ____D C:\Users\Sergio\AppData\Local\AMD
2017-03-06 19:04 - 2014-10-26 00:14 - 00000000 ____D C:\AMD
2017-03-06 18:50 - 2016-09-29 20:03 - 00000000 ____D C:\ProgramData\Package Cache
2017-03-06 18:49 - 2016-09-29 20:03 - 00000000 ____D C:\ProgramData\AMD
2017-03-04 23:55 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\NDF
2017-02-28 21:32 - 2016-02-14 18:43 - 00000000 ____D C:\Users\Sergio\.oracle_jre_usage
2017-02-27 22:14 - 2014-10-27 17:10 - 02053002 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2017-02-25 11:31 - 2014-10-25 23:53 - 00000000 ____D C:\Users\Sergio\AppData\Local\Packages

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2015-07-20 16:32 - 2015-07-20 16:32 - 0923401 _____ () C:\Program Files (x86)\WinDlg_124.zip
2015-07-12 10:02 - 2015-07-12 10:02 - 0000000 ___SH () C:\Users\Sergio\AppData\Local\LumaEmu
2016-07-03 18:51 - 2016-07-03 18:51 - 0000733 _____ () C:\Users\Sergio\AppData\Local\recently-used.xbel
2016-09-29 20:03 - 2016-09-29 20:03 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2015-07-06 20:11 - 2015-07-06 20:11 - 0005036 _____ () C:\ProgramData\flwjycbm.bab

==================== Bamital & volsnap ======================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert

LastRegBack: 2017-03-18 21:07

==================== Ende von FRST.txt ============================
         

Und hier noch der Addition Log

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 15-03-2017
durchgeführt von Sergio (21-03-2017 21:20:17)
Gestartet von C:\Users\Sergio\Desktop
Windows 10 Pro Version 1607 (X64) (2016-09-29 19:16:19)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-1478414814-3749218601-3539646535-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1478414814-3749218601-3539646535-503 - Limited - Disabled)
Gast (S-1-5-21-1478414814-3749218601-3539646535-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1478414814-3749218601-3539646535-1003 - Limited - Enabled)
postgres (S-1-5-21-1478414814-3749218601-3539646535-1007 - Limited - Enabled) => C:\Users\postgres
Sergio (S-1-5-21-1478414814-3749218601-3539646535-1001 - Administrator - Enabled) => C:\Users\Sergio

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 25.0.0.134 - Adobe Systems Incorporated)
Adobe Flash Player 25 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 25.0.0.127 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.19) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.19 - Adobe Systems Incorporated)
AMD Install Manager (HKLM\...\AMD Catalyst Install Manager) (Version: 5.00 - Advanced Micro Devices, Inc.)
Apple Application Support (32-Bit) (HKLM-x32\...\{9BA1A894-B42F-4805-BC8C-349C905A3930}) (Version: 5.3.1 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{7EAC8A42-9FAC-4F6B-AABF-C08C9F2E0F13}) (Version: 5.3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{55BB2110-FB43-49B3-93F4-945A0CFB0A6C}) (Version: 10.0.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Ashampoo WinOptimizer 2017 (HKLM-x32\...\{4209F371-6CE9-533C-2CDC-94E053273B35}_is1) (Version: 14.00.04 - Ashampoo GmbH & Co. KG)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
calibre 64bit (HKLM\...\{DD84AFA7-867C-428A-8FA4-59A98AB60A1F}) (Version: 2.7.0 - Kovid Goyal)
Catalyst Control Center Next Localization BR (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (Version: 2016.0226.1531.27895 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.28 - Piriform)
chip 1-click download service (HKLM-x32\...\{503CA94E-0834-4CEE-AD92-BA17AF4E809A}) (Version: 3.6.9.0 - Chip Digital GmbH)
ComicRack v0.9.176 (HKLM\...\ComicRack) (Version: v0.9.176 - cYo Soft)
Dragon Ball Xenoverse 2 Digitale Deluxe Edition MULTi9 1.0 (HKLM-x32\...\Dragon Ball Xenoverse 2 Digitale Deluxe Edition MULTi9 1.0) (Version:  - )
Evernote v. 6.4.2 (HKLM-x32\...\{E74F0DCA-9FC8-11E6-9D98-005056950253}) (Version: 6.4.2.3788 - Evernote Corp.)
f.lux (HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Flux) (Version:  - )
FocalFilter (HKLM-x32\...\{78156F61-016D-402A-9EF9-C2AA253DB22A}) (Version: 0.9.00 - FocalFilter)
FreeMind (HKLM-x32\...\B991B020-2968-11D8-AF23-444553540000_is1) (Version: 1.0.1 - )
GeoGebra 5 (HKLM-x32\...\GeoGebra 5) (Version: 5.0.177.0 - International GeoGebra Institute)
Google Chrome (HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Google Chrome) (Version: 56.0.2924.87 - Google Inc.)
iTunes (HKLM\...\{9D0D2A8B-7E7B-4D88-8D50-24286ED6A5EB}) (Version: 12.5.5.5 - Apple Inc.)
Java 8 Update 121 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180121F0}) (Version: 8.0.1210.13 - Oracle Corporation)
Java 8 Update 92 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418092F0}) (Version: 8.0.920.14 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
JetBrains PyCharm Community Edition 2016.3.2 (HKLM-x32\...\PyCharm Community Edition 2016.3.2) (Version: 163.10154.50 - JetBrains s.r.o.)
Maltego CE 4.0.11 (HKLM-x32\...\MaltegoCE 4.0.11) (Version: 4.0.11 - Paterva)
Malwarebytes Version 3.0.6.1469 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.0.6.1469 - Malwarebytes)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\OneDriveSetup.exe) (Version: 17.3.6743.1212 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50905.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23506 (HKLM-x32\...\{3ee5e5bb-b7cc-4556-8861-a00a82977d6c}) (Version: 14.0.23506.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24212 (HKLM-x32\...\{462f63a8-6347-4894-a1b3-dbfe3a4c981d}) (Version: 14.0.24212.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 47.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 47.0.2 (x86 de)) (Version: 47.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 42.0.0.5780 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
NVIDIA PhysX (HKLM-x32\...\{B455E95A-B804-439F-B533-336B1635AE97}) (Version: 9.14.0702 - NVIDIA Corporation)
Oracle VM VirtualBox 5.1.14 (HKLM\...\{6AE61854-0F78-49E3-ABCC-586FB43CE709}) (Version: 5.1.14 - Oracle Corporation)
Outils de vérification linguistique 2013 de Microsoft Office - Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PokerStars.eu (HKLM-x32\...\PokerStars.eu) (Version:  - PokerStars.eu)
Python 3.6.0 (64-bit) (HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\{37a4e38b-baf7-4500-97f1-0f7c51d9a395}) (Version: 3.6.150.0 - Python Software Foundation)
Python 3.6.0 Core Interpreter (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Development Libraries (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Documentation (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Executables (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 pip Bootstrap (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Standard Library (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Tcl/Tk Support (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Test Suite (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python 3.6.0 Utility Scripts (64-bit) (Version: 3.6.150.0 - Python Software Foundation) Hidden
Python Launcher (HKLM-x32\...\{A674B2CB-13CA-437B-A215-9DD257959A49}) (Version: 3.6.5835.0 - Python Software Foundation)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7535 - Realtek Semiconductor Corp.)
Sandboxie 5.16 (64-bit) (HKLM\...\Sandboxie) (Version: 5.16 - Sandboxie Holdings, LLC)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version:  - Microsoft) Hidden
Skype™ 7.6 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.6.105 - Skype Technologies S.A.)
Soda PDF Desktop Asian Fonts Pack (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Convert Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Create Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Edit Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Forms Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Insert Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop OCR Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Review Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop Secure Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
Soda PDF Desktop View Module (Version: 9.0.24.30332 - LULU Software Limited) Hidden
South Park Der Stab der Wahrheit Incl. Ultimate Fellowship Pack MULTI-2 1.00 (HKLM-x32\...\South Park Der Stab der Wahrheit Incl. Ultimate Fellowship Pack MULTI-2 1.00) (Version:  - )
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Spotify (HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Spotify) (Version: 1.0.50.41368.gbd68dbef - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
SumatraPDF (HKLM-x32\...\SumatraPDF) (Version: 3.0 - Krzysztof Kowalczyk)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.19 - TeamSpeak Systems GmbH)
Tenable Nessus (x64) (HKLM\...\{BD1A3F84-26A0-4B77-9441-A25A9456D05D}) (Version: 6.10.2.20085 - Tenable Network Security, Inc.)
The Elder Scrolls V Skyrim Total Conversion Enderal Edition 1.0.0.9 (HKLM-x32\...\The Elder Scrolls V Skyrim Total Conversion Enderal Edition 1.0.0.9) (Version:  - )
The Swapper (HKLM\...\Steam App 231160) (Version:  - Olli Harjola, Otto Hantula, Tom Jubert, Carlo Castellano)
The Talos Principle MULTi12 244371 (HKLM-x32\...\The Talos Principle MULTi12 244371) (Version:  - )
The Witness MULTi2 1.0 (HKLM-x32\...\The Witness MULTi2 1.0) (Version:  - )
The Witness Update 3 MULTi2 1.0 (HKLM-x32\...\The Witness Update 3 MULTi2 1.0) (Version:  - )
Transmissions: Element 120 (HKLM\...\Steam App 365300) (Version:  - Shokunin)
Update for Skype for Business 2015 (KB3039776) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{5D2260D6-DB16-41DC-915B-A39BF4F66362}) (Version:  - Microsoft)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: 5.4.7.0 - Elaborate Bytes)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.4 - VideoLAN)
VMware Player (HKLM-x32\...\VMware_Player) (Version: 6.0.7 - VMware, Inc)
VMware Player (Version: 6.0.7 - VMware, Inc.) Hidden
WinRAR 5.40 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
XMind 7 (Update 1) (v3.6.1) (HKLM-x32\...\XMind_is1) (Version: 3.6.1.201512240104 - XMind Ltd.)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001_Classes\CLSID\{CB492AF1-2CEF-4E58-BE47-471C77D0C8BA}\InprocServer32 -> C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\psuser_64.dll (Google Inc.)

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {05866645-3760-4F4E-BC6C-3BBDEDFB310F} - System32\Tasks\AMD Updater => C:\Program Files\AMD\CIM\\Bin64\InstallManagerApp.exe [2016-02-26] (Advanced Micro Devices, Inc.)
Task: {05C0574D-989C-4495-8DE8-D6246D77AF3C} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {12154CA5-8F42-4B2F-A33E-3A02C98490B3} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {1BFBFA70-D3C6-4DB6-A3D3-6A34F0996C8F} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001Core => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe [2015-03-26] (Google Inc.)
Task: {1CF529C5-D29F-43AE-92FD-82A50EC964BA} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001Core1d2597b6c57f2c5 => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe [2015-03-26] (Google Inc.)
Task: {2AA358D6-9F4F-48E9-916F-1A0EDC6BE390} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {30F3058C-0415-4F77-84D4-B602143DF305} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => %SystemRoot%\System32\AutoWorkplace.exe 
Task: {377CB5EC-1FF1-4320-9889-A0AB77542A9E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-03-18] (Adobe Systems Incorporated)
Task: {3D20A507-D104-4CED-89A4-AF8E3F5AAC5C} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {43B97978-A6E7-44F8-B307-9CD98822E46C} - System32\Tasks\{B009C1D4-4FB9-4DE4-AEC7-12D4889EE128} => pcalua.exe -a "F:\Life Is Strange\Binaries\Win32\LifeIsStrange.exe" -d "F:\Life Is Strange\Binaries\Win32"
Task: {4828E74B-9E89-46CC-9738-CB90DB87849F} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {57033CC7-D3A0-4EAD-A992-F3900D9707E6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2017-03-03] (Piriform Ltd)
Task: {6324C092-090C-47D8-9DC5-45B732284B97} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {838F70AE-67A7-4327-AB01-D85A7E6734B1} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {9148DF24-37DC-4805-9F26-DF5BCE9715A9} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001UA => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe [2015-03-26] (Google Inc.)
Task: {C2240968-5C24-4A71-816D-7A321E9E1A2F} - System32\Tasks\{DD5EF7D6-65B6-4080-B57C-5810676A3FEA} => Firefox.exe hxxp://ui.skype.com/ui/0/6.21.60.104/de/abandoninstall?page=tsBing
Task: {D7E2333E-A177-4BF2-9C9E-4A5584D13208} - System32\Tasks\Launch HTC Sync Loader => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe 
Task: {E4015168-5F3B-4C32-93EC-98E3B5132F6A} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe 
Task: {EF679536-F393-428B-947B-09BA2A858E4D} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation)
Task: {F69F380B-C6CC-4E25-85D7-5A95585509AF} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001UA1d2597b6c617c32 => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe [2015-03-26] (Google Inc.)
Task: {FA1C89C0-1F9A-4401-9AE3-5C5284B8138A} - System32\Tasks\OneDrive Standalone Update Task => C:\Users\Sergio\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\OneDriveStandaloneUpdater.exe 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001Core.job => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1478414814-3749218601-3539646535-1001UA.job => C:\Users\Sergio\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2016-07-16 12:42 - 2016-07-16 12:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-12-18 23:02 - 2016-12-09 11:29 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-09-01 17:12 - 2016-09-01 17:12 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2017-01-13 13:56 - 2017-01-13 13:56 - 01353528 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2017-03-20 22:36 - 2017-02-24 06:23 - 02264352 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll
2017-03-20 22:36 - 2017-02-24 06:23 - 02264528 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2016-12-18 23:02 - 2016-12-09 11:29 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2016-09-30 08:34 - 2016-09-07 05:56 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-16 14:57 - 2016-12-21 08:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-01-16 14:57 - 2016-12-21 07:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-16 14:57 - 2016-12-21 07:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-16 14:57 - 2016-12-21 07:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-16 14:57 - 2016-12-21 07:48 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2017-01-16 14:57 - 2016-12-21 07:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-16 14:57 - 2016-12-21 07:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2017-03-13 18:23 - 2017-03-13 18:23 - 00077312 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-03-13 18:23 - 2017-03-13 18:23 - 00182784 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-03-13 18:23 - 2017-03-13 18:23 - 41048064 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-03-13 18:23 - 2017-03-13 18:23 - 02236896 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\roottools.dll
2015-06-24 14:28 - 2015-06-24 14:28 - 01301720 _____ () C:\Program Files (x86)\VMware\VMware Player\libxml2.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)

AlternateDataStreams: C:\Users\Sergio\Desktop\2014-06-09 12.36.44.jpg:com.dropbox.attributes [912]
AlternateDataStreams: C:\Users\Sergio\Desktop\2014-06-09 12.41.14.jpg:com.dropbox.attributes [225]

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE trusted site: HKU\.DEFAULT\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\localhost -> localhost

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2013-08-22 14:25 - 2016-12-13 20:23 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Sergio\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\img2.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

HKLM\...\StartupApproved\StartupFolder: => "Audible Download Manager.lnk"
HKLM\...\StartupApproved\StartupFolder: => "FocalFilterHelper.lnk"
HKLM\...\StartupApproved\Run: => "RTHDVCPL"
HKLM\...\StartupApproved\Run: => "iTunesHelper"
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKLM\...\StartupApproved\Run: => "StartCN"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "Razer Synapse"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "VirtualCloneDrive"
HKLM\...\StartupApproved\Run32: => "Raptr"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\StartupFolder: => "An OneNote senden.lnk"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\StartupFolder: => "EvernoteClipper.lnk"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\Run: => "Spotify Web Helper"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\Run: => "Google Update"
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\StartupApproved\Run: => "OneDrive"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [{A2A3A5EB-3D7A-434E-B3A6-3A3E55D22D2C}] => (Allow) C:\Windows\Temp\KMSnano\qemu-system-i386.exe
FirewallRules: [{CB1C8D8D-C811-4A8B-B0D7-111A2F2A92FA}] => (Allow) C:\Windows\Temp\KMSnano\qemu-system-i386.exe

==================== Wiederherstellungspunkte =========================

ACHTUNG: Systemwiederherstellung ist deaktiviert

==================== Fehlerhafte Geräte im Gerätemanager =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (03/21/2017 09:03:55 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/21/2017 09:00:02 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Event-ID 0

Error: (03/21/2017 08:58:23 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/20/2017 10:48:45 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/20/2017 10:35:43 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/20/2017 10:27:27 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Event-ID 0

Error: (03/20/2017 10:24:33 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/19/2017 01:58:00 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/19/2017 11:58:59 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (03/19/2017 09:58:51 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SERGIOS-PC)
Description: Bei der Aktivierung der App „Microsoft.BingFoodAndDrink_8wekyb3d8bbwe!AppexFoodAndDrink“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.


Systemfehler:
=============
Error: (03/21/2017 09:04:49 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: Der Server "{784E29F4-5EBE-4279-9948-1E8FE941646D}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (03/21/2017 09:01:49 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 und der APPID 
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (03/21/2017 09:01:46 PM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: Der Dienst "chip 1-click download service" hat einen ungültigen aktuellen Status gemeldet: 0

Error: (03/21/2017 09:01:46 PM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: Der Dienst "chip 1-click download service" hat einen ungültigen aktuellen Status gemeldet: 0

Error: (03/21/2017 09:01:45 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Soda PDF Desktop Creator" wurde aufgrund folgenden Fehlers nicht gestartet: 
Das System kann die angegebene Datei nicht finden.

Error: (03/21/2017 09:00:52 PM) (Source: DCOM) (EventID: 10010) (User: SERGIOS-PC)
Description: Der Server "{9AA46009-3CE0-458A-A354-715610A075E6}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (03/21/2017 09:00:50 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (03/21/2017 09:00:44 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Search" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler: 
Es wird bereits eine Instanz des Dienstes ausgeführt.

Error: (03/21/2017 09:00:29 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)
Description: Der Server "{784E29F4-5EBE-4279-9948-1E8FE941646D}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (03/21/2017 09:00:14 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.


CodeIntegrity:
===================================
  Date: 2017-03-19 05:34:50.982
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-03-18 00:15:51.902
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-03-08 20:41:44.737
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-03-07 16:07:59.583
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-03-05 12:03:31.285
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-03-03 17:01:58.393
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-03-01 22:16:13.030
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-02-28 23:26:03.401
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-02-28 12:36:19.913
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2017-02-04 18:13:32.823
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Speicherinformationen =========================== 

Prozessor: AMD Phenom(tm) II X4 945 Processor
Prozentuale Nutzung des RAM: 22%
Installierter physikalischer RAM: 16383.17 MB
Verfügbarer physikalischer RAM: 12632.42 MB
Summe virtueller Speicher: 18815.17 MB
Verfügbarer virtueller Speicher: 15105.8 MB

==================== Laufwerke ================================

Drive c: () (Fixed) (Total:100.21 GB) (Free:2.9 GB) NTFS
Drive d: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive e: () (Fixed) (Total:931.41 GB) (Free:44.85 GB) NTFS
Drive f: () (Fixed) (Total:156.25 GB) (Free:30.61 GB) NTFS
Drive h: () (Fixed) (Total:100 GB) (Free:99.68 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (Size: 335.4 GB) (Disk ID: F261F55D)
Partition 1: (Active) - (Size=100 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=156.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=79.1 GB) - (Type=05)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: FEBD6380)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: 01EE8E42)
Partition 1: (Not Active) - (Size=100.2 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=450 MB) - (Type=27)

==================== Ende von Addition.txt ============================
         

Servus,



Wir kontrollieren nochmal alles.



Hinweis: Der Suchlauf mit ESET kann länger dauern.





Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

start
CloseProcesses:
C:\ProgramData\flwjycbm.bab
C:\Users\Sergio\AppData\Local\Chromium
DeleteValue: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.001|
EmptyTemp:
end
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Schritt 2
Downloade dir die passende Version von HitmanPro auf deinen Desktop: HitmanPro - 32 Bit | HitmanPro - 64 Bit.

• Starte die HitmanPro.exe
• Klicke auf
  
• Entferne den Haken bei
  
• Klicke auf
  und
• Akzeptiere die Lizenzbedingungen und klicke auf
• Klicke auf
  
  und auf
• Wenn der Scan beendet wurde, nichts löschen lassen etc. sondern wähle unten links auf der Button-Leiste
  und speichere die Logdatei auf Deinem Desktop.
• Schließe HitmanPro und poste mir das Log.

 

Schritt 3

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 4

• Starte die FRST.exe erneut. Vergewissere dich, dass vor Addition.txt ein Haken gesetzt ist und drücke auf Untersuchen.
• FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
• Poste mir beide Logdateien mit deiner nächsten Antwort.

Gibt es jetzt noch Probleme mit dem PC oder mit deinen Internet Browsern? Wenn ja, welche?







Bitte poste mit deiner nächsten Antwort

• die Logdatei des FRST-Fix,
• die Logdatei von HitmanPro,
• die Logdatei von ESET,
• die beiden neuen Logdateien von FRST,
• die Beantwortung der gestellten Fragen.

Servus, hier die Logdatein.
Beim ESET Scan hat mein Rechner übernacht leider einen Neustart gemacht weil Windows Updates gemacht hat. Deswegen habe ich es heute nochmal neu durchlaufen lassen.


FRST-Fix

Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version: 15-03-2017
durchgeführt von Sergio (22-03-2017 19:26:21) Run:2
Gestartet von C:\Users\Sergio\Desktop
Geladene Profile: Sergio (Verfügbare Profile: Sergio & postgres)
Start-Modus: Normal
==============================================

fixlist Inhalt:
*****************
start
CloseProcesses:
C:\ProgramData\flwjycbm.bab
C:\Users\Sergio\AppData\Local\Chromium
DeleteValue: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.001|
EmptyTemp:
end
         
*****************

Prozesse erfolgreich geschlossen.
C:\ProgramData\flwjycbm.bab => erfolgreich verschoben
C:\Users\Sergio\AppData\Local\Chromium => erfolgreich verschoben
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.001\\ => Wert erfolgreich entfernt

=========== EmptyTemp: ==========

BITS transfer queue => 284945 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 13056527 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 11210 B
Edge => 0 B
Chrome => 0 B
Firefox => 6097913 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 0 B
LocalService => 0 B
NetworkService => 2536 B
Sergio => 14911 B
postgres => 0 B

RecycleBin => 184673 B
EmptyTemp: => 18.7 MB temporäre Dateien entfernt.

================================


Das System musste neu gestartet werden.

==== Ende von Fixlog 19:26:27 ====
         

Hitmanpro

HitmanPro 3.7.15.281
www.hitmanpro.com

   Computer name . . . . : SERGIOS-PC
   Windows . . . . . . . : 10.0.0.14393.X64/4
   User name . . . . . . : SERGIOS-PC\Sergio
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2017-03-22 19:44:33
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 3m 47s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 2
   Traces  . . . . . . . : 4

   Objects scanned . . . : 3.462.524
   Files scanned . . . . : 174.368
   Remnants scanned  . . : 1.002.901 files / 2.285.255 keys

Malware _____________________________________________________________________

   C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\dmr_72.exe
      Size . . . . . . . : 531.464 bytes
      Age  . . . . . . . : 1.9 days (2017-03-20 22:31:53)
      Entropy  . . . . . : 6.7
      SHA-256  . . . . . : E8C94324346A70C2AE8D2320816BBC579578B443AF0F80ABBA75865892F15974
      Needs elevation  . : Yes
      Product  . . . . . : CHIP Secured Installer
      Publisher  . . . . : Chip Digital GmbH
      Description  . . . : CHIP Secured Installer
      Version  . . . . . : 2.1.4.4
      RSA Key Size . . . : 2048
      LanguageID . . . . : 0
      Authenticode . . . : Valid
    > Kaspersky  . . . . : not-a-virus:HEUR:Downloader.MSIL.DownloadSponsor.gen
      Fuzzy  . . . . . . : 95.0
      Forensic Cluster
         -2.9s C:\AdwCleaner\quarantine\files\zuukkerbmubhlwuyaxazjwgshrrerddr\
         -2.9s C:\AdwCleaner\quarantine\files\zuukkerbmubhlwuyaxazjwgshrrerddr\Config.ini
         -2.9s C:\AdwCleaner\quarantine\files\zuukkerbmubhlwuyaxazjwgshrrerddr\Errorlog.txt
         -2.9s C:\AdwCleaner\quarantine\files\zuukkerbmubhlwuyaxazjwgshrrerddr\OptIgnoreList.txt
         -2.9s C:\AdwCleaner\quarantine\files\zuukkerbmubhlwuyaxazjwgshrrerddr\backup\
         -2.8s C:\AdwCleaner\quarantine\files\zuukkerbmubhlwuyaxazjwgshrrerddr\backup\SERGIOS-PC 18.03.2017 225409.rbk
         -2.7s C:\AdwCleaner\quarantine\files\zuukkerbmubhlwuyaxazjwgshrrerddr\backup\SERGIOS-PC 18.03.2017 230014.reg
         -2.7s C:\AdwCleaner\quarantine\files\zuukkerbmubhlwuyaxazjwgshrrerddr\backup\SERGIOS-PC 18.03.2017 230025.reg
         -2.6s C:\AdwCleaner\quarantine\files\zuukkerbmubhlwuyaxazjwgshrrerddr\backup\SERGIOS-PC 18.03.2017 230036.reg
         -2.6s C:\AdwCleaner\quarantine\files\zuukkerbmubhlwuyaxazjwgshrrerddr\backup\SERGIOS-PC 19.03.2017 000641.reg
         -2.6s C:\AdwCleaner\quarantine\files\zuukkerbmubhlwuyaxazjwgshrrerddr\backup\SERGIOS-PC 19.03.2017 000649.reg
         -2.3s C:\AdwCleaner\quarantine\files\ljzbbnqbhmxjusfifiovinduykkkoxqc\
         -2.3s C:\AdwCleaner\quarantine\files\ljzbbnqbhmxjusfifiovinduykkkoxqc\Logs\
         -2.3s C:\AdwCleaner\quarantine\files\ljzbbnqbhmxjusfifiovinduykkkoxqc\Logs\Webcompanion\
         -2.3s C:\AdwCleaner\quarantine\files\ljzbbnqbhmxjusfifiovinduykkkoxqc\Logs\Webcompanion\adblocker.log
         -2.3s C:\AdwCleaner\quarantine\files\ljzbbnqbhmxjusfifiovinduykkkoxqc\Logs\Webcompanion\pupmanager.log
         -2.3s C:\AdwCleaner\quarantine\files\ljzbbnqbhmxjusfifiovinduykkkoxqc\Logs\Webcompanion\wcassistant.log
         -2.3s C:\AdwCleaner\quarantine\files\ljzbbnqbhmxjusfifiovinduykkkoxqc\Logs\Webcompanion\webcompanion.log
         -2.2s C:\AdwCleaner\quarantine\files\ijzyftyacgnlumrvktifcadvzoscsjim\
         -2.2s C:\AdwCleaner\quarantine\files\ijzyftyacgnlumrvktifcadvzoscsjim\Wise Registry Cleaner.lnk
         -1.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\
         -1.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\1c.ico
         -1.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\LanguageList.txt
         -1.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\License.txt
         -1.1s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\LiveUpdate.exe
         -1.1s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\unins000.dat
         -0.8s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\unins000.exe
         -0.8s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\unins000.msg
         -0.8s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\WiseRegCleaner.exe
         -0.8s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\
         -0.8s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Arabic.ini
         -0.8s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Belarusian(Cyrillic).ini
         -0.8s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Belarusian(Latin).ini
         -0.8s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Bengali(India).ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Bulgarian.ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Catalan(Spain).ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Chinese(Simplified).ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Chinese(Traditional).ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Croatian.ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Czech.ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Danish.ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Dutch(Nederlands).ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\English.ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Estonian.ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Finnish.ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\French.ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Georgian.ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\German.ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Greek.ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Hungarian.ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Indonesian.ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Italian.ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Japanese.ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Korean.ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Kurdish(Kurmanci).ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Lithuanian.ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Norwegian(Bokmal).ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Norwegian(Nynorsk).ini
         -0.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Persian.ini
         -0.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Polish.ini
         -0.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Portuguese(Brazil).ini
         -0.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Portuguese(Portugal).ini
         -0.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Romanian.ini
         -0.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Russian.ini
         -0.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Serbian.ini
         -0.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Slovak.ini
         -0.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Slovenian.ini
         -0.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Spanish(Argentina).ini
         -0.4s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Spanish(Spain).ini
         -0.4s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Swedish(Sweden).ini
         -0.4s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Tajik.ini
         -0.4s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Thai.ini
         -0.4s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Turkish.ini
         -0.4s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Ukrainian.ini
         -0.4s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Vietnamese.ini
         -0.1s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\
          0.0s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\Downloads\152e221a8bef8d2d13c58f995563a1a1\
          0.0s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\Downloads\
          0.0s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\dmr_72.exe
          0.0s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\lnkucqllnsugozzn.dat
          0.0s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\luziqgxrcmyjbggk.dat
          0.0s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\yxkrjbwbbbywuoyk.dat
          0.0s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\Downloads\152e221a8bef8d2d13c58f995563a1a1\25bba82dad5396f1acd569a802c4adc3\
          3.0s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\Downloads\152e221a8bef8d2d13c58f995563a1a1\25bba82dad5396f1acd569a802c4adc3\Sandboxie516Install.exe
          3.0s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\Downloads\152e221a8bef8d2d13c58f995563a1a1\7ff3efdaebacddf7f5b0b8a3561966c9\
          3.0s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\Downloads\152e221a8bef8d2d13c58f995563a1a1\7ff3efdaebacddf7f5b0b8a3561966c9\spybot-2.4.40.exe
          3.3s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\Downloads\152e221a8bef8d2d13c58f995563a1a1\da431718e10b05366665c733d1172e40\
          4.3s C:\Users\Sergio\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\AC\Microsoft\CryptnetUrlCache\Content\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1
          4.4s C:\Users\Sergio\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\AC\INetCache\B11YJ1JU\
          4.6s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\Downloads\152e221a8bef8d2d13c58f995563a1a1\da431718e10b05366665c733d1172e40\Adaware_Installer_12.0.636.exe
          5.0s C:\AdwCleaner\quarantine\files\frjmjeatexikksjnkjovosljypbzkcjd.back
          5.1s C:\AdwCleaner\quarantine\files\minicemeqzpqtyfcqqpftaasnsnvphzx.back
          5.1s C:\AdwCleaner\quarantine\files\kpqhbxcojjvprmgxoxjrutmrcjlmlxbi.back
          5.2s C:\AdwCleaner\quarantine\files\jmkyidmkljoyaawrbsweiaywagkpypes.back
          5.2s C:\AdwCleaner\quarantine\files\wfmtyubjmvfhivhbqtfoeckxlhpawdxr.back
          5.3s C:\AdwCleaner\quarantine\registry\reg_vfmmtaiofqxitidipytwrzjrpwlfdvhx.reg
          5.5s C:\AdwCleaner\quarantine\registry\reg_sxsweqetwqvszakhjmczsarnycjtewsu.reg
          5.6s C:\AdwCleaner\quarantine\registry\reg_oygwvxevblnagbjovskjsmxfbtccexrg.reg
          5.7s C:\AdwCleaner\quarantine\registry\reg_axavcmxedldxiilkiillvrwanyxeveot.reg
          5.8s C:\AdwCleaner\quarantine\registry\reg_qpelbrvpudvsmupyfmdeciuikzvtrkdm.reg
          5.9s C:\AdwCleaner\quarantine\registry\reg_euozmtsikepsdsvvrupsphmoonzkksbl.reg
          6.0s C:\AdwCleaner\quarantine\registry\reg_woxfrjvitpoxlkwcwxtxzhhqyhtyktjj.reg
          6.1s C:\AdwCleaner\quarantine\registry\reg_tejlefsulklikeqmjcnzbgtfowbbiadv.reg
          6.2s C:\AdwCleaner\quarantine\registry\reg_oxikgavvhedhdqfrtopmrfocagffhvyc.reg
          6.3s C:\AdwCleaner\quarantine\registry\reg_zepsqdtrguwcoxpeuejpudxrdjtxzshl.reg
          6.4s C:\AdwCleaner\quarantine\registry\reg_rxjdzwzuzuaxxvxvcilighrwrovtpurv.reg
          6.6s C:\AdwCleaner\quarantine\registry\reg_cfwcnjtrdbxwoqlzgaynlzusoiynjeqw.reg
          6.7s C:\AdwCleaner\quarantine\registry\reg_qjmnenobngjrmstzapycwoskngkdjgie.reg
          6.8s C:\AdwCleaner\quarantine\registry\reg_rxmeqtsgesvtuemlnppcxmpbuhhwrrqt.reg
          6.9s C:\AdwCleaner\quarantine\registry\reg_hzmaggvsoybfqwdfybgqoejnoiqnpwti.reg
          7.0s C:\AdwCleaner\quarantine\registry\reg_elyteeazenakdiyohxoqykifhaazcpyb.reg
          7.1s C:\AdwCleaner\quarantine\registry\reg_pizxhhdyzuqsgzfkhrakvjhezrxdxwqi.reg
          7.2s C:\AdwCleaner\quarantine\registry\reg_ohcsalzezvpvqswpofzakeufxelvrdjr.reg
          7.3s C:\AdwCleaner\quarantine\registry\reg_xhdyfsvcxegluencecwzmfcaoqeqocle.reg
          7.4s C:\AdwCleaner\quarantine\registry\reg_kotfeyujqlbepwyspfnkzcsdttniwyeo.reg
          7.6s C:\AdwCleaner\quarantine\registry\reg_tvxakeaozhwbudlzhzqwvuelkrcvesgt.reg
          7.7s C:\AdwCleaner\quarantine\registry\reg_uiifqsddbvoalehvszmzxolqdlxcyjma.reg
          7.8s C:\AdwCleaner\quarantine\registry\reg_gwhwysrmozujknbcpzcywcjggafpmnmz.reg
          7.9s C:\AdwCleaner\quarantine\registry\reg_eyqgqoemjlfztzpckimepufoolnwougv.reg
          8.0s C:\AdwCleaner\quarantine\registry\reg_ilkpsriwxmjyhuhytoqpunxhvlrwqyfd.reg
          8.1s C:\AdwCleaner\quarantine\registry\reg_xysopuknnzghncgyjaijuernmvzpuhpl.reg
          8.2s C:\AdwCleaner\quarantine\registry\reg_hcwfdqjrzdojcrdxtrqfdtjccdynmwda.reg
          8.3s C:\AdwCleaner\quarantine\registry\reg_zcpzjxnddjfdysveefkvhymwtnaflezi.reg
          8.4s C:\AdwCleaner\quarantine\registry\reg_syvxvfiurqsgpizwonsvrjcdeeojxbfq.reg
          8.5s C:\AdwCleaner\quarantine\registry\reg_djxulxhlmndfsqjbgafatqbmzsrsmxmr.reg
          8.6s C:\AdwCleaner\quarantine\registry\reg_cfnbytltgvkibdjpxtrqgvngcebhwslh.reg
          8.7s C:\AdwCleaner\quarantine\registry\reg_nkofheayzhiutqzyatzaekymxfzjttle.reg
          8.9s C:\AdwCleaner\quarantine\registry\reg_ldkxtjqquwkjzehqrbvmvoscpvpkqdws.reg
          9.0s C:\AdwCleaner\quarantine\registry\reg_kvsofvxjmvnmhhzueviwqktvdlnjsmow.reg
          9.1s C:\AdwCleaner\quarantine\registry\reg_zchrwmhrwdiznizxuovyxfodzxfuxxxv.reg
          9.2s C:\AdwCleaner\quarantine\registry\reg_vulvuwcztmtrudxylbqimxnziveuftjm.reg
          9.4s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\4\94\
          9.4s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\4\94\97C23C6884B05782.dat
          9.5s C:\AdwCleaner\quarantine\registry\reg_vnvfokfrzedtxwvadmegpinofrslamyo.reg
          9.5s C:\AdwCleaner\quarantine\registry\reg_ijugsgfnmsynflfzjadrxueviboibhai.reg
          9.6s C:\AdwCleaner\quarantine\registry\reg_kqptwxylblkfarlhwaraskrpvvjpvqnl.reg
          9.7s C:\AdwCleaner\quarantine\registry\reg_qkihgzsxqnscodtgqzwnsdksuawsuojm.reg
          9.8s C:\AdwCleaner\quarantine\registry\reg_nwnmpxkwqdmsfnpkjuknmypqegrdcxuq.reg
          9.9s C:\AdwCleaner\quarantine\registry\reg_wsypwwklzbnyitbobiszvixnarsyqjmm.reg
         10.0s C:\AdwCleaner\quarantine\registry\reg_tdxikfqkjytrmiatuemmvuukfvimwohe.reg
         10.1s C:\AdwCleaner\quarantine\registry\reg_xtknhqyvpqbzyijcapyqbneqptsszbas.reg
         10.2s C:\AdwCleaner\quarantine\registry\reg_jcoadalidppaeesqdwdvucagxqrcyksa.reg
         10.3s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{5A7B5378-1B87-4B49-AAFC-6B39413FD656}
         11.6s C:\AdwCleaner\quarantine\registry\reg_zttjqqlxjjtbgjfmylpgqyvzkqkrrevc.reg
         11.7s C:\AdwCleaner\quarantine\registry\reg_mbagvhgarxmyzlkxfkefkiasbcogdxhm.reg
         11.8s C:\AdwCleaner\quarantine\registry\reg_qdqmvxxscbbqkspowednrjusjdpysswz.reg
         11.9s C:\AdwCleaner\quarantine\registry\reg_swrdvepzcvdalcxcbeqlwmjyesfjnows.reg
         12.0s C:\AdwCleaner\quarantine\registry\reg_lswasuoqokhyzhqgioicflpwkehiqgsm.reg
         12.4s C:\Windows\Prefetch\NETSH.EXE-A596235F.pf
         13.5s C:\Windows\Prefetch\GPSCRIPT.EXE-FB901B09.pf
         15.3s C:\Users\Sergio\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\AC\TokenBroker\Cache\d504c4469d9435771892d902d1746eeb0074f772.tbres
         16.0s C:\Users\Sergio\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\AC\Microsoft\CryptnetUrlCache\Content\1DAF2884EC4DFA96BA4A58D4DBC9C406
         16.5s C:\Users\Sergio\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\AC\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C
         16.9s C:\Users\Sergio\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\AC\Microsoft\CryptnetUrlCache\Content\A053CFB63FC8E6507871752236B5CCD5_F08FA59F86A4C4C8E5A6E225CE714A73
         17.0s C:\Users\Sergio\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\AC\INetCache\VWZC20MO\
         17.0s C:\Users\Sergio\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\AC\INetCache\P2IZNW93\
         17.5s C:\Users\Sergio\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\AC\Microsoft\CryptnetUrlCache\Content\B912B2C6928A18B8CD7D50CF08BEA95B_8F80102BD7C0FE19E85136CCC46E53A7
         17.5s C:\Users\Sergio\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\AC\Microsoft\CryptnetUrlCache\Content\B912B2C6928A18B8CD7D50CF08BEA95B_3449BF054D431FED5C8F067CDF33D4C8
         17.6s C:\Windows\Prefetch\DLLHOST.EXE-C7F45418.pf
         23.3s C:\Windows\Prefetch\GPUPDATE.EXE-7EBA4B6F.pf
         24.0s C:\AdwCleaner\AdwCleaner[C0].txt
         51.8s C:\Windows\Prefetch\SETTINGSYNCHOST.EXE-0130E42A.pf
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\00\235
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\22\100018
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\21\100017
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\01\213
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\15\294
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\03\208
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\11\1252
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\19\328
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\18\12284
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\17\109001
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\18\109002
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\22\109003
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\02\109004
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\04\109005
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\22\109006
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\05\317
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\10\197
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\01\198
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\05\199
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\11\200
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\09\287
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\10\286
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\18\195
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\15\196
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\05\191
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\00\192
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\17\193
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\12\194
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\19\272
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\04\259
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\21\260
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\15\262
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\01\271
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\10\267
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\19\266
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\02\303
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\19\316
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\22\318
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\13\278
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\20\189
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\01\263
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\04\261
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\07\273
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\22\190
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\11\15040
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\14\9664
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\17\300
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\15\288
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\07\290
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\05\341
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\17\345
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\05\334
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\15\321
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\08\322
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\11\291
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\15\292
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\12\12282
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\04\12283
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\01\289
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\10\340
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\21\344
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\07\15010
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\14\15039

   C:\WINDOWS\system32\config\systemprofile\AppData\Local\DMR\Sandboxie - CHIP-Installer.exe
      Size . . . . . . . : 1.496.584 bytes
      Age  . . . . . . . : 3.8 days (2017-03-19 01:03:55)
      Entropy  . . . . . : 7.1
      SHA-256  . . . . . : 64C7C953D80CAC88EC5EE790835C15F1A628B885FD8BD386EA86C5FE58B54289
      Needs elevation  . : Yes
      RSA Key Size . . . : 2048
      Authenticode . . . : Valid
    > Kaspersky  . . . . : not-a-virus:HEUR:Downloader.MSIL.DownloadSponsor.gen
      Fuzzy  . . . . . . : 106.0


Suspicious files ____________________________________________________________

   C:\Users\Sergio\Desktop\FRST64.exe
      Size . . . . . . . : 2.424.832 bytes
      Age  . . . . . . . : 3.2 days (2017-03-19 13:51:41)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : 3A3DCD0D3C9C1FE10C45AF795DC9452DA192246BB67D896AB7F16151A53C1B5F
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.
      Forensic Cluster
          0.0s C:\Users\Sergio\Desktop\FRST64.exe
          3.2s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\2\76\82035343A27699B4.dat
          5.3s C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\datareporting\archived\2017-03\1489927907050.bed8fd49-94ba-49c4-9d05-614a790ec23a.main.jsonlz4


Potential Unwanted Programs _________________________________________________

   C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\securityProtection.sqlite (SecurityProtection)
         

ESET Log

HitmanPro 3.7.15.281
www.hitmanpro.com

   Computer name . . . . : SERGIOS-PC
   Windows . . . . . . . : 10.0.0.14393.X64/4
   User name . . . . . . : SERGIOS-PC\Sergio
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2017-03-22 19:44:33
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 3m 47s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 2
   Traces  . . . . . . . : 4

   Objects scanned . . . : 3.462.524
   Files scanned . . . . : 174.368
   Remnants scanned  . . : 1.002.901 files / 2.285.255 keys

Malware _____________________________________________________________________

   C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\dmr_72.exe
      Size . . . . . . . : 531.464 bytes
      Age  . . . . . . . : 1.9 days (2017-03-20 22:31:53)
      Entropy  . . . . . : 6.7
      SHA-256  . . . . . : E8C94324346A70C2AE8D2320816BBC579578B443AF0F80ABBA75865892F15974
      Needs elevation  . : Yes
      Product  . . . . . : CHIP Secured Installer
      Publisher  . . . . : Chip Digital GmbH
      Description  . . . : CHIP Secured Installer
      Version  . . . . . : 2.1.4.4
      RSA Key Size . . . : 2048
      LanguageID . . . . : 0
      Authenticode . . . : Valid
    > Kaspersky  . . . . : not-a-virus:HEUR:Downloader.MSIL.DownloadSponsor.gen
      Fuzzy  . . . . . . : 95.0
      Forensic Cluster
         -2.9s C:\AdwCleaner\quarantine\files\zuukkerbmubhlwuyaxazjwgshrrerddr\
         -2.9s C:\AdwCleaner\quarantine\files\zuukkerbmubhlwuyaxazjwgshrrerddr\Config.ini
         -2.9s C:\AdwCleaner\quarantine\files\zuukkerbmubhlwuyaxazjwgshrrerddr\Errorlog.txt
         -2.9s C:\AdwCleaner\quarantine\files\zuukkerbmubhlwuyaxazjwgshrrerddr\OptIgnoreList.txt
         -2.9s C:\AdwCleaner\quarantine\files\zuukkerbmubhlwuyaxazjwgshrrerddr\backup\
         -2.8s C:\AdwCleaner\quarantine\files\zuukkerbmubhlwuyaxazjwgshrrerddr\backup\SERGIOS-PC 18.03.2017 225409.rbk
         -2.7s C:\AdwCleaner\quarantine\files\zuukkerbmubhlwuyaxazjwgshrrerddr\backup\SERGIOS-PC 18.03.2017 230014.reg
         -2.7s C:\AdwCleaner\quarantine\files\zuukkerbmubhlwuyaxazjwgshrrerddr\backup\SERGIOS-PC 18.03.2017 230025.reg
         -2.6s C:\AdwCleaner\quarantine\files\zuukkerbmubhlwuyaxazjwgshrrerddr\backup\SERGIOS-PC 18.03.2017 230036.reg
         -2.6s C:\AdwCleaner\quarantine\files\zuukkerbmubhlwuyaxazjwgshrrerddr\backup\SERGIOS-PC 19.03.2017 000641.reg
         -2.6s C:\AdwCleaner\quarantine\files\zuukkerbmubhlwuyaxazjwgshrrerddr\backup\SERGIOS-PC 19.03.2017 000649.reg
         -2.3s C:\AdwCleaner\quarantine\files\ljzbbnqbhmxjusfifiovinduykkkoxqc\
         -2.3s C:\AdwCleaner\quarantine\files\ljzbbnqbhmxjusfifiovinduykkkoxqc\Logs\
         -2.3s C:\AdwCleaner\quarantine\files\ljzbbnqbhmxjusfifiovinduykkkoxqc\Logs\Webcompanion\
         -2.3s C:\AdwCleaner\quarantine\files\ljzbbnqbhmxjusfifiovinduykkkoxqc\Logs\Webcompanion\adblocker.log
         -2.3s C:\AdwCleaner\quarantine\files\ljzbbnqbhmxjusfifiovinduykkkoxqc\Logs\Webcompanion\pupmanager.log
         -2.3s C:\AdwCleaner\quarantine\files\ljzbbnqbhmxjusfifiovinduykkkoxqc\Logs\Webcompanion\wcassistant.log
         -2.3s C:\AdwCleaner\quarantine\files\ljzbbnqbhmxjusfifiovinduykkkoxqc\Logs\Webcompanion\webcompanion.log
         -2.2s C:\AdwCleaner\quarantine\files\ijzyftyacgnlumrvktifcadvzoscsjim\
         -2.2s C:\AdwCleaner\quarantine\files\ijzyftyacgnlumrvktifcadvzoscsjim\Wise Registry Cleaner.lnk
         -1.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\
         -1.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\1c.ico
         -1.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\LanguageList.txt
         -1.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\License.txt
         -1.1s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\LiveUpdate.exe
         -1.1s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\unins000.dat
         -0.8s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\unins000.exe
         -0.8s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\unins000.msg
         -0.8s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\WiseRegCleaner.exe
         -0.8s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\
         -0.8s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Arabic.ini
         -0.8s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Belarusian(Cyrillic).ini
         -0.8s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Belarusian(Latin).ini
         -0.8s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Bengali(India).ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Bulgarian.ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Catalan(Spain).ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Chinese(Simplified).ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Chinese(Traditional).ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Croatian.ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Czech.ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Danish.ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Dutch(Nederlands).ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\English.ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Estonian.ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Finnish.ini
         -0.7s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\French.ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Georgian.ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\German.ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Greek.ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Hungarian.ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Indonesian.ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Italian.ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Japanese.ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Korean.ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Kurdish(Kurmanci).ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Lithuanian.ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Norwegian(Bokmal).ini
         -0.6s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Norwegian(Nynorsk).ini
         -0.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Persian.ini
         -0.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Polish.ini
         -0.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Portuguese(Brazil).ini
         -0.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Portuguese(Portugal).ini
         -0.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Romanian.ini
         -0.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Russian.ini
         -0.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Serbian.ini
         -0.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Slovak.ini
         -0.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Slovenian.ini
         -0.5s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Spanish(Argentina).ini
         -0.4s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Spanish(Spain).ini
         -0.4s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Swedish(Sweden).ini
         -0.4s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Tajik.ini
         -0.4s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Thai.ini
         -0.4s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Turkish.ini
         -0.4s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Ukrainian.ini
         -0.4s C:\AdwCleaner\quarantine\files\bsnnmnsqnolggsnuzlvwfmfnjwyboeze\Languages\Vietnamese.ini
         -0.1s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\
          0.0s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\Downloads\152e221a8bef8d2d13c58f995563a1a1\
          0.0s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\Downloads\
          0.0s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\dmr_72.exe
          0.0s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\lnkucqllnsugozzn.dat
          0.0s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\luziqgxrcmyjbggk.dat
          0.0s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\yxkrjbwbbbywuoyk.dat
          0.0s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\Downloads\152e221a8bef8d2d13c58f995563a1a1\25bba82dad5396f1acd569a802c4adc3\
          3.0s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\Downloads\152e221a8bef8d2d13c58f995563a1a1\25bba82dad5396f1acd569a802c4adc3\Sandboxie516Install.exe
          3.0s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\Downloads\152e221a8bef8d2d13c58f995563a1a1\7ff3efdaebacddf7f5b0b8a3561966c9\
          3.0s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\Downloads\152e221a8bef8d2d13c58f995563a1a1\7ff3efdaebacddf7f5b0b8a3561966c9\spybot-2.4.40.exe
          3.3s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\Downloads\152e221a8bef8d2d13c58f995563a1a1\da431718e10b05366665c733d1172e40\
          4.3s C:\Users\Sergio\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\AC\Microsoft\CryptnetUrlCache\Content\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1
          4.4s C:\Users\Sergio\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\AC\INetCache\B11YJ1JU\
          4.6s C:\AdwCleaner\quarantine\files\dfsupdujpxbzeiihrnqgovoiiclagavl\Downloads\152e221a8bef8d2d13c58f995563a1a1\da431718e10b05366665c733d1172e40\Adaware_Installer_12.0.636.exe
          5.0s C:\AdwCleaner\quarantine\files\frjmjeatexikksjnkjovosljypbzkcjd.back
          5.1s C:\AdwCleaner\quarantine\files\minicemeqzpqtyfcqqpftaasnsnvphzx.back
          5.1s C:\AdwCleaner\quarantine\files\kpqhbxcojjvprmgxoxjrutmrcjlmlxbi.back
          5.2s C:\AdwCleaner\quarantine\files\jmkyidmkljoyaawrbsweiaywagkpypes.back
          5.2s C:\AdwCleaner\quarantine\files\wfmtyubjmvfhivhbqtfoeckxlhpawdxr.back
          5.3s C:\AdwCleaner\quarantine\registry\reg_vfmmtaiofqxitidipytwrzjrpwlfdvhx.reg
          5.5s C:\AdwCleaner\quarantine\registry\reg_sxsweqetwqvszakhjmczsarnycjtewsu.reg
          5.6s C:\AdwCleaner\quarantine\registry\reg_oygwvxevblnagbjovskjsmxfbtccexrg.reg
          5.7s C:\AdwCleaner\quarantine\registry\reg_axavcmxedldxiilkiillvrwanyxeveot.reg
          5.8s C:\AdwCleaner\quarantine\registry\reg_qpelbrvpudvsmupyfmdeciuikzvtrkdm.reg
          5.9s C:\AdwCleaner\quarantine\registry\reg_euozmtsikepsdsvvrupsphmoonzkksbl.reg
          6.0s C:\AdwCleaner\quarantine\registry\reg_woxfrjvitpoxlkwcwxtxzhhqyhtyktjj.reg
          6.1s C:\AdwCleaner\quarantine\registry\reg_tejlefsulklikeqmjcnzbgtfowbbiadv.reg
          6.2s C:\AdwCleaner\quarantine\registry\reg_oxikgavvhedhdqfrtopmrfocagffhvyc.reg
          6.3s C:\AdwCleaner\quarantine\registry\reg_zepsqdtrguwcoxpeuejpudxrdjtxzshl.reg
          6.4s C:\AdwCleaner\quarantine\registry\reg_rxjdzwzuzuaxxvxvcilighrwrovtpurv.reg
          6.6s C:\AdwCleaner\quarantine\registry\reg_cfwcnjtrdbxwoqlzgaynlzusoiynjeqw.reg
          6.7s C:\AdwCleaner\quarantine\registry\reg_qjmnenobngjrmstzapycwoskngkdjgie.reg
          6.8s C:\AdwCleaner\quarantine\registry\reg_rxmeqtsgesvtuemlnppcxmpbuhhwrrqt.reg
          6.9s C:\AdwCleaner\quarantine\registry\reg_hzmaggvsoybfqwdfybgqoejnoiqnpwti.reg
          7.0s C:\AdwCleaner\quarantine\registry\reg_elyteeazenakdiyohxoqykifhaazcpyb.reg
          7.1s C:\AdwCleaner\quarantine\registry\reg_pizxhhdyzuqsgzfkhrakvjhezrxdxwqi.reg
          7.2s C:\AdwCleaner\quarantine\registry\reg_ohcsalzezvpvqswpofzakeufxelvrdjr.reg
          7.3s C:\AdwCleaner\quarantine\registry\reg_xhdyfsvcxegluencecwzmfcaoqeqocle.reg
          7.4s C:\AdwCleaner\quarantine\registry\reg_kotfeyujqlbepwyspfnkzcsdttniwyeo.reg
          7.6s C:\AdwCleaner\quarantine\registry\reg_tvxakeaozhwbudlzhzqwvuelkrcvesgt.reg
          7.7s C:\AdwCleaner\quarantine\registry\reg_uiifqsddbvoalehvszmzxolqdlxcyjma.reg
          7.8s C:\AdwCleaner\quarantine\registry\reg_gwhwysrmozujknbcpzcywcjggafpmnmz.reg
          7.9s C:\AdwCleaner\quarantine\registry\reg_eyqgqoemjlfztzpckimepufoolnwougv.reg
          8.0s C:\AdwCleaner\quarantine\registry\reg_ilkpsriwxmjyhuhytoqpunxhvlrwqyfd.reg
          8.1s C:\AdwCleaner\quarantine\registry\reg_xysopuknnzghncgyjaijuernmvzpuhpl.reg
          8.2s C:\AdwCleaner\quarantine\registry\reg_hcwfdqjrzdojcrdxtrqfdtjccdynmwda.reg
          8.3s C:\AdwCleaner\quarantine\registry\reg_zcpzjxnddjfdysveefkvhymwtnaflezi.reg
          8.4s C:\AdwCleaner\quarantine\registry\reg_syvxvfiurqsgpizwonsvrjcdeeojxbfq.reg
          8.5s C:\AdwCleaner\quarantine\registry\reg_djxulxhlmndfsqjbgafatqbmzsrsmxmr.reg
          8.6s C:\AdwCleaner\quarantine\registry\reg_cfnbytltgvkibdjpxtrqgvngcebhwslh.reg
          8.7s C:\AdwCleaner\quarantine\registry\reg_nkofheayzhiutqzyatzaekymxfzjttle.reg
          8.9s C:\AdwCleaner\quarantine\registry\reg_ldkxtjqquwkjzehqrbvmvoscpvpkqdws.reg
          9.0s C:\AdwCleaner\quarantine\registry\reg_kvsofvxjmvnmhhzueviwqktvdlnjsmow.reg
          9.1s C:\AdwCleaner\quarantine\registry\reg_zchrwmhrwdiznizxuovyxfodzxfuxxxv.reg
          9.2s C:\AdwCleaner\quarantine\registry\reg_vulvuwcztmtrudxylbqimxnziveuftjm.reg
          9.4s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\4\94\
          9.4s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\4\94\97C23C6884B05782.dat
          9.5s C:\AdwCleaner\quarantine\registry\reg_vnvfokfrzedtxwvadmegpinofrslamyo.reg
          9.5s C:\AdwCleaner\quarantine\registry\reg_ijugsgfnmsynflfzjadrxueviboibhai.reg
          9.6s C:\AdwCleaner\quarantine\registry\reg_kqptwxylblkfarlhwaraskrpvvjpvqnl.reg
          9.7s C:\AdwCleaner\quarantine\registry\reg_qkihgzsxqnscodtgqzwnsdksuawsuojm.reg
          9.8s C:\AdwCleaner\quarantine\registry\reg_nwnmpxkwqdmsfnpkjuknmypqegrdcxuq.reg
          9.9s C:\AdwCleaner\quarantine\registry\reg_wsypwwklzbnyitbobiszvixnarsyqjmm.reg
         10.0s C:\AdwCleaner\quarantine\registry\reg_tdxikfqkjytrmiatuemmvuukfvimwohe.reg
         10.1s C:\AdwCleaner\quarantine\registry\reg_xtknhqyvpqbzyijcapyqbneqptsszbas.reg
         10.2s C:\AdwCleaner\quarantine\registry\reg_jcoadalidppaeesqdwdvucagxqrcyksa.reg
         10.3s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{5A7B5378-1B87-4B49-AAFC-6B39413FD656}
         11.6s C:\AdwCleaner\quarantine\registry\reg_zttjqqlxjjtbgjfmylpgqyvzkqkrrevc.reg
         11.7s C:\AdwCleaner\quarantine\registry\reg_mbagvhgarxmyzlkxfkefkiasbcogdxhm.reg
         11.8s C:\AdwCleaner\quarantine\registry\reg_qdqmvxxscbbqkspowednrjusjdpysswz.reg
         11.9s C:\AdwCleaner\quarantine\registry\reg_swrdvepzcvdalcxcbeqlwmjyesfjnows.reg
         12.0s C:\AdwCleaner\quarantine\registry\reg_lswasuoqokhyzhqgioicflpwkehiqgsm.reg
         12.4s C:\Windows\Prefetch\NETSH.EXE-A596235F.pf
         13.5s C:\Windows\Prefetch\GPSCRIPT.EXE-FB901B09.pf
         15.3s C:\Users\Sergio\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\AC\TokenBroker\Cache\d504c4469d9435771892d902d1746eeb0074f772.tbres
         16.0s C:\Users\Sergio\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\AC\Microsoft\CryptnetUrlCache\Content\1DAF2884EC4DFA96BA4A58D4DBC9C406
         16.5s C:\Users\Sergio\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\AC\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C
         16.9s C:\Users\Sergio\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\AC\Microsoft\CryptnetUrlCache\Content\A053CFB63FC8E6507871752236B5CCD5_F08FA59F86A4C4C8E5A6E225CE714A73
         17.0s C:\Users\Sergio\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\AC\INetCache\VWZC20MO\
         17.0s C:\Users\Sergio\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\AC\INetCache\P2IZNW93\
         17.5s C:\Users\Sergio\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\AC\Microsoft\CryptnetUrlCache\Content\B912B2C6928A18B8CD7D50CF08BEA95B_8F80102BD7C0FE19E85136CCC46E53A7
         17.5s C:\Users\Sergio\AppData\Local\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\AC\Microsoft\CryptnetUrlCache\Content\B912B2C6928A18B8CD7D50CF08BEA95B_3449BF054D431FED5C8F067CDF33D4C8
         17.6s C:\Windows\Prefetch\DLLHOST.EXE-C7F45418.pf
         23.3s C:\Windows\Prefetch\GPUPDATE.EXE-7EBA4B6F.pf
         24.0s C:\AdwCleaner\AdwCleaner[C0].txt
         51.8s C:\Windows\Prefetch\SETTINGSYNCHOST.EXE-0130E42A.pf
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\00\235
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\22\100018
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\21\100017
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\01\213
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\15\294
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\03\208
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\11\1252
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\19\328
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\18\12284
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\17\109001
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\18\109002
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\22\109003
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\02\109004
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\04\109005
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\22\109006
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\05\317
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\10\197
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\01\198
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\05\199
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\11\200
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\09\287
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\10\286
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\18\195
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\15\196
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\05\191
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\00\192
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\17\193
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\12\194
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\19\272
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\04\259
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\21\260
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\15\262
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\01\271
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\10\267
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\19\266
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\02\303
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\19\316
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\22\318
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\13\278
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\20\189
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\01\263
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\04\261
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\07\273
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\22\190
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\11\15040
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\14\9664
         54.6s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\17\300
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\15\288
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\07\290
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\05\341
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\17\345
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\05\334
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\15\321
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\08\322
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\11\291
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\15\292
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\12\12282
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\04\12283
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\01\289
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\10\340
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\21\344
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\07\15010
         54.7s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Mput\MputHistory\14\15039

   C:\WINDOWS\system32\config\systemprofile\AppData\Local\DMR\Sandboxie - CHIP-Installer.exe
      Size . . . . . . . : 1.496.584 bytes
      Age  . . . . . . . : 3.8 days (2017-03-19 01:03:55)
      Entropy  . . . . . : 7.1
      SHA-256  . . . . . : 64C7C953D80CAC88EC5EE790835C15F1A628B885FD8BD386EA86C5FE58B54289
      Needs elevation  . : Yes
      RSA Key Size . . . : 2048
      Authenticode . . . : Valid
    > Kaspersky  . . . . : not-a-virus:HEUR:Downloader.MSIL.DownloadSponsor.gen
      Fuzzy  . . . . . . : 106.0


Suspicious files ____________________________________________________________

   C:\Users\Sergio\Desktop\FRST64.exe
      Size . . . . . . . : 2.424.832 bytes
      Age  . . . . . . . : 3.2 days (2017-03-19 13:51:41)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : 3A3DCD0D3C9C1FE10C45AF795DC9452DA192246BB67D896AB7F16151A53C1B5F
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.
      Forensic Cluster
          0.0s C:\Users\Sergio\Desktop\FRST64.exe
          3.2s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\2\76\82035343A27699B4.dat
          5.3s C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\datareporting\archived\2017-03\1489927907050.bed8fd49-94ba-49c4-9d05-614a790ec23a.main.jsonlz4


Potential Unwanted Programs _________________________________________________

   C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\securityProtection.sqlite (SecurityProtection)
         

FRST

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 15-03-2017
durchgeführt von Sergio (Administrator) auf SERGIOS-PC (23-03-2017 16:10:42)
Gestartet von C:\Users\Sergio\Desktop
Geladene Profile: Sergio (Verfügbare Profile: Sergio & postgres)
Platform: Windows 10 Pro Version 1607 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
(Chip Digital GmbH) C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Tenable Network Security, Inc) C:\Program Files\Tenable\Nessus\nessus-service.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(Tenable Network Security, Inc) C:\Program Files\Tenable\Nessus\nessusd.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Flux Software LLC) C:\Users\Sergio\AppData\Local\FluxSoftware\Flux\flux.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.214.10010.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
() C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8016.42007.0_x64__8wekyb3d8bbwe\HxMail.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8016.42007.0_x64__8wekyb3d8bbwe\HxTsr.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe

==================== Registry (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8492800 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\cnext.exe [4926664 2016-02-26] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2016-09-07] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176440 2017-01-19] (Apple Inc.)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2780112 2017-01-20] (Malwarebytes)
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1160408 2016-12-17] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [Spotify Web Helper] => C:\Users\Sergio\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1446000 2017-03-11] (Spotify Ltd)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [Google Update] => C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\GoogleUpdateCore.exe [601752 2016-12-18] (Google Inc.)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [f.lux] => C:\Users\Sergio\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9364696 2017-03-03] (Piriform Ltd)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [799376 2016-12-14] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\MountPoints2: {b52f257e-9541-11e6-82b3-485b39c9a198} - "K:\HiSuiteDownLoader.exe" 
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [00ExpanDriveExt1] -> {C955792B-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [00ExpanDriveExt2] -> {C955792C-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [00ExpanDriveExt1] -> {C955792B-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [00ExpanDriveExt2] -> {C955792C-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Audible Download Manager.lnk [2015-05-07]
ShortcutTarget: Audible Download Manager.lnk -> C:\Program Files (x86)\Audible\Bin\AudibleDownloadHelper.exe (Keine Datei)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FocalFilterHelper.lnk [2016-02-26]
ShortcutTarget: FocalFilterHelper.lnk -> C:\Program Files (x86)\FocalFilter\FocalFilterHelper.exe (Microsoft)
Startup: C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2015-08-09]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2016-04-20]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{65462354-7EE1-4401-902C-4D58B7DBDA87}: [DhcpNameServer] 7.254.254.254
Tcpip\..\Interfaces\{8c608b9e-9074-4d1b-b1db-702840d39f03}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{aa6288ab-a4c6-4734-8fa6-9d9b694d76cd}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131343881188462559&GUID=D7BDAEA9-5712-40E5-A2B9-98992E8B0FDB
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131343881188468475&GUID=D7BDAEA9-5712-40E5-A2B9-98992E8B0FDB
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_121\bin\ssv.dll [2017-03-18] (Oracle Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-03-18] (Oracle Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2016-10-31] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2016-05-17] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default [2017-03-23]
FF NewTab: Mozilla\Firefox\Profiles\0fihcjle.default -> about:newtab
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\0fihcjle.default -> Google
FF DefaultSearchUrl: Mozilla\Firefox\Profiles\0fihcjle.default -> hxxps://www.google.com/search?bcutc=sp-006
FF SearchEngineOrder.1: Mozilla\Firefox\Profiles\0fihcjle.default -> Google
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\0fihcjle.default -> Google
FF Homepage: Mozilla\Firefox\Profiles\0fihcjle.default -> about:home
FF Keyword.URL: Mozilla\Firefox\Profiles\0fihcjle.default -> hxxps://www.google.com/search?bcutc=sp-006
FF Extension: (BeeLine Reader) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\beelinereader-firefox@beelinereader.com.xpi [2016-03-08]
FF Extension: (FoxyProxy Standard) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\foxyproxy@eric.h.jung [2017-02-07]
FF Extension: (convert2mp3.net YouTube2MP3 Converter) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\info@convert2mp3.net.xpi [2016-12-15]
FF Extension: (pdf updater) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{34840d80-0446-4a42-83ce-5c0fa22cd4e3}.xpi [2016-05-18] [ist nicht signiert]
FF Extension: (NoScript) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2017-03-20]
FF Extension: (LeechBlock) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{a95d8332-e4b4-6e7f-98ac-20b733364387} [2017-03-20]
FF Extension: (Adblock Plus) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-24]
FF Extension: (DownThemAll!) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2017-03-21]
FF SearchPlugin: C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\searchplugins\google-avast.xml [2017-03-18]
FF HKLM\...\Firefox\Extensions: [soda_pdf_desktop_conv@sodapdf.com] - C:\Program Files\Soda PDF Desktop\resources\sodapdfdesktopfirefoxextension => nicht gefunden
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_25_0_0_127.dll [2017-03-18] ()
FF Plugin: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-03-18] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-03-18] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50905.0\npctrl.dll [2017-02-10] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_25_0_0_127.dll [2017-03-18] ()
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-07-19] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50905.0\npctrl.dll [2017-02-10] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2016-12-17] (Adobe Systems Inc.)
FF Plugin-x32: Soda PDF Desktop -> C:\Program Files (x86)\Soda PDF Desktop\np-previewer.dll [Keine Datei]
FF Plugin HKU\S-1-5-21-1478414814-3749218601-3539646535-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-18] (Google Inc.)
FF Plugin HKU\S-1-5-21-1478414814-3749218601-3539646535-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-18] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2016-07-19] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-12-17] (Adobe Systems Inc.)

Chrome: 
=======
CHR DefaultProfile: Default
CHR Profile: C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default [2017-03-21]
CHR Extension: (Google Präsentationen) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-03-26]
CHR Extension: (Google Docs) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-03-26]
CHR Extension: (Google Drive) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-03-11]
CHR Extension: (YouTube) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-03-11]
CHR Extension: (Google-Suche) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-03-11]
CHR Extension: (Google Tabellen) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-03-26]
CHR Extension: (Google Docs Offline) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-21]
CHR Extension: (AMZ Seller Browser) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\klgpelgeohjghmccooegimcfhanlnngc [2016-05-09]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-12]
CHR Extension: (Google Mail) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-01]
CHR Extension: (Chrome Media Router) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-03-11]

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-08-04] (Advanced Micro Devices, Inc.) [Datei ist nicht signiert]
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)
R2 chip1click; C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe [91136 2016-10-27] (Chip Digital GmbH) [Datei ist nicht signiert]
S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4355024 2017-01-20] (Malwarebytes)
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [197776 2016-12-14] (Sandboxie Holdings, LLC)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-09-15] (Microsoft Corporation)
R2 Tenable Nessus; C:\Program Files\Tenable\Nessus\nessus-service.exe [17376 2017-02-15] (Tenable Network Security, Inc)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
S3 Soda PDF Desktop; "C:\Program Files\Soda PDF Desktop\ws.exe" [X]
S3 Soda PDF Desktop CrashHandler; "C:\Program Files\Soda PDF Desktop\crash-handler-ws.exe" [X]
S2 Soda PDF Desktop Creator; "C:\Program Files\Soda PDF Desktop\creator-ws.exe" [X]

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S0 amdkmafd; C:\WINDOWS\System32\drivers\amdkmafd.sys [23240 2016-02-26] (Advanced Micro Devices, Inc.)
R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R3 AtiHDAudioService; C:\WINDOWS\system32\drivers\AtihdWT6.sys [102400 2016-02-26] (Advanced Micro Devices)
S3 HTCAND64; C:\WINDOWS\System32\Drivers\ANDROIDUSB.sys [33736 2009-11-02] (HTC, Corporation) [Datei ist nicht signiert]
S3 HtcVCom32; C:\WINDOWS\system32\DRIVERS\HtcVComV64.sys [121800 2010-03-09] (QUALCOMM Incorporated) [Datei ist nicht signiert]
R3 MTsensor; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [17280 2013-05-17] ()
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [589824 2016-07-16] (Realtek                                            )
S3 RtlWlanu_OldIC; C:\WINDOWS\System32\drivers\rtwlanu_oldIC.sys [3814400 2016-07-16] (Realtek Semiconductor Corporation                           )
S3 rzdaendpt; C:\WINDOWS\System32\drivers\rzdaendpt.sys [33448 2014-09-05] (Razer Inc)
S3 rzvkeyboard; C:\WINDOWS\System32\drivers\rzvkeyboard.sys [31912 2014-09-05] (Razer Inc)
S3 SaiK0728; C:\WINDOWS\system32\DRIVERS\SaiK0728.sys [129024 2008-01-21] (Saitek)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [205968 2016-12-14] (Sandboxie Holdings, LLC)
R1 VBoxNetAdp; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys [131144 2017-01-16] (Oracle Corporation)
R1 VBoxNetLwf; C:\WINDOWS\system32\DRIVERS\VBoxNetLwf.sys [205440 2017-01-16] (Oracle Corporation)
R0 vsock; C:\WINDOWS\System32\drivers\vsock.sys [73296 2013-10-08] (VMware, Inc.)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
U3 DfSdkS; kein ImagePath

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-03-23 16:10 - 2017-03-23 16:11 - 00021494 _____ C:\Users\Sergio\Desktop\FRST.txt
2017-03-23 09:20 - 2017-03-23 09:20 - 00000000 ____D C:\Users\Sergio\AppData\LocalLow\Mozilla
2017-03-23 01:15 - 2017-03-23 01:15 - 00000000 ____D C:\WINDOWS\SysWOW64\GroupPolicyUsers
2017-03-23 01:15 - 2017-03-23 01:15 - 00000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy
2017-03-23 01:15 - 2017-03-23 01:15 - 00000000 ____D C:\WINDOWS\system32\GroupPolicyUsers
2017-03-23 01:15 - 2017-03-23 01:15 - 00000000 ____D C:\WINDOWS\system32\GroupPolicy
2017-03-22 19:49 - 2017-03-22 19:49 - 00000000 ____D C:\Program Files (x86)\ESET
2017-03-22 19:44 - 2017-03-22 19:49 - 00000000 ____D C:\ProgramData\HitmanPro
2017-03-22 19:43 - 2017-03-22 19:44 - 11581544 _____ (SurfRight B.V.) C:\Users\Sergio\Desktop\HitmanPro_x64.exe
2017-03-22 19:25 - 2017-03-22 19:26 - 00001497 _____ C:\Users\Sergio\Desktop\Fixlog.txt
2017-03-21 21:03 - 2017-03-21 21:03 - 00165376 _____ C:\Users\Sergio\Desktop\SystemLook_x64.exe
2017-03-20 22:36 - 2017-03-23 09:35 - 00092088 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2017-03-20 22:36 - 2017-03-23 09:15 - 00251840 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-03-20 22:36 - 2017-03-23 09:15 - 00186304 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMChameleon.sys
2017-03-20 22:36 - 2017-03-23 09:15 - 00111544 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2017-03-20 22:36 - 2017-03-23 09:15 - 00043968 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2017-03-20 22:36 - 2017-03-20 22:36 - 00001912 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-03-20 22:36 - 2017-03-20 22:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-03-20 22:36 - 2017-03-20 22:36 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-03-20 22:36 - 2017-03-20 22:36 - 00000000 ____D C:\Program Files\Malwarebytes
2017-03-20 22:36 - 2017-02-24 06:23 - 00077408 _____ C:\WINDOWS\system32\Drivers\mbae64.sys
2017-03-20 22:33 - 2017-03-23 09:15 - 00346096 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-03-20 22:28 - 2017-03-20 22:32 - 00000000 ____D C:\AdwCleaner
2017-03-20 22:27 - 2017-03-20 22:28 - 04031440 _____ C:\Users\Sergio\Desktop\AdwCleaner_6.044.exe
2017-03-19 13:44 - 2017-03-19 13:49 - 00082710 _____ C:\TDSSKiller.3.1.0.12_19.03.2017_13.44.46_log.txt
2017-03-19 13:44 - 2017-03-19 13:44 - 04747704 _____ (AO Kaspersky Lab) C:\Users\Sergio\Desktop\tdsskiller.exe
2017-03-19 11:34 - 2017-03-19 11:34 - 00000085 _____ C:\WINDOWS\wininit.ini
2017-03-19 11:34 - 2017-03-19 11:34 - 00000000 ____D C:\WINDOWS\System32\Tasks\Safer-Networking
2017-03-19 02:00 - 2017-03-19 02:00 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\QuickScan
2017-03-19 01:43 - 2017-03-23 16:10 - 00000000 ____D C:\FRST
2017-03-19 01:42 - 2017-03-19 01:42 - 02424832 _____ (Farbar) C:\Users\Sergio\Desktop\FRST64.exe
2017-03-19 01:12 - 2017-03-19 01:12 - 00000000 ____D C:\Users\Sergio\AppData\Local\AdAwareDesktop
2017-03-19 01:10 - 2017-03-19 01:10 - 00000000 ____D C:\Users\Sergio\AppData\Local\AdAwareUpdater
2017-03-19 01:10 - 2017-03-19 01:10 - 00000000 ____D C:\Program Files\Common Files\adaware
2017-03-19 01:07 - 2017-03-20 22:33 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2017-03-19 01:07 - 2017-03-19 11:34 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2017-03-19 01:05 - 2017-03-20 22:34 - 00001748 _____ C:\WINDOWS\Sandboxie.ini
2017-03-19 01:05 - 2017-03-19 01:04 - 00000955 _____ C:\Users\Sergio\Desktop\Sandboxed Web Browser.lnk
2017-03-19 01:04 - 2017-03-19 01:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2017-03-19 01:04 - 2017-03-19 01:04 - 00000000 ____D C:\Program Files\Sandboxie
2017-03-19 01:02 - 2017-03-19 01:02 - 00000000 ___HD C:\$SysReset
2017-03-19 01:02 - 2017-03-19 01:02 - 00000000 ____D C:\WINDOWS\Panther
2017-03-19 00:06 - 2017-03-19 00:06 - 00217088 _____ C:\Users\postgres\NTUSER.rhk
2017-03-19 00:03 - 2017-03-19 00:03 - 00015836 _____ C:\Users\Sergio\Documents\cc_20170319_000336.reg
2017-03-18 23:51 - 2017-03-18 23:51 - 00001822 _____ C:\Users\Public\Desktop\iTunes.lnk
2017-03-18 23:51 - 2017-03-18 23:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2017-03-18 23:50 - 2017-03-18 23:51 - 00000000 ____D C:\Program Files\iTunes
2017-03-18 23:50 - 2017-03-18 23:50 - 00000000 ____D C:\Program Files\iPod
2017-03-18 23:49 - 2017-03-18 23:49 - 00000000 ____D C:\Program Files\Bonjour
2017-03-18 23:49 - 2017-03-18 23:49 - 00000000 ____D C:\Program Files (x86)\Bonjour
2017-03-18 23:41 - 2017-03-18 23:41 - 00000000 ____D C:\WINDOWS\System32\Tasks\AVAST Software
2017-03-18 23:39 - 2017-03-20 22:33 - 00000000 ____D C:\ProgramData\AVAST Software
2017-03-18 23:01 - 2017-03-19 00:06 - 04333568 _____ C:\Users\Sergio\NTUSER.rhk
2017-03-18 22:57 - 2017-03-18 22:57 - 00763016 _____ C:\Users\Sergio\Documents\cc_20170318_225706.reg
2017-03-18 22:55 - 2017-03-20 22:45 - 00000000 ____D C:\ProgramData\Ashampoo
2017-03-18 22:55 - 2017-03-18 22:55 - 00001329 _____ C:\Users\Public\Desktop\Ashampoo WinOptimizer 2017.lnk
2017-03-18 22:55 - 2017-03-18 22:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
2017-03-18 22:55 - 2017-03-18 22:55 - 00000000 ____D C:\Program Files (x86)\Ashampoo
2017-03-18 22:55 - 2009-08-24 21:13 - 00034304 _____ (mst software GmbH, Germany) C:\WINDOWS\system32\DfSdkBt.exe
2017-03-18 22:53 - 2017-03-18 22:53 - 00000000 ____D C:\Program Files (x86)\Chip Digital GmbH
2017-03-18 22:48 - 2017-03-18 22:48 - 00002862 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2017-03-18 22:48 - 2017-03-18 22:48 - 00000863 _____ C:\Users\Public\Desktop\CCleaner.lnk
2017-03-18 22:48 - 2017-03-18 22:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2017-03-18 22:48 - 2017-03-18 22:48 - 00000000 ____D C:\Program Files\CCleaner
2017-03-18 22:25 - 2016-06-05 07:42 - 00000000 ____D C:\Users\Sergio\Desktop\Python 3 - Intensivkurs  Projekte erfolgreich realisieren By Mark Pilgrim
2017-03-18 21:48 - 2016-09-01 12:09 - 00000000 ____D C:\Users\Sergio\Desktop\Yael Adler - Haut nah. Alles über unser größtes Organ inkl. pdf
2017-03-18 21:47 - 2016-10-17 16:46 - 00000000 ____D C:\Users\Sergio\Desktop\Nadja Hermann - Fettlogik überwinden
2017-03-18 01:04 - 2017-03-17 21:06 - 00000000 ____D C:\Users\Sergio\Desktop\Gunter Dueck - Flachsinn_ Ich habe Hirn, ich will hier raus
2017-03-16 21:27 - 2016-11-24 02:24 - 00000000 ____D C:\Users\Sergio\Desktop\Haiyti - Nightliner (2016)
2017-03-13 20:44 - 2017-03-13 20:44 - 14966655 _____ C:\Users\Sergio\Desktop\3662536676.psychologie.der.maerchen.2017.by.www.lul.to.pdf
2017-03-12 12:29 - 2017-03-12 12:26 - 00074345 ____N C:\Users\Sergio\Desktop\11057856.pdf
2017-03-11 11:55 - 2017-03-11 11:55 - 00000000 ____D C:\Users\Sergio\AppData\Local\TeamSpeak 3
2017-03-11 11:55 - 2017-03-11 11:55 - 00000000 ____D C:\Users\Sergio\.TeamSpeak 3
2017-03-10 22:56 - 2017-03-10 22:56 - 00000000 ____D C:\Users\Sergio\PycharmProjects
2017-03-10 22:55 - 2017-03-10 22:55 - 00001078 _____ C:\Users\Sergio\Desktop\JetBrains PyCharm Community Edition 2016.3.2.lnk
2017-03-10 22:55 - 2017-03-10 22:55 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\JetBrains
2017-03-10 22:55 - 2017-03-10 22:55 - 00000000 ____D C:\Users\Sergio\.PyCharmCE2016.3
2017-03-10 22:54 - 2017-03-10 22:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JetBrains
2017-03-10 22:54 - 2017-03-10 22:54 - 00000000 ____D C:\Program Files (x86)\JetBrains
2017-03-09 16:03 - 2017-03-09 16:03 - 00002713 _____ C:\Users\Sergio\Desktop\IDLE (Python 3.6 64-bit).lnk
2017-03-09 16:03 - 2017-03-09 16:03 - 00001520 _____ C:\Users\Sergio\Desktop\Python 3.6 (64-bit).lnk
2017-03-09 15:59 - 2017-03-09 15:59 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Python 3.6
2017-03-09 15:59 - 2017-03-09 15:59 - 00000000 ____D C:\Users\Sergio\AppData\Local\Package Cache
2017-03-08 16:00 - 2017-03-08 16:00 - 06744873 ____R C:\Users\Sergio\Desktop\3658108576.ich.glaube.es.hackt.2016.4.auflage.by.www.lul.to.pdf
2017-03-06 19:08 - 2017-03-06 19:08 - 00004296 _____ C:\WINDOWS\System32\Tasks\AMD Updater
2017-03-06 19:07 - 2017-03-06 19:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Radeon Settings
2017-03-06 18:50 - 2017-03-06 18:50 - 00000000 ____D C:\Users\Sergio\.Plays.tv
2017-03-05 18:37 - 2017-01-01 17:08 - 00000000 ____D C:\Users\Sergio\Desktop\Tory Lanez - Chixtape 4 (DatPiff.com)
2017-03-05 18:27 - 2017-03-05 18:27 - 00000000 ____D C:\ProgramData\GeoComply
2017-03-04 21:04 - 2017-03-04 21:06 - 00000000 ____D C:\Users\Sergio\VirtualBox VMs
2017-03-04 20:55 - 2017-03-05 14:02 - 00000000 ____D C:\Users\Sergio\.VirtualBox
2017-03-04 20:55 - 2017-03-04 20:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2017-03-04 20:55 - 2017-03-04 20:55 - 00000000 ____D C:\Program Files\Oracle
2017-03-04 20:55 - 2017-01-16 17:38 - 00959720 _____ (Oracle Corporation) C:\WINDOWS\system32\Drivers\VBoxDrv.sys
2017-03-04 20:55 - 2017-01-16 17:38 - 00149304 _____ (Oracle Corporation) C:\WINDOWS\system32\Drivers\VBoxUSBMon.sys
2017-03-01 23:49 - 2017-03-23 09:15 - 00001024 _____ C:\.rnd
2017-03-01 23:49 - 2017-03-01 23:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tenable Network Security
2017-03-01 23:48 - 2017-03-01 23:48 - 00000000 ____D C:\ProgramData\Tenable
2017-03-01 23:48 - 2017-03-01 23:48 - 00000000 ____D C:\Program Files\Tenable
2017-02-28 21:46 - 2017-03-05 11:48 - 00000000 ____D C:\Users\Sergio\Desktop\Ethic Hacking
2017-02-28 21:33 - 2017-02-28 21:33 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\.maltego
2017-02-28 21:33 - 2017-02-28 21:33 - 00000000 ____D C:\ProgramData\Paterva
2017-02-28 21:33 - 2017-02-28 21:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paterva
2017-02-28 21:32 - 2017-02-28 21:32 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Sun
2017-02-28 21:32 - 2017-02-28 21:32 - 00000000 ____D C:\Program Files (x86)\Paterva
2017-02-28 21:31 - 2017-03-18 23:51 - 00110144 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll
2017-02-28 21:31 - 2017-03-18 23:51 - 00000000 ____D C:\Program Files\Java
2017-02-27 22:16 - 2015-06-24 14:30 - 00064728 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vmx86.sys
2017-02-27 22:16 - 2013-10-08 18:21 - 00073296 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vsock.sys
2017-02-27 22:16 - 2013-10-08 18:21 - 00067664 _____ (VMware, Inc.) C:\WINDOWS\system32\vsocklib.dll
2017-02-27 22:16 - 2013-10-08 18:21 - 00063568 _____ (VMware, Inc.) C:\WINDOWS\SysWOW64\vsocklib.dll
2017-02-27 22:15 - 2015-06-24 14:30 - 00437976 _____ (VMware, Inc.) C:\WINDOWS\SysWOW64\vmnat.exe
2017-02-27 22:15 - 2015-06-24 14:30 - 00359128 _____ (VMware, Inc.) C:\WINDOWS\SysWOW64\vmnetdhcp.exe
2017-02-27 22:15 - 2015-06-24 14:27 - 00031448 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vmnetuserif.sys
2017-02-27 22:14 - 2017-02-27 22:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware
2017-02-27 22:14 - 2017-02-27 22:14 - 00000000 ____D C:\Program Files\Common Files\VMware
2017-02-27 22:14 - 2017-02-27 22:14 - 00000000 ____D C:\Program Files (x86)\VMware
2017-02-27 22:14 - 2015-06-24 14:27 - 00931032 _____ (VMware, Inc.) C:\WINDOWS\system32\vnetlib64.dll
2017-02-27 22:14 - 2014-08-21 08:07 - 00054976 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\hcmon.sys
2017-02-27 22:14 - 2014-08-21 08:06 - 00058048 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vmusb.sys
2017-02-27 22:11 - 2017-02-27 22:42 - 00000000 ____D C:\Users\Sergio\Documents\Virtual Machines
2017-02-27 19:48 - 2017-02-27 19:48 - 00000000 ____D C:\Users\Sergio\.idlerc

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-03-23 16:08 - 2016-09-29 20:02 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-03-23 13:28 - 2016-07-16 12:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-03-23 09:25 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-03-23 09:22 - 2016-07-16 23:51 - 01126950 _____ C:\WINDOWS\system32\perfh007.dat
2017-03-23 09:22 - 2016-07-16 23:51 - 00270638 _____ C:\WINDOWS\system32\perfc007.dat
2017-03-23 09:22 - 2015-08-09 20:57 - 02644890 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-03-23 09:20 - 2016-09-29 20:05 - 00000000 ____D C:\Users\Sergio
2017-03-23 09:20 - 2015-06-02 19:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-03-23 09:20 - 2014-10-31 14:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-03-23 09:20 - 2014-10-25 23:53 - 00000000 ____D C:\Users\Sergio\AppData\Local\VirtualStore
2017-03-23 09:15 - 2016-09-29 20:14 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-03-23 09:15 - 2016-07-16 12:45 - 00000000 ____D C:\WINDOWS\INF
2017-03-23 09:15 - 2014-10-27 17:10 - 00000000 ____D C:\ProgramData\VMware
2017-03-23 09:10 - 2016-07-16 07:04 - 00786432 _____ C:\WINDOWS\system32\config\BBI
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ___SD C:\WINDOWS\system32\F12
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ___RD C:\WINDOWS\PrintDialog
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ___RD C:\Program Files\Windows Defender
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\SysWOW64\setup
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\setup
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\oobe
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\appraiser
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\ShellExperiences
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\PolicyDefinitions
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\bcastdvr
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2017-03-22 19:50 - 2016-07-16 12:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-03-20 22:33 - 2015-04-16 15:08 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2017-03-20 22:33 - 2015-04-16 15:08 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2017-03-20 22:33 - 2014-10-26 12:23 - 00000000 ____D C:\Program Files\WinRAR
2017-03-20 22:32 - 2016-09-29 20:16 - 00000008 __RSH C:\Users\Sergio\ntuser.pol
2017-03-19 11:34 - 2016-07-16 07:04 - 00032768 _____ C:\WINDOWS\system32\config\ELAM
2017-03-19 03:10 - 2016-10-04 16:41 - 00000000 ____D C:\Program Files (x86)\SpeedFan
2017-03-19 00:06 - 2016-09-29 20:05 - 00000000 ____D C:\Users\postgres
2017-03-18 23:52 - 2016-09-29 20:14 - 00004440 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2017-03-18 23:52 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2017-03-18 23:52 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\Macromed
2017-03-18 23:52 - 2014-10-27 17:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-03-18 23:52 - 2014-10-26 12:23 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-03-18 23:52 - 2014-10-26 12:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-03-18 23:51 - 2014-10-26 12:41 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2017-03-18 23:50 - 2015-05-06 18:27 - 00000000 ____D C:\Program Files\Common Files\Apple
2017-03-18 23:49 - 2014-10-26 00:07 - 00001151 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-03-18 23:02 - 2015-03-10 17:03 - 00000000 ____D C:\Users\Sergio\AppData\LocalLow\Temp
2017-03-18 22:59 - 2014-10-26 12:50 - 00000000 ____D C:\Users\Sergio\AppData\Local\JDownloader v2.0
2017-03-18 22:55 - 2016-09-23 20:37 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\TS3Client
2017-03-18 22:55 - 2014-11-05 17:58 - 00000000 ____D C:\Program Files (x86)\Steam
2017-03-18 22:50 - 2014-10-26 10:16 - 00000000 ____D C:\Users\Sergio\AppData\Local\Razer
2017-03-18 22:50 - 2014-10-26 00:15 - 00000000 ____D C:\ProgramData\Razer
2017-03-18 22:50 - 2014-10-26 00:15 - 00000000 ____D C:\Program Files (x86)\Razer
2017-03-18 21:23 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2017-03-18 00:59 - 2014-10-27 09:42 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\vlc
2017-03-18 00:21 - 2014-10-29 14:39 - 00000000 ____D C:\WINDOWS\system32\MRT
2017-03-18 00:19 - 2015-04-16 15:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2017-03-18 00:19 - 2014-10-29 14:39 - 138634176 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-03-18 00:18 - 2014-10-26 12:31 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2017-03-18 00:15 - 2016-11-05 15:37 - 00000000 ____D C:\Users\Sergio\AppData\Local\ElevatedDiagnostics
2017-03-16 21:23 - 2013-08-22 14:25 - 00000167 _____ C:\WINDOWS\win.ini
2017-03-14 19:22 - 2014-12-23 17:29 - 00000000 ____D C:\Users\Sergio\AppData\Local\Spotify
2017-03-13 20:27 - 2014-10-27 17:14 - 00000000 ____D C:\Users\Sergio\AppData\Local\VMware
2017-03-13 19:32 - 2014-12-23 17:28 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Spotify
2017-03-13 19:07 - 2014-10-27 17:14 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\VMware
2017-03-11 14:19 - 2016-10-23 19:11 - 00000000 ____D C:\Users\Sergio\Documents\Soda PDF Files
2017-03-11 14:19 - 2016-10-23 19:11 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Soda PDF Desktop
2017-03-11 12:13 - 2014-12-13 14:35 - 00000000 ____D C:\Users\Sergio\AppData\Local\PokerStars.EU
2017-03-11 12:12 - 2014-12-13 14:34 - 00000000 ____D C:\Program Files (x86)\PokerStars.EU
2017-03-11 11:55 - 2016-09-23 20:37 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2017-03-10 06:17 - 2016-07-16 12:49 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-03-10 06:17 - 2016-07-16 12:49 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-03-06 19:07 - 2016-09-29 20:03 - 00000000 ____D C:\Program Files\AMD
2017-03-06 19:07 - 2015-05-19 18:55 - 00000000 ____D C:\Program Files (x86)\AMD
2017-03-06 19:07 - 2014-10-26 00:19 - 00000000 ____D C:\Users\Sergio\AppData\Local\AMD
2017-03-06 19:04 - 2014-10-26 00:14 - 00000000 ____D C:\AMD
2017-03-06 18:50 - 2016-09-29 20:03 - 00000000 ____D C:\ProgramData\Package Cache
2017-03-06 18:49 - 2016-09-29 20:03 - 00000000 ____D C:\ProgramData\AMD
2017-03-04 23:55 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\NDF
2017-02-28 21:32 - 2016-02-14 18:43 - 00000000 ____D C:\Users\Sergio\.oracle_jre_usage
2017-02-27 22:14 - 2014-10-27 17:10 - 02053002 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2017-02-25 11:31 - 2014-10-25 23:53 - 00000000 ____D C:\Users\Sergio\AppData\Local\Packages

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2015-07-20 16:32 - 2015-07-20 16:32 - 0923401 _____ () C:\Program Files (x86)\WinDlg_124.zip
2015-07-12 10:02 - 2015-07-12 10:02 - 0000000 ___SH () C:\Users\Sergio\AppData\Local\LumaEmu
2016-07-03 18:51 - 2016-07-03 18:51 - 0000733 _____ () C:\Users\Sergio\AppData\Local\recently-used.xbel
2016-09-29 20:03 - 2016-09-29 20:03 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap ======================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert

LastRegBack: 2017-03-18 21:07

==================== Ende von FRST.txt ============================
         

Addition

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 15-03-2017
durchgeführt von Sergio (Administrator) auf SERGIOS-PC (23-03-2017 16:10:42)
Gestartet von C:\Users\Sergio\Desktop
Geladene Profile: Sergio (Verfügbare Profile: Sergio & postgres)
Platform: Windows 10 Pro Version 1607 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
(Chip Digital GmbH) C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Tenable Network Security, Inc) C:\Program Files\Tenable\Nessus\nessus-service.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(Tenable Network Security, Inc) C:\Program Files\Tenable\Nessus\nessusd.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.12.112.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Flux Software LLC) C:\Users\Sergio\AppData\Local\FluxSoftware\Flux\flux.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_17.214.10010.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
() C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8016.42007.0_x64__8wekyb3d8bbwe\HxMail.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8016.42007.0_x64__8wekyb3d8bbwe\HxTsr.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe

==================== Registry (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8492800 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\cnext.exe [4926664 2016-02-26] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2016-09-07] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176440 2017-01-19] (Apple Inc.)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2780112 2017-01-20] (Malwarebytes)
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1160408 2016-12-17] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [Spotify Web Helper] => C:\Users\Sergio\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1446000 2017-03-11] (Spotify Ltd)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [Google Update] => C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\GoogleUpdateCore.exe [601752 2016-12-18] (Google Inc.)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [f.lux] => C:\Users\Sergio\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9364696 2017-03-03] (Piriform Ltd)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [799376 2016-12-14] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\...\MountPoints2: {b52f257e-9541-11e6-82b3-485b39c9a198} - "K:\HiSuiteDownLoader.exe" 
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [00ExpanDriveExt1] -> {C955792B-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [00ExpanDriveExt2] -> {C955792C-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [00ExpanDriveExt1] -> {C955792B-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [00ExpanDriveExt2] -> {C955792C-31A0-4791-9DDE-0A9A57411C16} =>  -> Keine Datei
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Audible Download Manager.lnk [2015-05-07]
ShortcutTarget: Audible Download Manager.lnk -> C:\Program Files (x86)\Audible\Bin\AudibleDownloadHelper.exe (Keine Datei)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FocalFilterHelper.lnk [2016-02-26]
ShortcutTarget: FocalFilterHelper.lnk -> C:\Program Files (x86)\FocalFilter\FocalFilterHelper.exe (Microsoft)
Startup: C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2015-08-09]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2016-04-20]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{65462354-7EE1-4401-902C-4D58B7DBDA87}: [DhcpNameServer] 7.254.254.254
Tcpip\..\Interfaces\{8c608b9e-9074-4d1b-b1db-702840d39f03}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{aa6288ab-a4c6-4734-8fa6-9d9b694d76cd}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131343881188462559&GUID=D7BDAEA9-5712-40E5-A2B9-98992E8B0FDB
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131343881188468475&GUID=D7BDAEA9-5712-40E5-A2B9-98992E8B0FDB
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-1478414814-3749218601-3539646535-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\S-1-5-21-1478414814-3749218601-3539646535-1001 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_121\bin\ssv.dll [2017-03-18] (Oracle Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-03-18] (Oracle Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2016-12-13] (Microsoft Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2016-10-31] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2016-05-17] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default [2017-03-23]
FF NewTab: Mozilla\Firefox\Profiles\0fihcjle.default -> about:newtab
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\0fihcjle.default -> Google
FF DefaultSearchUrl: Mozilla\Firefox\Profiles\0fihcjle.default -> hxxps://www.google.com/search?bcutc=sp-006
FF SearchEngineOrder.1: Mozilla\Firefox\Profiles\0fihcjle.default -> Google
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\0fihcjle.default -> Google
FF Homepage: Mozilla\Firefox\Profiles\0fihcjle.default -> about:home
FF Keyword.URL: Mozilla\Firefox\Profiles\0fihcjle.default -> hxxps://www.google.com/search?bcutc=sp-006
FF Extension: (BeeLine Reader) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\beelinereader-firefox@beelinereader.com.xpi [2016-03-08]
FF Extension: (FoxyProxy Standard) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\foxyproxy@eric.h.jung [2017-02-07]
FF Extension: (convert2mp3.net YouTube2MP3 Converter) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\info@convert2mp3.net.xpi [2016-12-15]
FF Extension: (pdf updater) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{34840d80-0446-4a42-83ce-5c0fa22cd4e3}.xpi [2016-05-18] [ist nicht signiert]
FF Extension: (NoScript) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2017-03-20]
FF Extension: (LeechBlock) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{a95d8332-e4b4-6e7f-98ac-20b733364387} [2017-03-20]
FF Extension: (Adblock Plus) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-24]
FF Extension: (DownThemAll!) - C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2017-03-21]
FF SearchPlugin: C:\Users\Sergio\AppData\Roaming\Mozilla\Firefox\Profiles\0fihcjle.default\searchplugins\google-avast.xml [2017-03-18]
FF HKLM\...\Firefox\Extensions: [soda_pdf_desktop_conv@sodapdf.com] - C:\Program Files\Soda PDF Desktop\resources\sodapdfdesktopfirefoxextension => nicht gefunden
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_25_0_0_127.dll [2017-03-18] ()
FF Plugin: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-03-18] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-03-18] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50905.0\npctrl.dll [2017-02-10] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_25_0_0_127.dll [2017-03-18] ()
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-07-19] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50905.0\npctrl.dll [2017-02-10] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2016-12-17] (Adobe Systems Inc.)
FF Plugin-x32: Soda PDF Desktop -> C:\Program Files (x86)\Soda PDF Desktop\np-previewer.dll [Keine Datei]
FF Plugin HKU\S-1-5-21-1478414814-3749218601-3539646535-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-18] (Google Inc.)
FF Plugin HKU\S-1-5-21-1478414814-3749218601-3539646535-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Sergio\AppData\Local\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-18] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2016-07-19] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-12-17] (Adobe Systems Inc.)

Chrome: 
=======
CHR DefaultProfile: Default
CHR Profile: C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default [2017-03-21]
CHR Extension: (Google Präsentationen) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-03-26]
CHR Extension: (Google Docs) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-03-26]
CHR Extension: (Google Drive) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-03-11]
CHR Extension: (YouTube) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-03-11]
CHR Extension: (Google-Suche) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-03-11]
CHR Extension: (Google Tabellen) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-03-26]
CHR Extension: (Google Docs Offline) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-21]
CHR Extension: (AMZ Seller Browser) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\klgpelgeohjghmccooegimcfhanlnngc [2016-05-09]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-12]
CHR Extension: (Google Mail) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-01]
CHR Extension: (Chrome Media Router) - C:\Users\Sergio\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-03-11]

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-08-04] (Advanced Micro Devices, Inc.) [Datei ist nicht signiert]
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)
R2 chip1click; C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe [91136 2016-10-27] (Chip Digital GmbH) [Datei ist nicht signiert]
S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4355024 2017-01-20] (Malwarebytes)
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [197776 2016-12-14] (Sandboxie Holdings, LLC)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-09-15] (Microsoft Corporation)
R2 Tenable Nessus; C:\Program Files\Tenable\Nessus\nessus-service.exe [17376 2017-02-15] (Tenable Network Security, Inc)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
S3 Soda PDF Desktop; "C:\Program Files\Soda PDF Desktop\ws.exe" [X]
S3 Soda PDF Desktop CrashHandler; "C:\Program Files\Soda PDF Desktop\crash-handler-ws.exe" [X]
S2 Soda PDF Desktop Creator; "C:\Program Files\Soda PDF Desktop\creator-ws.exe" [X]

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S0 amdkmafd; C:\WINDOWS\System32\drivers\amdkmafd.sys [23240 2016-02-26] (Advanced Micro Devices, Inc.)
R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R3 AtiHDAudioService; C:\WINDOWS\system32\drivers\AtihdWT6.sys [102400 2016-02-26] (Advanced Micro Devices)
S3 HTCAND64; C:\WINDOWS\System32\Drivers\ANDROIDUSB.sys [33736 2009-11-02] (HTC, Corporation) [Datei ist nicht signiert]
S3 HtcVCom32; C:\WINDOWS\system32\DRIVERS\HtcVComV64.sys [121800 2010-03-09] (QUALCOMM Incorporated) [Datei ist nicht signiert]
R3 MTsensor; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [17280 2013-05-17] ()
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [589824 2016-07-16] (Realtek                                            )
S3 RtlWlanu_OldIC; C:\WINDOWS\System32\drivers\rtwlanu_oldIC.sys [3814400 2016-07-16] (Realtek Semiconductor Corporation                           )
S3 rzdaendpt; C:\WINDOWS\System32\drivers\rzdaendpt.sys [33448 2014-09-05] (Razer Inc)
S3 rzvkeyboard; C:\WINDOWS\System32\drivers\rzvkeyboard.sys [31912 2014-09-05] (Razer Inc)
S3 SaiK0728; C:\WINDOWS\system32\DRIVERS\SaiK0728.sys [129024 2008-01-21] (Saitek)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [205968 2016-12-14] (Sandboxie Holdings, LLC)
R1 VBoxNetAdp; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys [131144 2017-01-16] (Oracle Corporation)
R1 VBoxNetLwf; C:\WINDOWS\system32\DRIVERS\VBoxNetLwf.sys [205440 2017-01-16] (Oracle Corporation)
R0 vsock; C:\WINDOWS\System32\drivers\vsock.sys [73296 2013-10-08] (VMware, Inc.)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
U3 DfSdkS; kein ImagePath

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-03-23 16:10 - 2017-03-23 16:11 - 00021494 _____ C:\Users\Sergio\Desktop\FRST.txt
2017-03-23 09:20 - 2017-03-23 09:20 - 00000000 ____D C:\Users\Sergio\AppData\LocalLow\Mozilla
2017-03-23 01:15 - 2017-03-23 01:15 - 00000000 ____D C:\WINDOWS\SysWOW64\GroupPolicyUsers
2017-03-23 01:15 - 2017-03-23 01:15 - 00000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy
2017-03-23 01:15 - 2017-03-23 01:15 - 00000000 ____D C:\WINDOWS\system32\GroupPolicyUsers
2017-03-23 01:15 - 2017-03-23 01:15 - 00000000 ____D C:\WINDOWS\system32\GroupPolicy
2017-03-22 19:49 - 2017-03-22 19:49 - 00000000 ____D C:\Program Files (x86)\ESET
2017-03-22 19:44 - 2017-03-22 19:49 - 00000000 ____D C:\ProgramData\HitmanPro
2017-03-22 19:43 - 2017-03-22 19:44 - 11581544 _____ (SurfRight B.V.) C:\Users\Sergio\Desktop\HitmanPro_x64.exe
2017-03-22 19:25 - 2017-03-22 19:26 - 00001497 _____ C:\Users\Sergio\Desktop\Fixlog.txt
2017-03-21 21:03 - 2017-03-21 21:03 - 00165376 _____ C:\Users\Sergio\Desktop\SystemLook_x64.exe
2017-03-20 22:36 - 2017-03-23 09:35 - 00092088 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2017-03-20 22:36 - 2017-03-23 09:15 - 00251840 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-03-20 22:36 - 2017-03-23 09:15 - 00186304 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMChameleon.sys
2017-03-20 22:36 - 2017-03-23 09:15 - 00111544 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2017-03-20 22:36 - 2017-03-23 09:15 - 00043968 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2017-03-20 22:36 - 2017-03-20 22:36 - 00001912 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-03-20 22:36 - 2017-03-20 22:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-03-20 22:36 - 2017-03-20 22:36 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-03-20 22:36 - 2017-03-20 22:36 - 00000000 ____D C:\Program Files\Malwarebytes
2017-03-20 22:36 - 2017-02-24 06:23 - 00077408 _____ C:\WINDOWS\system32\Drivers\mbae64.sys
2017-03-20 22:33 - 2017-03-23 09:15 - 00346096 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-03-20 22:28 - 2017-03-20 22:32 - 00000000 ____D C:\AdwCleaner
2017-03-20 22:27 - 2017-03-20 22:28 - 04031440 _____ C:\Users\Sergio\Desktop\AdwCleaner_6.044.exe
2017-03-19 13:44 - 2017-03-19 13:49 - 00082710 _____ C:\TDSSKiller.3.1.0.12_19.03.2017_13.44.46_log.txt
2017-03-19 13:44 - 2017-03-19 13:44 - 04747704 _____ (AO Kaspersky Lab) C:\Users\Sergio\Desktop\tdsskiller.exe
2017-03-19 11:34 - 2017-03-19 11:34 - 00000085 _____ C:\WINDOWS\wininit.ini
2017-03-19 11:34 - 2017-03-19 11:34 - 00000000 ____D C:\WINDOWS\System32\Tasks\Safer-Networking
2017-03-19 02:00 - 2017-03-19 02:00 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\QuickScan
2017-03-19 01:43 - 2017-03-23 16:10 - 00000000 ____D C:\FRST
2017-03-19 01:42 - 2017-03-19 01:42 - 02424832 _____ (Farbar) C:\Users\Sergio\Desktop\FRST64.exe
2017-03-19 01:12 - 2017-03-19 01:12 - 00000000 ____D C:\Users\Sergio\AppData\Local\AdAwareDesktop
2017-03-19 01:10 - 2017-03-19 01:10 - 00000000 ____D C:\Users\Sergio\AppData\Local\AdAwareUpdater
2017-03-19 01:10 - 2017-03-19 01:10 - 00000000 ____D C:\Program Files\Common Files\adaware
2017-03-19 01:07 - 2017-03-20 22:33 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2017-03-19 01:07 - 2017-03-19 11:34 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2017-03-19 01:05 - 2017-03-20 22:34 - 00001748 _____ C:\WINDOWS\Sandboxie.ini
2017-03-19 01:05 - 2017-03-19 01:04 - 00000955 _____ C:\Users\Sergio\Desktop\Sandboxed Web Browser.lnk
2017-03-19 01:04 - 2017-03-19 01:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2017-03-19 01:04 - 2017-03-19 01:04 - 00000000 ____D C:\Program Files\Sandboxie
2017-03-19 01:02 - 2017-03-19 01:02 - 00000000 ___HD C:\$SysReset
2017-03-19 01:02 - 2017-03-19 01:02 - 00000000 ____D C:\WINDOWS\Panther
2017-03-19 00:06 - 2017-03-19 00:06 - 00217088 _____ C:\Users\postgres\NTUSER.rhk
2017-03-19 00:03 - 2017-03-19 00:03 - 00015836 _____ C:\Users\Sergio\Documents\cc_20170319_000336.reg
2017-03-18 23:51 - 2017-03-18 23:51 - 00001822 _____ C:\Users\Public\Desktop\iTunes.lnk
2017-03-18 23:51 - 2017-03-18 23:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2017-03-18 23:50 - 2017-03-18 23:51 - 00000000 ____D C:\Program Files\iTunes
2017-03-18 23:50 - 2017-03-18 23:50 - 00000000 ____D C:\Program Files\iPod
2017-03-18 23:49 - 2017-03-18 23:49 - 00000000 ____D C:\Program Files\Bonjour
2017-03-18 23:49 - 2017-03-18 23:49 - 00000000 ____D C:\Program Files (x86)\Bonjour
2017-03-18 23:41 - 2017-03-18 23:41 - 00000000 ____D C:\WINDOWS\System32\Tasks\AVAST Software
2017-03-18 23:39 - 2017-03-20 22:33 - 00000000 ____D C:\ProgramData\AVAST Software
2017-03-18 23:01 - 2017-03-19 00:06 - 04333568 _____ C:\Users\Sergio\NTUSER.rhk
2017-03-18 22:57 - 2017-03-18 22:57 - 00763016 _____ C:\Users\Sergio\Documents\cc_20170318_225706.reg
2017-03-18 22:55 - 2017-03-20 22:45 - 00000000 ____D C:\ProgramData\Ashampoo
2017-03-18 22:55 - 2017-03-18 22:55 - 00001329 _____ C:\Users\Public\Desktop\Ashampoo WinOptimizer 2017.lnk
2017-03-18 22:55 - 2017-03-18 22:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
2017-03-18 22:55 - 2017-03-18 22:55 - 00000000 ____D C:\Program Files (x86)\Ashampoo
2017-03-18 22:55 - 2009-08-24 21:13 - 00034304 _____ (mst software GmbH, Germany) C:\WINDOWS\system32\DfSdkBt.exe
2017-03-18 22:53 - 2017-03-18 22:53 - 00000000 ____D C:\Program Files (x86)\Chip Digital GmbH
2017-03-18 22:48 - 2017-03-18 22:48 - 00002862 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2017-03-18 22:48 - 2017-03-18 22:48 - 00000863 _____ C:\Users\Public\Desktop\CCleaner.lnk
2017-03-18 22:48 - 2017-03-18 22:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2017-03-18 22:48 - 2017-03-18 22:48 - 00000000 ____D C:\Program Files\CCleaner
2017-03-18 22:25 - 2016-06-05 07:42 - 00000000 ____D C:\Users\Sergio\Desktop\Python 3 - Intensivkurs  Projekte erfolgreich realisieren By Mark Pilgrim
2017-03-18 21:48 - 2016-09-01 12:09 - 00000000 ____D C:\Users\Sergio\Desktop\Yael Adler - Haut nah. Alles über unser größtes Organ inkl. pdf
2017-03-18 21:47 - 2016-10-17 16:46 - 00000000 ____D C:\Users\Sergio\Desktop\Nadja Hermann - Fettlogik überwinden
2017-03-18 01:04 - 2017-03-17 21:06 - 00000000 ____D C:\Users\Sergio\Desktop\Gunter Dueck - Flachsinn_ Ich habe Hirn, ich will hier raus
2017-03-16 21:27 - 2016-11-24 02:24 - 00000000 ____D C:\Users\Sergio\Desktop\Haiyti - Nightliner (2016)
2017-03-13 20:44 - 2017-03-13 20:44 - 14966655 _____ C:\Users\Sergio\Desktop\3662536676.psychologie.der.maerchen.2017.by.www.lul.to.pdf
2017-03-12 12:29 - 2017-03-12 12:26 - 00074345 ____N C:\Users\Sergio\Desktop\11057856.pdf
2017-03-11 11:55 - 2017-03-11 11:55 - 00000000 ____D C:\Users\Sergio\AppData\Local\TeamSpeak 3
2017-03-11 11:55 - 2017-03-11 11:55 - 00000000 ____D C:\Users\Sergio\.TeamSpeak 3
2017-03-10 22:56 - 2017-03-10 22:56 - 00000000 ____D C:\Users\Sergio\PycharmProjects
2017-03-10 22:55 - 2017-03-10 22:55 - 00001078 _____ C:\Users\Sergio\Desktop\JetBrains PyCharm Community Edition 2016.3.2.lnk
2017-03-10 22:55 - 2017-03-10 22:55 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\JetBrains
2017-03-10 22:55 - 2017-03-10 22:55 - 00000000 ____D C:\Users\Sergio\.PyCharmCE2016.3
2017-03-10 22:54 - 2017-03-10 22:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JetBrains
2017-03-10 22:54 - 2017-03-10 22:54 - 00000000 ____D C:\Program Files (x86)\JetBrains
2017-03-09 16:03 - 2017-03-09 16:03 - 00002713 _____ C:\Users\Sergio\Desktop\IDLE (Python 3.6 64-bit).lnk
2017-03-09 16:03 - 2017-03-09 16:03 - 00001520 _____ C:\Users\Sergio\Desktop\Python 3.6 (64-bit).lnk
2017-03-09 15:59 - 2017-03-09 15:59 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Python 3.6
2017-03-09 15:59 - 2017-03-09 15:59 - 00000000 ____D C:\Users\Sergio\AppData\Local\Package Cache
2017-03-08 16:00 - 2017-03-08 16:00 - 06744873 ____R C:\Users\Sergio\Desktop\3658108576.ich.glaube.es.hackt.2016.4.auflage.by.www.lul.to.pdf
2017-03-06 19:08 - 2017-03-06 19:08 - 00004296 _____ C:\WINDOWS\System32\Tasks\AMD Updater
2017-03-06 19:07 - 2017-03-06 19:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Radeon Settings
2017-03-06 18:50 - 2017-03-06 18:50 - 00000000 ____D C:\Users\Sergio\.Plays.tv
2017-03-05 18:37 - 2017-01-01 17:08 - 00000000 ____D C:\Users\Sergio\Desktop\Tory Lanez - Chixtape 4 (DatPiff.com)
2017-03-05 18:27 - 2017-03-05 18:27 - 00000000 ____D C:\ProgramData\GeoComply
2017-03-04 21:04 - 2017-03-04 21:06 - 00000000 ____D C:\Users\Sergio\VirtualBox VMs
2017-03-04 20:55 - 2017-03-05 14:02 - 00000000 ____D C:\Users\Sergio\.VirtualBox
2017-03-04 20:55 - 2017-03-04 20:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2017-03-04 20:55 - 2017-03-04 20:55 - 00000000 ____D C:\Program Files\Oracle
2017-03-04 20:55 - 2017-01-16 17:38 - 00959720 _____ (Oracle Corporation) C:\WINDOWS\system32\Drivers\VBoxDrv.sys
2017-03-04 20:55 - 2017-01-16 17:38 - 00149304 _____ (Oracle Corporation) C:\WINDOWS\system32\Drivers\VBoxUSBMon.sys
2017-03-01 23:49 - 2017-03-23 09:15 - 00001024 _____ C:\.rnd
2017-03-01 23:49 - 2017-03-01 23:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tenable Network Security
2017-03-01 23:48 - 2017-03-01 23:48 - 00000000 ____D C:\ProgramData\Tenable
2017-03-01 23:48 - 2017-03-01 23:48 - 00000000 ____D C:\Program Files\Tenable
2017-02-28 21:46 - 2017-03-05 11:48 - 00000000 ____D C:\Users\Sergio\Desktop\Ethic Hacking
2017-02-28 21:33 - 2017-02-28 21:33 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\.maltego
2017-02-28 21:33 - 2017-02-28 21:33 - 00000000 ____D C:\ProgramData\Paterva
2017-02-28 21:33 - 2017-02-28 21:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paterva
2017-02-28 21:32 - 2017-02-28 21:32 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Sun
2017-02-28 21:32 - 2017-02-28 21:32 - 00000000 ____D C:\Program Files (x86)\Paterva
2017-02-28 21:31 - 2017-03-18 23:51 - 00110144 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll
2017-02-28 21:31 - 2017-03-18 23:51 - 00000000 ____D C:\Program Files\Java
2017-02-27 22:16 - 2015-06-24 14:30 - 00064728 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vmx86.sys
2017-02-27 22:16 - 2013-10-08 18:21 - 00073296 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vsock.sys
2017-02-27 22:16 - 2013-10-08 18:21 - 00067664 _____ (VMware, Inc.) C:\WINDOWS\system32\vsocklib.dll
2017-02-27 22:16 - 2013-10-08 18:21 - 00063568 _____ (VMware, Inc.) C:\WINDOWS\SysWOW64\vsocklib.dll
2017-02-27 22:15 - 2015-06-24 14:30 - 00437976 _____ (VMware, Inc.) C:\WINDOWS\SysWOW64\vmnat.exe
2017-02-27 22:15 - 2015-06-24 14:30 - 00359128 _____ (VMware, Inc.) C:\WINDOWS\SysWOW64\vmnetdhcp.exe
2017-02-27 22:15 - 2015-06-24 14:27 - 00031448 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vmnetuserif.sys
2017-02-27 22:14 - 2017-02-27 22:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware
2017-02-27 22:14 - 2017-02-27 22:14 - 00000000 ____D C:\Program Files\Common Files\VMware
2017-02-27 22:14 - 2017-02-27 22:14 - 00000000 ____D C:\Program Files (x86)\VMware
2017-02-27 22:14 - 2015-06-24 14:27 - 00931032 _____ (VMware, Inc.) C:\WINDOWS\system32\vnetlib64.dll
2017-02-27 22:14 - 2014-08-21 08:07 - 00054976 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\hcmon.sys
2017-02-27 22:14 - 2014-08-21 08:06 - 00058048 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vmusb.sys
2017-02-27 22:11 - 2017-02-27 22:42 - 00000000 ____D C:\Users\Sergio\Documents\Virtual Machines
2017-02-27 19:48 - 2017-02-27 19:48 - 00000000 ____D C:\Users\Sergio\.idlerc

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-03-23 16:08 - 2016-09-29 20:02 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-03-23 13:28 - 2016-07-16 12:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-03-23 09:25 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-03-23 09:22 - 2016-07-16 23:51 - 01126950 _____ C:\WINDOWS\system32\perfh007.dat
2017-03-23 09:22 - 2016-07-16 23:51 - 00270638 _____ C:\WINDOWS\system32\perfc007.dat
2017-03-23 09:22 - 2015-08-09 20:57 - 02644890 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-03-23 09:20 - 2016-09-29 20:05 - 00000000 ____D C:\Users\Sergio
2017-03-23 09:20 - 2015-06-02 19:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-03-23 09:20 - 2014-10-31 14:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-03-23 09:20 - 2014-10-25 23:53 - 00000000 ____D C:\Users\Sergio\AppData\Local\VirtualStore
2017-03-23 09:15 - 2016-09-29 20:14 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-03-23 09:15 - 2016-07-16 12:45 - 00000000 ____D C:\WINDOWS\INF
2017-03-23 09:15 - 2014-10-27 17:10 - 00000000 ____D C:\ProgramData\VMware
2017-03-23 09:10 - 2016-07-16 07:04 - 00786432 _____ C:\WINDOWS\system32\config\BBI
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ___SD C:\WINDOWS\system32\F12
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ___RD C:\WINDOWS\PrintDialog
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ___RD C:\Program Files\Windows Defender
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\SysWOW64\setup
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\setup
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\oobe
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\appraiser
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\ShellExperiences
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\PolicyDefinitions
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\bcastdvr
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2017-03-23 09:09 - 2016-07-16 12:47 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2017-03-22 19:50 - 2016-07-16 12:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-03-20 22:33 - 2015-04-16 15:08 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2017-03-20 22:33 - 2015-04-16 15:08 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2017-03-20 22:33 - 2014-10-26 12:23 - 00000000 ____D C:\Program Files\WinRAR
2017-03-20 22:32 - 2016-09-29 20:16 - 00000008 __RSH C:\Users\Sergio\ntuser.pol
2017-03-19 11:34 - 2016-07-16 07:04 - 00032768 _____ C:\WINDOWS\system32\config\ELAM
2017-03-19 03:10 - 2016-10-04 16:41 - 00000000 ____D C:\Program Files (x86)\SpeedFan
2017-03-19 00:06 - 2016-09-29 20:05 - 00000000 ____D C:\Users\postgres
2017-03-18 23:52 - 2016-09-29 20:14 - 00004440 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2017-03-18 23:52 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2017-03-18 23:52 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\Macromed
2017-03-18 23:52 - 2014-10-27 17:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-03-18 23:52 - 2014-10-26 12:23 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-03-18 23:52 - 2014-10-26 12:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-03-18 23:51 - 2014-10-26 12:41 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2017-03-18 23:50 - 2015-05-06 18:27 - 00000000 ____D C:\Program Files\Common Files\Apple
2017-03-18 23:49 - 2014-10-26 00:07 - 00001151 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-03-18 23:02 - 2015-03-10 17:03 - 00000000 ____D C:\Users\Sergio\AppData\LocalLow\Temp
2017-03-18 22:59 - 2014-10-26 12:50 - 00000000 ____D C:\Users\Sergio\AppData\Local\JDownloader v2.0
2017-03-18 22:55 - 2016-09-23 20:37 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\TS3Client
2017-03-18 22:55 - 2014-11-05 17:58 - 00000000 ____D C:\Program Files (x86)\Steam
2017-03-18 22:50 - 2014-10-26 10:16 - 00000000 ____D C:\Users\Sergio\AppData\Local\Razer
2017-03-18 22:50 - 2014-10-26 00:15 - 00000000 ____D C:\ProgramData\Razer
2017-03-18 22:50 - 2014-10-26 00:15 - 00000000 ____D C:\Program Files (x86)\Razer
2017-03-18 21:23 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2017-03-18 00:59 - 2014-10-27 09:42 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\vlc
2017-03-18 00:21 - 2014-10-29 14:39 - 00000000 ____D C:\WINDOWS\system32\MRT
2017-03-18 00:19 - 2015-04-16 15:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2017-03-18 00:19 - 2014-10-29 14:39 - 138634176 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-03-18 00:18 - 2014-10-26 12:31 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2017-03-18 00:15 - 2016-11-05 15:37 - 00000000 ____D C:\Users\Sergio\AppData\Local\ElevatedDiagnostics
2017-03-16 21:23 - 2013-08-22 14:25 - 00000167 _____ C:\WINDOWS\win.ini
2017-03-14 19:22 - 2014-12-23 17:29 - 00000000 ____D C:\Users\Sergio\AppData\Local\Spotify
2017-03-13 20:27 - 2014-10-27 17:14 - 00000000 ____D C:\Users\Sergio\AppData\Local\VMware
2017-03-13 19:32 - 2014-12-23 17:28 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Spotify
2017-03-13 19:07 - 2014-10-27 17:14 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\VMware
2017-03-11 14:19 - 2016-10-23 19:11 - 00000000 ____D C:\Users\Sergio\Documents\Soda PDF Files
2017-03-11 14:19 - 2016-10-23 19:11 - 00000000 ____D C:\Users\Sergio\AppData\Roaming\Soda PDF Desktop
2017-03-11 12:13 - 2014-12-13 14:35 - 00000000 ____D C:\Users\Sergio\AppData\Local\PokerStars.EU
2017-03-11 12:12 - 2014-12-13 14:34 - 00000000 ____D C:\Program Files (x86)\PokerStars.EU
2017-03-11 11:55 - 2016-09-23 20:37 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2017-03-10 06:17 - 2016-07-16 12:49 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-03-10 06:17 - 2016-07-16 12:49 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-03-06 19:07 - 2016-09-29 20:03 - 00000000 ____D C:\Program Files\AMD
2017-03-06 19:07 - 2015-05-19 18:55 - 00000000 ____D C:\Program Files (x86)\AMD
2017-03-06 19:07 - 2014-10-26 00:19 - 00000000 ____D C:\Users\Sergio\AppData\Local\AMD
2017-03-06 19:04 - 2014-10-26 00:14 - 00000000 ____D C:\AMD
2017-03-06 18:50 - 2016-09-29 20:03 - 00000000 ____D C:\ProgramData\Package Cache
2017-03-06 18:49 - 2016-09-29 20:03 - 00000000 ____D C:\ProgramData\AMD
2017-03-04 23:55 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\NDF
2017-02-28 21:32 - 2016-02-14 18:43 - 00000000 ____D C:\Users\Sergio\.oracle_jre_usage
2017-02-27 22:14 - 2014-10-27 17:10 - 02053002 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2017-02-25 11:31 - 2014-10-25 23:53 - 00000000 ____D C:\Users\Sergio\AppData\Local\Packages

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2015-07-20 16:32 - 2015-07-20 16:32 - 0923401 _____ () C:\Program Files (x86)\WinDlg_124.zip
2015-07-12 10:02 - 2015-07-12 10:02 - 0000000 ___SH () C:\Users\Sergio\AppData\Local\LumaEmu
2016-07-03 18:51 - 2016-07-03 18:51 - 0000733 _____ () C:\Users\Sergio\AppData\Local\recently-used.xbel
2016-09-29 20:03 - 2016-09-29 20:03 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap ======================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert

LastRegBack: 2017-03-18 21:07

==================== Ende von FRST.txt ============================
         

Eine Beinträchtigung habe ich nie gespürt, aber ich habe den Rechner auch in der Zeit nicht genutzt.

Servus,


du hast zweimal die Logdatei von HitmanPro gepostet.

Es fehlt noch die Logdatei von ESET, bitte nachreichen.