search and new tab by yahoo

Ladekabel612 · 24.11.2017, 19:45

Hi,

bin zufällig im Ashampoo Uninstaller auf zwei Einträge von search and new tab by yahoo gestoßen, hab die nun Deinstalliert, aber ich bezweifel das es alles war, was drauf ist.

Ich hab bisher nur FRST ausgeführt, rest führe ich nach Ermessen von euch aus.

Code:

ATTFilter

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 24-11-2017
durchgeführt von lem0th (Administrator) auf COMPUTER-128234 (24-11-2017 19:28:16)
Gestartet von C:\Users\lem0th\Downloads
Geladene Profile: lem0th & _ashbackuppb_ (Verfügbare Profile: lem0th & _ashbackuppb_ & Administrator & DefaultAppPool)
Platform: Windows 10 Pro Version 1709 16299.64 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Ransomware Tool for Business 1.1\anti_ransom.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
() C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
() C:\Program Files (x86)\NETGEAR\WNA3100M\WifiSvc.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(WIBU-SYSTEMS AG) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
() C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupService-abpb.exe
() C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\oxHelper.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Ransomware Tool for Business 1.1\anti_ransom_gui.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Ransomware Tool for Business 1.1\anti_ransom_gui.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Ransomware Tool for Business 1.1\anti_ransom_gui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupClient-abpb.exe
() C:\Program Files (x86)\puush\puush.exe
() C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\oxHelper.exe
() C:\Program Files (x86)\NETGEAR\WNA3100M\WNA3100M.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Discord Inc.) C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\Discord.exe
(Discord Inc.) C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\Discord.exe
(Discord Inc.) C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\Discord.exe
(Dominik Reichl) C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(VideoLAN) C:\Program Files\VideoLAN\VLC\vlc.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_11710.1001.27.0_x64__8wekyb3d8bbwe\WinStore.App.exe
(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Microsoft Corporation) C:\Windows\System32\DataExchangeHost.exe
(Microsoft) C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkypeApp.exe
(Ashampoo Development GmbH & Co. KG) C:\Program Files (x86)\Ashampoo\Ashampoo UnInstaller 7\UI7.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe

==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [630168 2017-09-29] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13885696 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [163800 2016-07-30] (IvoSoft)
HKLM\...\Run: [Ashampoo Backup PB] => C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupClient-abpb.exe [326040 2017-05-08] ()
HKLM\...\Run: [Everything] => C:\Program Files\Everything\Everything.exe [2197608 2017-06-07] ()
HKLM-x32\...\Run: [ISUSScheduler] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2004-06-14] (InstallShield Software Corporation)
HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [3222448 2017-10-12] (Dominik Reichl)
HKLM-x32\...\Run: [vmware-tray.exe] => C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe [112104 2017-03-21] (VMware, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-09-05] (Oracle Corporation)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Beschränkung <==== ACHTUNG
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Run: [puush] => C:\Program Files (x86)\puush\puush.exe [568904 2015-05-30] ()
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Run: [Discord] => C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\Discord.exe [57477112 2017-08-08] (Discord Inc.)
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Run: [ISUSPM Startup] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [221184 2004-06-14] (InstallShield Software Corporation)
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Run: [Vivaldi Update Notifier] => C:\ProgramData\chocolatey\lib\Vivaldi\tools\vivaldi\Vivaldi-bin\update_notifier.exe [4716664 2017-09-20] (Vivaldi Technologies AS)
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Policies\system: [DisableLockWorkstation] 1
HKU\S-1-5-21-624198674-977653023-2037852723-1052\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [519680 2017-09-29] (Microsoft Corporation)
AppInit_DLLs: prio.dll => Keine Datei
IFEO\utilman.exe: [Debugger] c:\windows\system32\cmd.exe
SSODL: EldosMountNotificator-cbfs6 - {73F8D53A-4E1F-4434-A7D0-7C1E3B50BB78} - C:\WINDOWS\system32\cbfsMntNtf6.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator-cbfs6 - {73F8D53A-4E1F-4434-A7D0-7C1E3B50BB78} - C:\WINDOWS\SysWOW64\cbfsMntNtf6.dll (EldoS Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WNA3100M Genie.lnk [2016-07-10]
ShortcutTarget: NETGEAR WNA3100M Genie.lnk -> C:\Program Files (x86)\NETGEAR\WNA3100M\WNA3100M.exe ()
GroupPolicy: Beschränkung <==== ACHTUNG
GroupPolicy\User: Beschränkung <==== ACHTUNG

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{0a287408-cae2-4b64-9929-6ec5bb421193}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-624198674-977653023-2037852723-1040\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://de.yahoo.com/?fr=yset_ie_syc_oracle&type=orcl_hpset
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-624198674-977653023-2037852723-1040 -> {8CD4FD52-359A-4F3E-BEB3-D2114C31B19B} URL = hxxps://de.search.yahoo.com/search?p={searchTerms}&intl=de&fr=yset_ie_syc_oracle&type=orcl_default&partnerexternal-oracle=external-oracle
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_151\bin\ssv.dll [2017-10-28] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_151\bin\jp2ssv.dll [2017-10-28] (Oracle Corporation)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2016-07-30] (IvoSoft)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2016-07-30] (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)

FireFox:
========
FF DefaultProfile: 3am39cb5.default
FF ProfilePath: C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default [2017-11-24]
FF NetworkProxy: Mozilla\Firefox\Profiles\3am39cb5.default -> backup.ftp&quot;, &quot;100.44.118.68&quot;
FF Extension: (No Resource URI Leak) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\@no-resource-uri-leak.xpi [2016-12-24] [Lagacy]
FF Extension: (HTTPS Everywhere) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\https-everywhere@eff.org.xpi [2017-11-23]
FF Extension: (uBlock Origin) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\uBlock0@raymondhill.net.xpi [2017-11-08]
FF Extension: (uMatrix) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\uMatrix@raymondhill.net.xpi [2017-11-23]
FF Extension: (User Agent Switcher) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}.xpi [2017-03-27] [Lagacy]
FF Extension: (O2 Service Suite) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\{} [2017-01-17] [Lagacy] [ist nicht signiert]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_27_0_0_187.dll [2017-11-20] ()
FF Plugin: @java.com/DTPlugin,version=11.151.2 -> C:\Program Files\Java\jre1.8.0_151\bin\dtplugin\npDeployJava1.dll [2017-10-28] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.151.2 -> C:\Program Files\Java\jre1.8.0_151\bin\plugin2\npjp2.dll [2017-10-28] (Oracle Corporation)
FF Plugin: @videolan.org/vlc,version=2.2.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_187.dll [2017-11-20] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll [2015-01-09] (Adobe Systems, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-13] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-13] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [Keine Datei]

Chrome: 
=======
CHR DefaultProfile: Profile 1
CHR StartupUrls: Profile 1 -> &quot;hxxps://www.youtube.com/feed/subscriptions&quot;,&quot;hxxps://twitter.com/&quot;
CHR DefaultSearchURL: Profile 1 -> hxxps://de.search.yahoo.com/search?p={searchTerms}&fr=yset_chr_syc_oracle&type=default
CHR DefaultSearchKeyword: Profile 1 -> Yahoo
CHR DefaultSuggestURL: Profile 1 -> hxxps://de.search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10
CHR Profile: C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default [2017-07-01]
CHR Extension: (Google Präsentationen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-03-12]
CHR Extension: (Google Docs) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-03-12]
CHR Extension: (Google Drive) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-03-12]
CHR Extension: (YouTube) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-03-12]
CHR Extension: (Yahoo Partner) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\fabhkdeopjkcpkmofliimbjckmocfiom [2017-03-12]
CHR Extension: (Yahoo Partner) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdbpcigaolookbahgdofnimidinicfid [2017-06-30]
CHR Extension: (Google Tabellen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-03-12]
CHR Extension: (Google Docs Offline) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-06-30]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2017-03-12]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-12]
CHR Extension: (Google Mail) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-03-12]
CHR Extension: (Chrome Media Router) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-06-30]
CHR Profile: C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old [2017-03-15] <==== ACHTUNG
CHR Extension: (Google Präsentationen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-01-17]
CHR Extension: (Google Docs) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\aohghmighlieiainnegkcijnfilokake [2017-01-17]
CHR Extension: (Google Drive) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-01-17]
CHR Extension: (YouTube) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-01-17]
CHR Extension: (Google Tabellen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-01-17]
CHR Extension: (Google Docs Offline) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-01-17]
CHR Extension: (Blue Space) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\lgafflokkagpjiofcoodepkehnpldbge [2017-01-17]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-17]
CHR Extension: (Google Mail) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-01-17]
CHR Profile: C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1 [2017-11-24]
CHR Extension: (Google Präsentationen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-01-17]
CHR Extension: (Google Docs) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2017-01-17]
CHR Extension: (Google Drive) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-01-17]
CHR Extension: (YouTube) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-01-17]
CHR Extension: (CryptUp: Encrypt Gmail with PGP) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bnjglocicdkmhmoohhfkfkbbkejdhdgc [2017-02-10]
CHR Extension: (uBlock Origin) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2017-01-17]
CHR Extension: (Google Tabellen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-01-17]
CHR Extension: (HTTPS Everywhere) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gcbommkclmclpchllfjekcdonpmejbdp [2017-01-28]
CHR Extension: (Google Docs Offline) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-01-17]
CHR Extension: (Black blue shards) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\hgoflmajhinnohnhkfeggflmmppiilck [2017-01-17]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-19]
CHR Extension: (uMatrix) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ogfcmafjalglgifnmanfmnieipoejdcf [2017-01-17]
CHR Extension: (Google Mail) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-01-17]
CHR Extension: (Chrome Media Router) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-01-28]
CHR Profile: C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\System Profile [2017-01-17]
CHR HKU\S-1-5-21-624198674-977653023-2037852723-1040\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fabhkdeopjkcpkmofliimbjckmocfiom] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fdbpcigaolookbahgdofnimidinicfid] - hxxps://clients2.google.com/service/update2/crx

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S4 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2207960 2016-09-26] (Adobe Systems, Incorporated)
R2 AntiRansom; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Ransomware Tool for Business 1.1\anti_ransom.exe [693720 2016-07-19] (AO Kaspersky Lab)
R2 ashbackuppb; c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupService-abpb.exe [34712 2017-05-08] ()
R2 DirMngr; C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [216576 2016-08-18] () [Datei ist nicht signiert]
R2 EpsonScanSvc; C:\WINDOWS\system32\EscSvc64.exe [145224 2016-11-08] (Seiko Epson Corporation)
S3 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4470736 2017-05-09] (Malwarebytes)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [303360 2015-06-24] (Realtek Semiconductor)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [4297920 2017-09-30] (Microsoft Corporation)
S2 VMwareHostd; C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe [12482024 2017-03-21] ()
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [355304 2017-09-29] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [105944 2017-09-29] (Microsoft Corporation)
R2 WSWNA3100M; C:\Program Files (x86)\NETGEAR\WNA3100M\WifiSvc.exe [316120 2014-08-18] ()

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 ampa; C:\WINDOWS\system32\ampa.sys [38320 2016-12-25] ()
S3 ampa; C:\WINDOWS\SysWOW64\ampa.sys [38320 2016-12-25] ()
R1 cbfs6; C:\WINDOWS\system32\drivers\cbfs6.sys [460992 2016-06-13] (EldoS Corporation)
S3 dtlitescsibus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [30264 2016-09-17] (Disc Soft Ltd)
S3 dtliteusbbus; C:\WINDOWS\System32\drivers\dtliteusbbus.sys [47672 2016-09-17] (Disc Soft Ltd)
R0 kl1; C:\WINDOWS\System32\DRIVERS\kl1.sys [554416 2016-06-02] (AO Kaspersky Lab)
R3 klflt; C:\WINDOWS\system32\DRIVERS\klflt.sys [191312 2016-06-26] (AO Kaspersky Lab)
R1 klhk; C:\WINDOWS\system32\DRIVERS\klhk.sys [413008 2016-06-28] (AO Kaspersky Lab)
R1 KLIF; C:\WINDOWS\System32\DRIVERS\klif.sys [1012048 2016-06-26] (AO Kaspersky Lab)
R1 klpd; C:\WINDOWS\System32\DRIVERS\klpd.sys [45488 2016-05-31] (AO Kaspersky Lab)
R1 Klwtp; C:\WINDOWS\system32\DRIVERS\klwtp.sys [126864 2016-06-02] (AO Kaspersky Lab)
S3 MBAMFarflt; C:\WINDOWS\system32\drivers\farflt.sys [102856 2016-12-22] (Malwarebytes)
S3 MBAMProtection; C:\WINDOWS\system32\drivers\mbam.sys [43968 2016-12-22] (Malwarebytes)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [253856 2017-09-02] (Malwarebytes)
S3 MBAMWebProtection; C:\WINDOWS\system32\drivers\mwac.sys [91584 2016-12-23] (Malwarebytes)
R1 MpKsl0afd70c2; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1069DB8A-8BBF-4770-ACD8-EF3DF934A9C1}\MpKsl0afd70c2.sys [58120 2017-11-21] (Microsoft Corporation)
R1 MpKsl12257a4f; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{51632064-DC69-4F45-B781-2E4779211AEF}\MpKsl12257a4f.sys [58120 2017-11-23] (Microsoft Corporation)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [604160 2017-09-29] (Realtek )
R3 RtlWlanu; C:\WINDOWS\System32\drivers\rtwlanu.sys [3859704 2015-10-16] (Realtek Semiconductor Corporation )
R3 taphss6; C:\WINDOWS\System32\drivers\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.)
R2 UI5IFS; C:\Program Files (x86)\Ashampoo\Ashampoo UnInstaller 7\IFS64.sys [30016 2017-11-17] ()
S3 usbrndis6; C:\WINDOWS\System32\drivers\usb80236.sys [23040 2017-09-29] (Microsoft Corporation)
S3 VBAudioVACMME; C:\WINDOWS\system32\DRIVERS\vbaudio_cable64_win7.sys [41192 2016-01-29] (Windows (R) Win 7 DDK provider)
R1 VBoxNetAdp; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys [131144 2016-12-20] (Oracle Corporation)
S3 VBoxUSB; C:\WINDOWS\System32\Drivers\VBoxUSB.sys [125008 2015-11-10] (Oracle Corporation)
R1 veracrypt; C:\WINDOWS\System32\drivers\veracrypt.sys [631200 2017-10-15] (IDRIX)
R3 vpnpbus; C:\WINDOWS\System32\drivers\vpnpbus.sys [18624 2016-06-13] (EldoS Corporation)
R2 vstor2-mntapi20-shared; C:\Windows\SysWow64\drivers\vstor2-mntapi20-shared.sys [37960 2016-11-14] (VMware, Inc.)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44608 2017-09-29] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [309144 2017-09-29] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [119192 2017-09-29] (Microsoft Corporation)
U3 idsvc; kein ImagePath

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-11-24 19:28 - 2017-11-24 19:31 - 000025278 _____ C:\Users\lem0th\Downloads\FRST.txt
2017-11-24 19:27 - 2017-11-24 19:27 - 002393088 _____ (Farbar) C:\Users\lem0th\Downloads\FRST64.exe
2017-11-24 13:38 - 2017-11-24 13:38 - 000001285 _____ C:\Users\Public\Desktop\Ashampoo UnInstaller 7.lnk
2017-11-24 13:38 - 2017-11-24 13:38 - 000000221 _____ C:\Users\Public\Desktop\Ashampoo Deals.url
2017-11-24 13:38 - 2017-11-24 13:38 - 000000000 ____D C:\Users\lem0th\AppData\Local\Ashampoo
2017-11-24 13:37 - 2017-11-24 13:37 - 000000000 ____D C:\Program Files (x86)\Ashampoo
2017-11-24 13:35 - 2017-11-24 13:37 - 015879616 _____ (Ashampoo GmbH & Co. KG ) C:\Users\lem0th\Downloads\ashampoo_uninstaller_7_7.00.00_sm.exe
2017-11-23 20:09 - 2017-10-21 20:00 - 002916352 _____ C:\Users\lem0th\Desktop\main.db
2017-11-23 11:49 - 2017-11-23 11:50 - 059117240 _____ (Skype Technologies S.A. ) C:\Users\lem0th\Downloads\Skype-8.11.0.4.exe
2017-11-22 05:37 - 2017-11-22 05:37 - 000000022 _____ C:\WINDOWS\S.dirmngr
2017-11-22 05:37 - 2017-11-22 05:37 - 000000000 ____H C:\ProgramData\cm-lock
2017-11-22 05:27 - 2017-11-22 05:27 - 000000039 _____ C:\Users\lem0th\jeff stream.txt
2017-11-21 19:24 - 2017-11-21 19:24 - 000167296 _____ (Gibson Research Corp.) C:\Users\lem0th\Downloads\DNSBench.exe
2017-11-21 19:20 - 2017-11-21 19:21 - 000008653 _____ C:\Users\lem0th\Downloads\DNS Benchmarklist v1 by Möwe.ini
2017-11-21 02:18 - 2017-11-21 02:18 - 000000037 _____ C:\Users\lem0th\cities patar.txt
2017-11-20 01:46 - 2017-11-20 01:46 - 000001450 _____ C:\MediathekView.lnk
2017-11-20 01:44 - 2017-11-20 01:44 - 000004466 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2017-11-20 01:43 - 2017-11-20 01:43 - 000000000 ____D C:\Users\Default\AppData\Roaming\Macromedia
2017-11-20 01:43 - 2017-11-20 01:43 - 000000000 ____D C:\Users\Default User\AppData\Roaming\Macromedia
2017-11-17 21:28 - 2017-10-25 10:11 - 017083904 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
2017-11-17 21:28 - 2017-10-25 10:09 - 021753344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
2017-11-17 21:28 - 2017-10-25 04:36 - 025246208 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-11-17 21:28 - 2017-10-25 04:16 - 023658496 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-11-17 21:27 - 2017-10-25 10:11 - 000336896 _____ (Microsoft Corporation) C:\WINDOWS\system32\HolographicRuntimes.dll
2017-11-17 21:27 - 2017-10-25 09:57 - 000956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Spectrum.exe
2017-11-17 21:27 - 2017-10-25 09:57 - 000882688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Mirage.Internal.dll
2017-11-17 21:27 - 2017-10-25 09:56 - 000665600 _____ (Microsoft Corporation) C:\WINDOWS\system32\DHolographicDisplay.dll
2017-11-17 21:27 - 2017-10-25 07:36 - 000618496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Mirage.Internal.dll
2017-11-17 21:27 - 2017-10-25 05:41 - 000362176 _____ (Microsoft Corporation) C:\WINDOWS\system32\BioIso.exe
2017-11-17 21:27 - 2017-10-25 05:40 - 001634288 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2017-11-17 21:27 - 2017-10-25 05:40 - 000612760 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2017-11-17 21:27 - 2017-10-25 05:40 - 000269696 _____ C:\WINDOWS\system32\FaceProcessorCore.dll
2017-11-17 21:27 - 2017-10-25 05:39 - 007831248 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2017-11-17 21:27 - 2017-10-25 05:39 - 000479912 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64win.dll
2017-11-17 21:27 - 2017-10-25 05:39 - 000285080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2017-11-17 21:27 - 2017-10-25 05:37 - 001954048 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2017-11-17 21:27 - 2017-10-25 05:37 - 000610712 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2017-11-17 21:27 - 2017-10-25 05:36 - 008590744 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-11-17 21:27 - 2017-10-25 05:36 - 002400664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2017-11-17 21:27 - 2017-10-25 05:36 - 000187288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2017-11-17 21:27 - 2017-10-25 05:34 - 002573208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2017-11-17 21:27 - 2017-10-25 05:34 - 000839928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Perception.Stub.dll
2017-11-17 21:27 - 2017-10-25 05:34 - 000710920 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2017-11-17 21:27 - 2017-10-25 05:32 - 000559512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2017-11-17 21:27 - 2017-10-25 05:32 - 000147864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wcifs.sys
2017-11-17 21:27 - 2017-10-25 05:31 - 000436120 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHostCommon.dll
2017-11-17 21:27 - 2017-10-25 05:31 - 000045464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storufs.sys
2017-11-17 21:27 - 2017-10-25 05:30 - 004487968 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2017-11-17 21:27 - 2017-10-25 05:30 - 000555416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2017-11-17 21:27 - 2017-10-25 05:29 - 002269080 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsrcsnk.dll
2017-11-17 21:27 - 2017-10-25 05:29 - 001507736 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2017-11-17 21:27 - 2017-10-25 05:29 - 000603920 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2017-11-17 21:27 - 2017-10-25 05:28 - 001170008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2017-11-17 21:27 - 2017-10-25 05:27 - 006791472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2017-11-17 21:27 - 2017-10-25 05:27 - 001970520 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2017-11-17 21:27 - 2017-10-25 05:27 - 001426152 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2017-11-17 21:27 - 2017-10-25 05:27 - 000374032 _____ (Microsoft Corporation) C:\WINDOWS\system32\vac.exe
2017-11-17 21:27 - 2017-10-25 05:24 - 000428952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2017-11-17 21:27 - 2017-10-25 05:20 - 002717392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2017-11-17 21:27 - 2017-10-25 04:52 - 001615720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2017-11-17 21:27 - 2017-10-25 04:50 - 001528904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2017-11-17 21:27 - 2017-10-25 04:30 - 005615968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2017-11-17 21:27 - 2017-10-25 04:30 - 000354200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudExperienceHostCommon.dll
2017-11-17 21:27 - 2017-10-25 04:28 - 004648528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2017-11-17 21:27 - 2017-10-25 04:28 - 001246432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2017-11-17 21:27 - 2017-10-25 04:28 - 000982016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2017-11-17 21:27 - 2017-10-25 04:27 - 001454568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsrcsnk.dll
2017-11-17 21:27 - 2017-10-25 04:27 - 001377080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2017-11-17 21:27 - 2017-10-25 04:27 - 001015008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2017-11-17 21:27 - 2017-10-25 04:24 - 000506256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Perception.Stub.dll
2017-11-17 21:27 - 2017-10-25 04:22 - 006015200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2017-11-17 21:27 - 2017-10-25 04:22 - 002465848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2017-11-17 21:27 - 2017-10-25 04:19 - 003670016 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-11-17 21:27 - 2017-10-25 04:19 - 000097792 _____ C:\WINDOWS\system32\runexehelper.exe
2017-11-17 21:27 - 2017-10-25 04:18 - 000975872 _____ C:\WINDOWS\system32\FaceProcessor.dll
2017-11-17 21:27 - 2017-10-25 04:18 - 000328192 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll
2017-11-17 21:27 - 2017-10-25 04:18 - 000301056 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcLayers.dll
2017-11-17 21:27 - 2017-10-25 04:18 - 000135168 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_CapabilityAccess.dll
2017-11-17 21:27 - 2017-10-25 04:18 - 000095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\CapabilityAccessManagerClient.dll
2017-11-17 21:27 - 2017-10-25 04:18 - 000056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcSpecfc.dll
2017-11-17 21:27 - 2017-10-25 04:16 - 000227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\CapabilityAccessManager.dll
2017-11-17 21:27 - 2017-10-25 04:16 - 000114688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\UcmCx.sys
2017-11-17 21:27 - 2017-10-25 04:16 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzres.dll
2017-11-17 21:27 - 2017-10-25 04:15 - 000140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2017-11-17 21:27 - 2017-10-25 04:14 - 000541184 _____ (Microsoft Corporation) C:\WINDOWS\system32\HolographicExtensions.dll
2017-11-17 21:27 - 2017-10-25 04:14 - 000046080 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdrleakdiag.exe
2017-11-17 21:27 - 2017-10-25 04:13 - 002972672 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
2017-11-17 21:27 - 2017-10-25 04:12 - 000708096 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2017-11-17 21:27 - 2017-10-25 04:12 - 000599040 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2017-11-17 21:27 - 2017-10-25 04:12 - 000568832 _____ (Microsoft Corporation) C:\WINDOWS\system32\TileDataRepository.dll
2017-11-17 21:27 - 2017-10-25 04:11 - 000768512 _____ (Microsoft Corporation) C:\WINDOWS\system32\PCPKsp.dll
2017-11-17 21:27 - 2017-10-25 04:10 - 008099328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-11-17 21:27 - 2017-10-25 04:10 - 004742144 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2017-11-17 21:27 - 2017-10-25 04:10 - 001167360 _____ (Microsoft Corporation) C:\WINDOWS\system32\ISM.dll
2017-11-17 21:27 - 2017-10-25 04:09 - 002862080 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2017-11-17 21:27 - 2017-10-25 04:09 - 002106368 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2017-11-17 21:27 - 2017-10-25 04:09 - 001806336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll
2017-11-17 21:27 - 2017-10-25 04:09 - 000812032 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 002905600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-11-17 21:27 - 2017-10-25 04:08 - 002781696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 002633216 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 002392576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 001667584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Input.Inking.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 000654848 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 000487424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcSpecfc.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 000465408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 018914304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 003478016 _____ (Microsoft Corporation) C:\WINDOWS\system32\mispace.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 001485824 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 000685056 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 000372224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcLayers.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 000064512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CapabilityAccessManagerClient.dll
2017-11-17 21:27 - 2017-10-25 04:06 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tzres.dll
2017-11-17 21:27 - 2017-10-25 04:05 - 019339776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-11-17 21:27 - 2017-10-25 04:05 - 000106496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2017-11-17 21:27 - 2017-10-25 04:05 - 000022528 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtcVSp1res.dll
2017-11-17 21:27 - 2017-10-25 04:04 - 000124928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\luafv.sys
2017-11-17 21:27 - 2017-10-25 04:04 - 000041984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdrleakdiag.exe
2017-11-17 21:27 - 2017-10-25 04:03 - 000450048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TileDataRepository.dll
2017-11-17 21:27 - 2017-10-25 04:02 - 000591872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PCPKsp.dll
2017-11-17 21:27 - 2017-10-25 04:01 - 000462848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2017-11-17 21:27 - 2017-10-25 03:59 - 003679232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2017-11-17 21:27 - 2017-10-25 03:59 - 000664576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2017-11-17 21:27 - 2017-10-25 03:58 - 002467840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2017-11-17 21:27 - 2017-10-25 03:58 - 001322496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Input.Inking.dll
2017-11-17 21:27 - 2017-10-25 03:58 - 001280000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll
2017-11-17 21:27 - 2017-10-25 03:57 - 006035968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-11-17 21:27 - 2017-10-25 03:55 - 002864640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mispace.dll
2017-11-17 21:27 - 2017-10-25 03:54 - 000022528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msdtcVSp1res.dll
2017-11-17 21:27 - 2017-10-21 13:25 - 003313968 _____ C:\WINDOWS\system32\Windows.Mirage.dll
2017-11-17 21:27 - 2017-10-20 15:17 - 002474584 _____ C:\WINDOWS\SysWOW64\Windows.Mirage.dll
2017-11-17 21:27 - 2017-10-20 06:08 - 000339968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msexcl40.dll
2017-11-17 20:35 - 2017-11-17 20:35 - 000000000 _____ C:\Users\lem0th\AppData\Roaming\text.txt
2017-11-17 20:27 - 2017-11-17 20:27 - 000000000 ____D C:\Users\lem0th\AppData\Local\CrystalDiskMark5
2017-11-17 20:14 - 2017-11-17 20:14 - 000000000 ____D C:\WINDOWS\containers
2017-11-17 20:05 - 2017-11-17 20:07 - 000000000 ____D C:\WLAN
2017-11-17 19:59 - 2017-11-17 20:00 - 000000000 ____D C:\Program Files\CrystalDiskMark5
2017-11-17 19:58 - 2017-11-17 19:59 - 002783312 _____ (Crystal Dew World ) C:\Users\lem0th\Downloads\crystaldiskmark5_1_2-en.exe
2017-11-17 15:56 - 2017-11-17 15:56 - 000000000 _____ C:\WINDOWS\SysWOW64\last.dump
2017-11-17 15:45 - 2017-11-17 15:45 - 000061304 _____ () C:\WINDOWS\system32\Drivers\lpsport.sys
2017-11-17 15:37 - 2017-11-17 15:43 - 000000000 ____D C:\ProgramData\AVAST Software
2017-11-17 15:34 - 2017-11-17 15:35 - 010849904 _____ (Piriform Ltd) C:\Users\lem0th\Downloads\ccsetup537.exe
2017-11-16 22:10 - 2017-11-16 22:10 - 000096646 _____ C:\sleepstudy-report.html
2017-11-16 20:01 - 2017-11-16 20:01 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WhoCrashed
2017-11-16 16:57 - 2017-11-16 16:57 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Kits
2017-11-16 16:57 - 2017-11-16 16:57 - 000000000 ____D C:\Program Files (x86)\Windows Kits
2017-11-14 16:15 - 2017-11-14 16:15 - 000000016 _____ C:\Users\lem0th\uke termin.txt
2017-11-13 15:15 - 2017-11-13 15:15 - 000030518 _____ C:\Users\lem0th\tasklist.txt
2017-11-12 22:08 - 2017-10-10 08:14 - 000139672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecdd.sys
2017-11-12 22:08 - 2017-10-10 08:11 - 000739696 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll
2017-11-12 22:08 - 2017-10-10 08:10 - 001200024 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2017-11-12 22:08 - 2017-10-10 08:01 - 005906264 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2017-11-12 22:08 - 2017-10-10 08:00 - 001053592 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2017-11-12 22:08 - 2017-10-10 08:00 - 000373656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2017-11-12 22:08 - 2017-10-10 07:59 - 001641536 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2017-11-12 22:08 - 2017-10-10 07:59 - 000778936 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2017-11-12 22:08 - 2017-10-10 07:54 - 001463856 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2017-11-12 22:08 - 2017-10-10 07:53 - 000464416 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2017-11-12 22:08 - 2017-10-10 07:53 - 000232344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2017-11-12 22:08 - 2017-10-10 07:51 - 000184984 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspicli.dll
2017-11-12 22:08 - 2017-10-10 07:49 - 001554216 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2017-11-12 22:08 - 2017-10-10 07:49 - 000060824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\urscx01000.sys
2017-11-12 22:08 - 2017-10-10 07:48 - 000677280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2017-11-12 22:08 - 2017-10-10 07:44 - 000246168 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2017-11-12 22:08 - 2017-10-10 07:43 - 000418712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2017-11-12 22:08 - 2017-10-10 07:36 - 001436432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2017-11-12 22:08 - 2017-10-10 07:31 - 001323840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2017-11-12 22:08 - 2017-10-10 07:30 - 000123520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll
2017-11-12 22:08 - 2017-10-10 07:26 - 000649304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2017-11-12 22:08 - 2017-10-10 07:11 - 000597160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll
2017-11-12 22:08 - 2017-10-10 07:07 - 001261864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2017-11-12 22:08 - 2017-10-10 07:06 - 000353688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2017-11-12 22:08 - 2017-10-10 06:46 - 001470976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2017-11-12 22:08 - 2017-10-10 06:46 - 000136192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\t2embed.dll
2017-11-12 22:08 - 2017-10-10 06:43 - 000566272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TpmCoreProvisioning.dll
2017-11-12 22:08 - 2017-10-10 06:43 - 000070656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XblAuthTokenBrokerExt.dll
2017-11-12 22:08 - 2017-10-10 06:42 - 000374784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FirewallAPI.dll
2017-11-12 22:08 - 2017-10-10 06:42 - 000326144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptngc.dll
2017-11-12 22:08 - 2017-10-10 06:37 - 002869248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2017-11-12 22:08 - 2017-10-10 06:37 - 001587200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2017-11-12 22:08 - 2017-10-10 06:37 - 001559552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2017-11-12 22:08 - 2017-10-10 06:36 - 001664000 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2017-11-12 22:08 - 2017-10-10 06:36 - 000177664 _____ (Microsoft Corporation) C:\WINDOWS\system32\t2embed.dll
2017-11-12 22:08 - 2017-10-10 06:34 - 000057344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\UcmUcsi.sys
2017-11-12 22:08 - 2017-10-10 06:34 - 000034816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BasicRender.sys
2017-11-12 22:08 - 2017-10-10 06:34 - 000028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspisrv.dll
2017-11-12 22:08 - 2017-10-10 06:33 - 000086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthTokenBrokerExt.dll
2017-11-12 22:08 - 2017-10-10 06:33 - 000058880 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2017-11-12 22:08 - 2017-10-10 06:32 - 000529408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nwifi.sys
2017-11-12 22:08 - 2017-10-10 06:32 - 000461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll
2017-11-12 22:08 - 2017-10-10 06:31 - 000665088 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmCoreProvisioning.dll
2017-11-12 22:08 - 2017-10-10 06:31 - 000478208 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnr.dll
2017-11-12 22:08 - 2017-10-10 06:30 - 000542208 _____ (Microsoft Corporation) C:\WINDOWS\system32\FirewallAPI.dll
2017-11-12 22:08 - 2017-10-10 06:30 - 000442880 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptngc.dll
2017-11-12 22:08 - 2017-10-10 06:27 - 001547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2017-11-12 22:08 - 2017-10-10 06:26 - 003334144 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2017-11-12 22:08 - 2017-10-10 06:26 - 001856000 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2017-11-12 22:08 - 2017-10-10 06:25 - 001822208 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2017-11-12 22:08 - 2017-10-10 06:25 - 000925184 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2017-11-12 22:08 - 2017-10-10 06:24 - 000726016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2017-11-12 22:08 - 2017-10-10 06:24 - 000422912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv.sys
2017-11-12 22:08 - 2017-10-10 06:24 - 000285696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2017-11-12 22:08 - 2017-10-03 23:42 - 000640512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mswstr10.dll
2017-11-12 22:08 - 2017-10-03 23:42 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjint40.dll
2017-11-05 23:06 - 2017-11-05 23:06 - 000000043 _____ C:\Users\lem0th\money glitch.txt
2017-11-04 00:38 - 2017-11-04 00:38 - 000000000 ____D C:\Users\lem0th\Documents\FeedbackHub
2017-11-03 21:22 - 2017-10-28 12:12 - 000110144 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-64.dll
2017-11-01 19:17 - 2017-11-01 19:17 - 000023610 _____ C:\Users\lem0th\Documents\my-umatrix-backup.txt
2017-11-01 19:12 - 2017-11-01 19:13 - 000015765 _____ C:\Users\lem0th\Documents\my-umatrix-rules.txt
2017-10-31 12:25 - 2017-10-31 12:26 - 058031933 _____ C:\Users\lem0th\Documents\TV-20171030-2347-5101.webxl.h264.mp4
2017-10-30 19:57 - 2017-11-23 11:59 - 000000000 ____D C:\Users\lem0th\AppData\Local\PlaceholderTileLogoFolder
2017-10-30 18:02 - 2017-09-29 14:41 - 001312504 _____ (Microsoft Corporation) C:\WINDOWS\Taskmgr.exe
2017-10-30 17:30 - 2017-10-30 17:31 - 000080083 _____ C:\Users\lem0th\Documents\Addition.txt
2017-10-30 17:28 - 2017-10-30 17:31 - 000115706 _____ C:\Users\lem0th\Documents\FRST.txt
2017-10-30 17:11 - 2017-11-24 19:28 - 000000000 ____D C:\FRST
2017-10-30 17:10 - 2017-10-30 17:11 - 002403328 _____ (Farbar) C:\Users\lem0th\Documents\FRST64.exe
2017-10-30 16:42 - 2017-10-30 16:42 - 000000000 ____D C:\ProgramData\Microsoft OneDrive
2017-10-30 16:41 - 2017-10-30 16:41 - 000000000 ___HD C:\Users\lem0th\MicrosoftEdgeBackups
2017-10-30 16:39 - 2017-10-30 16:39 - 000001160 __RSH C:\Users\lem0th\ntuser.pol
2017-10-30 16:39 - 2017-10-30 16:39 - 000000020 ___SH C:\Users\lem0th\ntuser.ini
2017-10-30 16:39 - 2017-10-30 16:39 - 000000000 ___RD C:\Users\lem0th\3D Objects
2017-10-30 16:33 - 2017-10-30 16:34 - 000019053 _____ C:\WINDOWS\diagwrn.xml
2017-10-30 16:33 - 2017-10-30 16:34 - 000019053 _____ C:\WINDOWS\diagerr.xml
2017-10-30 16:31 - 2017-11-23 23:17 - 000003658 _____ C:\WINDOWS\System32\Tasks\CreateExplorerShellUnelevatedTask
2017-10-30 16:31 - 2017-11-22 05:37 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-10-30 16:31 - 2017-11-13 20:15 - 000003628 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2017-10-30 16:31 - 2017-11-13 20:15 - 000003504 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2017-10-30 16:31 - 2017-10-30 16:32 - 000003502 _____ C:\WINDOWS\System32\Tasks\EPSON XP-540 Series Update {2AB6DE24-84C4-4AAB-BF4A-771C3BEF1053}
2017-10-30 16:31 - 2017-10-30 16:32 - 000003116 _____ C:\WINDOWS\System32\Tasks\klcp_update
2017-10-30 16:31 - 2017-10-30 16:32 - 000002484 _____ C:\WINDOWS\System32\Tasks\Defender tägliche Updates
2017-10-30 16:31 - 2017-10-30 16:31 - 000003502 _____ C:\WINDOWS\System32\Tasks\EPSON XP-540 Series Update {57EB58A9-FBFB-47E1-B238-BD9213EE8D07}
2017-10-30 16:31 - 2017-10-30 16:31 - 000002746 _____ C:\WINDOWS\System32\Tasks\Sperrbildschirm
2017-10-30 16:31 - 2017-10-30 16:31 - 000000000 ____D C:\WINDOWS\System32\Tasks\WPD
2017-10-30 16:31 - 2016-12-19 18:28 - 000002210 _____ C:\WINDOWS\System32\Tasks\Core Temp Autostart Tygan
2017-10-30 16:21 - 2017-10-30 16:21 - 000000020 ___SH C:\Users\_ashbackuppb_\ntuser.ini
2017-10-30 16:09 - 2017-11-24 13:42 - 000000000 ____D C:\Users\lem0th\AppData\Local\Packages
2017-10-30 16:09 - 2017-10-30 16:09 - 000000000 ____D C:\ProgramData\USOShared
2017-10-30 16:07 - 2017-11-22 05:27 - 000000000 ____D C:\Users\lem0th
2017-10-30 16:07 - 2017-11-01 17:08 - 000000000 ____D C:\Users\_ashbackuppb_
2017-10-30 16:07 - 2017-10-30 16:29 - 000000000 ____D C:\Users\DefaultAppPool
2017-10-30 16:07 - 2017-10-30 16:26 - 000000000 ____D C:\Users\Administrator
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Vorlagen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Startmenü
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Netzwerkumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Lokale Einstellungen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Eigene Dateien
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Druckumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Documents\Eigene Videos
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Documents\Eigene Musik
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Documents\Eigene Bilder
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\AppData\Local\Verlauf
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\AppData\Local\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Vorlagen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Startmenü
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Netzwerkumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Lokale Einstellungen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Eigene Dateien
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Druckumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Documents\Eigene Videos
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Documents\Eigene Musik
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Documents\Eigene Bilder
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\AppData\Local\Verlauf
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\AppData\Local\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Vorlagen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Startmenü
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Netzwerkumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Lokale Einstellungen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Eigene Dateien
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Druckumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Documents\Eigene Videos
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Documents\Eigene Musik
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Documents\Eigene Bilder
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\AppData\Local\Verlauf
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\AppData\Local\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Vorlagen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Startmenü
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Netzwerkumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Lokale Einstellungen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Eigene Dateien
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Druckumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Documents\Eigene Videos
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Documents\Eigene Musik
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Documents\Eigene Bilder
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\AppData\Local\Verlauf
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\AppData\Local\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Anwendungsdaten
2017-10-30 16:02 - 2017-11-11 15:12 - 002252414 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-10-30 16:01 - 2017-09-29 14:41 - 002241024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2017-10-30 15:58 - 2017-11-24 18:02 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2017-10-30 15:58 - 2017-11-22 05:37 - 000742728 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-10-30 15:35 - 2016-06-28 12:28 - 000413008 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klhk.sys
2017-10-30 15:35 - 2016-06-26 15:14 - 001012048 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klif.sys
2017-10-30 15:35 - 2016-06-26 15:14 - 000191312 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klflt.sys
2017-10-30 15:35 - 2016-06-02 22:39 - 000126864 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klwtp.sys
2017-10-30 15:35 - 2016-06-02 03:43 - 000554416 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\kl1.sys
2017-10-30 15:35 - 2016-05-31 23:31 - 000045488 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klpd.sys
2017-10-30 15:34 - 2017-10-30 15:34 - 000000000 ___DL C:\Users\Public\Recorded TV (1)
2017-10-30 15:34 - 2017-10-30 15:34 - 000000000 ____D C:\Program Files\Common Files\SpeechEngines
2017-10-30 15:33 - 2017-10-30 15:54 - 000000000 ____D C:\WINDOWS\system32\config\bbimigrate
2017-10-30 15:30 - 2017-10-30 15:33 - 000000000 ____D C:\WINDOWS\ServiceProfiles
2017-10-30 15:26 - 2017-10-30 15:54 - 000000000 ___SD C:\WINDOWS\system32\lxss
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\WINDOWS\SysWOW64\XPSViewer
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\WINDOWS\SysWOW64\BestPractices
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\WINDOWS\system32\msmq
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\WINDOWS\system32\BestPractices
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\Program Files\Reference Assemblies
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\Program Files\MSBuild
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\Program Files (x86)\Reference Assemblies
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\Program Files (x86)\MSBuild
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\inetpub
2017-10-30 15:21 - 2017-09-22 18:19 - 000778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2017-10-30 15:21 - 2017-09-22 18:19 - 000103120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2017-10-30 15:21 - 2017-09-22 18:19 - 000035456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2017-10-30 15:20 - 2017-09-28 15:50 - 001166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2017-10-30 15:20 - 2017-09-28 15:50 - 000124624 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2017-10-30 15:20 - 2017-09-28 15:50 - 000035456 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2017-10-30 14:49 - 2017-10-30 14:49 - 000008192 _____ C:\WINDOWS\system32\config\userdiff
2017-10-30 14:13 - 2017-11-02 10:44 - 000000000 ___DC C:\WINDOWS\Panther
2017-10-30 14:07 - 2017-10-30 14:13 - 000000036 _____ C:\WINDOWS\progress.ini
2017-10-30 13:37 - 2017-10-30 16:36 - 000000000 ___HD C:\$GetCurrent
2017-10-28 09:38 - 2017-10-28 09:38 - 000195346 _____ C:\Users\lem0th\Documents\wu170509 (1).diagcab
2017-10-27 20:01 - 2017-10-27 20:01 - 000001440 _____ C:\Users\lem0th\Desktop\MediathekView.lnk
2017-10-27 19:58 - 2017-10-28 12:12 - 000110144 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll
2017-10-27 19:57 - 2017-10-28 12:14 - 000000000 ____D C:\Program Files\Java
2017-10-27 19:39 - 2017-10-27 19:39 - 000195346 _____ C:\Users\lem0th\Documents\wu170509.diagcab
2017-10-25 12:33 - 2017-10-25 12:33 - 000265976 _____ C:\Users\lem0th\Documents\lageplan_uke.pdf

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-11-24 19:33 - 2017-01-17 18:40 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\NetSpeedMonitor
2017-11-24 19:26 - 2017-03-15 12:54 - 000000000 ____D C:\Users\lem0th\AppData\Local\Ashampoo Backup PB
2017-11-24 19:06 - 2017-01-17 17:29 - 000000000 ____D C:\Users\lem0th\AppData\LocalLow\Mozilla
2017-11-24 13:42 - 2017-09-29 14:46 - 000000000 ___HD C:\Program Files\WindowsApps
2017-11-24 13:42 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\AppReadiness
2017-11-24 13:38 - 2017-03-15 12:52 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
2017-11-24 13:37 - 2017-03-15 12:52 - 000000000 ____D C:\ProgramData\Ashampoo
2017-11-23 23:58 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\DeliveryOptimization
2017-11-22 13:41 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\NDF
2017-11-22 05:36 - 2017-09-29 09:45 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\system32\F12
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\TextInput
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\appraiser
2017-11-22 05:34 - 2017-09-29 09:45 - 000000000 ____D C:\WINDOWS\system32\Dism
2017-11-22 05:33 - 2017-09-29 14:44 - 000000000 ____D C:\WINDOWS\INF
2017-11-21 21:01 - 2017-04-08 14:31 - 000000000 ____D C:\Users\lem0th\MediathekView
2017-11-21 21:00 - 2017-04-08 14:06 - 000000000 ____D C:\Users\lem0th\.mediathek3
2017-11-21 14:22 - 2010-11-21 04:27 - 000545440 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2017-11-20 01:44 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2017-11-20 01:44 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\Macromed
2017-11-18 23:09 - 2017-10-22 21:52 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\vlc
2017-11-18 21:01 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\rescache
2017-11-18 04:32 - 2017-01-17 18:33 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\KeePass
2017-11-17 21:32 - 2017-09-29 14:37 - 000000000 ____D C:\WINDOWS\CbsTemp
2017-11-17 20:17 - 2016-08-25 11:17 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-11-17 20:17 - 2014-11-05 16:46 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\zu-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\yo-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\xh-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\wo-SN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\vi-VN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\uz-Latn-UZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ur-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ug-CN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\tt-RU
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\tn-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\tk-TM
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ti-ET
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\tg-Cyrl-TJ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\te-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ta-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\sw-KE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-RS
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-BA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\sq-AL
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\si-LK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\sd-Arab-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\rw-RW
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\quz-PE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\quc-Latn-GT
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\prs-AF
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-Arab-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\or-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\nso-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\nn-NO
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ne-NP
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\mt-MT
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\mr-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\mn-MN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ml-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\mk-MK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\mi-NZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\lo-LA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\lb-LU
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ky-KG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ku-Arab-IQ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\kok-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\kn-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\km-KH
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\kk-KZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ka-GE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\is-IS
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ig-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\id-ID
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\hy-AM
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ha-Latn-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\gu-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\gd-GB
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ga-IE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\fil-PH
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\fa-IR
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\cy-GB
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\chr-CHER-US
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ca-ES-valencia
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\bs-Latn-BA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\bn-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\bn-BD
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\be-BY
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\az-Latn-AZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\as-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\am-ET
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\af-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\zu-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\yo-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\xh-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\wo-SN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\vi-VN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\uz-Latn-UZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ur-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ug-CN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\tt-RU
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\tn-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\tk-TM
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ti-ET
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\tg-Cyrl-TJ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\te-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ta-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\sw-KE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-RS
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-BA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\sq-AL
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\si-LK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\sd-Arab-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\rw-RW
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\quz-PE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\quc-Latn-GT
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\prs-AF
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\pa-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\pa-Arab-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\or-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\nso-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\nn-NO
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ne-NP
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\mt-MT
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\mr-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\mn-MN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ml-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\mk-MK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\mi-NZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\lo-LA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\lb-LU
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ky-KG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ku-Arab-IQ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\kok-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\kn-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\km-KH
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\kk-KZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ka-GE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\is-IS
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ig-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\id-ID
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\hy-AM
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ha-Latn-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\gu-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\gd-GB
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ga-IE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\fil-PH
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\fa-IR
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\cy-GB
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\chr-CHER-US
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ca-ES-valencia
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\bs-Latn-BA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\bn-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\bn-BD
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\be-BY
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\az-Latn-AZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\as-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\am-ET
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\af-ZA
2017-11-16 20:01 - 2017-09-03 02:54 - 000000000 ____D C:\Program Files\WhoCrashed
2017-11-16 16:56 - 2015-01-24 15:32 - 000000000 ____D C:\ProgramData\Package Cache
2017-11-14 15:41 - 2017-01-17 17:29 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Mozilla
2017-11-14 15:41 - 2016-07-23 17:08 - 000001228 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-11-14 01:22 - 2016-01-22 23:25 - 000002271 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-11-11 15:12 - 2017-09-30 15:34 - 000969320 _____ C:\WINDOWS\system32\perfh007.dat
2017-11-11 15:12 - 2017-09-30 15:34 - 000223032 _____ C:\WINDOWS\system32\perfc007.dat
2017-11-10 01:38 - 2017-06-21 16:11 - 000001056 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Core Temp.lnk
2017-11-07 12:33 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2017-11-04 02:25 - 2017-09-29 14:49 - 000835568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-11-04 02:25 - 2017-09-29 14:49 - 000177648 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-11-04 00:07 - 2017-01-17 17:43 - 000000000 ____D C:\Users\lem0th\AppData\Local\ElevatedDiagnostics
2017-11-03 21:29 - 2017-05-10 14:44 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-11-03 21:28 - 2017-03-08 18:48 - 000000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2017-11-03 21:26 - 2017-03-08 18:46 - 000000000 ____D C:\Program Files (x86)\TeamViewer
2017-11-03 21:23 - 2015-04-07 10:25 - 000000000 ____D C:\ProgramData\Skype
2017-11-03 21:12 - 2017-01-17 18:22 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Skype
2017-11-02 02:08 - 2017-06-21 16:53 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Everything
2017-11-01 17:11 - 2016-04-04 22:51 - 000014030 __RSH C:\ProgramData\ntuser.pol
2017-10-31 12:18 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\appcompat
2017-10-30 16:51 - 2017-02-20 17:19 - 000002358 _____ C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Vivaldi.lnk
2017-10-30 16:51 - 2017-02-20 17:19 - 000000000 ____D C:\Users\lem0th\AppData\Local\Vivaldi
2017-10-30 16:39 - 2017-01-17 16:59 - 000000000 ____D C:\Users\lem0th\AppData\Local\TileDataLayer
2017-10-30 16:39 - 2015-07-29 17:28 - 000000000 __RHD C:\Users\Public\AccountPictures
2017-10-30 16:35 - 2017-09-29 14:46 - 000000000 ____D C:\Program Files\windows nt
2017-10-30 16:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\Registration
2017-10-30 16:34 - 2017-09-29 09:45 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2017-10-30 16:32 - 2015-07-29 17:19 - 000023056 _____ C:\WINDOWS\system32\emptyregdb.dat
2017-10-30 16:30 - 2017-09-29 14:46 - 000000000 __RSD C:\WINDOWS\media
2017-10-30 16:19 - 2017-10-15 17:36 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Everything
2017-10-30 16:19 - 2017-04-17 21:18 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Paragon Partition Manager™ 14 Free
2017-10-30 16:19 - 2017-02-13 15:20 - 000000000 ___RD C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Test2
2017-10-30 16:12 - 2017-09-29 14:46 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-10-30 16:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\inetsrv
2017-10-30 16:09 - 2017-09-29 14:46 - 000000000 ____D C:\ProgramData\USOPrivate
2017-10-30 16:09 - 2017-02-26 20:44 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Hammer & Chisel, Inc
2017-10-30 16:08 - 2015-11-19 15:54 - 000000000 ____D C:\Users\Administrator\AppData\Local\Packages
2017-10-30 16:02 - 2017-04-06 16:05 - 002003936 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2017-10-30 16:01 - 2017-09-29 09:45 - 000000000 ____D C:\WINDOWS\system32\Sysprep
2017-10-30 16:00 - 2017-04-06 16:04 - 000000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2017-10-30 15:57 - 2017-09-29 14:46 - 000028672 _____ C:\WINDOWS\system32\config\BCD-Template
2017-10-30 15:55 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase
2017-10-30 15:55 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\system32\Tasks_Migrated
2017-10-30 15:54 - 2017-10-15 17:58 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2017-10-30 15:54 - 2017-10-15 17:52 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2017-10-30 15:54 - 2017-10-15 17:01 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VeraCrypt
2017-10-30 15:54 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\SysWOW64\WCN
2017-10-30 15:54 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\SysWOW64\sysprep
2017-10-30 15:54 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\system32\WCN
2017-10-30 15:54 - 2017-09-29 14:49 - 000000000 ____D C:\WINDOWS\Setup
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 __SHD C:\Program Files\Windows Sidebar
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 __SHD C:\Program Files (x86)\Windows Sidebar
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\SysWOW64\DiagSvcs
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\Downloaded Program Files
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\IME
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\spool
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\IME
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\AppLocker
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\schemas
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\Resources
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\IME
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\Program Files\Common Files\microsoft shared
2017-10-30 15:54 - 2017-08-31 03:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinMerge
2017-10-30 15:54 - 2017-08-30 17:21 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
2017-10-30 15:54 - 2017-08-17 12:53 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Software
2017-10-30 15:54 - 2017-04-17 21:28 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AOMEI Partition Assistant Standard Edition 6.1
2017-10-30 15:54 - 2017-03-30 22:36 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 5.2
2017-10-30 15:54 - 2017-03-29 14:52 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware
2017-10-30 15:54 - 2017-03-28 23:15 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy
2017-10-30 15:54 - 2017-03-21 02:59 - 000000000 __RSD C:\WINDOWS\system32\WindowsDevicePortal
2017-10-30 15:54 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\system32\catroot2.bak
2017-10-30 15:54 - 2017-03-11 00:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
2017-10-30 15:54 - 2017-02-23 22:44 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack
2017-10-30 15:54 - 2017-01-21 23:07 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Classic Shell
2017-10-30 15:54 - 2016-12-30 02:08 - 000000000 ____D C:\WINDOWS\SysWOW64\%ProductFolder%
2017-10-30 15:54 - 2016-12-30 00:07 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Anti-Ransomware Tool for Business
2017-10-30 15:54 - 2016-12-09 00:40 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-10-30 15:54 - 2016-09-02 00:41 - 000000000 ____D C:\WINDOWS\SysWOW64\Hotspot Shield
2017-10-30 15:54 - 2016-08-03 18:45 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2017-10-30 15:54 - 2016-08-03 18:06 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CrystalDiskInfo
2017-10-30 15:54 - 2016-06-22 13:59 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gpg4win
2017-10-30 15:54 - 2016-05-31 12:20 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steuer 2015
2017-10-30 15:54 - 2015-10-27 01:05 - 000000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2017-10-30 15:54 - 2015-05-30 17:25 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\puush
2017-10-30 15:54 - 2015-02-21 23:13 - 000000000 ____D C:\WINDOWS\SysWOW64\Adobe
2017-10-30 15:54 - 2014-11-22 15:04 - 000000000 ____D C:\WINDOWS\system32\appmgmt
2017-10-30 15:54 - 2014-11-03 18:48 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NETGEAR WNA3100M Genie
2017-10-30 15:54 - 2014-01-23 19:41 - 000000000 ____D C:\WINDOWS\system32\MRT
2017-10-30 15:45 - 2017-09-29 14:46 - 000000000 __RHD C:\Users\Public\Libraries
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\SysWOW64\winrm
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\SysWOW64\slmgr
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\SysWOW64\Printing_Admin_Scripts
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\system32\winrm
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\system32\slmgr
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\system32\Printing_Admin_Scripts
2017-10-30 15:36 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2017-10-30 15:36 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\en-GB
2017-10-30 15:36 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2017-10-30 15:36 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\oobe
2017-10-30 15:36 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\en-GB
2017-10-30 15:36 - 2017-04-06 16:04 - 000000000 ____D C:\WINDOWS\system32\SRSLabs
2017-10-30 15:36 - 2017-03-21 02:59 - 000000000 ___RD C:\WINDOWS\WebManagement
2017-10-30 15:35 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\system32\dsc
2017-10-30 15:35 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\system32\DiagSvcs
2017-10-30 15:34 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\OCR
2017-10-30 15:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\Help
2017-10-30 15:34 - 2017-09-29 14:46 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2017-10-30 15:34 - 2017-09-29 14:46 - 000000000 ____D C:\Program Files\Common Files\system
2017-10-30 15:34 - 2017-09-29 14:46 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2017-10-30 15:34 - 2017-08-17 12:51 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
2017-10-30 15:34 - 2017-04-06 16:04 - 000000000 ____D C:\Program Files\Realtek
2017-10-30 15:34 - 2016-08-29 17:47 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\sixteen tons entertainment
2017-10-30 15:34 - 2016-01-30 19:55 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MAGIX
2017-10-30 15:34 - 2015-09-22 16:14 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games
2017-10-30 15:27 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\inetsrv
2017-10-30 15:26 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\MUI
2017-10-30 15:26 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\MUI
2017-10-30 15:25 - 2017-09-29 14:43 - 000613376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqsnap.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000261632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000096256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa.tlb
2017-10-30 15:25 - 2017-09-29 14:43 - 000090624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa30.tlb
2017-10-30 15:25 - 2017-09-29 14:43 - 000055296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa20.tlb
2017-10-30 15:25 - 2017-09-29 14:43 - 000048640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\admwprox.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000036864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa10.tlb
2017-10-30 15:25 - 2017-09-29 14:43 - 000016896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisreset.exe
2017-10-30 15:25 - 2017-09-29 14:43 - 000014848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqcertui.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000011264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wamregps.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisrstap.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000009096 _____ C:\WINDOWS\SysWOW64\msmqtrc.mof
2017-10-30 15:25 - 2017-09-29 14:42 - 000054272 _____ (Microsoft Corporation) C:\WINDOWS\system32\admwprox.dll
2017-10-30 15:25 - 2017-09-29 14:42 - 000018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisreset.exe
2017-10-30 15:25 - 2017-09-29 14:42 - 000015360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wamregps.dll
2017-10-30 15:25 - 2017-09-29 14:42 - 000013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisrstap.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000980888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\lxcore.sys
2017-10-30 15:25 - 2017-09-29 14:41 - 000222720 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqrt.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplayx.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmsif.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mqac.sys
2017-10-30 15:25 - 2017-09-29 14:41 - 000072704 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsl.exe
2017-10-30 15:25 - 2017-09-29 14:41 - 000046592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpwsockx.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000024576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpmodemx.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000020480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplaysvr.exe
2017-10-30 15:25 - 2017-09-29 14:41 - 000018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmsifproxystub.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisRtl.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisRtl.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\ahadmin.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ahadmin.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000014336 _____ (Microsoft Corporation) C:\WINDOWS\system32\cngkeyhelper.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000011264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cngkeyhelper.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 001677824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmswitch.sys
2017-10-30 15:24 - 2017-09-29 14:41 - 000776192 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqsnap.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000747008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Wnv.sys
2017-10-30 15:24 - 2017-09-29 14:41 - 000564224 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqutil.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000389120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnet.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000306688 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000126464 _____ (Microsoft Corporation) C:\WINDOWS\system32\LxRun.exe
2017-10-30 15:24 - 2017-09-29 14:41 - 000125952 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqlogmgr.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000096256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa.tlb
2017-10-30 15:24 - 2017-09-29 14:41 - 000090624 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa30.tlb
2017-10-30 15:24 - 2017-09-29 14:41 - 000088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\nvspinfo.exe
2017-10-30 15:24 - 2017-09-29 14:41 - 000073216 _____ (Microsoft Corporation) C:\WINDOWS\system32\bash.exe
2017-10-30 15:24 - 2017-09-29 14:41 - 000062464 _____ (Microsoft Corporation) C:\WINDOWS\system32\wnvapi.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnathlp.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000055296 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa20.tlb
2017-10-30 15:24 - 2017-09-29 14:41 - 000036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa10.tlb
2017-10-30 15:24 - 2017-09-29 14:41 - 000034816 _____ (Microsoft Corporation) C:\WINDOWS\system32\wslapi.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000033688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmsproxy.sys
2017-10-30 15:24 - 2017-09-29 14:41 - 000022528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnsvr.exe
2017-10-30 15:24 - 2017-09-29 14:41 - 000017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqcertui.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000009096 _____ C:\WINDOWS\system32\msmqtrc.mof
2017-10-30 15:24 - 2017-09-29 14:41 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhupnp.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhpast.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnlobby.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnaddr.dll
2017-10-30 15:23 - 2017-09-29 14:43 - 000562176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqutil.dll
2017-10-30 15:23 - 2017-09-29 14:43 - 000156160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqrt.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 001381888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqqm.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000464896 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnet.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000067584 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnathlp.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqbkup.exe
2017-10-30 15:23 - 2017-09-29 14:41 - 000041984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wslconfig.exe
2017-10-30 15:23 - 2017-09-29 14:41 - 000026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnsvr.exe
2017-10-30 15:23 - 2017-09-29 14:41 - 000026112 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqsvc.exe
2017-10-30 15:23 - 2017-09-29 14:41 - 000015768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\lxss.sys
2017-10-30 15:23 - 2017-09-29 14:41 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhupnp.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhpast.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnlobby.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnaddr.dll
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\lv-LV
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\lt-LT
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\et-EE
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\es-MX
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\lv-LV
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\lt-LT
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\et-EE
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\es-MX
2017-10-30 13:04 - 2017-08-31 13:31 - 000028574 _____ C:\Users\lem0th\Documents\NeueDatenbank.kdbx
2017-10-28 12:21 - 2016-04-05 13:15 - 000000000 ____D C:\Program Files\7-Zip
2017-10-28 12:19 - 2017-06-22 03:14 - 000000000 ____D C:\Users\lem0th\AppData\Local\Everything

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2017-05-28 21:40 - 2017-05-28 21:41 - 832691886 _____ () C:\Users\lem0th\AppData\Roaming\Factorio.zip
2017-02-17 23:26 - 2017-03-27 02:39 - 000000154 _____ () C:\Users\lem0th\AppData\Roaming\prio.ini
2017-04-30 18:56 - 2017-04-30 02:43 - 000000027 _____ () C:\Users\lem0th\AppData\Roaming\test.bat
2017-11-17 20:35 - 2017-11-17 20:35 - 000000000 _____ () C:\Users\lem0th\AppData\Roaming\text.txt
2017-01-17 17:42 - 2016-07-17 22:18 - 000007656 _____ () C:\Users\lem0th\AppData\Local\Resmon.ResmonCfg

==================== Bamital & volsnap ======================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert

LastRegBack: 2017-11-19 18:21

==================== Ende von FRST.txt ============================

Rest kommt im nächsten Beitrag.

Screenshot: https://puu.sh/ysLd5/8658eeb8b7.png (Kaspersky ist installiert, da ich es irgendwie nicht deinstalliert kriege. Finde es auch nicht im Autostart)

M-K-D-B · 24.11.2017, 22:26

Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.

Um die Bereinigung möchlichst effektiv und schnell gestalten zu können, bitte ich um Beachtung der folgenden Hinweise:

Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support unterbrechen bis jegliche Art von illegaler Software vom Rechner entfernt wurde.
Lies dir meine Anleitungen immer sorgfältig durch, arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste immer alle Logdateien (auch wenn nichts gefunden wurde). Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
Solltest du mir nicht innerhalb von 3 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo. Solltest du einmal länger abwesend sein, so gib mir bitte Bescheid!
Während der Bereinigung bitte nichts installieren oder deinstallieren, außer ich bitte dich darum!
Außerdem bitte ich dich, nicht eigenmächtig irgendwelche Sicherheitsprogramme auszuführen und damit deinen Rechner zu überprüfen/bereinigen, da ich so leicht den Überblick verlieren kann.
Zudem hättest du dir das Eröffnen eines Themas in diesem Fall auch gleich sparen können, wenn du dann doch wieder alleine rumhantierst.
Bitte beachten: Download bei filepony.de: So ladet Ihr unsere Tools richtig!
Alle zu verwendenen Programme sind auf dem Desktop ( C:\users\dein Benutzername\Desktop\ ) abzuspeichern und von dort als Administrator zu starten!
Einige Programme, die wir hier verwenden, können unter Umständen von deinem Antiviren- oder Anti-Malwareprogramm fälschlicherweise als Bedrohung eingestuft werden. Die Sicherheitsprogramme können aufgrund eines bestimmten Programmverhaltens nicht zwischen "gut" oder "böse" unterscheiden und schlagen Alarm. Dabei handelt es sich um Fehlalarme, welche du getrost ignorieren kannst. Gegebenenfalls musst du deine Sicherheitssoftware vor der Ausführung eines Programms deaktivieren, damit unsere Bereinigungsvorgänge nicht beeinträchtigt werden.
Sollten die Logdateien einmal die zulässige Länge (~ 120.000 Zeichen) überschreiten, so teile die Logdateien auf mehrere Posts auf.
Zur Not kannst du die Logdateien dann auch zippen (in ein .zip Archiv packen) und als Anhang hochladen.
Bitte arbeite so lange mit mir zusammen, bis ich dir sage, dass wir fertig sind und dein Rechner "sauber" ist. Das vorzeitige Verschwinden von Symptomen heißt nicht automatisch, dass dein Rechner bereits vollständig sauber ist.
In der Regel antworte ich dir innerhalb von 24 Stunden, oft sogar wesentlich schneller.
Jedoch habe auch ich einen normalen Beruf und Familie. Ich bin daher nicht jeden Tag stundenlag hier im Forum unterwegs. Es kann unter Umständen bis zu 2 Tage dauern, bis du eine Antwort von mir erhältst. Sollte diese Zeit überschritten sein, so kannst du mir gerne eine PM als Erinnerung schicken.

Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags:

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke aauf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Danke für deine Mitarbeit!

Schritt 1
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Bitte poste mit deiner nächsten Antwort

die beiden neuen Logdateien von FRST (FRST.txt und Addition.txt).

Ladekabel612 · 24.11.2017, 22:42

Code:

ATTFilter

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 24-11-2017 01
durchgeführt von lem0th (Administrator) auf COMPUTER-128234 (24-11-2017 22:32:12)
Gestartet von C:\Users\lem0th\Desktop
Geladene Profile: lem0th & _ashbackuppb_ (Verfügbare Profile: lem0th & _ashbackuppb_ & Administrator & DefaultAppPool)
Platform: Windows 10 Pro Version 1709 16299.64 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Ransomware Tool for Business 1.1\anti_ransom.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
() C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
() C:\Program Files (x86)\NETGEAR\WNA3100M\WifiSvc.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(WIBU-SYSTEMS AG) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
() C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupService-abpb.exe
() C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\oxHelper.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Ransomware Tool for Business 1.1\anti_ransom_gui.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Ransomware Tool for Business 1.1\anti_ransom_gui.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Ransomware Tool for Business 1.1\anti_ransom_gui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupClient-abpb.exe
() C:\Program Files (x86)\puush\puush.exe
() C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\oxHelper.exe
() C:\Program Files (x86)\NETGEAR\WNA3100M\WNA3100M.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Discord Inc.) C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\Discord.exe
(Discord Inc.) C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\Discord.exe
(Discord Inc.) C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\Discord.exe
(Dominik Reichl) C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_11710.1001.27.0_x64__8wekyb3d8bbwe\WinStore.App.exe
(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Microsoft Corporation) C:\Windows\System32\DataExchangeHost.exe
(Ashampoo Development GmbH & Co. KG) C:\Program Files (x86)\Ashampoo\Ashampoo UnInstaller 7\UI7.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft) C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkypeApp.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
(Microsoft Corporation) C:\Windows\System32\browser_broker.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe

==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [630168 2017-09-29] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13885696 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [163800 2016-07-30] (IvoSoft)
HKLM\...\Run: [Ashampoo Backup PB] => C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupClient-abpb.exe [326040 2017-05-08] ()
HKLM\...\Run: [Everything] => C:\Program Files\Everything\Everything.exe [2197608 2017-06-07] ()
HKLM-x32\...\Run: [ISUSScheduler] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2004-06-14] (InstallShield Software Corporation)
HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [3222448 2017-10-12] (Dominik Reichl)
HKLM-x32\...\Run: [vmware-tray.exe] => C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe [112104 2017-03-21] (VMware, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-09-05] (Oracle Corporation)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Beschränkung <==== ACHTUNG
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Run: [puush] => C:\Program Files (x86)\puush\puush.exe [568904 2015-05-30] ()
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Run: [Discord] => C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\Discord.exe [57477112 2017-08-08] (Discord Inc.)
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Run: [ISUSPM Startup] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [221184 2004-06-14] (InstallShield Software Corporation)
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Run: [Vivaldi Update Notifier] => C:\ProgramData\chocolatey\lib\Vivaldi\tools\vivaldi\Vivaldi-bin\update_notifier.exe [4716664 2017-09-20] (Vivaldi Technologies AS)
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Policies\system: [DisableLockWorkstation] 1
HKU\S-1-5-21-624198674-977653023-2037852723-1052\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [519680 2017-09-29] (Microsoft Corporation)
AppInit_DLLs: prio.dll => Keine Datei
IFEO\utilman.exe: [Debugger] c:\windows\system32\cmd.exe
SSODL: EldosMountNotificator-cbfs6 - {73F8D53A-4E1F-4434-A7D0-7C1E3B50BB78} - C:\WINDOWS\system32\cbfsMntNtf6.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator-cbfs6 - {73F8D53A-4E1F-4434-A7D0-7C1E3B50BB78} - C:\WINDOWS\SysWOW64\cbfsMntNtf6.dll (EldoS Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WNA3100M Genie.lnk [2016-07-10]
ShortcutTarget: NETGEAR WNA3100M Genie.lnk -> C:\Program Files (x86)\NETGEAR\WNA3100M\WNA3100M.exe ()
GroupPolicy: Beschränkung <==== ACHTUNG
GroupPolicy\User: Beschränkung <==== ACHTUNG

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{0a287408-cae2-4b64-9929-6ec5bb421193}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-624198674-977653023-2037852723-1040\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://de.yahoo.com/?fr=yset_ie_syc_oracle&type=orcl_hpset
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-624198674-977653023-2037852723-1040 -> {8CD4FD52-359A-4F3E-BEB3-D2114C31B19B} URL = hxxps://de.search.yahoo.com/search?p={searchTerms}&intl=de&fr=yset_ie_syc_oracle&type=orcl_default&partnerexternal-oracle=external-oracle
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_151\bin\ssv.dll [2017-10-28] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_151\bin\jp2ssv.dll [2017-10-28] (Oracle Corporation)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2016-07-30] (IvoSoft)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2016-07-30] (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)

FireFox:
========
FF DefaultProfile: 3am39cb5.default
FF ProfilePath: C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default [2017-11-24]
FF NetworkProxy: Mozilla\Firefox\Profiles\3am39cb5.default -> backup.ftp", "100.44.118.68"
FF Extension: (No Resource URI Leak) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\@no-resource-uri-leak.xpi [2016-12-24] [Lagacy]
FF Extension: (HTTPS Everywhere) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\https-everywhere@eff.org.xpi [2017-11-23]
FF Extension: (uBlock Origin) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\uBlock0@raymondhill.net.xpi [2017-11-08]
FF Extension: (uMatrix) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\uMatrix@raymondhill.net.xpi [2017-11-23]
FF Extension: (User Agent Switcher) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}.xpi [2017-03-27] [Lagacy]
FF Extension: (O2 Service Suite) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\{} [2017-01-17] [Lagacy] [ist nicht signiert]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_27_0_0_187.dll [2017-11-20] ()
FF Plugin: @java.com/DTPlugin,version=11.151.2 -> C:\Program Files\Java\jre1.8.0_151\bin\dtplugin\npDeployJava1.dll [2017-10-28] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.151.2 -> C:\Program Files\Java\jre1.8.0_151\bin\plugin2\npjp2.dll [2017-10-28] (Oracle Corporation)
FF Plugin: @videolan.org/vlc,version=2.2.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_187.dll [2017-11-20] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll [2015-01-09] (Adobe Systems, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-13] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-13] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [Keine Datei]

Chrome: 
=======
CHR DefaultProfile: Profile 1
CHR StartupUrls: Profile 1 -> "hxxps://www.youtube.com/feed/subscriptions","hxxps://twitter.com/"
CHR DefaultSearchURL: Profile 1 -> hxxps://de.search.yahoo.com/search?p={searchTerms}&fr=yset_chr_syc_oracle&type=default
CHR DefaultSearchKeyword: Profile 1 -> Yahoo
CHR DefaultSuggestURL: Profile 1 -> hxxps://de.search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10
CHR Profile: C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default [2017-11-24]
CHR Extension: (Google Präsentationen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-03-12]
CHR Extension: (Google Docs) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-03-12]
CHR Extension: (Google Drive) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-03-12]
CHR Extension: (YouTube) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-03-12]
CHR Extension: (Google Tabellen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-03-12]
CHR Extension: (Google Docs Offline) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-06-30]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2017-03-12]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-12]
CHR Extension: (Google Mail) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-03-12]
CHR Extension: (Chrome Media Router) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-06-30]
CHR Profile: C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old [2017-03-15] <==== ACHTUNG
CHR Extension: (Google Präsentationen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-01-17]
CHR Extension: (Google Docs) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\aohghmighlieiainnegkcijnfilokake [2017-01-17]
CHR Extension: (Google Drive) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-01-17]
CHR Extension: (YouTube) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-01-17]
CHR Extension: (Google Tabellen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-01-17]
CHR Extension: (Google Docs Offline) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-01-17]
CHR Extension: (Blue Space) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\lgafflokkagpjiofcoodepkehnpldbge [2017-01-17]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-17]
CHR Extension: (Google Mail) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-01-17]
CHR Profile: C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1 [2017-11-24]
CHR Extension: (Google Präsentationen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-01-17]
CHR Extension: (Google Docs) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2017-01-17]
CHR Extension: (Google Drive) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-01-17]
CHR Extension: (YouTube) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-01-17]
CHR Extension: (CryptUp: Encrypt Gmail with PGP) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bnjglocicdkmhmoohhfkfkbbkejdhdgc [2017-02-10]
CHR Extension: (uBlock Origin) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2017-01-17]
CHR Extension: (Google Tabellen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-01-17]
CHR Extension: (HTTPS Everywhere) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gcbommkclmclpchllfjekcdonpmejbdp [2017-01-28]
CHR Extension: (Google Docs Offline) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-01-17]
CHR Extension: (Black blue shards) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\hgoflmajhinnohnhkfeggflmmppiilck [2017-01-17]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-19]
CHR Extension: (uMatrix) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ogfcmafjalglgifnmanfmnieipoejdcf [2017-01-17]
CHR Extension: (Google Mail) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-01-17]
CHR Extension: (Chrome Media Router) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-01-28]
CHR Profile: C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\System Profile [2017-01-17]
CHR HKU\S-1-5-21-624198674-977653023-2037852723-1040\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S4 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2207960 2016-09-26] (Adobe Systems, Incorporated)
R2 AntiRansom; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Ransomware Tool for Business 1.1\anti_ransom.exe [693720 2016-07-19] (AO Kaspersky Lab)
R2 ashbackuppb; c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupService-abpb.exe [34712 2017-05-08] ()
R2 DirMngr; C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [216576 2016-08-18] () [Datei ist nicht signiert]
R2 EpsonScanSvc; C:\WINDOWS\system32\EscSvc64.exe [145224 2016-11-08] (Seiko Epson Corporation)
S3 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4470736 2017-05-09] (Malwarebytes)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [303360 2015-06-24] (Realtek Semiconductor)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [4297920 2017-09-30] (Microsoft Corporation)
S2 VMwareHostd; C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe [12482024 2017-03-21] ()
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [355304 2017-09-29] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [105944 2017-09-29] (Microsoft Corporation)
R2 WSWNA3100M; C:\Program Files (x86)\NETGEAR\WNA3100M\WifiSvc.exe [316120 2014-08-18] ()

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 ampa; C:\WINDOWS\system32\ampa.sys [38320 2016-12-25] ()
S3 ampa; C:\WINDOWS\SysWOW64\ampa.sys [38320 2016-12-25] ()
R1 cbfs6; C:\WINDOWS\system32\drivers\cbfs6.sys [460992 2016-06-13] (EldoS Corporation)
S3 dtlitescsibus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [30264 2016-09-17] (Disc Soft Ltd)
S3 dtliteusbbus; C:\WINDOWS\System32\drivers\dtliteusbbus.sys [47672 2016-09-17] (Disc Soft Ltd)
R0 kl1; C:\WINDOWS\System32\DRIVERS\kl1.sys [554416 2016-06-02] (AO Kaspersky Lab)
R3 klflt; C:\WINDOWS\system32\DRIVERS\klflt.sys [191312 2016-06-26] (AO Kaspersky Lab)
R1 klhk; C:\WINDOWS\system32\DRIVERS\klhk.sys [413008 2016-06-28] (AO Kaspersky Lab)
R1 KLIF; C:\WINDOWS\System32\DRIVERS\klif.sys [1012048 2016-06-26] (AO Kaspersky Lab)
R1 klpd; C:\WINDOWS\System32\DRIVERS\klpd.sys [45488 2016-05-31] (AO Kaspersky Lab)
R1 Klwtp; C:\WINDOWS\system32\DRIVERS\klwtp.sys [126864 2016-06-02] (AO Kaspersky Lab)
S3 MBAMFarflt; C:\WINDOWS\system32\drivers\farflt.sys [102856 2016-12-22] (Malwarebytes)
S3 MBAMProtection; C:\WINDOWS\system32\drivers\mbam.sys [43968 2016-12-22] (Malwarebytes)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [253856 2017-09-02] (Malwarebytes)
S3 MBAMWebProtection; C:\WINDOWS\system32\drivers\mwac.sys [91584 2016-12-23] (Malwarebytes)
R1 MpKsl0afd70c2; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1069DB8A-8BBF-4770-ACD8-EF3DF934A9C1}\MpKsl0afd70c2.sys [58120 2017-11-21] (Microsoft Corporation)
R1 MpKsl72594455; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8868E91A-25FE-4B58-B992-CC715B559242}\MpKsl72594455.sys [58120 2017-11-24] (Microsoft Corporation)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [604160 2017-09-29] (Realtek )
R3 RtlWlanu; C:\WINDOWS\System32\drivers\rtwlanu.sys [3859704 2015-10-16] (Realtek Semiconductor Corporation )
R3 taphss6; C:\WINDOWS\System32\drivers\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.)
R2 UI5IFS; C:\Program Files (x86)\Ashampoo\Ashampoo UnInstaller 7\IFS64.sys [30016 2017-11-17] ()
S3 usbrndis6; C:\WINDOWS\System32\drivers\usb80236.sys [23040 2017-09-29] (Microsoft Corporation)
S3 VBAudioVACMME; C:\WINDOWS\system32\DRIVERS\vbaudio_cable64_win7.sys [41192 2016-01-29] (Windows (R) Win 7 DDK provider)
R1 VBoxNetAdp; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys [131144 2016-12-20] (Oracle Corporation)
S3 VBoxUSB; C:\WINDOWS\System32\Drivers\VBoxUSB.sys [125008 2015-11-10] (Oracle Corporation)
R1 veracrypt; C:\WINDOWS\System32\drivers\veracrypt.sys [631200 2017-10-15] (IDRIX)
R3 vpnpbus; C:\WINDOWS\System32\drivers\vpnpbus.sys [18624 2016-06-13] (EldoS Corporation)
R2 vstor2-mntapi20-shared; C:\Windows\SysWow64\drivers\vstor2-mntapi20-shared.sys [37960 2016-11-14] (VMware, Inc.)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44608 2017-09-29] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [309144 2017-09-29] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [119192 2017-09-29] (Microsoft Corporation)
U3 idsvc; kein ImagePath

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-11-24 22:32 - 2017-11-24 22:35 - 000026069 _____ C:\Users\lem0th\Desktop\FRST.txt
2017-11-24 22:32 - 2017-11-24 22:32 - 000000000 ____D C:\Users\lem0th\Desktop\FRST-OlderVersion
2017-11-24 20:48 - 2017-11-24 20:48 - 000000134 _____ C:\Users\lem0th\sophie.txt
2017-11-24 20:35 - 2017-11-24 20:37 - 000000055 _____ C:\Users\lem0th\Desktop\sophie anschreiben text.txt
2017-11-24 19:34 - 2017-11-24 19:40 - 000081476 _____ C:\Users\lem0th\Downloads\Addition.txt
2017-11-24 19:28 - 2017-11-24 19:40 - 000096544 _____ C:\Users\lem0th\Downloads\FRST.txt
2017-11-24 19:27 - 2017-11-24 22:32 - 002393088 _____ (Farbar) C:\Users\lem0th\Desktop\FRST64.exe
2017-11-24 13:38 - 2017-11-24 13:38 - 000001285 _____ C:\Users\Public\Desktop\Ashampoo UnInstaller 7.lnk
2017-11-24 13:38 - 2017-11-24 13:38 - 000000221 _____ C:\Users\Public\Desktop\Ashampoo Deals.url
2017-11-24 13:38 - 2017-11-24 13:38 - 000000000 ____D C:\Users\lem0th\AppData\Local\Ashampoo
2017-11-24 13:37 - 2017-11-24 13:37 - 000000000 ____D C:\Program Files (x86)\Ashampoo
2017-11-24 13:35 - 2017-11-24 13:37 - 015879616 _____ (Ashampoo GmbH & Co. KG ) C:\Users\lem0th\Downloads\ashampoo_uninstaller_7_7.00.00_sm.exe
2017-11-23 20:09 - 2017-10-21 20:00 - 002916352 _____ C:\Users\lem0th\Desktop\main.db
2017-11-23 11:49 - 2017-11-23 11:50 - 059117240 _____ (Skype Technologies S.A. ) C:\Users\lem0th\Downloads\Skype-8.11.0.4.exe
2017-11-22 05:37 - 2017-11-22 05:37 - 000000022 _____ C:\WINDOWS\S.dirmngr
2017-11-22 05:37 - 2017-11-22 05:37 - 000000000 ____H C:\ProgramData\cm-lock
2017-11-22 05:27 - 2017-11-22 05:27 - 000000039 _____ C:\Users\lem0th\jeff stream.txt
2017-11-21 19:24 - 2017-11-21 19:24 - 000167296 _____ (Gibson Research Corp.) C:\Users\lem0th\Downloads\DNSBench.exe
2017-11-21 19:20 - 2017-11-21 19:21 - 000008653 _____ C:\Users\lem0th\Downloads\DNS Benchmarklist v1 by Möwe.ini
2017-11-21 02:18 - 2017-11-21 02:18 - 000000037 _____ C:\Users\lem0th\cities patar.txt
2017-11-20 01:46 - 2017-11-20 01:46 - 000001450 _____ C:\MediathekView.lnk
2017-11-20 01:44 - 2017-11-20 01:44 - 000004466 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2017-11-20 01:43 - 2017-11-20 01:43 - 000000000 ____D C:\Users\Default\AppData\Roaming\Macromedia
2017-11-20 01:43 - 2017-11-20 01:43 - 000000000 ____D C:\Users\Default User\AppData\Roaming\Macromedia
2017-11-17 21:28 - 2017-10-25 10:11 - 017083904 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
2017-11-17 21:28 - 2017-10-25 10:09 - 021753344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
2017-11-17 21:28 - 2017-10-25 04:36 - 025246208 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-11-17 21:28 - 2017-10-25 04:16 - 023658496 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-11-17 21:27 - 2017-10-25 10:11 - 000336896 _____ (Microsoft Corporation) C:\WINDOWS\system32\HolographicRuntimes.dll
2017-11-17 21:27 - 2017-10-25 09:57 - 000956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Spectrum.exe
2017-11-17 21:27 - 2017-10-25 09:57 - 000882688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Mirage.Internal.dll
2017-11-17 21:27 - 2017-10-25 09:56 - 000665600 _____ (Microsoft Corporation) C:\WINDOWS\system32\DHolographicDisplay.dll
2017-11-17 21:27 - 2017-10-25 07:36 - 000618496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Mirage.Internal.dll
2017-11-17 21:27 - 2017-10-25 05:41 - 000362176 _____ (Microsoft Corporation) C:\WINDOWS\system32\BioIso.exe
2017-11-17 21:27 - 2017-10-25 05:40 - 001634288 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2017-11-17 21:27 - 2017-10-25 05:40 - 000612760 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2017-11-17 21:27 - 2017-10-25 05:40 - 000269696 _____ C:\WINDOWS\system32\FaceProcessorCore.dll
2017-11-17 21:27 - 2017-10-25 05:39 - 007831248 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2017-11-17 21:27 - 2017-10-25 05:39 - 000479912 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64win.dll
2017-11-17 21:27 - 2017-10-25 05:39 - 000285080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2017-11-17 21:27 - 2017-10-25 05:37 - 001954048 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2017-11-17 21:27 - 2017-10-25 05:37 - 000610712 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2017-11-17 21:27 - 2017-10-25 05:36 - 008590744 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-11-17 21:27 - 2017-10-25 05:36 - 002400664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2017-11-17 21:27 - 2017-10-25 05:36 - 000187288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2017-11-17 21:27 - 2017-10-25 05:34 - 002573208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2017-11-17 21:27 - 2017-10-25 05:34 - 000839928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Perception.Stub.dll
2017-11-17 21:27 - 2017-10-25 05:34 - 000710920 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2017-11-17 21:27 - 2017-10-25 05:32 - 000559512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2017-11-17 21:27 - 2017-10-25 05:32 - 000147864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wcifs.sys
2017-11-17 21:27 - 2017-10-25 05:31 - 000436120 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHostCommon.dll
2017-11-17 21:27 - 2017-10-25 05:31 - 000045464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storufs.sys
2017-11-17 21:27 - 2017-10-25 05:30 - 004487968 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2017-11-17 21:27 - 2017-10-25 05:30 - 000555416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2017-11-17 21:27 - 2017-10-25 05:29 - 002269080 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsrcsnk.dll
2017-11-17 21:27 - 2017-10-25 05:29 - 001507736 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2017-11-17 21:27 - 2017-10-25 05:29 - 000603920 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2017-11-17 21:27 - 2017-10-25 05:28 - 001170008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2017-11-17 21:27 - 2017-10-25 05:27 - 006791472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2017-11-17 21:27 - 2017-10-25 05:27 - 001970520 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2017-11-17 21:27 - 2017-10-25 05:27 - 001426152 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2017-11-17 21:27 - 2017-10-25 05:27 - 000374032 _____ (Microsoft Corporation) C:\WINDOWS\system32\vac.exe
2017-11-17 21:27 - 2017-10-25 05:24 - 000428952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2017-11-17 21:27 - 2017-10-25 05:20 - 002717392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2017-11-17 21:27 - 2017-10-25 04:52 - 001615720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2017-11-17 21:27 - 2017-10-25 04:50 - 001528904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2017-11-17 21:27 - 2017-10-25 04:30 - 005615968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2017-11-17 21:27 - 2017-10-25 04:30 - 000354200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudExperienceHostCommon.dll
2017-11-17 21:27 - 2017-10-25 04:28 - 004648528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2017-11-17 21:27 - 2017-10-25 04:28 - 001246432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2017-11-17 21:27 - 2017-10-25 04:28 - 000982016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2017-11-17 21:27 - 2017-10-25 04:27 - 001454568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsrcsnk.dll
2017-11-17 21:27 - 2017-10-25 04:27 - 001377080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2017-11-17 21:27 - 2017-10-25 04:27 - 001015008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2017-11-17 21:27 - 2017-10-25 04:24 - 000506256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Perception.Stub.dll
2017-11-17 21:27 - 2017-10-25 04:22 - 006015200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2017-11-17 21:27 - 2017-10-25 04:22 - 002465848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2017-11-17 21:27 - 2017-10-25 04:19 - 003670016 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-11-17 21:27 - 2017-10-25 04:19 - 000097792 _____ C:\WINDOWS\system32\runexehelper.exe
2017-11-17 21:27 - 2017-10-25 04:18 - 000975872 _____ C:\WINDOWS\system32\FaceProcessor.dll
2017-11-17 21:27 - 2017-10-25 04:18 - 000328192 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll
2017-11-17 21:27 - 2017-10-25 04:18 - 000301056 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcLayers.dll
2017-11-17 21:27 - 2017-10-25 04:18 - 000135168 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_CapabilityAccess.dll
2017-11-17 21:27 - 2017-10-25 04:18 - 000095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\CapabilityAccessManagerClient.dll
2017-11-17 21:27 - 2017-10-25 04:18 - 000056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcSpecfc.dll
2017-11-17 21:27 - 2017-10-25 04:16 - 000227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\CapabilityAccessManager.dll
2017-11-17 21:27 - 2017-10-25 04:16 - 000114688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\UcmCx.sys
2017-11-17 21:27 - 2017-10-25 04:16 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzres.dll
2017-11-17 21:27 - 2017-10-25 04:15 - 000140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2017-11-17 21:27 - 2017-10-25 04:14 - 000541184 _____ (Microsoft Corporation) C:\WINDOWS\system32\HolographicExtensions.dll
2017-11-17 21:27 - 2017-10-25 04:14 - 000046080 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdrleakdiag.exe
2017-11-17 21:27 - 2017-10-25 04:13 - 002972672 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
2017-11-17 21:27 - 2017-10-25 04:12 - 000708096 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2017-11-17 21:27 - 2017-10-25 04:12 - 000599040 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2017-11-17 21:27 - 2017-10-25 04:12 - 000568832 _____ (Microsoft Corporation) C:\WINDOWS\system32\TileDataRepository.dll
2017-11-17 21:27 - 2017-10-25 04:11 - 000768512 _____ (Microsoft Corporation) C:\WINDOWS\system32\PCPKsp.dll
2017-11-17 21:27 - 2017-10-25 04:10 - 008099328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-11-17 21:27 - 2017-10-25 04:10 - 004742144 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2017-11-17 21:27 - 2017-10-25 04:10 - 001167360 _____ (Microsoft Corporation) C:\WINDOWS\system32\ISM.dll
2017-11-17 21:27 - 2017-10-25 04:09 - 002862080 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2017-11-17 21:27 - 2017-10-25 04:09 - 002106368 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2017-11-17 21:27 - 2017-10-25 04:09 - 001806336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll
2017-11-17 21:27 - 2017-10-25 04:09 - 000812032 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 002905600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-11-17 21:27 - 2017-10-25 04:08 - 002781696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 002633216 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 002392576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 001667584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Input.Inking.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 000654848 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 000487424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcSpecfc.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 000465408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 018914304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 003478016 _____ (Microsoft Corporation) C:\WINDOWS\system32\mispace.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 001485824 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 000685056 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 000372224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcLayers.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 000064512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CapabilityAccessManagerClient.dll
2017-11-17 21:27 - 2017-10-25 04:06 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tzres.dll
2017-11-17 21:27 - 2017-10-25 04:05 - 019339776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-11-17 21:27 - 2017-10-25 04:05 - 000106496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2017-11-17 21:27 - 2017-10-25 04:05 - 000022528 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtcVSp1res.dll
2017-11-17 21:27 - 2017-10-25 04:04 - 000124928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\luafv.sys
2017-11-17 21:27 - 2017-10-25 04:04 - 000041984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdrleakdiag.exe
2017-11-17 21:27 - 2017-10-25 04:03 - 000450048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TileDataRepository.dll
2017-11-17 21:27 - 2017-10-25 04:02 - 000591872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PCPKsp.dll
2017-11-17 21:27 - 2017-10-25 04:01 - 000462848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2017-11-17 21:27 - 2017-10-25 03:59 - 003679232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2017-11-17 21:27 - 2017-10-25 03:59 - 000664576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2017-11-17 21:27 - 2017-10-25 03:58 - 002467840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2017-11-17 21:27 - 2017-10-25 03:58 - 001322496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Input.Inking.dll
2017-11-17 21:27 - 2017-10-25 03:58 - 001280000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll
2017-11-17 21:27 - 2017-10-25 03:57 - 006035968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-11-17 21:27 - 2017-10-25 03:55 - 002864640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mispace.dll
2017-11-17 21:27 - 2017-10-25 03:54 - 000022528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msdtcVSp1res.dll
2017-11-17 21:27 - 2017-10-21 13:25 - 003313968 _____ C:\WINDOWS\system32\Windows.Mirage.dll
2017-11-17 21:27 - 2017-10-20 15:17 - 002474584 _____ C:\WINDOWS\SysWOW64\Windows.Mirage.dll
2017-11-17 21:27 - 2017-10-20 06:08 - 000339968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msexcl40.dll
2017-11-17 20:35 - 2017-11-17 20:35 - 000000000 _____ C:\Users\lem0th\AppData\Roaming\text.txt
2017-11-17 20:27 - 2017-11-17 20:27 - 000000000 ____D C:\Users\lem0th\AppData\Local\CrystalDiskMark5
2017-11-17 20:14 - 2017-11-17 20:14 - 000000000 ____D C:\WINDOWS\containers
2017-11-17 20:05 - 2017-11-17 20:07 - 000000000 ____D C:\WLAN
2017-11-17 19:59 - 2017-11-17 20:00 - 000000000 ____D C:\Program Files\CrystalDiskMark5
2017-11-17 19:58 - 2017-11-17 19:59 - 002783312 _____ (Crystal Dew World ) C:\Users\lem0th\Downloads\crystaldiskmark5_1_2-en.exe
2017-11-17 15:56 - 2017-11-17 15:56 - 000000000 _____ C:\WINDOWS\SysWOW64\last.dump
2017-11-17 15:45 - 2017-11-17 15:45 - 000061304 _____ () C:\WINDOWS\system32\Drivers\lpsport.sys
2017-11-17 15:37 - 2017-11-17 15:43 - 000000000 ____D C:\ProgramData\AVAST Software
2017-11-17 15:34 - 2017-11-17 15:35 - 010849904 _____ (Piriform Ltd) C:\Users\lem0th\Downloads\ccsetup537.exe
2017-11-16 22:10 - 2017-11-16 22:10 - 000096646 _____ C:\sleepstudy-report.html
2017-11-16 20:01 - 2017-11-16 20:01 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WhoCrashed
2017-11-16 16:57 - 2017-11-16 16:57 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Kits
2017-11-16 16:57 - 2017-11-16 16:57 - 000000000 ____D C:\Program Files (x86)\Windows Kits
2017-11-14 16:15 - 2017-11-14 16:15 - 000000016 _____ C:\Users\lem0th\uke termin.txt
2017-11-13 15:15 - 2017-11-13 15:15 - 000030518 _____ C:\Users\lem0th\tasklist.txt
2017-11-12 22:08 - 2017-10-10 08:14 - 000139672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecdd.sys
2017-11-12 22:08 - 2017-10-10 08:11 - 000739696 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll
2017-11-12 22:08 - 2017-10-10 08:10 - 001200024 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2017-11-12 22:08 - 2017-10-10 08:01 - 005906264 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2017-11-12 22:08 - 2017-10-10 08:00 - 001053592 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2017-11-12 22:08 - 2017-10-10 08:00 - 000373656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2017-11-12 22:08 - 2017-10-10 07:59 - 001641536 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2017-11-12 22:08 - 2017-10-10 07:59 - 000778936 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2017-11-12 22:08 - 2017-10-10 07:54 - 001463856 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2017-11-12 22:08 - 2017-10-10 07:53 - 000464416 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2017-11-12 22:08 - 2017-10-10 07:53 - 000232344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2017-11-12 22:08 - 2017-10-10 07:51 - 000184984 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspicli.dll
2017-11-12 22:08 - 2017-10-10 07:49 - 001554216 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2017-11-12 22:08 - 2017-10-10 07:49 - 000060824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\urscx01000.sys
2017-11-12 22:08 - 2017-10-10 07:48 - 000677280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2017-11-12 22:08 - 2017-10-10 07:44 - 000246168 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2017-11-12 22:08 - 2017-10-10 07:43 - 000418712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2017-11-12 22:08 - 2017-10-10 07:36 - 001436432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2017-11-12 22:08 - 2017-10-10 07:31 - 001323840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2017-11-12 22:08 - 2017-10-10 07:30 - 000123520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll
2017-11-12 22:08 - 2017-10-10 07:26 - 000649304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2017-11-12 22:08 - 2017-10-10 07:11 - 000597160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll
2017-11-12 22:08 - 2017-10-10 07:07 - 001261864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2017-11-12 22:08 - 2017-10-10 07:06 - 000353688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2017-11-12 22:08 - 2017-10-10 06:46 - 001470976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2017-11-12 22:08 - 2017-10-10 06:46 - 000136192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\t2embed.dll
2017-11-12 22:08 - 2017-10-10 06:43 - 000566272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TpmCoreProvisioning.dll
2017-11-12 22:08 - 2017-10-10 06:43 - 000070656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XblAuthTokenBrokerExt.dll
2017-11-12 22:08 - 2017-10-10 06:42 - 000374784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FirewallAPI.dll
2017-11-12 22:08 - 2017-10-10 06:42 - 000326144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptngc.dll
2017-11-12 22:08 - 2017-10-10 06:37 - 002869248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2017-11-12 22:08 - 2017-10-10 06:37 - 001587200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2017-11-12 22:08 - 2017-10-10 06:37 - 001559552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2017-11-12 22:08 - 2017-10-10 06:36 - 001664000 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2017-11-12 22:08 - 2017-10-10 06:36 - 000177664 _____ (Microsoft Corporation) C:\WINDOWS\system32\t2embed.dll
2017-11-12 22:08 - 2017-10-10 06:34 - 000057344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\UcmUcsi.sys
2017-11-12 22:08 - 2017-10-10 06:34 - 000034816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BasicRender.sys
2017-11-12 22:08 - 2017-10-10 06:34 - 000028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspisrv.dll
2017-11-12 22:08 - 2017-10-10 06:33 - 000086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthTokenBrokerExt.dll
2017-11-12 22:08 - 2017-10-10 06:33 - 000058880 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2017-11-12 22:08 - 2017-10-10 06:32 - 000529408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nwifi.sys
2017-11-12 22:08 - 2017-10-10 06:32 - 000461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll
2017-11-12 22:08 - 2017-10-10 06:31 - 000665088 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmCoreProvisioning.dll
2017-11-12 22:08 - 2017-10-10 06:31 - 000478208 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnr.dll
2017-11-12 22:08 - 2017-10-10 06:30 - 000542208 _____ (Microsoft Corporation) C:\WINDOWS\system32\FirewallAPI.dll
2017-11-12 22:08 - 2017-10-10 06:30 - 000442880 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptngc.dll
2017-11-12 22:08 - 2017-10-10 06:27 - 001547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2017-11-12 22:08 - 2017-10-10 06:26 - 003334144 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2017-11-12 22:08 - 2017-10-10 06:26 - 001856000 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2017-11-12 22:08 - 2017-10-10 06:25 - 001822208 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2017-11-12 22:08 - 2017-10-10 06:25 - 000925184 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2017-11-12 22:08 - 2017-10-10 06:24 - 000726016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2017-11-12 22:08 - 2017-10-10 06:24 - 000422912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv.sys
2017-11-12 22:08 - 2017-10-10 06:24 - 000285696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2017-11-12 22:08 - 2017-10-03 23:42 - 000640512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mswstr10.dll
2017-11-12 22:08 - 2017-10-03 23:42 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjint40.dll
2017-11-05 23:06 - 2017-11-05 23:06 - 000000043 _____ C:\Users\lem0th\money glitch.txt
2017-11-04 00:38 - 2017-11-04 00:38 - 000000000 ____D C:\Users\lem0th\Documents\FeedbackHub
2017-11-03 21:22 - 2017-10-28 12:12 - 000110144 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-64.dll
2017-11-01 19:17 - 2017-11-01 19:17 - 000023610 _____ C:\Users\lem0th\Documents\my-umatrix-backup.txt
2017-11-01 19:12 - 2017-11-01 19:13 - 000015765 _____ C:\Users\lem0th\Documents\my-umatrix-rules.txt
2017-10-31 12:25 - 2017-10-31 12:26 - 058031933 _____ C:\Users\lem0th\Documents\TV-20171030-2347-5101.webxl.h264.mp4
2017-10-30 19:57 - 2017-11-23 11:59 - 000000000 ____D C:\Users\lem0th\AppData\Local\PlaceholderTileLogoFolder
2017-10-30 18:02 - 2017-09-29 14:41 - 001312504 _____ (Microsoft Corporation) C:\WINDOWS\Taskmgr.exe
2017-10-30 17:30 - 2017-10-30 17:31 - 000080083 _____ C:\Users\lem0th\Documents\Addition.txt
2017-10-30 17:28 - 2017-10-30 17:31 - 000115706 _____ C:\Users\lem0th\Documents\FRST.txt
2017-10-30 17:11 - 2017-11-24 22:32 - 000000000 ____D C:\FRST
2017-10-30 17:10 - 2017-10-30 17:11 - 002403328 _____ (Farbar) C:\Users\lem0th\Documents\FRST64.exe
2017-10-30 16:42 - 2017-10-30 16:42 - 000000000 ____D C:\ProgramData\Microsoft OneDrive
2017-10-30 16:41 - 2017-10-30 16:41 - 000000000 ___HD C:\Users\lem0th\MicrosoftEdgeBackups
2017-10-30 16:39 - 2017-10-30 16:39 - 000001160 __RSH C:\Users\lem0th\ntuser.pol
2017-10-30 16:39 - 2017-10-30 16:39 - 000000020 ___SH C:\Users\lem0th\ntuser.ini
2017-10-30 16:39 - 2017-10-30 16:39 - 000000000 ___RD C:\Users\lem0th\3D Objects
2017-10-30 16:33 - 2017-10-30 16:34 - 000019053 _____ C:\WINDOWS\diagwrn.xml
2017-10-30 16:33 - 2017-10-30 16:34 - 000019053 _____ C:\WINDOWS\diagerr.xml
2017-10-30 16:31 - 2017-11-23 23:17 - 000003658 _____ C:\WINDOWS\System32\Tasks\CreateExplorerShellUnelevatedTask
2017-10-30 16:31 - 2017-11-22 05:37 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-10-30 16:31 - 2017-11-13 20:15 - 000003628 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2017-10-30 16:31 - 2017-11-13 20:15 - 000003504 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2017-10-30 16:31 - 2017-10-30 16:32 - 000003502 _____ C:\WINDOWS\System32\Tasks\EPSON XP-540 Series Update {2AB6DE24-84C4-4AAB-BF4A-771C3BEF1053}
2017-10-30 16:31 - 2017-10-30 16:32 - 000003116 _____ C:\WINDOWS\System32\Tasks\klcp_update
2017-10-30 16:31 - 2017-10-30 16:32 - 000002484 _____ C:\WINDOWS\System32\Tasks\Defender tägliche Updates
2017-10-30 16:31 - 2017-10-30 16:31 - 000003502 _____ C:\WINDOWS\System32\Tasks\EPSON XP-540 Series Update {57EB58A9-FBFB-47E1-B238-BD9213EE8D07}
2017-10-30 16:31 - 2017-10-30 16:31 - 000002746 _____ C:\WINDOWS\System32\Tasks\Sperrbildschirm
2017-10-30 16:31 - 2017-10-30 16:31 - 000000000 ____D C:\WINDOWS\System32\Tasks\WPD
2017-10-30 16:31 - 2016-12-19 18:28 - 000002210 _____ C:\WINDOWS\System32\Tasks\Core Temp Autostart Tygan
2017-10-30 16:21 - 2017-10-30 16:21 - 000000020 ___SH C:\Users\_ashbackuppb_\ntuser.ini
2017-10-30 16:09 - 2017-11-24 13:42 - 000000000 ____D C:\Users\lem0th\AppData\Local\Packages
2017-10-30 16:09 - 2017-10-30 16:09 - 000000000 ____D C:\ProgramData\USOShared
2017-10-30 16:07 - 2017-11-24 20:48 - 000000000 ____D C:\Users\lem0th
2017-10-30 16:07 - 2017-11-01 17:08 - 000000000 ____D C:\Users\_ashbackuppb_
2017-10-30 16:07 - 2017-10-30 16:29 - 000000000 ____D C:\Users\DefaultAppPool
2017-10-30 16:07 - 2017-10-30 16:26 - 000000000 ____D C:\Users\Administrator
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Vorlagen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Startmenü
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Netzwerkumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Lokale Einstellungen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Eigene Dateien
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Druckumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Documents\Eigene Videos
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Documents\Eigene Musik
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Documents\Eigene Bilder
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\AppData\Local\Verlauf
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\AppData\Local\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Vorlagen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Startmenü
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Netzwerkumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Lokale Einstellungen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Eigene Dateien
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Druckumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Documents\Eigene Videos
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Documents\Eigene Musik
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Documents\Eigene Bilder
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\AppData\Local\Verlauf
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\AppData\Local\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Vorlagen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Startmenü
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Netzwerkumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Lokale Einstellungen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Eigene Dateien
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Druckumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Documents\Eigene Videos
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Documents\Eigene Musik
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Documents\Eigene Bilder
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\AppData\Local\Verlauf
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\AppData\Local\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Vorlagen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Startmenü
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Netzwerkumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Lokale Einstellungen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Eigene Dateien
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Druckumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Documents\Eigene Videos
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Documents\Eigene Musik
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Documents\Eigene Bilder
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\AppData\Local\Verlauf
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\AppData\Local\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Anwendungsdaten
2017-10-30 16:02 - 2017-11-11 15:12 - 002252414 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-10-30 16:01 - 2017-09-29 14:41 - 002241024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2017-10-30 15:58 - 2017-11-24 18:02 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2017-10-30 15:58 - 2017-11-22 05:37 - 000742728 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-10-30 15:35 - 2016-06-28 12:28 - 000413008 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klhk.sys
2017-10-30 15:35 - 2016-06-26 15:14 - 001012048 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klif.sys
2017-10-30 15:35 - 2016-06-26 15:14 - 000191312 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klflt.sys
2017-10-30 15:35 - 2016-06-02 22:39 - 000126864 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klwtp.sys
2017-10-30 15:35 - 2016-06-02 03:43 - 000554416 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\kl1.sys
2017-10-30 15:35 - 2016-05-31 23:31 - 000045488 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klpd.sys
2017-10-30 15:34 - 2017-10-30 15:34 - 000000000 ___DL C:\Users\Public\Recorded TV (1)
2017-10-30 15:34 - 2017-10-30 15:34 - 000000000 ____D C:\Program Files\Common Files\SpeechEngines
2017-10-30 15:33 - 2017-10-30 15:54 - 000000000 ____D C:\WINDOWS\system32\config\bbimigrate
2017-10-30 15:30 - 2017-10-30 15:33 - 000000000 ____D C:\WINDOWS\ServiceProfiles
2017-10-30 15:26 - 2017-10-30 15:54 - 000000000 ___SD C:\WINDOWS\system32\lxss
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\WINDOWS\SysWOW64\XPSViewer
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\WINDOWS\SysWOW64\BestPractices
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\WINDOWS\system32\msmq
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\WINDOWS\system32\BestPractices
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\Program Files\Reference Assemblies
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\Program Files\MSBuild
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\Program Files (x86)\Reference Assemblies
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\Program Files (x86)\MSBuild
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\inetpub
2017-10-30 15:21 - 2017-09-22 18:19 - 000778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2017-10-30 15:21 - 2017-09-22 18:19 - 000103120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2017-10-30 15:21 - 2017-09-22 18:19 - 000035456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2017-10-30 15:20 - 2017-09-28 15:50 - 001166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2017-10-30 15:20 - 2017-09-28 15:50 - 000124624 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2017-10-30 15:20 - 2017-09-28 15:50 - 000035456 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2017-10-30 14:49 - 2017-10-30 14:49 - 000008192 _____ C:\WINDOWS\system32\config\userdiff
2017-10-30 14:13 - 2017-11-02 10:44 - 000000000 ___DC C:\WINDOWS\Panther
2017-10-30 14:07 - 2017-10-30 14:13 - 000000036 _____ C:\WINDOWS\progress.ini
2017-10-30 13:37 - 2017-10-30 16:36 - 000000000 ___HD C:\$GetCurrent
2017-10-28 09:38 - 2017-10-28 09:38 - 000195346 _____ C:\Users\lem0th\Documents\wu170509 (1).diagcab
2017-10-27 20:01 - 2017-10-27 20:01 - 000001440 _____ C:\Users\lem0th\Desktop\MediathekView.lnk
2017-10-27 19:58 - 2017-10-28 12:12 - 000110144 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll
2017-10-27 19:57 - 2017-10-28 12:14 - 000000000 ____D C:\Program Files\Java
2017-10-27 19:39 - 2017-10-27 19:39 - 000195346 _____ C:\Users\lem0th\Documents\wu170509.diagcab
2017-10-25 12:33 - 2017-10-25 12:33 - 000265976 _____ C:\Users\lem0th\Documents\lageplan_uke.pdf

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-11-24 22:36 - 2017-01-17 18:40 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\NetSpeedMonitor
2017-11-24 22:33 - 2017-10-22 21:52 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\vlc
2017-11-24 19:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\DeliveryOptimization
2017-11-24 19:26 - 2017-03-15 12:54 - 000000000 ____D C:\Users\lem0th\AppData\Local\Ashampoo Backup PB
2017-11-24 19:06 - 2017-01-17 17:29 - 000000000 ____D C:\Users\lem0th\AppData\LocalLow\Mozilla
2017-11-24 13:42 - 2017-09-29 14:46 - 000000000 ___HD C:\Program Files\WindowsApps
2017-11-24 13:42 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\AppReadiness
2017-11-24 13:38 - 2017-03-15 12:52 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
2017-11-24 13:37 - 2017-03-15 12:52 - 000000000 ____D C:\ProgramData\Ashampoo
2017-11-22 13:41 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\NDF
2017-11-22 05:36 - 2017-09-29 09:45 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\system32\F12
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\TextInput
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\appraiser
2017-11-22 05:34 - 2017-09-29 09:45 - 000000000 ____D C:\WINDOWS\system32\Dism
2017-11-22 05:33 - 2017-09-29 14:44 - 000000000 ____D C:\WINDOWS\INF
2017-11-21 21:01 - 2017-04-08 14:31 - 000000000 ____D C:\Users\lem0th\MediathekView
2017-11-21 21:00 - 2017-04-08 14:06 - 000000000 ____D C:\Users\lem0th\.mediathek3
2017-11-21 14:22 - 2010-11-21 04:27 - 000545440 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2017-11-20 01:44 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2017-11-20 01:44 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\Macromed
2017-11-18 21:01 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\rescache
2017-11-18 04:32 - 2017-01-17 18:33 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\KeePass
2017-11-17 21:32 - 2017-09-29 14:37 - 000000000 ____D C:\WINDOWS\CbsTemp
2017-11-17 20:17 - 2016-08-25 11:17 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-11-17 20:17 - 2014-11-05 16:46 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\zu-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\yo-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\xh-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\wo-SN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\vi-VN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\uz-Latn-UZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ur-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ug-CN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\tt-RU
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\tn-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\tk-TM
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ti-ET
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\tg-Cyrl-TJ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\te-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ta-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\sw-KE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-RS
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-BA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\sq-AL
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\si-LK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\sd-Arab-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\rw-RW
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\quz-PE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\quc-Latn-GT
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\prs-AF
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-Arab-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\or-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\nso-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\nn-NO
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ne-NP
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\mt-MT
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\mr-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\mn-MN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ml-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\mk-MK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\mi-NZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\lo-LA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\lb-LU
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ky-KG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ku-Arab-IQ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\kok-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\kn-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\km-KH
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\kk-KZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ka-GE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\is-IS
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ig-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\id-ID
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\hy-AM
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ha-Latn-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\gu-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\gd-GB
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ga-IE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\fil-PH
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\fa-IR
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\cy-GB
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\chr-CHER-US
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ca-ES-valencia
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\bs-Latn-BA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\bn-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\bn-BD
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\be-BY
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\az-Latn-AZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\as-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\am-ET
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\af-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\zu-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\yo-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\xh-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\wo-SN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\vi-VN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\uz-Latn-UZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ur-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ug-CN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\tt-RU
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\tn-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\tk-TM
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ti-ET
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\tg-Cyrl-TJ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\te-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ta-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\sw-KE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-RS
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-BA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\sq-AL
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\si-LK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\sd-Arab-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\rw-RW
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\quz-PE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\quc-Latn-GT
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\prs-AF
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\pa-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\pa-Arab-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\or-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\nso-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\nn-NO
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ne-NP
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\mt-MT
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\mr-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\mn-MN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ml-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\mk-MK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\mi-NZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\lo-LA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\lb-LU
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ky-KG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ku-Arab-IQ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\kok-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\kn-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\km-KH
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\kk-KZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ka-GE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\is-IS
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ig-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\id-ID
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\hy-AM
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ha-Latn-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\gu-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\gd-GB
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ga-IE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\fil-PH
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\fa-IR
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\cy-GB
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\chr-CHER-US
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ca-ES-valencia
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\bs-Latn-BA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\bn-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\bn-BD
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\be-BY
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\az-Latn-AZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\as-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\am-ET
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\af-ZA
2017-11-16 20:01 - 2017-09-03 02:54 - 000000000 ____D C:\Program Files\WhoCrashed
2017-11-16 16:56 - 2015-01-24 15:32 - 000000000 ____D C:\ProgramData\Package Cache
2017-11-14 15:41 - 2017-01-17 17:29 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Mozilla
2017-11-14 15:41 - 2016-07-23 17:08 - 000001228 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-11-14 01:22 - 2016-01-22 23:25 - 000002271 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-11-11 15:12 - 2017-09-30 15:34 - 000969320 _____ C:\WINDOWS\system32\perfh007.dat
2017-11-11 15:12 - 2017-09-30 15:34 - 000223032 _____ C:\WINDOWS\system32\perfc007.dat
2017-11-10 01:38 - 2017-06-21 16:11 - 000001056 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Core Temp.lnk
2017-11-07 12:33 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2017-11-04 02:25 - 2017-09-29 14:49 - 000835568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-11-04 02:25 - 2017-09-29 14:49 - 000177648 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-11-04 00:07 - 2017-01-17 17:43 - 000000000 ____D C:\Users\lem0th\AppData\Local\ElevatedDiagnostics
2017-11-03 21:29 - 2017-05-10 14:44 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-11-03 21:28 - 2017-03-08 18:48 - 000000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2017-11-03 21:26 - 2017-03-08 18:46 - 000000000 ____D C:\Program Files (x86)\TeamViewer
2017-11-03 21:23 - 2015-04-07 10:25 - 000000000 ____D C:\ProgramData\Skype
2017-11-03 21:12 - 2017-01-17 18:22 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Skype
2017-11-02 02:08 - 2017-06-21 16:53 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Everything
2017-11-01 17:11 - 2016-04-04 22:51 - 000014030 __RSH C:\ProgramData\ntuser.pol
2017-10-31 12:18 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\appcompat
2017-10-30 16:51 - 2017-02-20 17:19 - 000002358 _____ C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Vivaldi.lnk
2017-10-30 16:51 - 2017-02-20 17:19 - 000000000 ____D C:\Users\lem0th\AppData\Local\Vivaldi
2017-10-30 16:39 - 2017-01-17 16:59 - 000000000 ____D C:\Users\lem0th\AppData\Local\TileDataLayer
2017-10-30 16:39 - 2015-07-29 17:28 - 000000000 __RHD C:\Users\Public\AccountPictures
2017-10-30 16:35 - 2017-09-29 14:46 - 000000000 ____D C:\Program Files\windows nt
2017-10-30 16:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\Registration
2017-10-30 16:34 - 2017-09-29 09:45 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2017-10-30 16:32 - 2015-07-29 17:19 - 000023056 _____ C:\WINDOWS\system32\emptyregdb.dat
2017-10-30 16:30 - 2017-09-29 14:46 - 000000000 __RSD C:\WINDOWS\media
2017-10-30 16:19 - 2017-10-15 17:36 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Everything
2017-10-30 16:19 - 2017-04-17 21:18 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Paragon Partition Manager™ 14 Free
2017-10-30 16:19 - 2017-02-13 15:20 - 000000000 ___RD C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Test2
2017-10-30 16:12 - 2017-09-29 14:46 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-10-30 16:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\inetsrv
2017-10-30 16:09 - 2017-09-29 14:46 - 000000000 ____D C:\ProgramData\USOPrivate
2017-10-30 16:09 - 2017-02-26 20:44 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Hammer & Chisel, Inc
2017-10-30 16:08 - 2015-11-19 15:54 - 000000000 ____D C:\Users\Administrator\AppData\Local\Packages
2017-10-30 16:02 - 2017-04-06 16:05 - 002003936 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2017-10-30 16:01 - 2017-09-29 09:45 - 000000000 ____D C:\WINDOWS\system32\Sysprep
2017-10-30 16:00 - 2017-04-06 16:04 - 000000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2017-10-30 15:57 - 2017-09-29 14:46 - 000028672 _____ C:\WINDOWS\system32\config\BCD-Template
2017-10-30 15:55 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase
2017-10-30 15:55 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\system32\Tasks_Migrated
2017-10-30 15:54 - 2017-10-15 17:58 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2017-10-30 15:54 - 2017-10-15 17:52 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2017-10-30 15:54 - 2017-10-15 17:01 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VeraCrypt
2017-10-30 15:54 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\SysWOW64\WCN
2017-10-30 15:54 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\SysWOW64\sysprep
2017-10-30 15:54 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\system32\WCN
2017-10-30 15:54 - 2017-09-29 14:49 - 000000000 ____D C:\WINDOWS\Setup
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 __SHD C:\Program Files\Windows Sidebar
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 __SHD C:\Program Files (x86)\Windows Sidebar
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\SysWOW64\DiagSvcs
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\Downloaded Program Files
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\IME
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\spool
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\IME
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\AppLocker
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\schemas
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\Resources
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\IME
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\Program Files\Common Files\microsoft shared
2017-10-30 15:54 - 2017-08-31 03:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinMerge
2017-10-30 15:54 - 2017-08-30 17:21 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
2017-10-30 15:54 - 2017-08-17 12:53 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Software
2017-10-30 15:54 - 2017-04-17 21:28 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AOMEI Partition Assistant Standard Edition 6.1
2017-10-30 15:54 - 2017-03-30 22:36 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 5.2
2017-10-30 15:54 - 2017-03-29 14:52 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware
2017-10-30 15:54 - 2017-03-28 23:15 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy
2017-10-30 15:54 - 2017-03-21 02:59 - 000000000 __RSD C:\WINDOWS\system32\WindowsDevicePortal
2017-10-30 15:54 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\system32\catroot2.bak
2017-10-30 15:54 - 2017-03-11 00:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
2017-10-30 15:54 - 2017-02-23 22:44 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack
2017-10-30 15:54 - 2017-01-21 23:07 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Classic Shell
2017-10-30 15:54 - 2016-12-30 02:08 - 000000000 ____D C:\WINDOWS\SysWOW64\%ProductFolder%
2017-10-30 15:54 - 2016-12-30 00:07 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Anti-Ransomware Tool for Business
2017-10-30 15:54 - 2016-12-09 00:40 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-10-30 15:54 - 2016-09-02 00:41 - 000000000 ____D C:\WINDOWS\SysWOW64\Hotspot Shield
2017-10-30 15:54 - 2016-08-03 18:45 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2017-10-30 15:54 - 2016-08-03 18:06 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CrystalDiskInfo
2017-10-30 15:54 - 2016-06-22 13:59 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gpg4win
2017-10-30 15:54 - 2016-05-31 12:20 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steuer 2015
2017-10-30 15:54 - 2015-10-27 01:05 - 000000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2017-10-30 15:54 - 2015-05-30 17:25 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\puush
2017-10-30 15:54 - 2015-02-21 23:13 - 000000000 ____D C:\WINDOWS\SysWOW64\Adobe
2017-10-30 15:54 - 2014-11-22 15:04 - 000000000 ____D C:\WINDOWS\system32\appmgmt
2017-10-30 15:54 - 2014-11-03 18:48 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NETGEAR WNA3100M Genie
2017-10-30 15:54 - 2014-01-23 19:41 - 000000000 ____D C:\WINDOWS\system32\MRT
2017-10-30 15:45 - 2017-09-29 14:46 - 000000000 __RHD C:\Users\Public\Libraries
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\SysWOW64\winrm
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\SysWOW64\slmgr
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\SysWOW64\Printing_Admin_Scripts
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\system32\winrm
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\system32\slmgr
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\system32\Printing_Admin_Scripts
2017-10-30 15:36 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2017-10-30 15:36 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\en-GB
2017-10-30 15:36 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2017-10-30 15:36 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\oobe
2017-10-30 15:36 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\en-GB
2017-10-30 15:36 - 2017-04-06 16:04 - 000000000 ____D C:\WINDOWS\system32\SRSLabs
2017-10-30 15:36 - 2017-03-21 02:59 - 000000000 ___RD C:\WINDOWS\WebManagement
2017-10-30 15:35 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\system32\dsc
2017-10-30 15:35 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\system32\DiagSvcs
2017-10-30 15:34 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\OCR
2017-10-30 15:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\Help
2017-10-30 15:34 - 2017-09-29 14:46 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2017-10-30 15:34 - 2017-09-29 14:46 - 000000000 ____D C:\Program Files\Common Files\system
2017-10-30 15:34 - 2017-09-29 14:46 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2017-10-30 15:34 - 2017-08-17 12:51 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
2017-10-30 15:34 - 2017-04-06 16:04 - 000000000 ____D C:\Program Files\Realtek
2017-10-30 15:34 - 2016-08-29 17:47 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\sixteen tons entertainment
2017-10-30 15:34 - 2016-01-30 19:55 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MAGIX
2017-10-30 15:34 - 2015-09-22 16:14 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games
2017-10-30 15:27 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\inetsrv
2017-10-30 15:26 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\MUI
2017-10-30 15:26 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\MUI
2017-10-30 15:25 - 2017-09-29 14:43 - 000613376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqsnap.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000261632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000096256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa.tlb
2017-10-30 15:25 - 2017-09-29 14:43 - 000090624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa30.tlb
2017-10-30 15:25 - 2017-09-29 14:43 - 000055296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa20.tlb
2017-10-30 15:25 - 2017-09-29 14:43 - 000048640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\admwprox.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000036864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa10.tlb
2017-10-30 15:25 - 2017-09-29 14:43 - 000016896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisreset.exe
2017-10-30 15:25 - 2017-09-29 14:43 - 000014848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqcertui.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000011264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wamregps.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisrstap.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000009096 _____ C:\WINDOWS\SysWOW64\msmqtrc.mof
2017-10-30 15:25 - 2017-09-29 14:42 - 000054272 _____ (Microsoft Corporation) C:\WINDOWS\system32\admwprox.dll
2017-10-30 15:25 - 2017-09-29 14:42 - 000018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisreset.exe
2017-10-30 15:25 - 2017-09-29 14:42 - 000015360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wamregps.dll
2017-10-30 15:25 - 2017-09-29 14:42 - 000013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisrstap.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000980888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\lxcore.sys
2017-10-30 15:25 - 2017-09-29 14:41 - 000222720 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqrt.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplayx.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmsif.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mqac.sys
2017-10-30 15:25 - 2017-09-29 14:41 - 000072704 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsl.exe
2017-10-30 15:25 - 2017-09-29 14:41 - 000046592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpwsockx.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000024576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpmodemx.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000020480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplaysvr.exe
2017-10-30 15:25 - 2017-09-29 14:41 - 000018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmsifproxystub.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisRtl.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisRtl.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\ahadmin.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ahadmin.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000014336 _____ (Microsoft Corporation) C:\WINDOWS\system32\cngkeyhelper.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000011264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cngkeyhelper.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 001677824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmswitch.sys
2017-10-30 15:24 - 2017-09-29 14:41 - 000776192 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqsnap.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000747008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Wnv.sys
2017-10-30 15:24 - 2017-09-29 14:41 - 000564224 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqutil.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000389120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnet.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000306688 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000126464 _____ (Microsoft Corporation) C:\WINDOWS\system32\LxRun.exe
2017-10-30 15:24 - 2017-09-29 14:41 - 000125952 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqlogmgr.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000096256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa.tlb
2017-10-30 15:24 - 2017-09-29 14:41 - 000090624 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa30.tlb
2017-10-30 15:24 - 2017-09-29 14:41 - 000088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\nvspinfo.exe
2017-10-30 15:24 - 2017-09-29 14:41 - 000073216 _____ (Microsoft Corporation) C:\WINDOWS\system32\bash.exe
2017-10-30 15:24 - 2017-09-29 14:41 - 000062464 _____ (Microsoft Corporation) C:\WINDOWS\system32\wnvapi.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnathlp.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000055296 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa20.tlb
2017-10-30 15:24 - 2017-09-29 14:41 - 000036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa10.tlb
2017-10-30 15:24 - 2017-09-29 14:41 - 000034816 _____ (Microsoft Corporation) C:\WINDOWS\system32\wslapi.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000033688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmsproxy.sys
2017-10-30 15:24 - 2017-09-29 14:41 - 000022528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnsvr.exe
2017-10-30 15:24 - 2017-09-29 14:41 - 000017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqcertui.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000009096 _____ C:\WINDOWS\system32\msmqtrc.mof
2017-10-30 15:24 - 2017-09-29 14:41 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhupnp.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhpast.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnlobby.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnaddr.dll
2017-10-30 15:23 - 2017-09-29 14:43 - 000562176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqutil.dll
2017-10-30 15:23 - 2017-09-29 14:43 - 000156160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqrt.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 001381888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqqm.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000464896 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnet.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000067584 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnathlp.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqbkup.exe
2017-10-30 15:23 - 2017-09-29 14:41 - 000041984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wslconfig.exe
2017-10-30 15:23 - 2017-09-29 14:41 - 000026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnsvr.exe
2017-10-30 15:23 - 2017-09-29 14:41 - 000026112 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqsvc.exe
2017-10-30 15:23 - 2017-09-29 14:41 - 000015768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\lxss.sys
2017-10-30 15:23 - 2017-09-29 14:41 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhupnp.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhpast.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnlobby.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnaddr.dll
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\lv-LV
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\lt-LT
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\et-EE
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\es-MX
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\lv-LV
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\lt-LT
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\et-EE
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\es-MX
2017-10-30 13:04 - 2017-08-31 13:31 - 000028574 _____ C:\Users\lem0th\Documents\NeueDatenbank.kdbx
2017-10-28 12:21 - 2016-04-05 13:15 - 000000000 ____D C:\Program Files\7-Zip
2017-10-28 12:19 - 2017-06-22 03:14 - 000000000 ____D C:\Users\lem0th\AppData\Local\Everything

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2017-05-28 21:40 - 2017-05-28 21:41 - 832691886 _____ () C:\Users\lem0th\AppData\Roaming\Factorio.zip
2017-02-17 23:26 - 2017-03-27 02:39 - 000000154 _____ () C:\Users\lem0th\AppData\Roaming\prio.ini
2017-04-30 18:56 - 2017-04-30 02:43 - 000000027 _____ () C:\Users\lem0th\AppData\Roaming\test.bat
2017-11-17 20:35 - 2017-11-17 20:35 - 000000000 _____ () C:\Users\lem0th\AppData\Roaming\text.txt
2017-01-17 17:42 - 2016-07-17 22:18 - 000007656 _____ () C:\Users\lem0th\AppData\Local\Resmon.ResmonCfg

==================== Bamital & volsnap ======================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert

LastRegBack: 2017-11-19 18:21

==================== Ende von FRST.txt ============================

Ladekabel612 · 24.11.2017, 22:43

Code:

ATTFilter

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 24-11-2017 01
durchgeführt von lem0th (24-11-2017 22:37:03)
Gestartet von C:\Users\lem0th\Desktop
Windows 10 Pro Version 1709 16299.64 (X64) (2017-10-30 15:36:44)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-624198674-977653023-2037852723-500 - Administrator - Disabled) => C:\Users\Administrator
DefaultAccount (S-1-5-21-624198674-977653023-2037852723-503 - Limited - Disabled)
Gast (S-1-5-21-624198674-977653023-2037852723-501 - Limited - Disabled)
lem0th (S-1-5-21-624198674-977653023-2037852723-1040 - Administrator - Enabled) => C:\Users\lem0th
WDAGUtilityAccount (S-1-5-21-624198674-977653023-2037852723-504 - Limited - Disabled)
_ashbackuppb_ (S-1-5-21-624198674-977653023-2037852723-1052 - Administrator - Enabled) => C:\Users\_ashbackuppb_

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

7-Zip 16.04 (x64) (HKLM\...\7-Zip) (Version: 16.04 - Igor Pavlov)
Adobe Flash Player 27 NPAPI (HKLM-x32\...\{34D4D627-00A1-4C0D-BF68-576C146B9ED6}) (Version: 27.0.0.187 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\{7E33E883-0D17-4397-A461-B576605E34B1}) (Version: 12.1.6.156 - Adobe Systems, Inc)
AMD Catalyst Install Manager (HKLM\...\{37FCE154-7F59-74F0-3A35-BF503CEB230B}) (Version: 8.0.877.0 - Advanced Micro Devices, Inc.)
AOMEI Partition Assistant Standard Edition 6.1 (HKLM-x32\...\{02F850ED-FD0E-4ED1-BE0B-54981f5BD3D4}_is1) (Version:  - AOMEI Technology Co., Ltd.)
Ashampoo Backup Pro 11 (HKLM\...\{DF972766-3CEA-0FEC-AD7D-0A1791430C35}_is1) (Version: 11.08 - Ashampoo GmbH & Co. KG)
Ashampoo UnInstaller 7 (HKLM-x32\...\{4209F371-C268-A90D-7A44-135E420FACEF}_is1) (Version: 7.00.00 - Ashampoo GmbH & Co. KG)
Classic Shell (HKLM\...\{383BB30A-B4A7-4666-9A83-22CFA8640097}) (Version: 4.3.0 - IvoSoft)
CrystalDiskInfo 7.0.2 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 7.0.2 - Crystal Dew World)
CrystalDiskMark 5.1.2 (HKLM\...\CrystalDiskMark5_is1) (Version: 5.1.2 - Crystal Dew World)
Discord (HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Discord) (Version: 0.0.298 - Discord Inc.)
Emergency 4 Deluxe (HKLM-x32\...\{EDA12670-56B5-4459-BA21-D010F0E3EBA1}) (Version: 1.03.001 - )
Epson Scan 2 (HKLM-x32\...\Epson Scan 2) (Version:  - Seiko Epson Corporation)
EPSON Scan OCR Component (HKLM-x32\...\{563B99D8-8895-4E3E-AE8D-15BE8C05F1C1}) (Version: 3.00.01 - SEIKO EPSON Corp.)
Epson Software Updater (HKLM-x32\...\{B55DB65D-EF6E-4E04-89D5-B03603BF681B}) (Version: 4.4.5 - SEIKO EPSON CORPORATION)
EPSON XP-540 Series Printer Uninstall (HKLM\...\EPSON XP-540 Series) (Version:  - Seiko Epson Corporation)
EPSON-Handbücher (HKLM-x32\...\{84CECC1B-21EF-41B1-9A91-3E724E5D99D3}) (Version: 1.53.0.0 - Seiko Epson Corporation)
EpsonNet Print (HKLM\...\{96ED1D58-440C-4345-8FEE-C4781366C67F}) (Version: 3.1.4.0 - SEIKO EPSON Corporation)
Everything 1.4.1.877 (x64) (HKLM\...\Everything) (Version: 1.4.1.877 (x64) - David Carpenter)
Factorio version 0.15.15 (HKLM\...\Factorio_is1) (Version:  - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 62.0.3202.94 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
Gpg4win (2.3.3) (HKLM-x32\...\GPG4Win) (Version: 2.3.3 - The Gpg4win Project)
Grand Theft Auto San Andreas (HKLM-x32\...\{086BADF8-9B1F-4E89-B207-2EDA520972D6}) (Version: 1.00.00001 - Rockstar Games)
Java 8 Update 151 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180151F0}) (Version: 8.0.1510.12 - Oracle Corporation)
Kaspersky Anti-Ransomware Tool for Business (HKLM-x32\...\{0F30C04E-E20E-4A5D-95AE-BF041D6CF673}) (Version: 1.1.24.0 - Kaspersky Lab) Hidden
KeePass Password Safe 2.37 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.37 - Dominik Reichl)
Kits Configuration Installer (HKLM-x32\...\{86E59C8F-61D5-1782-A3CE-60AE7E4D7791}) (Version: 10.1.16299.15 - Microsoft) Hidden
K-Lite Codec Pack 13.2.0 Standard (HKLM-x32\...\KLiteCodecPack_is1) (Version: 13.2.0 - KLCP)
LibreOffice 5.2.6.2 (HKLM-x32\...\{443795BA-BBA0-46CF-A07F-DB5B461785F7}) (Version: 5.2.6.2 - The Document Foundation)
MAGIX Movie Edit Pro 2016 Premium (HKLM\...\{0E64129B-4258-44B9-8034-464C6E28878D}) (Version: 15.0.0.73 - MAGIX Software GmbH) Hidden
MAGIX Movie Edit Pro 2016 Premium (HKLM\...\MX.{0E64129B-4258-44B9-8034-464C6E28878D}) (Version: 15.0.0.73 - MAGIX Software GmbH)
MAGIX Video deluxe 2016 Premium Update (HKLM\...\{AA6874A6-C7EB-42D5-B434-A86B75E00F32}) (Version: 15.0.0.77 - MAGIX Software GmbH) Hidden
Malwarebytes Version 3.1.2.1733 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.1.2.1733 - Malwarebytes)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61187 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61186 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.7523 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.7523 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.7523 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.7523 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{b341426f-8543-4e0d-96c3-e976f8ec5ab6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{3c3aafc8-d898-43ec-998f-965ffdae065a}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40649 (HKLM-x32\...\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}) (Version: 12.0.40649.5 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23918 (HKLM-x32\...\{dab68466-3a7d-41a8-a5cf-415e3ff8ef71}) (Version: 14.0.23918.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual J# 2.0 Redistributable Package - SE (x64) (HKLM\...\Microsoft Visual J# 2.0 Redistributable Package - SE (x64)) (Version:  - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)
Microsoft_VC100_CRT_x86 (HKLM-x32\...\{6FDDB201-2CA0-42BD-973F-7B2C4A61EA3F}) (Version: 1.0.0 - Microsoft)
Mozilla Firefox 57.0 (x64 de) (HKLM\...\Mozilla Firefox 57.0 (x64 de)) (Version: 57.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 57.0.0.6525 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
NETGEAR WNA3100M N300 Wireless USB Adapter (HKLM-x32\...\{D3580358-0F78-402A-BE53-2E9D06383E04}) (Version: 1.2.0.6 - NETGEAR)
NetSpeedMonitor 2.5.4.0 x64 (HKLM\...\{88F41EE2-949B-4B52-933D-C7F8F67BC1D2}) (Version: 2.5.4.0 - Florian Gilles)
Notepad++ (64-bit x64) (HKLM\...\Notepad++) (Version: 7.5.1 - Notepad++ Team)
paint.net (HKLM\...\{F10AAD91-58DF-44EC-A647-810197141667}) (Version: 4.0.19 - dotPDN LLC)
Paragon Partition Manager™ 14 Free (HKLM\...\{47E5588F-C3A0-11DE-9857-005056C00008}) (Version: 90.00.0003 - Paragon Software)
Prio (HKLM\...\Prio) (Version: 2.1.0.4391 - )
puush (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284B}) (Version: 1.0.0.0 - Dean Herbert)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7535 - Realtek Semiconductor Corp.)
Resilio Sync (HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Resilio Sync) (Version: 2.4.4 - Resilio, Inc.)
Revo Uninstaller 2.0.2 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.2 - VS Revo Group, Ltd.)
SDK Debuggers (HKLM-x32\...\{E14725F0-A67E-BEA3-8BAF-7D9C5B5881E4}) (Version: 10.1.16299.15 - Microsoft Corporation) Hidden
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Steuer 2015 (HKLM-x32\...\{E262CD3B-8825-4D56-AEF1-5E127F2FBB05}) (Version: 23.00.1146 - Buhl Data Service GmbH)
VC80CRTRedist - 8.0.50727.6195 (HKLM-x32\...\{933B4015-4618-4716-A828-5289FC03165F}) (Version: 1.2.0 - DivX, Inc) Hidden
VeraCrypt (HKLM-x32\...\VeraCrypt) (Version: 1.21 - IDRIX)
Vivaldi (HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Vivaldi) (Version: 1.12.955.48 - Vivaldi)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.6 - VideoLAN)
VMware Workstation (HKLM\...\{A4D1DB40-C6DC-40F8-AF6D-46BD4DD5ACAC}) (Version: 12.5.5 - VMware, Inc.)
WhoCrashed 5.54 (HKLM\...\WhoCrashed_is1) (Version:  - Resplendence Software Projects Sp.)
Windows Software Development Kit - Windows 10.0.16299.15 (HKLM-x32\...\{6195c203-b53c-4bb7-983a-6070a902e704}) (Version: 10.1.16299.15 - Microsoft Corporation)
WinMerge 2.14.0 (HKLM-x32\...\WinMerge_is1) (Version: 2.14.0 - Thingamahoochie Software)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-624198674-977653023-2037852723-1040_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\lem0th\AppData\Local\Microsoft\OneDrive\17.3.6816.0313\amd64\FileSyncShell64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-624198674-977653023-2037852723-1040_Classes\CLSID\{581FFA00-FC33-0004-0402-95003A5CDE89}\InprocServer32 -> C:\Users\lem0th\AppData\Roaming\Resilio Sync\ShellExtensionPath64_2DC.dll ()
CustomCLSID: HKU\S-1-5-21-624198674-977653023-2037852723-1040_Classes\CLSID\{581FFA01-FC33-0004-0402-95003A5CDE89}\InprocServer32 -> C:\Users\lem0th\AppData\Roaming\Resilio Sync\ShellExtensionPath64_2DC.dll ()
CustomCLSID: HKU\S-1-5-21-624198674-977653023-2037852723-1040_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\lem0th\AppData\Local\Microsoft\OneDrive\17.3.6816.0313\amd64\FileSyncShell64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-624198674-977653023-2037852723-1040_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\lem0th\AppData\Local\Microsoft\OneDrive\17.3.6816.0313\amd64\FileSyncShell64.dll => Keine Datei
ShellIconOverlayIdentifiers: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ShellIconOverlayIdentifiers: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ShellIconOverlayIdentifiers: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [!Resilio Sync 2.4.4Done] -> {581FFA04-FC33-0004-0402-95003A5CDE89} => C:\ProgramData\Resilio Sync\ShellExtensionOverlay64_2DC.dll [2017-03-25] ()
ShellIconOverlayIdentifiers: [!Resilio Sync 2.4.4RO] -> {581FFA03-FC33-0004-0402-95003A5CDE89} => C:\ProgramData\Resilio Sync\ShellExtensionOverlay64_2DC.dll [2017-03-25] ()
ShellIconOverlayIdentifiers: [!Resilio Sync 2.4.4RW] -> {581FFA02-FC33-0004-0402-95003A5CDE89} => C:\ProgramData\Resilio Sync\ShellExtensionOverlay64_2DC.dll [2017-03-25] ()
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [1MediaFireIconError] -> {5EE8C634-CDC0-453D-9731-DF0B19F4E807} => C:\Program Files (x86)\MediaFire Desktop\MediaFireIcon3_d1739.dll -> Keine Datei
ShellIconOverlayIdentifiers: [1MediaFireIconReadOnly] -> {7995D0FC-769B-4197-AEC0-991921CB99E1} => C:\Program Files (x86)\MediaFire Desktop\MediaFireIcon5_d1739.dll -> Keine Datei
ShellIconOverlayIdentifiers: [1MediaFireIconSynched] -> {9A3B79CB-D899-40B5-8DBC-20447F1ADC8F} => C:\Program Files (x86)\MediaFire Desktop\MediaFireIcon_d1739.dll -> Keine Datei
ShellIconOverlayIdentifiers: [1MediaFireIconSyncing] -> {C4D81971-6B13-4173-AB21-F83AD20CCC04} => C:\Program Files (x86)\MediaFire Desktop\MediaFireIcon2_d1739.dll -> Keine Datei
ShellIconOverlayIdentifiers: [EldosIconOverlay-cbfs6] -> {36A9E202-9EBD-4037-9EC8-9403A1FE827B} => C:\WINDOWS\system32\cbfsMntNtf6.dll [2016-06-13] (EldoS Corporation)
ShellIconOverlayIdentifiers: [MediaFireIconLock] -> {759F3E92-F4E8-4953-8315-238B8B17E0F3} => C:\Program Files (x86)\MediaFire Desktop\MediaFireIcon4_d1739.dll -> Keine Datei
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
ShellIconOverlayIdentifiers-x32: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ShellIconOverlayIdentifiers-x32: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ShellIconOverlayIdentifiers-x32: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [!Resilio Sync 2.4.4Done] -> {581FFA04-FC33-0004-0402-95003A5CDE89} => C:\ProgramData\Resilio Sync\ShellExtensionOverlay64_2DC.dll [2017-03-25] ()
ShellIconOverlayIdentifiers-x32: [!Resilio Sync 2.4.4RO] -> {581FFA03-FC33-0004-0402-95003A5CDE89} => C:\ProgramData\Resilio Sync\ShellExtensionOverlay64_2DC.dll [2017-03-25] ()
ShellIconOverlayIdentifiers-x32: [!Resilio Sync 2.4.4RW] -> {581FFA02-FC33-0004-0402-95003A5CDE89} => C:\ProgramData\Resilio Sync\ShellExtensionOverlay64_2DC.dll [2017-03-25] ()
ShellIconOverlayIdentifiers-x32: [EldosIconOverlay-cbfs6] -> {36A9E202-9EBD-4037-9EC8-9403A1FE827B} => C:\WINDOWS\system32\cbfsMntNtf6.dll [2016-06-13] (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files\Notepad++\NppShell_06.dll [2017-08-29] ()
ContextMenuHandlers1: [GpgEX] -> {CCD955E4-5C16-4A33-AFDA-A8947A94946B} => C:\Program Files (x86)\GNU\GnuPG\bin\gpgex.dll [2016-08-18] (g10 Code GmbH)
ContextMenuHandlers1: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ContextMenuHandlers1: [MFShellStatic] -> {007D3D20-762B-40FF-BE6A-15E479A9DBFA} => C:\Program Files (x86)\MediaFire Desktop\MFDesktopShellStatic_d1739.dll -> Keine Datei
ContextMenuHandlers1: [WinMerge] -> {4E716236-AA30-4C65-B225-D68BBA81E9C2} => C:\Program Files (x86)\WinMerge\ShellExtensionX64.dll [2013-02-02] (hxxp://winmerge.org)
ContextMenuHandlers2: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ContextMenuHandlers2-x32: [VMDiskMenuHandler] -> {271DC252-6FE1-4D59-9053-E4CF50AB99DE} => C:\Program Files (x86)\VMware\VMware Workstation\vmdkShellExt.dll [2017-03-21] (VMware, Inc.)
ContextMenuHandlers2-x32: [VMDiskMenuHandler64] -> {E4D28EDC-8C0B-43EE-9E7D-C8A8682334DC} => C:\Program Files (x86)\VMware\VMware Workstation\x64\vmdkShellExt64.dll [2017-03-21] (VMware, Inc.)
ContextMenuHandlers2-x32: [WinMerge] -> {4E716236-AA30-4C65-B225-D68BBA81E9C2} => C:\Program Files (x86)\WinMerge\ShellExtensionX64.dll [2013-02-02] (hxxp://winmerge.org)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-05-09] (Malwarebytes)
ContextMenuHandlers3: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ContextMenuHandlers3: [SendTo] -> -{7BA4C740-9E81-11CF-99D3-00AA004AE837} =>  -> Keine Datei
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers4: [GpgEX] -> {CCD955E4-5C16-4A33-AFDA-A8947A94946B} => C:\Program Files (x86)\GNU\GnuPG\bin\gpgex.dll [2016-08-18] (g10 Code GmbH)
ContextMenuHandlers4: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ContextMenuHandlers4: [MSSE] -> {0365FE2C-F183-4091-AC82-BFC39FB75C49} =>  -> Keine Datei
ContextMenuHandlers4: [WinMerge] -> {4E716236-AA30-4C65-B225-D68BBA81E9C2} => C:\Program Files (x86)\WinMerge\ShellExtensionX64.dll [2013-02-02] (hxxp://winmerge.org)
ContextMenuHandlers5: [Gadgets] -> {6B9228DA-9C15-419e-856C-19E768A13BDC} =>  -> Keine Datei
ContextMenuHandlers5: [WinMerge] -> {4E716236-AA30-4C65-B225-D68BBA81E9C2} => C:\Program Files (x86)\WinMerge\ShellExtensionX64.dll [2013-02-02] (hxxp://winmerge.org)
ContextMenuHandlers6: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers6: [Fast Explorer] -> {693BE9C0-BEC3-11D2-B4C1-C33BBD3AD64B} =>  -> Keine Datei
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-05-09] (Malwarebytes)
ContextMenuHandlers6: [MFShellStatic] -> {007D3D20-762B-40FF-BE6A-15E479A9DBFA} => C:\Program Files (x86)\MediaFire Desktop\MFDesktopShellStatic_d1739.dll -> Keine Datei
ContextMenuHandlers6: [StartMenuExt] -> {E595F05F-903F-4318-8B0A-7F633B520D2B} => C:\WINDOWS\System32\StartMenuHelper64.dll [2016-07-30] (IvoSoft)
ContextMenuHandlers1_S-1-5-21-624198674-977653023-2037852723-1040: [Resilio Sync 2.4.4] -> {581FFA00-FC33-0004-0402-95003A5CDE89} => C:\Users\lem0th\AppData\Roaming\Resilio Sync\ShellExtensionPath64_2DC.dll [2017-03-25] ()
ContextMenuHandlers4_S-1-5-21-624198674-977653023-2037852723-1040: [Resilio Sync 2.4.4] -> {581FFA00-FC33-0004-0402-95003A5CDE89} => C:\Users\lem0th\AppData\Roaming\Resilio Sync\ShellExtensionPath64_2DC.dll [2017-03-25] ()

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {077D9730-A325-418A-A370-8FDB2AB69740} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-01-22] (Google Inc.)
Task: {0925C293-A417-4212-97B6-79AA19FA7961} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {0B75604B-9502-4A48-ADE3-1237E2FBF078} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {15D635DD-27BD-4CBB-8FF7-667CA955FEB0} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\WINDOWS\ehome\ehrec.exe
Task: {1E24BA0C-A9C7-4EB3-B9FC-80BA2F51F025} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {2010C5A7-AB3A-49B1-9C74-87670E1563B1} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {28F380A0-0DF8-4D51-B386-871F732C952C} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\WINDOWS\ehome\mcupdate.exe
Task: {2922E616-61B8-4990-B55D-D5E006369855} - System32\Tasks\EPSON XP-540 Series Update {57EB58A9-FBFB-47E1-B238-BD9213EE8D07} => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSRIE.EXE [2013-11-22] (SEIKO EPSON CORPORATION)
Task: {34150056-E698-4C15-A124-37E8DE1AC7C7} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {40237349-3DDE-4B82-8440-23FA248D5599} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe
Task: {5403244C-E898-4F08-895E-F3CA03F79136} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {5653A8BA-5766-4972-AFE4-6AF986F39A5A} - \{A1C0E21F-C04B-4D7F-A3C7-F4A887B38845} -> Keine Datei <==== ACHTUNG
Task: {565763B7-74CD-4027-9408-72B0647956E7} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {56F31CE6-6542-4ED2-AD8A-6B1BDE758A4B} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {5804C292-C77C-4BA6-A77B-687BCA77E37D} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {5ACFA180-BE93-4757-A600-57A61FE79EDC} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {5E4561E9-FD6F-448E-86AE-14F6C764A2B4} - System32\Tasks\klcp_update => C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool.exe [2017-05-24] ()
Task: {6670D31E-C371-47EA-AEBC-DFCB51D7B4B5} - System32\Tasks\Sperrbildschirm => reg.exe add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData /t REG_DWORD /v AllowLockScreen /d 0 /f
Task: {6B947FBC-CBFA-49C1-BE7A-76A0EEA3F402} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {79A51A49-477E-4F5F-8156-0AC3B0B6EE79} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe
Task: {7D2FC676-CC2E-44B0-820F-C92183A172FF} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {852E0376-20DA-4B53-8524-4C6ED036C24F} - System32\Tasks\Microsoft\Windows\Windows Subsystem for Linux\AptPackageIndexUpdate => C:\WINDOWS\System32\LxRun.exe [2017-10-30] (Microsoft Corporation)
Task: {8C74191A-5503-44AD-8270-915C52BBC428} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {90633838-3B10-43F0-BC61-5C8504498795} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {90AFBFCB-A5D9-4CA2-A58A-95CFFE3A4C90} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {92ED629F-603B-4D58-A644-04F7BB98D4C8} - System32\Tasks\Core Temp Autostart Tygan => C:\Program Files\Core Temp\Core Temp.exe
Task: {92F20432-E2F6-40CC-BDCF-8C7F6266DC22} - System32\Tasks\EPSON XP-540 Series Update {2AB6DE24-84C4-4AAB-BF4A-771C3BEF1053} => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSRIE.EXE [2013-11-22] (SEIKO EPSON CORPORATION)
Task: {9958AC97-9AE4-4593-BC43-0FC982D5E833} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {9B052FB7-4425-490E-BC1E-4E7554AD627D} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG
Task: {9EEF6C19-6405-4416-B34E-A560701B7380} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {A03E5801-CB80-4C0C-A0E8-F73C97F59AEB} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe
Task: {A97FEBFA-8C43-4447-B21D-C6897DA374E4} - \CreateChoiceProcessTask -> Keine Datei <==== ACHTUNG
Task: {AA43015D-35A1-43C5-BE5E-A138B79B3AF1} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {B1D23DB8-9377-47F8-9BBC-16FDCB8B191A} - System32\Tasks\CreateExplorerShellUnelevatedTask => C:\WINDOWS\explorer.exe /NOUACCHECK
Task: {B6E6AFBA-338C-44F1-B2A5-FBD198DEC00C} - \{A4058700-9B97-4117-8851-8B6C3C211F42} -> Keine Datei <==== ACHTUNG
Task: {B954A2A3-7EA5-47B8-93AB-136A508381A7} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Task: {BC28107D-F86D-4C90-86FA-BC9A0D4BD14E} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-11-20] (Adobe Systems Incorporated)
Task: {C9DE67D1-1BB8-4B1A-AA9D-E0B1199931F8} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {CDE38717-7FCF-49E4-9B48-4D8930E458E0} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {DA80726F-9E08-4DF3-B961-7A8A7D20A5C6} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {E7EAF163-3F7F-44D3-9B80-C8B5F93C8F28} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {F1E4FF0B-03E2-4A42-BF69-17E5765E0C20} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {F6A11EE2-0023-4595-8D9D-F2922462880E} - \{1A673BBD-E760-48DE-8182-982ABA1E0CD0} -> Keine Datei <==== ACHTUNG
Task: {F8D69DA4-D5C2-4E9D-930E-2906092F8638} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {FB409A52-D98C-4458-BB8A-24EE89EF7A6E} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {FC13AE24-50AF-4150-830A-1BA18858E237} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {FE639A93-6D40-4961-AC31-1B45E9126512} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {FF4245B5-59A8-403F-B4E5-8A1D3FF865E7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-01-22] (Google Inc.)
Task: {FFF8BFAC-4011-4218-BA7B-C5B42F2008CC} - \{104B9CA5-EF7D-4A10-ADB6-70F6F3EB62CE} -> Keine Datei <==== ACHTUNG

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\WINDOWS\Tasks\EPSON XP-540 Series Update {2AB6DE24-84C4-4AAB-BF4A-771C3BEF1053}.job => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSRIE.EXE:/EXE:{2AB6DE24-84C4-4AAB-BF4A-771C3BEF1053} /F:UpdateWORKGROUP\COMPUTER-128234$ĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
Task: C:\WINDOWS\Tasks\EPSON XP-540 Series Update {57EB58A9-FBFB-47E1-B238-BD9213EE8D07}.job => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSRIE.EXE:/EXE:{57EB58A9-FBFB-47E1-B238-BD9213EE8D07} /F:UpdateWORKGROUP\COMPUTER-128234$ĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi

==================== Verknüpfungen & WMI ========================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)


ShortcutWithArgument: C:\Users\lem0th\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\69639df789022856\Lem0th - Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory="Profile 1"

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2016-08-18 09:27 - 2016-08-18 09:27 - 000216576 _____ () C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
2014-11-03 18:48 - 2014-08-18 17:50 - 000316120 _____ () C:\Program Files (x86)\NETGEAR\WNA3100M\WifiSvc.exe
2017-03-15 12:52 - 2017-05-08 13:50 - 000034712 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupService-abpb.exe
2017-03-15 12:52 - 2017-05-08 13:50 - 000084376 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupServiceLib.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000132504 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\deemon.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000425368 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\twirl.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 008931224 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupCore.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 005060504 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\ox.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000308120 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\tomb.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000443800 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\veem.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000274328 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\crumb.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000131480 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\scoolite.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 001075096 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\webdave.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000059288 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\lzmaUtil.dll
2017-03-15 12:52 - 2017-05-03 12:33 - 000080896 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\ziputil.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000063896 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\minizutil.dll
2017-03-15 12:52 - 2017-05-03 12:33 - 000256512 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\jsoncpp.dll
2017-03-15 12:52 - 2017-05-03 12:33 - 000026112 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\zlibutil.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000080280 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\ashinetutil.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000163224 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\netutil.dll
2017-03-15 12:52 - 2017-05-03 12:33 - 000250880 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\party.dll
2017-03-15 12:52 - 2017-05-03 12:33 - 000083456 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\zdll.dll
2017-03-15 12:52 - 2017-05-03 12:33 - 000052224 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\lzma.dll
2017-03-15 12:52 - 2017-05-03 12:33 - 000581632 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\sqlite.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000031128 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\lz4util.dll
2017-03-15 12:52 - 2017-05-03 12:33 - 000111616 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\minizip.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000042392 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\lz4.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000044952 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\oxHelper.exe
2017-09-29 14:41 - 2017-09-29 14:41 - 000184432 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000326040 _____ () C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupClient-abpb.exe
2017-03-15 12:52 - 2017-05-08 13:50 - 006125976 _____ () C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupClientLib.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000126872 _____ () C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\featback.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000304536 _____ () C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\updateman.dll
2012-01-10 13:41 - 2015-05-30 17:26 - 000568904 _____ () C:\Program Files (x86)\puush\puush.exe
2015-02-11 19:57 - 2015-08-10 01:21 - 008276200 _____ () C:\Program Files (x86)\NETGEAR\WNA3100M\WNA3100M.exe
2017-09-14 12:10 - 2017-09-14 12:10 - 003553704 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11710.1001.27.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2017-11-11 00:42 - 2017-11-11 00:43 - 010257920 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11710.1001.27.0_x64__8wekyb3d8bbwe\WinStore.Entertainment.Mobile.dll
2017-11-23 11:57 - 2017-11-23 11:58 - 000087552 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-11-23 11:57 - 2017-11-23 11:58 - 000206336 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-11-23 11:57 - 2017-11-23 11:58 - 025461760 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-11-23 11:57 - 2017-11-23 11:58 - 002552832 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\skypert.dll
2017-11-23 11:57 - 2017-11-23 11:58 - 000685056 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\RtmMvrUap.dll
2017-11-23 11:57 - 2017-11-23 11:58 - 000135680 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkypeHost.Proxies.dll
2017-03-25 01:04 - 2017-03-25 01:04 - 000529408 _____ () C:\ProgramData\Resilio Sync\ShellExtensionOverlay64_2DC.dll
2017-09-29 14:42 - 2017-09-30 15:36 - 011044864 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-09-29 14:42 - 2017-09-30 15:36 - 001804288 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-11-14 01:22 - 2017-11-10 10:57 - 004135768 _____ () C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\libglesv2.dll
2017-11-14 01:22 - 2017-11-10 10:57 - 000100184 _____ () C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\libegl.dll
2017-09-29 14:41 - 2017-09-29 14:41 - 000047616 _____ () C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUITelemetry.dll
2017-09-29 14:41 - 2017-09-29 14:41 - 004173824 _____ () C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUIDataModel.dll
2017-09-29 14:41 - 2017-09-29 14:41 - 003634176 _____ () C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUIViewModels.dll
2017-11-15 02:31 - 2017-11-03 16:02 - 031229952 _____ () C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\PepperFlash\27.0.0.187\pepflashplayer.dll
2017-11-23 11:57 - 2017-11-23 11:58 - 000244736 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\Microsoft.Skype.ImageTool.dll
2017-11-23 11:57 - 2017-11-23 11:58 - 000041472 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\TraceProvider.dll
2016-04-05 12:12 - 2016-04-05 12:12 - 000221696 _____ () C:\Program Files (x86)\GNU\GnuPG\libksba-8.dll
2016-08-18 09:03 - 2016-08-18 09:03 - 000050176 _____ () C:\Program Files (x86)\GNU\GnuPG\libw32pth-0.dll
2016-08-18 09:14 - 2016-08-18 09:14 - 000073728 _____ () C:\Program Files (x86)\GNU\GnuPG\libassuan-0.dll
2016-08-18 09:17 - 2016-08-18 09:17 - 000751104 _____ () C:\Program Files (x86)\GNU\GnuPG\libgcrypt-20.dll
2016-08-18 09:09 - 2016-08-18 09:09 - 000103424 _____ () C:\Program Files (x86)\GNU\GnuPG\libgpg-error-0.dll
2014-11-03 18:48 - 2015-07-15 16:26 - 000450560 _____ () C:\Program Files (x86)\NETGEAR\WNA3100M\WifiLib.dll
2015-02-11 19:58 - 2014-07-22 10:18 - 000278528 _____ () C:\Program Files (x86)\NETGEAR\WNA3100M\WifiSvcLib.dll
2017-08-09 01:12 - 2017-08-08 14:13 - 001893880 _____ () C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\ffmpeg.dll
2017-08-09 01:43 - 2017-08-09 01:43 - 001577976 _____ () \\?\C:\Users\lem0th\AppData\Roaming\discord\0.0.298\modules\discord_toaster\discord_toaster.node
2017-11-23 03:07 - 2017-11-23 03:07 - 001403384 _____ () \\?\C:\Users\lem0th\AppData\Roaming\discord\0.0.298\modules\discord_overlay\discord_overlay.node
2017-08-09 01:12 - 2017-08-08 14:13 - 001938424 _____ () C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\libglesv2.dll
2017-08-09 01:12 - 2017-08-08 14:13 - 000095736 _____ () C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\libegl.dll
2017-08-09 01:43 - 2017-10-06 20:00 - 009722360 _____ () \\?\C:\Users\lem0th\AppData\Roaming\discord\0.0.298\modules\discord_voice\discord_voice.node
2017-08-09 01:43 - 2017-11-23 02:48 - 001494520 _____ () \\?\C:\Users\lem0th\AppData\Roaming\discord\0.0.298\modules\discord_utils\discord_utils.node
2017-11-23 03:06 - 2017-11-23 03:06 - 000148992 _____ () \\?\C:\Users\lem0th\AppData\Local\Temp\9757.tmp.node
2017-08-09 01:42 - 2017-08-09 01:42 - 002658296 _____ () \\?\C:\Users\lem0th\AppData\Roaming\discord\0.0.298\modules\discord_rpc\discord_rpc.node
2017-08-09 01:44 - 2017-08-09 01:44 - 002673656 _____ () \\?\C:\Users\lem0th\AppData\Roaming\discord\0.0.298\modules\discord_contact_import\discord_contact_import.node
2017-11-23 03:07 - 2017-11-23 03:07 - 001505272 _____ () \\?\C:\Users\lem0th\AppData\Roaming\discord\0.0.298\modules\discord_game_utils\discord_game_utils.node

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)


==================== Hosts Inhalt: ==========================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2009-07-14 03:34 - 2017-10-08 13:41 - 000004915 _____ C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1 choice.microsoft.com
127.0.0.1 Choice.microsoft.com.nstac.net
127.0.0.1 Df.telemetry.microsoft.com
127.0.0.1 Oca.telemetry.microsoft.com
127.0.0.1 Oca.telemetry.microsoft.com.nsatc.net
127.0.0.1 Redir.metaservices.microsoft.com
127.0.0.1 Reports.wes.df.telemetry.microsoft.com
127.0.0.1 Services.wes.df.telemetry.microsoft.com
127.0.0.1 Settings-sandbox.data.microsoft.com
127.0.0.1 Sqm.df.telemetry.microsoft.com
127.0.0.1 Sqm.telemetry.microsoft.com
127.0.0.1 Sqm.telemetry.microsoft.com.nsatc.net
127.0.0.1 Telecommand.telemetry.microsoft.com
127.0.0.1 Telecommand.telemetry.microsoft.com.nsatc.net
127.0.0.1 Telemetry.appex.bing.net
127.0.0.1 Telemetry.appex.bing.net:443
127.0.0.1 Telemetry.microsoft.com
127.0.0.1 Telemetry.urs.microsoft.com
127.0.0.1 Vortex-sandbox.data.microsoft.com
127.0.0.1 Vortex-win.data.microsoft.com
127.0.0.1 Vortex.data.microsoft.com
127.0.0.1 Watson.telemetry.microsoft.com
127.0.0.1 Watson.telemetry.microsoft.com.nsatc.net
127.0.0.1 apps.skype.com
127.0.0.1 apps.spotify.com
0.0.0.0 a.ads1.msn.com 
0.0.0.0 a.ads2.msads.net 
0.0.0.0 a.ads2.msn.com 
0.0.0.0 a.rad.msn.com 
0.0.0.0 a-0001.a-msedge.net 

Da befinden sich 109 zusätzliche Einträge.


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-624198674-977653023-2037852723-1040\Control Panel\Desktop\\Wallpaper -> c:\windows\web\wallpaper\theme1\img1.jpg
HKU\S-1-5-21-624198674-977653023-2037852723-1052\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 1) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Warn)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

MSCONFIG\Services: dbupdate => 2
MSCONFIG\Services: dbupdatem => 3
MSCONFIG\Services: Disc Soft Lite Bus Service => 3
MSCONFIG\Services: GalaxyClientService => 3
MSCONFIG\Services: GalaxyCommunication => 3
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: hshld => 2
MSCONFIG\Services: HssTrayService => 3
MSCONFIG\Services: HssWd => 2
MSCONFIG\Services: MBAMScheduler => 2
MSCONFIG\Services: MBAMService => 3
MSCONFIG\Services: MF NTFS Monitor => 2
MSCONFIG\Services: Origin Client Service => 3
MSCONFIG\Services: Origin Web Helper Service => 2
MSCONFIG\Services: TeamViewer => 3
MSCONFIG\Services: VMAuthdService => 2
MSCONFIG\Services: VMnetDHCP => 2
MSCONFIG\Services: VMUSBArbService => 2
MSCONFIG\Services: VMware NAT Service => 2
MSCONFIG\Services: VMwareHostd => 2
MSCONFIG\Services: YSearchUtilSvc => 2
MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
MSCONFIG\startupreg: PeerBlock => C:\Program Files\PeerBlock\peerblock.exe
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: Steam => "C:\Program Files (x86)\Steam\steam.exe" -silent
HKLM\...\StartupApproved\Run: => "Everything"
HKLM\...\StartupApproved\Run: => "SecurityHealth"
HKLM\...\StartupApproved\Run: => "AdobeAAMUpdater-1.0"
HKLM\...\StartupApproved\Run: => "NetSpeedMonitor"
HKLM\...\StartupApproved\Run: => "Malwarebytes TrayApp"
HKLM\...\StartupApproved\Run: => "OODITRAY.EXE"
HKLM\...\StartupApproved\Run32: => "Dropbox"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "ISUSScheduler"
HKLM\...\StartupApproved\Run32: => "Adobe Creative Cloud"
HKLM\...\StartupApproved\Run32: => "KeePass 2 PreLoad"
HKLM\...\StartupApproved\Run32: => "vmware-tray.exe"
HKLM\...\StartupApproved\Run32: => "DivXMediaServer"
HKLM\...\StartupApproved\Run32: => "SE61T-UserTools"
HKLM\...\StartupApproved\Run32: => "EaseUS Cleanup"
HKLM\...\StartupApproved\Run32: => "EaseUS EPM tray"
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\StartupApproved\StartupFolder: => "Twitch.lnk"
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\StartupApproved\Run: => "Skype"
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\StartupApproved\Run: => "GoogleDriveSync"
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\StartupApproved\Run: => "ISUSPM Startup"
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\StartupApproved\Run: => "SpiderOakONE"
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\StartupApproved\Run: => "OneDriveSetup"
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\StartupApproved\Run: => "Vivaldi Update Notifier"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [{F4BB3505-3E0A-408B-9689-808D4A790786}] => (Allow) C:\Users\lem0th\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\Data\ENEasyApp.exe
FirewallRules: [{1E87F7EE-F61F-4690-954D-295076E2BBA1}] => (Allow) C:\Users\lem0th\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\Data\ENEasyApp.exe
FirewallRules: [{A255C040-F45E-47BF-8892-C1C02B7D5AA8}] => (Allow) C:\Users\lem0th\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{D8825A33-54FE-4BE9-994A-35434B115295}] => (Allow) C:\Users\lem0th\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{620BE6D2-A228-417F-B1FD-B9323B3D3D0C}] => (Allow) C:\Users\lem0th\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{97E3584F-AAC0-4DDD-B339-55000F772E9E}] => (Allow) C:\Users\lem0th\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{E83B674A-0E5F-462B-9F79-737C8A767C4D}] => (Allow) C:\Users\lem0th\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{57C3935C-92F4-4AA4-BEF1-6291A8781D0A}] => (Allow) C:\Users\lem0th\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{0D5FBF2C-114C-433A-9925-B701286ACEF7}] => (Block) X:\programme\skype\phone\skype.exe
FirewallRules: [UDP Query User{F83EF883-3A6D-4890-862C-0863AC0683C1}X:\programme\skype\phone\skype.exe] => (Allow) X:\programme\skype\phone\skype.exe
FirewallRules: [TCP Query User{D9B90A33-152D-4F6B-BA3A-9274F46A9A87}X:\programme\skype\phone\skype.exe] => (Allow) X:\programme\skype\phone\skype.exe
FirewallRules: [{A6306B7D-5B1D-4768-94C0-56D9B1671C6C}] => (Allow) X:\Programme\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{B1396EA0-0381-416F-A675-CC8337F67D7D}] => (Allow) X:\Programme\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{A09F9C70-9A03-4DAB-B654-41697181755C}] => (Allow) X:\Programme\Steam\Steam.exe
FirewallRules: [{B3596106-9451-4FCB-98CA-0F94F1A0A1BF}] => (Allow) X:\Programme\Steam\Steam.exe
FirewallRules: [UDP Query User{95D78738-45DB-4DEC-8CCE-43A0361053C7}C:\users\tygan\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\tygan\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{870CBFB2-7629-4AF7-AFA5-D48CE1FB53FC}C:\users\tygan\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\tygan\appdata\roaming\spotify\spotify.exe
FirewallRules: [{B867E3F2-353C-4AC2-8338-C2C60A5CBE79}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{397F6080-982A-42BB-A420-5BB640A7335B}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{749346A5-877C-4982-BD22-2948F1FCC218}] => (Block) C:\Windows\explorer.exe
FirewallRules: [{2765E0F4-2918-4A46-B9C9-43CDD8FCBA2B}] => (Block) C:\windows\systemapps\microsoft.windows.cortana_cw5n1h2txyewy\searchui.exe
FirewallRules: [{60E6D465-398E-4850-BE86-7EF7620A2377}] => (Block) C:\windows\system32\svchost.exe
FirewallRules: [{BC9350F7-BEDB-4808-995E-02C045262D71}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
FirewallRules: [{DE432B9C-B9B8-484E-92F4-420DB4569043}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
FirewallRules: [{F68498C4-1C82-46BF-A645-3429352A92A0}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
FirewallRules: [{570422B8-0DA1-4ED4-9AF5-B3C0CB2218A7}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
FirewallRules: [{6108EBF8-5249-4288-8E76-82B630A50267}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Sid Meier's Civilization III Complete\Conquests\Civ3Conquests.exe
FirewallRules: [{52BCE2DD-BE9B-4D83-94DC-518971B48B41}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Sid Meier's Civilization III Complete\Conquests\Civ3Conquests.exe
FirewallRules: [{0CFD36A9-C245-4D8B-BCE4-B97CFBC7E2E3}] => (Allow) %ProgramFiles% (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{021008C2-F369-4EC7-A04F-B64627B642D6}] => (Allow) %ProgramFiles% (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{3C26B0A2-E042-47DB-90D4-9F81BC82B2CC}] => (Allow) %ProgramFiles% (x86)\Mozilla Thunderbird\thunderbird.exe
FirewallRules: [{CC5F2C28-7374-4AED-9D91-90C23E4FBB56}] => (Allow) %ProgramFiles% (x86)\Steam\Steam.exe
FirewallRules: [UDP Query User{AF48CB2B-A69C-4CF2-B462-881C4995E614}C:\users\tygan\desktop\utox64.exe] => (Block) C:\users\tygan\desktop\utox64.exe
FirewallRules: [TCP Query User{3BB40C19-F2EA-4690-B6BB-367E7C2C263A}C:\users\tygan\desktop\utox64.exe] => (Block) C:\users\tygan\desktop\utox64.exe
FirewallRules: [UDP Query User{B808CC0C-4968-48F4-9BE7-084EF520E631}C:\users\johnny\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\johnny\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{4B8C2D2F-48DE-4603-A1B7-651D9094521E}C:\users\johnny\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\johnny\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{98E01700-645C-4C9A-9952-5BF89CBCF7CB}C:\users\johnny\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\johnny\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{EE24100D-05F1-4FDC-B0FB-55A8BF1B4487}C:\users\johnny\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\johnny\appdata\roaming\spotify\spotify.exe
FirewallRules: [{6236CC6A-BAC1-4844-B52D-4F058E166D63}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto Vice City\gta-vc.exe
FirewallRules: [{9EBBE327-BE32-4380-9CBC-88C1AD733278}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto Vice City\gta-vc.exe
FirewallRules: [UDP Query User{FC5CEB87-E833-4592-8760-3780D7556624}C:\users\l14d\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\l14d\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{A24E337A-91EB-489C-82A0-4CA2CCEBA69D}C:\users\l14d\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\l14d\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{902F54A4-0F65-4C67-91EA-EC5BFBEEE553}C:\users\l14d\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\l14d\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{D204B75D-FE2F-452A-A067-DBA89935BD82}C:\users\l14d\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\l14d\appdata\roaming\spotify\spotify.exe
FirewallRules: [{EC32C821-96C4-41F2-BD9A-609FEFA5B42F}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{54B2336C-4F2A-4C84-8028-6A77EF4C8E56}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{8275ADA2-E5C4-49CD-8056-9491007BA7D8}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{4A4247F5-9F6F-4FBE-AE9A-6856E2C09127}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [UDP Query User{C5BED132-D2F1-4B49-8E1C-89BA784920F2}C:\program files\java\jre1.8.0_45\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_45\bin\javaw.exe
FirewallRules: [TCP Query User{F425035C-FBD1-4846-BDC4-AE2E1A8F6BD6}C:\program files\java\jre1.8.0_45\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_45\bin\javaw.exe
FirewallRules: [TCP Query User{59343DAA-AC50-4FC2-8130-AFAAD277F5B4}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{E2BF7FA6-5490-4AD5-9649-9CEADB98B4C6}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{93D428DF-D9C1-4E3D-A833-119E7AD19B5F}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{C6C52E2C-A3B4-4AD8-AEB5-CC968831FC3E}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{CBCA0539-E485-4FB4-BF53-DEB504D29C8C}C:\program files\java\jre1.8.0_45\bin\javaw.exe] => (Block) C:\program files\java\jre1.8.0_45\bin\javaw.exe
FirewallRules: [UDP Query User{9AAF3CFF-DD7A-497A-BE2F-F9EFB4709A44}C:\program files\java\jre1.8.0_45\bin\javaw.exe] => (Block) C:\program files\java\jre1.8.0_45\bin\javaw.exe
FirewallRules: [{F930D29C-5362-4EE2-99B9-D74E90CF26FC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto 3\gta3.exe
FirewallRules: [{CA1EF5BB-0368-4FDB-B4D7-A96D85334062}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto 3\gta3.exe
FirewallRules: [TCP Query User{2E56E230-0344-4E6A-A98B-DB52242916A6}C:\program files (x86)\java\jre1.8.0_66\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_66\bin\javaw.exe
FirewallRules: [UDP Query User{FEB90422-50BF-4BBC-9C67-1CA183385D2A}C:\program files (x86)\java\jre1.8.0_66\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_66\bin\javaw.exe
FirewallRules: [TCP Query User{5E58BCBA-2A54-42BA-9272-F8FC180D0541}C:\program files (x86)\java\jre1.8.0_66\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_66\bin\javaw.exe
FirewallRules: [UDP Query User{460DAE00-1A73-4C21-88E5-DF8586370FE8}C:\program files (x86)\java\jre1.8.0_66\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_66\bin\javaw.exe
FirewallRules: [TCP Query User{49D22B15-CEAC-4B61-B0DB-ADB5DD1DBD3B}C:\program files\java\jre1.8.0_66\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_66\bin\javaw.exe
FirewallRules: [UDP Query User{87795A95-AC95-41A5-B44D-0FC8B98692F7}C:\program files\java\jre1.8.0_66\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_66\bin\javaw.exe
FirewallRules: [TCP Query User{A0D57D79-90D4-4328-A541-14045F7C2F3A}C:\program files\java\jre1.8.0_71\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_71\bin\javaw.exe
FirewallRules: [UDP Query User{1281CC9F-65AC-4C51-899F-6F497D4741B1}C:\program files\java\jre1.8.0_71\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_71\bin\javaw.exe
FirewallRules: [{E6972D16-0AC3-4BC9-B47C-514B7F426CB7}] => (Block) C:\Program Files\MAGIX\Movie Edit Pro 2016 Premium\Videodeluxe.exe
FirewallRules: [TCP Query User{1C83C5A9-CB4A-4E20-8FA2-A55AD8A8AD85}C:\program files\java\jre1.8.0_71\bin\java.exe] => (Allow) C:\program files\java\jre1.8.0_71\bin\java.exe
FirewallRules: [UDP Query User{4AD96FA5-D0F1-4A80-B277-A8EC07B1095B}C:\program files\java\jre1.8.0_71\bin\java.exe] => (Allow) C:\program files\java\jre1.8.0_71\bin\java.exe
FirewallRules: [TCP Query User{9EBF9B06-1E53-4968-8D45-64E7F5AB85D4}C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe
FirewallRules: [UDP Query User{26D9069E-74CF-4BB8-BB4E-B9A4F160A93B}C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe
FirewallRules: [TCP Query User{1BE7434B-A126-4C66-AA5D-1AD1CD895E4E}C:\program files\java\jre1.8.0_73\bin\javaw.exe] => (Block) C:\program files\java\jre1.8.0_73\bin\javaw.exe
FirewallRules: [UDP Query User{8CA8EC04-3441-45AD-9C88-62454794DE5E}C:\program files\java\jre1.8.0_73\bin\javaw.exe] => (Block) C:\program files\java\jre1.8.0_73\bin\javaw.exe
FirewallRules: [TCP Query User{816974BA-CA0A-4943-9878-2EC7BEE898A6}C:\program files\java\jre1.8.0_73\bin\javaw.exe] => (Block) C:\program files\java\jre1.8.0_73\bin\javaw.exe
FirewallRules: [UDP Query User{1B73E9FF-F469-4B8D-888C-CA465E90CCA3}C:\program files\java\jre1.8.0_73\bin\javaw.exe] => (Block) C:\program files\java\jre1.8.0_73\bin\javaw.exe
FirewallRules: [TCP Query User{CF1861DC-4799-410C-8AE7-FB60D285C243}C:\program files\java\jre1.8.0_91\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_91\bin\javaw.exe
FirewallRules: [UDP Query User{1DB619F2-55EB-458A-A1F0-CC69931D7953}C:\program files\java\jre1.8.0_91\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_91\bin\javaw.exe
FirewallRules: [TCP Query User{C37E1485-FA69-404E-9B3C-CAB73BFD5045}C:\program files\java\jre1.8.0_91\bin\javaw.exe] => (Block) C:\program files\java\jre1.8.0_91\bin\javaw.exe
FirewallRules: [UDP Query User{7FC55172-7B01-4F4C-8E97-01BD9B41FF9F}C:\program files\java\jre1.8.0_91\bin\javaw.exe] => (Block) C:\program files\java\jre1.8.0_91\bin\javaw.exe
FirewallRules: [{109A825B-BFD3-4938-AC47-369D022FF258}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Sid Meier's Civilization IV\Civilization4.exe
FirewallRules: [{3C38DAF4-FB24-44EF-878A-F4A6C9C03B8E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Sid Meier's Civilization IV\Civilization4.exe
FirewallRules: [{50A6CFBE-9E49-42AC-9709-23D26F9C4577}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Civilization IV Colonization\Colonization.exe
FirewallRules: [{5CA233AE-05C8-43E9-B286-450B6F760564}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Civilization IV Colonization\Colonization.exe
FirewallRules: [{AB8027AA-30D9-418F-933C-E9C1E46F1131}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Sid Meier's Civilization IV Warlords\Warlords\Civ4Warlords.exe
FirewallRules: [{AC68BEBD-FB95-4821-96F5-D051F3C7570F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Sid Meier's Civilization IV Warlords\Warlords\Civ4Warlords.exe
FirewallRules: [{3D971F71-8933-43F4-ABF0-1D0FAFA5D112}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Sid Meier's Civilization IV Warlords\Warlords\Civ4Warlords_PitBoss.exe
FirewallRules: [{88B80F2A-4D2D-4167-B2DB-274A064167AF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Sid Meier's Civilization IV Warlords\Warlords\Civ4Warlords_PitBoss.exe
FirewallRules: [{A42BE9C8-851B-4EF6-AEEF-811D2922A9E2}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Sid Meier's Civilization IV Beyond the Sword\Beyond the Sword\Civ4BeyondSword.exe
FirewallRules: [{D27C7C8E-1B14-45CA-B1D5-1CE4ECCE5D37}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Sid Meier's Civilization IV Beyond the Sword\Beyond the Sword\Civ4BeyondSword.exe
FirewallRules: [{777B1491-5F7F-41B3-88A0-E196B3EAFCC0}] => (Block) C:\Program Files\MAGIX\Movie Edit Pro 2016 Premium\Videodeluxe.exe
FirewallRules: [{378394AB-9822-4122-8E55-E3995F4CA54A}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{E60AE206-2D55-4AE2-BE03-1329312FD0F2}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{9C336E88-6428-4B9A-838A-652B480F10BF}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{E842D196-0257-4841-9B7C-6BFB26E23550}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{74C5B6D2-DC40-4F90-8C5A-0B511F332214}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{42814750-9923-44D2-94FF-F9D1F260C1A5}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{24C8B25B-7A7D-4B4B-995F-393323D16B4A}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{CCEDE4A1-E76C-4EED-BD8F-F60410BC5B52}] => (Block) %ProgramFiles%\WinRAR\WinRAR.exe
FirewallRules: [{A459CB98-EE87-4569-934A-0BC78A4B0250}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{21DD52DF-BE4E-4343-A5F0-BCB4CBCA79DC}] => (Allow) %ProgramFiles% (x86)\Steam\Steam.exe
FirewallRules: [{1F77FC1E-CA44-4AB3-8C42-B328FE503B4E}] => (Allow) %ProgramFiles% (x86)\Steam\GameOverlayUI.exe
FirewallRules: [{079E1CFE-97EC-4C4E-9C7B-4F87F6A86CC3}] => (Allow) %ProgramFiles% (x86)\Steam\bin\steamservice.exe
FirewallRules: [{2EF885B4-8060-4CEB-B1E5-7094BA0F947D}] => (Allow) %ProgramFiles% (x86)\Steam\bin\x64launcher.exe
FirewallRules: [{AEB6F9A1-3DE6-488E-AB33-EBCBE94730E3}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{1CDF547E-BC01-4035-9EE8-5D3EB35BC032}] => (Allow) %ProgramFiles% (x86)\Kaspersky Lab\Kaspersky Anti-Ransomware Tool for Business 1.1\anti_ransom.exe
FirewallRules: [{EC303E74-A5AC-4052-A252-071BF4B218E2}] => (Allow) C:\users\l14d\appdata\roaming\spotify\spotify.exe
FirewallRules: [{76E89C3D-EBDF-411D-95B2-1ADC371A35AB}] => (Allow) c:\windows\System32\cryptsvc.dll
FirewallRules: [{CD45E7C7-4B89-4DDC-A55B-04EB092F1A77}] => (Block) C:\Program Files\WindowsApps\Microsoft.WindowsStore_11610.1001.25.0_x64__8wekyb3d8bbwe\WinStore.App.exe
FirewallRules: [{C26EE298-886A-4704-B4FA-1AF5F33FD674}] => (Block) C:\Program Files\OO Software\DiskImage\oodiag.exe
FirewallRules: [{04F7C3B3-BB56-4D3C-AF09-BA057503A34C}] => (Allow) F:\Programme\Steam\Steam.exe
FirewallRules: [{F3326345-4AB3-40B1-8352-868BFA65093F}] => (Allow) F:\Programme\Steam\Steam.exe
FirewallRules: [{163092D8-A359-4178-A42D-2C5A790C36EF}] => (Allow) F:\Programme\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{F46C4F36-F1EE-42D2-A6DD-1FB805245F1E}] => (Allow) F:\Programme\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{9812FA29-EED4-4B8C-AC4D-E628E974CE7B}] => (Allow) F:\Programme\Steam\steamapps\common\Grand Theft Auto Vice City\gta-vc.exe
FirewallRules: [{C66F2F80-8DF6-4834-9F80-CBE026E61EFA}] => (Allow) F:\Programme\Steam\steamapps\common\Grand Theft Auto Vice City\gta-vc.exe
FirewallRules: [{E70FDD12-F25A-4652-AFEC-002CEAA96EF5}] => (Allow) F:\Programme\Steam\steamapps\common\Sid Meier's Civilization III Complete\Conquests\Civ3Conquests.exe
FirewallRules: [{1AF93ECC-0433-44FF-84D7-11EAAA33D6A1}] => (Allow) F:\Programme\Steam\steamapps\common\Sid Meier's Civilization III Complete\Conquests\Civ3Conquests.exe
FirewallRules: [{C3E32BCA-0054-4AD1-8A76-1C03B4804F4E}] => (Allow) F:\Programme\Steam\steamapps\common\Sid Meier's Civilization IV\Civilization4.exe
FirewallRules: [{9F95A2E7-D273-4208-8E47-EB21E140E999}] => (Allow) F:\Programme\Steam\steamapps\common\Sid Meier's Civilization IV\Civilization4.exe
FirewallRules: [{0B6EEC55-FB45-49FD-8375-54A0168AAEA5}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{18D6DB11-8E54-47B5-98D6-F216C819968E}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{0E8071AF-9129-4F8F-9B5C-9F38086D1F14}] => (Allow) F:\Programme\Steam\Steam.exe
FirewallRules: [{0B807F17-22AC-49A9-B87E-22F1FBCB113F}] => (Allow) F:\Programme\Steam\Steam.exe
FirewallRules: [{BF9A7F51-2F95-457A-82A4-31EC0FF24E87}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{301982E4-7C1B-43A3-AE9E-2A20CF6943A2}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{796E3438-A88E-4B3A-9EAB-A3621DF23CBF}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{0ED8DA3F-4669-4936-AA9B-C9A1579CCEAA}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{95B1B0C6-6CC2-4B3E-AC2E-408F1DCA6CBE}] => (Allow) F:\Programme\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{31DC7896-46BB-4079-A5FA-2170398C213F}] => (Allow) F:\Programme\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{35241042-2243-45C3-8EAE-20AE3BA2C9D9}] => (Allow) F:\Programme\Steam\Steam.exe
FirewallRules: [{3B474DAE-4AA3-423A-AAA0-F4C0C040B23F}] => (Allow) F:\Programme\Steam\Steam.exe
FirewallRules: [{707B7272-14CD-425D-B62B-18719C886662}] => (Allow) F:\Programme\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{5AE4401A-8EB0-4A87-A32F-377831176300}] => (Allow) F:\Programme\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{FFA4538F-3EBF-4EC4-847E-FBF38B8F27D8}] => (Allow) F:\Programme\Steam\Steam.exe
FirewallRules: [{BBF7CF47-EC67-4333-87DC-CC42160DE2AF}] => (Allow) F:\Programme\Steam\Steam.exe
FirewallRules: [{3D09D967-6F5A-4D30-A32A-1CFC54CC4896}] => (Allow) F:\Programme\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{77643507-F748-4A3C-AB02-15ACCEBD4498}] => (Allow) F:\Programme\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{B36CDBA0-DD20-4816-928F-78B11E567096}] => (Allow) F:\Programme\Steam\steamapps\common\Grand Theft Auto 3\gta3.exe
FirewallRules: [{24FCAFCC-72AA-4A29-A782-B367F8E516D2}] => (Allow) F:\Programme\Steam\steamapps\common\Grand Theft Auto 3\gta3.exe
FirewallRules: [TCP Query User{214F63DA-EBC4-4E80-8D81-D6AC1F26DEEA}F:\programme\skype\phone\skype.exe] => (Allow) F:\programme\skype\phone\skype.exe
FirewallRules: [UDP Query User{83AB9D48-4CA2-4920-AF21-57030C351A8B}F:\programme\skype\phone\skype.exe] => (Allow) F:\programme\skype\phone\skype.exe
FirewallRules: [{37F4059B-E85E-42E8-9DDB-839B9B6D3F4E}] => (Block) F:\programme\skype\phone\skype.exe
FirewallRules: [{E26BD086-BB5B-45FC-8398-94BC034BB042}] => (Allow) C:\Users\lem0th\AppData\Roaming\Resilio Sync\Resilio Sync.exe
FirewallRules: [{6E7FB522-35A1-4910-B17C-B75B9D725CA1}] => (Allow) C:\Users\lem0th\AppData\Roaming\Resilio Sync\Resilio Sync.exe
FirewallRules: [{84DB157C-2405-40E4-AE80-433B5DEEABEB}] => (Allow) C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe
FirewallRules: [{66D74E4F-F78D-4013-B909-A9183F5F1C4C}] => (Allow) C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe
FirewallRules: [{F8AD3435-5DFB-4E3A-BFAD-6D89E4A165DD}] => (Allow) C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe
FirewallRules: [{8C5FB2A6-32BE-42D1-A373-2E79F7A967BB}] => (Allow) C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe
FirewallRules: [{C2DC9810-E2D7-4C4E-9AE7-CADE8B0503F9}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{70A1E5BE-1563-47E9-B744-A866345A10BF}] => (Block) %ProgramFiles%\MAGIX\Movie Edit Pro 2016 Premium\videodeluxe.exe

==================== Wiederherstellungspunkte =========================

15-11-2017 18:47:42 Windows Update
20-11-2017 13:08:57 Windows Update

==================== Fehlerhafte Geräte im Gerätemanager =============

Name: PS/2-Standardtastatur
Description: PS/2-Standardtastatur
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardtastaturen)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (11/20/2017 05:02:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: WifiSvc.exe, Version: 2.1.0.24, Zeitstempel: 0x53cdc9f5
Name des fehlerhaften Moduls: WifiLib.dll, Version: 2.1.1.20, Zeitstempel: 0x55a6273a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00003486
ID des fehlerhaften Prozesses: 0x1f20
Startzeit der fehlerhaften Anwendung: 0x01d35fde7851ac63
Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\NETGEAR\WNA3100M\WifiSvc.exe
Pfad des fehlerhaften Moduls: C:\Program Files (x86)\NETGEAR\WNA3100M\WifiLib.dll
Berichtskennung: a1075dbd-05f3-4bab-ac23-7d74583d1f85
Vollständiger Name des fehlerhaften Pakets: 
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (11/17/2017 09:50:53 PM) (Source: COM) (EventID: 10031) (User: )
Description: Eine das Marshalling aufhebende Richtlinienprüfung wurde ausgeführt, als das Marshalling eines benutzerdefinierten gemarshallten Objekts aufgehoben wurde. Die Klasse "{41FD88F7-F295-4D39-91AC-A85F3149A05B}" wurde abgelehnt.

Error: (11/17/2017 09:50:53 PM) (Source: COM) (EventID: 10031) (User: )
Description: Eine das Marshalling aufhebende Richtlinienprüfung wurde ausgeführt, als das Marshalling eines benutzerdefinierten gemarshallten Objekts aufgehoben wurde. Die Klasse "{95CABCC9-BC57-4C12-B8DF-BA193232AA01}" wurde abgelehnt.

Error: (11/17/2017 08:27:41 PM) (Source: COM) (EventID: 10031) (User: )
Description: Eine das Marshalling aufhebende Richtlinienprüfung wurde ausgeführt, als das Marshalling eines benutzerdefinierten gemarshallten Objekts aufgehoben wurde. Die Klasse "{41FD88F7-F295-4D39-91AC-A85F3149A05B}" wurde abgelehnt.

Error: (11/17/2017 08:27:41 PM) (Source: COM) (EventID: 10031) (User: )
Description: Eine das Marshalling aufhebende Richtlinienprüfung wurde ausgeführt, als das Marshalling eines benutzerdefinierten gemarshallten Objekts aufgehoben wurde. Die Klasse "{41FD88F7-F295-4D39-91AC-A85F3149A05B}" wurde abgelehnt.

Error: (11/17/2017 04:00:37 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "QueryFullProcessImageNameW" ist ein unerwarteter Fehler aufgetreten. hr = 0x8007001f, Ein an das System angeschlossenes Gerät funktioniert nicht.
.


Vorgang:
   Asynchroner Vorgang wird ausgeführt

Kontext:
   Aktueller Status: DoSnapshotSet

Error: (11/17/2017 03:59:10 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {75abbc58-bc28-442a-8219-e77724043f24}

Error: (11/17/2017 03:52:29 PM) (Source: ESENT) (EventID: 455) (User: )
Description: DllHost (7176,R,0) WebCacheLocal: Fehler -1032 (0xfffffbf8) beim Öffnen von Protokolldatei C:\Users\lem0th\AppData\Local\Microsoft\Windows\WebCache\V01.log.

Error: (11/17/2017 03:52:29 PM) (Source: ESENT) (EventID: 490) (User: )
Description: DllHost (7176,R,0) WebCacheLocal: Der Versuch, die Datei "C:\Users\lem0th\AppData\Local\Microsoft\Windows\WebCache\V01.log" für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.

Error: (11/17/2017 03:52:19 PM) (Source: ESENT) (EventID: 455) (User: )
Description: DllHost (7176,R,0) WebCacheLocal: Fehler -1032 (0xfffffbf8) beim Öffnen von Protokolldatei C:\Users\lem0th\AppData\Local\Microsoft\Windows\WebCache\V01.log.


Systemfehler:
=============
Error: (11/24/2017 06:28:11 PM) (Source: DCOM) (EventID: 10016) (User: COMPUTER-128234)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "COMPUTER-128234\lem0th" (SID: S-1-5-21-624198674-977653023-2037852723-1040) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (11/23/2017 05:56:54 PM) (Source: DCOM) (EventID: 10016) (User: COMPUTER-128234)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "COMPUTER-128234\lem0th" (SID: S-1-5-21-624198674-977653023-2037852723-1040) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (11/22/2017 06:56:39 PM) (Source: DCOM) (EventID: 10016) (User: COMPUTER-128234)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "COMPUTER-128234\lem0th" (SID: S-1-5-21-624198674-977653023-2037852723-1040) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (11/22/2017 01:43:52 PM) (Source: DCOM) (EventID: 10016) (User: COMPUTER-128234)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "COMPUTER-128234\lem0th" (SID: S-1-5-21-624198674-977653023-2037852723-1040) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 und der APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.

Error: (11/22/2017 01:40:01 PM) (Source: Tcpip) (EventID: 4199) (User: )
Description: Das System hat einen Adressenkonflikt der IP-Adresse 192.168.1.3 mit dem Computer mit der
Netzwerkhardwareadresse 30-35-AD-48-9C-57 ermittelt. Netzwerkvorgänge könnten daher auf diesem
System unterbrochen werden.

Error: (11/22/2017 05:40:59 AM) (Source: DCOM) (EventID: 10010) (User: COMPUTER-128234)
Description: Der Server "{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (11/22/2017 05:40:59 AM) (Source: DCOM) (EventID: 10010) (User: COMPUTER-128234)
Description: Der Server "{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (11/22/2017 05:40:59 AM) (Source: DCOM) (EventID: 10010) (User: COMPUTER-128234)
Description: Der Server "{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (11/22/2017 05:40:59 AM) (Source: DCOM) (EventID: 10010) (User: COMPUTER-128234)
Description: Der Server "{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (11/22/2017 05:40:59 AM) (Source: DCOM) (EventID: 10010) (User: COMPUTER-128234)
Description: Der Server "{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.


CodeIntegrity:
===================================
  Date: 2017-11-24 21:42:12.993
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.

  Date: 2017-11-24 21:42:12.969
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.

  Date: 2017-11-24 21:42:12.944
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.

  Date: 2017-11-24 21:42:12.905
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.

  Date: 2017-11-24 21:13:34.290
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.

  Date: 2017-11-24 21:13:34.271
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.

  Date: 2017-11-24 21:13:34.252
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.

  Date: 2017-11-24 21:13:34.223
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.

  Date: 2017-11-24 21:12:35.932
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.

  Date: 2017-11-24 21:12:35.887
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.


==================== Speicherinformationen =========================== 

Prozessor: Intel(R) Core(TM)2 Duo CPU E7300 @ 2.66GHz
Prozentuale Nutzung des RAM: 82%
Installierter physikalischer RAM: 4094.18 MB
Verfügbarer physikalischer RAM: 731.59 MB
Summe virtueller Speicher: 8190.18 MB
Verfügbarer virtueller Speicher: 2169.79 MB

==================== Laufwerke ================================

Drive c: (Windows) (Fixed) (Total:464.75 GB) (Free:298.93 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 933BC6BB)
Partition 1: (Active) - (Size=99 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=464.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=473 MB) - (Type=27)
Partition 4: (Not Active) - (Size=455 MB) - (Type=27)

========================================================
Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 279.5 GB) (Disk ID: B828D6C1)
Partition 1: (Not Active) - (Size=279.5 GB) - (Type=07 NTFS)

==================== Ende von Addition.txt ============================

Wenn nacher noch Zeit da ist: Hast du irgendeine Idee, warum Google Chrome keine Weiterleitungen auf Seiten mehr annimmt? Habe chrome://flags schon zurückgesetzt, dennoch bleibt Chrome dabei die Weiterleitungen zu verweigern.

M-K-D-B · 25.11.2017, 14:09

Servus,

die Frage bezüglich Google Chrome kann ich leider aktuell nicht beantworten. Eventuell muss man den Browser zurücksetzen, damit es wieder wie gewünscht funktioniert.

Wir starten erst mal so:

Schritt 1
Downloade Dir bitte AdwCleaner auf deinen Desktop (Bebilderte Anleitung).

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Werkzeuge > Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel
- "Prefetch" Dateien
- Proxy
- Winsock
- Firewall
- Internet Explorer Richtlinien
- Chrome Richtlinien
Bestätige die Auswahl mit Ok.
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen (auch dann wenn AdwCleaner sagt, dass nichts gefunden wurde) und bestätige auftretende Hinweise mit Ok.
Klicke am Ende der Bereinigung auf Jetzt neu starten. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 2
Downloade Dir bitte Malwarebytes Anti-Malware 3 (Bebilderte Anleitung)

Installiere das Programm in den vorgegebenen Pfad.
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scan, wähle den Bedrohungs-Scan aus und klicke auf Scan starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Ausgewählte Elemente in die Quarantäne verschieben.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM nach dem Neustart, klicke auf Berichte.
Wähle den neuesten Scan-Bericht aus, klicke auf Bericht anzeigen und dann auf Export.
Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 3

Starte die FRST.exe erneut. Vergewissere dich, dass vor Addition.txt ein Haken gesetzt ist und drücke auf Untersuchen.
FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
Poste mir beide Logdateien mit deiner nächsten Antwort.

Bitte poste mit deiner nächsten Antwort

die Logdatei von AdwCleaner,
die Logdatei von MBAM,
die zwei neuen Logdateien von FRST.

Ladekabel612 · 25.11.2017, 17:23

Code:

ATTFilter

# AdwCleaner 7.0.4.0 - Logfile created on Sat Nov 25 15:12:21 2017
# Updated on 2017/27/10 by Malwarebytes 
# Running on Windows 10 Pro (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

Deleted: C:\Users\lem0th\AppData\Local\YSearchUtil


***** [ Files ] *****

No malicious files deleted.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\services
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe


***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Prefetch files deleted
::Proxy settings cleared
::Firewall rules cleared
::IE policies deleted
::Chrome policies deleted
::Additional Actions: 0



*************************

C:/AdwCleaner/AdwCleaner[S0].txt - [1151 B] - [2017/11/25 15:11:0]


########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ##########

Code:

ATTFilter

Malwarebytes
www.malwarebytes.com

-Protokolldetails-
Scan-Datum: 25.11.17
Scan-Zeit: 16:21
Protokolldatei: 
Administrator: Ja

-Softwaredaten-
Version: 3.1.2.1733
Komponentenversion: 1.0.160
Version des Aktualisierungspakets: 1.0.3343
Lizenz: Testversion

-Systemdaten-
Betriebssystem: Windows 10 (Build 16299.64)
CPU: x64
Dateisystem: NTFS
Benutzer: COMPUTER-128234\lem0th

-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Ergebnis: Abgeschlossen
Gescannte Objekte: 530429
Erkannte Bedrohungen: 2
In die Quarantäne verschobene Bedrohungen: 2
Abgelaufene Zeit: 30 Min., 7 Sek.

-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

-Scan-Details-
Prozess: 0
(keine bösartigen Elemente erkannt)

Modul: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)

Registrierungswert: 0
(keine bösartigen Elemente erkannt)

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Daten-Stream: 0
(keine bösartigen Elemente erkannt)

Ordner: 0
(keine bösartigen Elemente erkannt)

Datei: 2
PUP.Optional.AshampooDriverUpdater, C:\PROGRAMDATA\ASHAMPOO\ICO_ASHAMPOO_DEALS.ICO, In Quarantäne, [2329], [354924],1.0.3343
PUP.Optional.AshampooDriverUpdater, C:\USERS\PUBLIC\DESKTOP\ASHAMPOO DEALS.URL, In Quarantäne, [2329], [354883],1.0.3343

Physischer Sektor: 0
(keine bösartigen Elemente erkannt)


(end)

Code:

ATTFilter

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 24-11-2017 01
durchgeführt von lem0th (Administrator) auf COMPUTER-128234 (25-11-2017 17:09:54)
Gestartet von C:\Users\lem0th\Desktop
Geladene Profile: lem0th & _ashbackuppb_ (Verfügbare Profile: lem0th & _ashbackuppb_ & Administrator & DefaultAppPool)
Platform: Windows 10 Pro Version 1709 16299.64 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
(WIBU-SYSTEMS AG) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Ransomware Tool for Business 1.1\anti_ransom.exe
() C:\Program Files (x86)\NETGEAR\WNA3100M\WifiSvc.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
() C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupService-abpb.exe
() C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\oxHelper.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Ransomware Tool for Business 1.1\anti_ransom_gui.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(VideoLAN) C:\Program Files\VideoLAN\VLC\vlc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupClient-abpb.exe
() C:\Program Files (x86)\puush\puush.exe
(Discord Inc.) C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\Discord.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\oxHelper.exe
() C:\Program Files (x86)\NETGEAR\WNA3100M\WNA3100M.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files\WindowsApps\49297T.Partl.DailyPic2_2.8.6.0_x64__jr9bq2af9farr\DailyPic.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google) C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\SwReporter\23.133.200\software_reporter_tool.exe
(Google) C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\SwReporter\23.133.200\software_reporter_tool.exe
(Discord Inc.) C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\Discord.exe
(Discord Inc.) C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\Discord.exe

==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [630168 2017-09-29] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13885696 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [163800 2016-07-30] (IvoSoft)
HKLM\...\Run: [Ashampoo Backup PB] => C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupClient-abpb.exe [326040 2017-05-08] ()
HKLM\...\Run: [Everything] => C:\Program Files\Everything\Everything.exe [2197608 2017-06-07] ()
HKLM-x32\...\Run: [ISUSScheduler] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2004-06-14] (InstallShield Software Corporation)
HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [3222448 2017-10-12] (Dominik Reichl)
HKLM-x32\...\Run: [vmware-tray.exe] => C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe [112104 2017-03-21] (VMware, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-09-05] (Oracle Corporation)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Beschränkung <==== ACHTUNG
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Run: [puush] => C:\Program Files (x86)\puush\puush.exe [568904 2015-05-30] ()
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Run: [Discord] => C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\Discord.exe [57477112 2017-08-08] (Discord Inc.)
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Run: [ISUSPM Startup] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [221184 2004-06-14] (InstallShield Software Corporation)
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Run: [Vivaldi Update Notifier] => C:\ProgramData\chocolatey\lib\Vivaldi\tools\vivaldi\Vivaldi-bin\update_notifier.exe [4716664 2017-09-20] (Vivaldi Technologies AS)
HKU\S-1-5-21-624198674-977653023-2037852723-1052\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [519680 2017-09-29] (Microsoft Corporation)
AppInit_DLLs: prio.dll => Keine Datei
SSODL: EldosMountNotificator-cbfs6 - {73F8D53A-4E1F-4434-A7D0-7C1E3B50BB78} - C:\WINDOWS\system32\cbfsMntNtf6.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator-cbfs6 - {73F8D53A-4E1F-4434-A7D0-7C1E3B50BB78} - C:\WINDOWS\SysWOW64\cbfsMntNtf6.dll (EldoS Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WNA3100M Genie.lnk [2016-07-10]
ShortcutTarget: NETGEAR WNA3100M Genie.lnk -> C:\Program Files (x86)\NETGEAR\WNA3100M\WNA3100M.exe ()

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{0a287408-cae2-4b64-9929-6ec5bb421193}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-624198674-977653023-2037852723-1040\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://de.yahoo.com/?fr=yset_ie_syc_oracle&type=orcl_hpset
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-624198674-977653023-2037852723-1040 -> {8CD4FD52-359A-4F3E-BEB3-D2114C31B19B} URL = hxxps://de.search.yahoo.com/search?p={searchTerms}&intl=de&fr=yset_ie_syc_oracle&type=orcl_default&partnerexternal-oracle=external-oracle
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_151\bin\ssv.dll [2017-10-28] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_151\bin\jp2ssv.dll [2017-10-28] (Oracle Corporation)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2016-07-30] (IvoSoft)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2016-07-30] (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)

FireFox:
========
FF DefaultProfile: 3am39cb5.default
FF ProfilePath: C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default [2017-11-24]
FF NetworkProxy: Mozilla\Firefox\Profiles\3am39cb5.default -> backup.ftp&quot;, &quot;100.44.118.68&quot;
FF Extension: (No Resource URI Leak) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\@no-resource-uri-leak.xpi [2016-12-24] [Lagacy]
FF Extension: (HTTPS Everywhere) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\https-everywhere@eff.org.xpi [2017-11-23]
FF Extension: (uBlock Origin) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\uBlock0@raymondhill.net.xpi [2017-11-08]
FF Extension: (uMatrix) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\uMatrix@raymondhill.net.xpi [2017-11-23]
FF Extension: (User Agent Switcher) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}.xpi [2017-03-27] [Lagacy]
FF Extension: (O2 Service Suite) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\{} [2017-01-17] [Lagacy] [ist nicht signiert]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_27_0_0_187.dll [2017-11-20] ()
FF Plugin: @java.com/DTPlugin,version=11.151.2 -> C:\Program Files\Java\jre1.8.0_151\bin\dtplugin\npDeployJava1.dll [2017-10-28] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.151.2 -> C:\Program Files\Java\jre1.8.0_151\bin\plugin2\npjp2.dll [2017-10-28] (Oracle Corporation)
FF Plugin: @videolan.org/vlc,version=2.2.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_187.dll [2017-11-20] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll [2015-01-09] (Adobe Systems, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-13] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-13] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [Keine Datei]

Chrome: 
=======
CHR DefaultProfile: Profile 1
CHR StartupUrls: Profile 1 -> &quot;hxxps://www.youtube.com/feed/subscriptions&quot;,&quot;hxxps://twitter.com/&quot;
CHR DefaultSearchURL: Profile 1 -> hxxps://de.search.yahoo.com/search?p={searchTerms}&fr=yset_chr_syc_oracle&type=default
CHR DefaultSearchKeyword: Profile 1 -> Yahoo
CHR DefaultSuggestURL: Profile 1 -> hxxps://de.search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10
CHR Profile: C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default [2017-11-25]
CHR Extension: (Google Präsentationen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-03-12]
CHR Extension: (Google Docs) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-03-12]
CHR Extension: (Google Drive) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-03-12]
CHR Extension: (YouTube) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-03-12]
CHR Extension: (Google Tabellen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-03-12]
CHR Extension: (Google Docs Offline) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-06-30]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2017-03-12]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-12]
CHR Extension: (Google Mail) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-03-12]
CHR Extension: (Chrome Media Router) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-06-30]
CHR Profile: C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old [2017-03-15] <==== ACHTUNG
CHR Extension: (Google Präsentationen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-01-17]
CHR Extension: (Google Docs) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\aohghmighlieiainnegkcijnfilokake [2017-01-17]
CHR Extension: (Google Drive) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-01-17]
CHR Extension: (YouTube) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-01-17]
CHR Extension: (Google Tabellen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-01-17]
CHR Extension: (Google Docs Offline) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-01-17]
CHR Extension: (Blue Space) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\lgafflokkagpjiofcoodepkehnpldbge [2017-01-17]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-17]
CHR Extension: (Google Mail) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-01-17]
CHR Profile: C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1 [2017-11-25]
CHR Extension: (Google Präsentationen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-01-17]
CHR Extension: (Google Docs) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2017-01-17]
CHR Extension: (Google Drive) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-01-17]
CHR Extension: (YouTube) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-01-17]
CHR Extension: (CryptUp: Encrypt Gmail with PGP) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bnjglocicdkmhmoohhfkfkbbkejdhdgc [2017-02-10]
CHR Extension: (uBlock Origin) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2017-01-17]
CHR Extension: (Google Tabellen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-01-17]
CHR Extension: (HTTPS Everywhere) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gcbommkclmclpchllfjekcdonpmejbdp [2017-01-28]
CHR Extension: (Google Docs Offline) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-01-17]
CHR Extension: (Black blue shards) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\hgoflmajhinnohnhkfeggflmmppiilck [2017-01-17]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-19]
CHR Extension: (uMatrix) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ogfcmafjalglgifnmanfmnieipoejdcf [2017-01-17]
CHR Extension: (Google Mail) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-01-17]
CHR Extension: (Chrome Media Router) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-01-28]
CHR Profile: C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\System Profile [2017-01-17]
CHR HKU\S-1-5-21-624198674-977653023-2037852723-1040\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S4 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2207960 2016-09-26] (Adobe Systems, Incorporated)
R2 AntiRansom; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Ransomware Tool for Business 1.1\anti_ransom.exe [693720 2016-07-19] (AO Kaspersky Lab)
R2 ashbackuppb; c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupService-abpb.exe [34712 2017-05-08] ()
R2 DirMngr; C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [216576 2016-08-18] () [Datei ist nicht signiert]
R2 EpsonScanSvc; C:\WINDOWS\system32\EscSvc64.exe [145224 2016-11-08] (Seiko Epson Corporation)
S3 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4470736 2017-05-09] (Malwarebytes)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [303360 2015-06-24] (Realtek Semiconductor)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [4297920 2017-09-30] (Microsoft Corporation)
S2 VMwareHostd; C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe [12482024 2017-03-21] ()
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [355304 2017-09-29] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [105944 2017-09-29] (Microsoft Corporation)
R2 WSWNA3100M; C:\Program Files (x86)\NETGEAR\WNA3100M\WifiSvc.exe [316120 2014-08-18] ()

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 ampa; C:\WINDOWS\system32\ampa.sys [38320 2016-12-25] ()
S3 ampa; C:\WINDOWS\SysWOW64\ampa.sys [38320 2016-12-25] ()
R1 cbfs6; C:\WINDOWS\system32\drivers\cbfs6.sys [460992 2016-06-13] (EldoS Corporation)
S3 dtlitescsibus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [30264 2016-09-17] (Disc Soft Ltd)
S3 dtliteusbbus; C:\WINDOWS\System32\drivers\dtliteusbbus.sys [47672 2016-09-17] (Disc Soft Ltd)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [77376 2017-09-02] ()
R0 kl1; C:\WINDOWS\System32\DRIVERS\kl1.sys [554416 2016-06-02] (AO Kaspersky Lab)
R3 klflt; C:\WINDOWS\system32\DRIVERS\klflt.sys [191312 2016-06-26] (AO Kaspersky Lab)
R1 klhk; C:\WINDOWS\system32\DRIVERS\klhk.sys [413008 2016-06-28] (AO Kaspersky Lab)
R1 KLIF; C:\WINDOWS\System32\DRIVERS\klif.sys [1012048 2016-06-26] (AO Kaspersky Lab)
R1 klpd; C:\WINDOWS\System32\DRIVERS\klpd.sys [45488 2016-05-31] (AO Kaspersky Lab)
R1 Klwtp; C:\WINDOWS\system32\DRIVERS\klwtp.sys [126864 2016-06-02] (AO Kaspersky Lab)
R2 MBAMChameleon; C:\WINDOWS\system32\drivers\MBAMChameleon.sys [188352 2017-11-25] (Malwarebytes)
S3 MBAMFarflt; C:\WINDOWS\system32\drivers\farflt.sys [101784 2017-11-25] (Malwarebytes)
S3 MBAMProtection; C:\WINDOWS\system32\drivers\mbam.sys [45472 2017-11-25] (Malwarebytes)
R0 MBAMSwissArmy; C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys [253856 2017-11-25] (Malwarebytes)
S3 MBAMWebProtection; C:\WINDOWS\system32\drivers\mwac.sys [93600 2017-11-25] (Malwarebytes)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [604160 2017-09-29] (Realtek )
R3 RtlWlanu; C:\WINDOWS\System32\drivers\rtwlanu.sys [3859704 2015-10-16] (Realtek Semiconductor Corporation )
R3 taphss6; C:\WINDOWS\System32\drivers\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.)
R2 UI5IFS; C:\Program Files (x86)\Ashampoo\Ashampoo UnInstaller 7\IFS64.sys [30016 2017-11-17] ()
S3 usbrndis6; C:\WINDOWS\System32\drivers\usb80236.sys [23040 2017-09-29] (Microsoft Corporation)
S3 VBAudioVACMME; C:\WINDOWS\system32\DRIVERS\vbaudio_cable64_win7.sys [41192 2016-01-29] (Windows (R) Win 7 DDK provider)
R1 VBoxNetAdp; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys [131144 2016-12-20] (Oracle Corporation)
S3 VBoxUSB; C:\WINDOWS\System32\Drivers\VBoxUSB.sys [125008 2015-11-10] (Oracle Corporation)
R1 veracrypt; C:\WINDOWS\System32\drivers\veracrypt.sys [631200 2017-10-15] (IDRIX)
R3 vpnpbus; C:\WINDOWS\System32\drivers\vpnpbus.sys [18624 2016-06-13] (EldoS Corporation)
R2 vstor2-mntapi20-shared; C:\Windows\SysWow64\drivers\vstor2-mntapi20-shared.sys [37960 2016-11-14] (VMware, Inc.)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44608 2017-09-29] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [309144 2017-09-29] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [119192 2017-09-29] (Microsoft Corporation)
U3 idsvc; kein ImagePath

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-11-25 17:05 - 2017-11-25 17:05 - 000000022 _____ C:\WINDOWS\S.dirmngr
2017-11-25 17:05 - 2017-11-25 17:05 - 000000000 ____H C:\ProgramData\cm-lock
2017-11-25 16:06 - 2017-11-25 16:12 - 000000000 ____D C:\AdwCleaner
2017-11-25 16:05 - 2017-11-25 16:05 - 008261584 _____ (Malwarebytes) C:\Users\lem0th\Desktop\adwcleaner_7.0.4.0.exe
2017-11-24 22:38 - 2017-11-24 22:38 - 000000000 ____D C:\Users\Public\Documents\Ashampoo
2017-11-24 22:37 - 2017-11-24 22:41 - 000082080 _____ C:\Users\lem0th\Desktop\Addition.txt
2017-11-24 22:32 - 2017-11-25 17:11 - 000023415 _____ C:\Users\lem0th\Desktop\FRST.txt
2017-11-24 22:32 - 2017-11-24 22:32 - 000000000 ____D C:\Users\lem0th\Desktop\FRST-OlderVersion
2017-11-24 20:48 - 2017-11-24 20:48 - 000000134 _____ C:\Users\lem0th\sophie.txt
2017-11-24 20:35 - 2017-11-24 20:37 - 000000055 _____ C:\Users\lem0th\Desktop\sophie anschreiben text.txt
2017-11-24 19:34 - 2017-11-24 19:40 - 000081476 _____ C:\Users\lem0th\Downloads\Addition.txt
2017-11-24 19:28 - 2017-11-24 19:40 - 000096544 _____ C:\Users\lem0th\Downloads\FRST.txt
2017-11-24 19:27 - 2017-11-24 22:32 - 002393088 _____ (Farbar) C:\Users\lem0th\Desktop\FRST64.exe
2017-11-24 13:38 - 2017-11-24 13:38 - 000001285 _____ C:\Users\Public\Desktop\Ashampoo UnInstaller 7.lnk
2017-11-24 13:38 - 2017-11-24 13:38 - 000000000 ____D C:\Users\lem0th\AppData\Local\Ashampoo
2017-11-24 13:37 - 2017-11-24 13:37 - 000000000 ____D C:\Program Files (x86)\Ashampoo
2017-11-24 13:35 - 2017-11-24 13:37 - 015879616 _____ (Ashampoo GmbH & Co. KG ) C:\Users\lem0th\Downloads\ashampoo_uninstaller_7_7.00.00_sm.exe
2017-11-23 20:09 - 2017-10-21 20:00 - 002916352 _____ C:\Users\lem0th\Desktop\main.db
2017-11-23 11:49 - 2017-11-23 11:50 - 059117240 _____ (Skype Technologies S.A. ) C:\Users\lem0th\Downloads\Skype-8.11.0.4.exe
2017-11-22 05:27 - 2017-11-22 05:27 - 000000039 _____ C:\Users\lem0th\jeff stream.txt
2017-11-21 19:24 - 2017-11-21 19:24 - 000167296 _____ (Gibson Research Corp.) C:\Users\lem0th\Downloads\DNSBench.exe
2017-11-21 19:20 - 2017-11-21 19:21 - 000008653 _____ C:\Users\lem0th\Downloads\DNS Benchmarklist v1 by Möwe.ini
2017-11-21 02:18 - 2017-11-21 02:18 - 000000037 _____ C:\Users\lem0th\cities patar.txt
2017-11-20 01:46 - 2017-11-20 01:46 - 000001450 _____ C:\MediathekView.lnk
2017-11-20 01:44 - 2017-11-20 01:44 - 000004466 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2017-11-20 01:43 - 2017-11-20 01:43 - 000000000 ____D C:\Users\Default\AppData\Roaming\Macromedia
2017-11-20 01:43 - 2017-11-20 01:43 - 000000000 ____D C:\Users\Default User\AppData\Roaming\Macromedia
2017-11-17 21:28 - 2017-10-25 10:11 - 017083904 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
2017-11-17 21:28 - 2017-10-25 10:09 - 021753344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
2017-11-17 21:28 - 2017-10-25 04:36 - 025246208 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-11-17 21:28 - 2017-10-25 04:16 - 023658496 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-11-17 21:27 - 2017-10-25 10:11 - 000336896 _____ (Microsoft Corporation) C:\WINDOWS\system32\HolographicRuntimes.dll
2017-11-17 21:27 - 2017-10-25 09:57 - 000956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Spectrum.exe
2017-11-17 21:27 - 2017-10-25 09:57 - 000882688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Mirage.Internal.dll
2017-11-17 21:27 - 2017-10-25 09:56 - 000665600 _____ (Microsoft Corporation) C:\WINDOWS\system32\DHolographicDisplay.dll
2017-11-17 21:27 - 2017-10-25 07:36 - 000618496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Mirage.Internal.dll
2017-11-17 21:27 - 2017-10-25 05:41 - 000362176 _____ (Microsoft Corporation) C:\WINDOWS\system32\BioIso.exe
2017-11-17 21:27 - 2017-10-25 05:40 - 001634288 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2017-11-17 21:27 - 2017-10-25 05:40 - 000612760 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2017-11-17 21:27 - 2017-10-25 05:40 - 000269696 _____ C:\WINDOWS\system32\FaceProcessorCore.dll
2017-11-17 21:27 - 2017-10-25 05:39 - 007831248 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2017-11-17 21:27 - 2017-10-25 05:39 - 000479912 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64win.dll
2017-11-17 21:27 - 2017-10-25 05:39 - 000285080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2017-11-17 21:27 - 2017-10-25 05:37 - 001954048 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2017-11-17 21:27 - 2017-10-25 05:37 - 000610712 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2017-11-17 21:27 - 2017-10-25 05:36 - 008590744 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-11-17 21:27 - 2017-10-25 05:36 - 002400664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2017-11-17 21:27 - 2017-10-25 05:36 - 000187288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2017-11-17 21:27 - 2017-10-25 05:34 - 002573208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2017-11-17 21:27 - 2017-10-25 05:34 - 000839928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Perception.Stub.dll
2017-11-17 21:27 - 2017-10-25 05:34 - 000710920 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2017-11-17 21:27 - 2017-10-25 05:32 - 000559512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2017-11-17 21:27 - 2017-10-25 05:32 - 000147864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wcifs.sys
2017-11-17 21:27 - 2017-10-25 05:31 - 000436120 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHostCommon.dll
2017-11-17 21:27 - 2017-10-25 05:31 - 000045464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storufs.sys
2017-11-17 21:27 - 2017-10-25 05:30 - 004487968 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2017-11-17 21:27 - 2017-10-25 05:30 - 000555416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2017-11-17 21:27 - 2017-10-25 05:29 - 002269080 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsrcsnk.dll
2017-11-17 21:27 - 2017-10-25 05:29 - 001507736 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2017-11-17 21:27 - 2017-10-25 05:29 - 000603920 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2017-11-17 21:27 - 2017-10-25 05:28 - 001170008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2017-11-17 21:27 - 2017-10-25 05:27 - 006791472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2017-11-17 21:27 - 2017-10-25 05:27 - 001970520 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2017-11-17 21:27 - 2017-10-25 05:27 - 001426152 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2017-11-17 21:27 - 2017-10-25 05:27 - 000374032 _____ (Microsoft Corporation) C:\WINDOWS\system32\vac.exe
2017-11-17 21:27 - 2017-10-25 05:24 - 000428952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2017-11-17 21:27 - 2017-10-25 05:20 - 002717392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2017-11-17 21:27 - 2017-10-25 04:52 - 001615720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2017-11-17 21:27 - 2017-10-25 04:50 - 001528904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2017-11-17 21:27 - 2017-10-25 04:30 - 005615968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2017-11-17 21:27 - 2017-10-25 04:30 - 000354200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudExperienceHostCommon.dll
2017-11-17 21:27 - 2017-10-25 04:28 - 004648528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2017-11-17 21:27 - 2017-10-25 04:28 - 001246432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2017-11-17 21:27 - 2017-10-25 04:28 - 000982016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2017-11-17 21:27 - 2017-10-25 04:27 - 001454568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsrcsnk.dll
2017-11-17 21:27 - 2017-10-25 04:27 - 001377080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2017-11-17 21:27 - 2017-10-25 04:27 - 001015008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2017-11-17 21:27 - 2017-10-25 04:24 - 000506256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Perception.Stub.dll
2017-11-17 21:27 - 2017-10-25 04:22 - 006015200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2017-11-17 21:27 - 2017-10-25 04:22 - 002465848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2017-11-17 21:27 - 2017-10-25 04:19 - 003670016 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-11-17 21:27 - 2017-10-25 04:19 - 000097792 _____ C:\WINDOWS\system32\runexehelper.exe
2017-11-17 21:27 - 2017-10-25 04:18 - 000975872 _____ C:\WINDOWS\system32\FaceProcessor.dll
2017-11-17 21:27 - 2017-10-25 04:18 - 000328192 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll
2017-11-17 21:27 - 2017-10-25 04:18 - 000301056 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcLayers.dll
2017-11-17 21:27 - 2017-10-25 04:18 - 000135168 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_CapabilityAccess.dll
2017-11-17 21:27 - 2017-10-25 04:18 - 000095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\CapabilityAccessManagerClient.dll
2017-11-17 21:27 - 2017-10-25 04:18 - 000056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcSpecfc.dll
2017-11-17 21:27 - 2017-10-25 04:16 - 000227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\CapabilityAccessManager.dll
2017-11-17 21:27 - 2017-10-25 04:16 - 000114688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\UcmCx.sys
2017-11-17 21:27 - 2017-10-25 04:16 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzres.dll
2017-11-17 21:27 - 2017-10-25 04:15 - 000140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2017-11-17 21:27 - 2017-10-25 04:14 - 000541184 _____ (Microsoft Corporation) C:\WINDOWS\system32\HolographicExtensions.dll
2017-11-17 21:27 - 2017-10-25 04:14 - 000046080 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdrleakdiag.exe
2017-11-17 21:27 - 2017-10-25 04:13 - 002972672 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
2017-11-17 21:27 - 2017-10-25 04:12 - 000708096 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2017-11-17 21:27 - 2017-10-25 04:12 - 000599040 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2017-11-17 21:27 - 2017-10-25 04:12 - 000568832 _____ (Microsoft Corporation) C:\WINDOWS\system32\TileDataRepository.dll
2017-11-17 21:27 - 2017-10-25 04:11 - 000768512 _____ (Microsoft Corporation) C:\WINDOWS\system32\PCPKsp.dll
2017-11-17 21:27 - 2017-10-25 04:10 - 008099328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-11-17 21:27 - 2017-10-25 04:10 - 004742144 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2017-11-17 21:27 - 2017-10-25 04:10 - 001167360 _____ (Microsoft Corporation) C:\WINDOWS\system32\ISM.dll
2017-11-17 21:27 - 2017-10-25 04:09 - 002862080 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2017-11-17 21:27 - 2017-10-25 04:09 - 002106368 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2017-11-17 21:27 - 2017-10-25 04:09 - 001806336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll
2017-11-17 21:27 - 2017-10-25 04:09 - 000812032 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 002905600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-11-17 21:27 - 2017-10-25 04:08 - 002781696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 002633216 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 002392576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 001667584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Input.Inking.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 000654848 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 000487424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcSpecfc.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 000465408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 018914304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 003478016 _____ (Microsoft Corporation) C:\WINDOWS\system32\mispace.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 001485824 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 000685056 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 000372224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcLayers.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 000064512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CapabilityAccessManagerClient.dll
2017-11-17 21:27 - 2017-10-25 04:06 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tzres.dll
2017-11-17 21:27 - 2017-10-25 04:05 - 019339776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-11-17 21:27 - 2017-10-25 04:05 - 000106496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2017-11-17 21:27 - 2017-10-25 04:05 - 000022528 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtcVSp1res.dll
2017-11-17 21:27 - 2017-10-25 04:04 - 000124928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\luafv.sys
2017-11-17 21:27 - 2017-10-25 04:04 - 000041984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdrleakdiag.exe
2017-11-17 21:27 - 2017-10-25 04:03 - 000450048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TileDataRepository.dll
2017-11-17 21:27 - 2017-10-25 04:02 - 000591872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PCPKsp.dll
2017-11-17 21:27 - 2017-10-25 04:01 - 000462848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2017-11-17 21:27 - 2017-10-25 03:59 - 003679232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2017-11-17 21:27 - 2017-10-25 03:59 - 000664576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2017-11-17 21:27 - 2017-10-25 03:58 - 002467840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2017-11-17 21:27 - 2017-10-25 03:58 - 001322496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Input.Inking.dll
2017-11-17 21:27 - 2017-10-25 03:58 - 001280000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll
2017-11-17 21:27 - 2017-10-25 03:57 - 006035968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-11-17 21:27 - 2017-10-25 03:55 - 002864640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mispace.dll
2017-11-17 21:27 - 2017-10-25 03:54 - 000022528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msdtcVSp1res.dll
2017-11-17 21:27 - 2017-10-21 13:25 - 003313968 _____ C:\WINDOWS\system32\Windows.Mirage.dll
2017-11-17 21:27 - 2017-10-20 15:17 - 002474584 _____ C:\WINDOWS\SysWOW64\Windows.Mirage.dll
2017-11-17 21:27 - 2017-10-20 06:08 - 000339968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msexcl40.dll
2017-11-17 20:35 - 2017-11-17 20:35 - 000000000 _____ C:\Users\lem0th\AppData\Roaming\text.txt
2017-11-17 20:27 - 2017-11-17 20:27 - 000000000 ____D C:\Users\lem0th\AppData\Local\CrystalDiskMark5
2017-11-17 20:14 - 2017-11-17 20:14 - 000000000 ____D C:\WINDOWS\containers
2017-11-17 20:05 - 2017-11-17 20:07 - 000000000 ____D C:\WLAN
2017-11-17 19:59 - 2017-11-17 20:00 - 000000000 ____D C:\Program Files\CrystalDiskMark5
2017-11-17 19:58 - 2017-11-17 19:59 - 002783312 _____ (Crystal Dew World ) C:\Users\lem0th\Downloads\crystaldiskmark5_1_2-en.exe
2017-11-17 15:56 - 2017-11-17 15:56 - 000000000 _____ C:\WINDOWS\SysWOW64\last.dump
2017-11-17 15:45 - 2017-11-17 15:45 - 000061304 _____ () C:\WINDOWS\system32\Drivers\lpsport.sys
2017-11-17 15:37 - 2017-11-17 15:43 - 000000000 ____D C:\ProgramData\AVAST Software
2017-11-17 15:34 - 2017-11-17 15:35 - 010849904 _____ (Piriform Ltd) C:\Users\lem0th\Downloads\ccsetup537.exe
2017-11-16 22:10 - 2017-11-16 22:10 - 000096646 _____ C:\sleepstudy-report.html
2017-11-16 20:01 - 2017-11-16 20:01 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WhoCrashed
2017-11-16 16:57 - 2017-11-16 16:57 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Kits
2017-11-16 16:57 - 2017-11-16 16:57 - 000000000 ____D C:\Program Files (x86)\Windows Kits
2017-11-14 16:15 - 2017-11-14 16:15 - 000000016 _____ C:\Users\lem0th\uke termin.txt
2017-11-13 15:15 - 2017-11-13 15:15 - 000030518 _____ C:\Users\lem0th\tasklist.txt
2017-11-12 22:08 - 2017-10-10 08:14 - 000139672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecdd.sys
2017-11-12 22:08 - 2017-10-10 08:11 - 000739696 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll
2017-11-12 22:08 - 2017-10-10 08:10 - 001200024 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2017-11-12 22:08 - 2017-10-10 08:01 - 005906264 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2017-11-12 22:08 - 2017-10-10 08:00 - 001053592 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2017-11-12 22:08 - 2017-10-10 08:00 - 000373656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2017-11-12 22:08 - 2017-10-10 07:59 - 001641536 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2017-11-12 22:08 - 2017-10-10 07:59 - 000778936 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2017-11-12 22:08 - 2017-10-10 07:54 - 001463856 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2017-11-12 22:08 - 2017-10-10 07:53 - 000464416 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2017-11-12 22:08 - 2017-10-10 07:53 - 000232344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2017-11-12 22:08 - 2017-10-10 07:51 - 000184984 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspicli.dll
2017-11-12 22:08 - 2017-10-10 07:49 - 001554216 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2017-11-12 22:08 - 2017-10-10 07:49 - 000060824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\urscx01000.sys
2017-11-12 22:08 - 2017-10-10 07:48 - 000677280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2017-11-12 22:08 - 2017-10-10 07:44 - 000246168 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2017-11-12 22:08 - 2017-10-10 07:43 - 000418712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2017-11-12 22:08 - 2017-10-10 07:36 - 001436432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2017-11-12 22:08 - 2017-10-10 07:31 - 001323840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2017-11-12 22:08 - 2017-10-10 07:30 - 000123520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll
2017-11-12 22:08 - 2017-10-10 07:26 - 000649304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2017-11-12 22:08 - 2017-10-10 07:11 - 000597160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll
2017-11-12 22:08 - 2017-10-10 07:07 - 001261864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2017-11-12 22:08 - 2017-10-10 07:06 - 000353688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2017-11-12 22:08 - 2017-10-10 06:46 - 001470976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2017-11-12 22:08 - 2017-10-10 06:46 - 000136192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\t2embed.dll
2017-11-12 22:08 - 2017-10-10 06:43 - 000566272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TpmCoreProvisioning.dll
2017-11-12 22:08 - 2017-10-10 06:43 - 000070656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XblAuthTokenBrokerExt.dll
2017-11-12 22:08 - 2017-10-10 06:42 - 000374784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FirewallAPI.dll
2017-11-12 22:08 - 2017-10-10 06:42 - 000326144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptngc.dll
2017-11-12 22:08 - 2017-10-10 06:37 - 002869248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2017-11-12 22:08 - 2017-10-10 06:37 - 001587200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2017-11-12 22:08 - 2017-10-10 06:37 - 001559552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2017-11-12 22:08 - 2017-10-10 06:36 - 001664000 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2017-11-12 22:08 - 2017-10-10 06:36 - 000177664 _____ (Microsoft Corporation) C:\WINDOWS\system32\t2embed.dll
2017-11-12 22:08 - 2017-10-10 06:34 - 000057344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\UcmUcsi.sys
2017-11-12 22:08 - 2017-10-10 06:34 - 000034816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BasicRender.sys
2017-11-12 22:08 - 2017-10-10 06:34 - 000028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspisrv.dll
2017-11-12 22:08 - 2017-10-10 06:33 - 000086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthTokenBrokerExt.dll
2017-11-12 22:08 - 2017-10-10 06:33 - 000058880 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2017-11-12 22:08 - 2017-10-10 06:32 - 000529408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nwifi.sys
2017-11-12 22:08 - 2017-10-10 06:32 - 000461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll
2017-11-12 22:08 - 2017-10-10 06:31 - 000665088 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmCoreProvisioning.dll
2017-11-12 22:08 - 2017-10-10 06:31 - 000478208 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnr.dll
2017-11-12 22:08 - 2017-10-10 06:30 - 000542208 _____ (Microsoft Corporation) C:\WINDOWS\system32\FirewallAPI.dll
2017-11-12 22:08 - 2017-10-10 06:30 - 000442880 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptngc.dll
2017-11-12 22:08 - 2017-10-10 06:27 - 001547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2017-11-12 22:08 - 2017-10-10 06:26 - 003334144 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2017-11-12 22:08 - 2017-10-10 06:26 - 001856000 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2017-11-12 22:08 - 2017-10-10 06:25 - 001822208 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2017-11-12 22:08 - 2017-10-10 06:25 - 000925184 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2017-11-12 22:08 - 2017-10-10 06:24 - 000726016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2017-11-12 22:08 - 2017-10-10 06:24 - 000422912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv.sys
2017-11-12 22:08 - 2017-10-10 06:24 - 000285696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2017-11-12 22:08 - 2017-10-03 23:42 - 000640512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mswstr10.dll
2017-11-12 22:08 - 2017-10-03 23:42 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjint40.dll
2017-11-05 23:06 - 2017-11-05 23:06 - 000000043 _____ C:\Users\lem0th\money glitch.txt
2017-11-04 00:38 - 2017-11-04 00:38 - 000000000 ____D C:\Users\lem0th\Documents\FeedbackHub
2017-11-03 21:22 - 2017-10-28 12:12 - 000110144 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-64.dll
2017-11-01 19:17 - 2017-11-01 19:17 - 000023610 _____ C:\Users\lem0th\Documents\my-umatrix-backup.txt
2017-11-01 19:12 - 2017-11-01 19:13 - 000015765 _____ C:\Users\lem0th\Documents\my-umatrix-rules.txt
2017-10-31 12:25 - 2017-10-31 12:26 - 058031933 _____ C:\Users\lem0th\Documents\TV-20171030-2347-5101.webxl.h264.mp4
2017-10-30 19:57 - 2017-11-23 11:59 - 000000000 ____D C:\Users\lem0th\AppData\Local\PlaceholderTileLogoFolder
2017-10-30 18:02 - 2017-09-29 14:41 - 001312504 _____ (Microsoft Corporation) C:\WINDOWS\Taskmgr.exe
2017-10-30 17:30 - 2017-10-30 17:31 - 000080083 _____ C:\Users\lem0th\Documents\Addition.txt
2017-10-30 17:28 - 2017-10-30 17:31 - 000115706 _____ C:\Users\lem0th\Documents\FRST.txt
2017-10-30 17:11 - 2017-11-25 17:09 - 000000000 ____D C:\FRST
2017-10-30 17:10 - 2017-10-30 17:11 - 002403328 _____ (Farbar) C:\Users\lem0th\Documents\FRST64.exe
2017-10-30 16:42 - 2017-10-30 16:42 - 000000000 ____D C:\ProgramData\Microsoft OneDrive
2017-10-30 16:41 - 2017-10-30 16:41 - 000000000 ___HD C:\Users\lem0th\MicrosoftEdgeBackups
2017-10-30 16:39 - 2017-11-25 16:12 - 000000008 __RSH C:\Users\lem0th\ntuser.pol
2017-10-30 16:39 - 2017-10-30 16:39 - 000000020 ___SH C:\Users\lem0th\ntuser.ini
2017-10-30 16:39 - 2017-10-30 16:39 - 000000000 ___RD C:\Users\lem0th\3D Objects
2017-10-30 16:33 - 2017-10-30 16:34 - 000019053 _____ C:\WINDOWS\diagwrn.xml
2017-10-30 16:33 - 2017-10-30 16:34 - 000019053 _____ C:\WINDOWS\diagerr.xml
2017-10-30 16:31 - 2017-11-25 17:05 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-10-30 16:31 - 2017-11-23 23:17 - 000003658 _____ C:\WINDOWS\System32\Tasks\CreateExplorerShellUnelevatedTask
2017-10-30 16:31 - 2017-11-13 20:15 - 000003628 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2017-10-30 16:31 - 2017-11-13 20:15 - 000003504 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2017-10-30 16:31 - 2017-10-30 16:32 - 000003502 _____ C:\WINDOWS\System32\Tasks\EPSON XP-540 Series Update {2AB6DE24-84C4-4AAB-BF4A-771C3BEF1053}
2017-10-30 16:31 - 2017-10-30 16:32 - 000003116 _____ C:\WINDOWS\System32\Tasks\klcp_update
2017-10-30 16:31 - 2017-10-30 16:32 - 000002484 _____ C:\WINDOWS\System32\Tasks\Defender tägliche Updates
2017-10-30 16:31 - 2017-10-30 16:31 - 000003502 _____ C:\WINDOWS\System32\Tasks\EPSON XP-540 Series Update {57EB58A9-FBFB-47E1-B238-BD9213EE8D07}
2017-10-30 16:31 - 2017-10-30 16:31 - 000002746 _____ C:\WINDOWS\System32\Tasks\Sperrbildschirm
2017-10-30 16:31 - 2017-10-30 16:31 - 000000000 ____D C:\WINDOWS\System32\Tasks\WPD
2017-10-30 16:31 - 2016-12-19 18:28 - 000002210 _____ C:\WINDOWS\System32\Tasks\Core Temp Autostart Tygan
2017-10-30 16:21 - 2017-10-30 16:21 - 000000020 ___SH C:\Users\_ashbackuppb_\ntuser.ini
2017-10-30 16:09 - 2017-11-24 13:42 - 000000000 ____D C:\Users\lem0th\AppData\Local\Packages
2017-10-30 16:09 - 2017-10-30 16:09 - 000000000 ____D C:\ProgramData\USOShared
2017-10-30 16:07 - 2017-11-25 16:12 - 000000000 ____D C:\Users\lem0th
2017-10-30 16:07 - 2017-11-01 17:08 - 000000000 ____D C:\Users\_ashbackuppb_
2017-10-30 16:07 - 2017-10-30 16:29 - 000000000 ____D C:\Users\DefaultAppPool
2017-10-30 16:07 - 2017-10-30 16:26 - 000000000 ____D C:\Users\Administrator
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Vorlagen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Startmenü
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Netzwerkumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Lokale Einstellungen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Eigene Dateien
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Druckumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Documents\Eigene Videos
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Documents\Eigene Musik
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Documents\Eigene Bilder
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\AppData\Local\Verlauf
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\AppData\Local\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Vorlagen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Startmenü
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Netzwerkumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Lokale Einstellungen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Eigene Dateien
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Druckumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Documents\Eigene Videos
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Documents\Eigene Musik
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Documents\Eigene Bilder
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\AppData\Local\Verlauf
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\AppData\Local\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Vorlagen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Startmenü
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Netzwerkumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Lokale Einstellungen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Eigene Dateien
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Druckumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Documents\Eigene Videos
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Documents\Eigene Musik
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Documents\Eigene Bilder
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\AppData\Local\Verlauf
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\AppData\Local\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Vorlagen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Startmenü
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Netzwerkumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Lokale Einstellungen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Eigene Dateien
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Druckumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Documents\Eigene Videos
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Documents\Eigene Musik
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Documents\Eigene Bilder
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\AppData\Local\Verlauf
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\AppData\Local\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Anwendungsdaten
2017-10-30 16:02 - 2017-11-11 15:12 - 002252414 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-10-30 16:01 - 2017-09-29 14:41 - 002241024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2017-10-30 15:58 - 2017-11-25 15:16 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2017-10-30 15:58 - 2017-11-22 05:37 - 000742728 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-10-30 15:35 - 2016-06-28 12:28 - 000413008 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klhk.sys
2017-10-30 15:35 - 2016-06-26 15:14 - 001012048 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klif.sys
2017-10-30 15:35 - 2016-06-26 15:14 - 000191312 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klflt.sys
2017-10-30 15:35 - 2016-06-02 22:39 - 000126864 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klwtp.sys
2017-10-30 15:35 - 2016-06-02 03:43 - 000554416 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\kl1.sys
2017-10-30 15:35 - 2016-05-31 23:31 - 000045488 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klpd.sys
2017-10-30 15:34 - 2017-10-30 15:34 - 000000000 ___DL C:\Users\Public\Recorded TV (1)
2017-10-30 15:34 - 2017-10-30 15:34 - 000000000 ____D C:\Program Files\Common Files\SpeechEngines
2017-10-30 15:33 - 2017-10-30 15:54 - 000000000 ____D C:\WINDOWS\system32\config\bbimigrate
2017-10-30 15:30 - 2017-10-30 15:33 - 000000000 ____D C:\WINDOWS\ServiceProfiles
2017-10-30 15:26 - 2017-10-30 15:54 - 000000000 ___SD C:\WINDOWS\system32\lxss
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\WINDOWS\SysWOW64\XPSViewer
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\WINDOWS\SysWOW64\BestPractices
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\WINDOWS\system32\msmq
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\WINDOWS\system32\BestPractices
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\Program Files\Reference Assemblies
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\Program Files\MSBuild
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\Program Files (x86)\Reference Assemblies
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\Program Files (x86)\MSBuild
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\inetpub
2017-10-30 15:21 - 2017-09-22 18:19 - 000778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2017-10-30 15:21 - 2017-09-22 18:19 - 000103120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2017-10-30 15:21 - 2017-09-22 18:19 - 000035456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2017-10-30 15:20 - 2017-09-28 15:50 - 001166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2017-10-30 15:20 - 2017-09-28 15:50 - 000124624 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2017-10-30 15:20 - 2017-09-28 15:50 - 000035456 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2017-10-30 14:49 - 2017-10-30 14:49 - 000008192 _____ C:\WINDOWS\system32\config\userdiff
2017-10-30 14:13 - 2017-11-02 10:44 - 000000000 ___DC C:\WINDOWS\Panther
2017-10-30 14:07 - 2017-10-30 14:13 - 000000036 _____ C:\WINDOWS\progress.ini
2017-10-30 13:37 - 2017-10-30 16:36 - 000000000 ___HD C:\$GetCurrent
2017-10-28 09:38 - 2017-10-28 09:38 - 000195346 _____ C:\Users\lem0th\Documents\wu170509 (1).diagcab
2017-10-27 20:01 - 2017-10-27 20:01 - 000001440 _____ C:\Users\lem0th\Desktop\MediathekView.lnk
2017-10-27 19:58 - 2017-10-28 12:12 - 000110144 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll
2017-10-27 19:57 - 2017-10-28 12:14 - 000000000 ____D C:\Program Files\Java
2017-10-27 19:39 - 2017-10-27 19:39 - 000195346 _____ C:\Users\lem0th\Documents\wu170509.diagcab

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-11-25 17:14 - 2017-01-17 18:40 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\NetSpeedMonitor
2017-11-25 17:05 - 2017-03-15 12:52 - 000000000 ____D C:\ProgramData\Ashampoo
2017-11-25 17:04 - 2017-09-29 09:45 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2017-11-25 16:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\DeliveryOptimization
2017-11-25 16:20 - 2016-12-09 00:41 - 000093600 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2017-11-25 16:19 - 2016-12-09 00:41 - 000188352 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMChameleon.sys
2017-11-25 16:19 - 2016-12-09 00:41 - 000101784 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2017-11-25 16:19 - 2016-12-09 00:41 - 000045472 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2017-11-25 16:18 - 2016-12-09 00:40 - 000253856 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-11-25 16:12 - 2016-04-04 22:51 - 000000008 __RSH C:\ProgramData\ntuser.pol
2017-11-24 22:45 - 2017-01-17 17:29 - 000000000 ____D C:\Users\lem0th\AppData\LocalLow\Mozilla
2017-11-24 22:33 - 2017-10-22 21:52 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\vlc
2017-11-24 19:26 - 2017-03-15 12:54 - 000000000 ____D C:\Users\lem0th\AppData\Local\Ashampoo Backup PB
2017-11-24 13:42 - 2017-09-29 14:46 - 000000000 ___HD C:\Program Files\WindowsApps
2017-11-24 13:42 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\AppReadiness
2017-11-24 13:38 - 2017-03-15 12:52 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
2017-11-22 13:41 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\NDF
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\system32\F12
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\TextInput
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\appraiser
2017-11-22 05:34 - 2017-09-29 09:45 - 000000000 ____D C:\WINDOWS\system32\Dism
2017-11-22 05:33 - 2017-09-29 14:44 - 000000000 ____D C:\WINDOWS\INF
2017-11-21 21:01 - 2017-04-08 14:31 - 000000000 ____D C:\Users\lem0th\MediathekView
2017-11-21 21:00 - 2017-04-08 14:06 - 000000000 ____D C:\Users\lem0th\.mediathek3
2017-11-21 14:22 - 2010-11-21 04:27 - 000545440 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2017-11-20 01:44 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2017-11-20 01:44 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\Macromed
2017-11-18 21:01 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\rescache
2017-11-18 04:32 - 2017-01-17 18:33 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\KeePass
2017-11-17 21:32 - 2017-09-29 14:37 - 000000000 ____D C:\WINDOWS\CbsTemp
2017-11-17 20:17 - 2016-08-25 11:17 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-11-17 20:17 - 2014-11-05 16:46 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\zu-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\yo-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\xh-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\wo-SN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\vi-VN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\uz-Latn-UZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ur-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ug-CN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\tt-RU
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\tn-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\tk-TM
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ti-ET
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\tg-Cyrl-TJ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\te-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ta-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\sw-KE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-RS
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-BA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\sq-AL
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\si-LK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\sd-Arab-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\rw-RW
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\quz-PE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\quc-Latn-GT
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\prs-AF
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-Arab-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\or-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\nso-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\nn-NO
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ne-NP
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\mt-MT
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\mr-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\mn-MN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ml-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\mk-MK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\mi-NZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\lo-LA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\lb-LU
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ky-KG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ku-Arab-IQ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\kok-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\kn-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\km-KH
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\kk-KZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ka-GE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\is-IS
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ig-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\id-ID
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\hy-AM
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ha-Latn-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\gu-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\gd-GB
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ga-IE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\fil-PH
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\fa-IR
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\cy-GB
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\chr-CHER-US
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ca-ES-valencia
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\bs-Latn-BA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\bn-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\bn-BD
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\be-BY
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\az-Latn-AZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\as-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\am-ET
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\af-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\zu-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\yo-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\xh-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\wo-SN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\vi-VN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\uz-Latn-UZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ur-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ug-CN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\tt-RU
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\tn-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\tk-TM
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ti-ET
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\tg-Cyrl-TJ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\te-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ta-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\sw-KE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-RS
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-BA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\sq-AL
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\si-LK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\sd-Arab-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\rw-RW
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\quz-PE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\quc-Latn-GT
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\prs-AF
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\pa-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\pa-Arab-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\or-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\nso-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\nn-NO
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ne-NP
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\mt-MT
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\mr-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\mn-MN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ml-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\mk-MK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\mi-NZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\lo-LA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\lb-LU
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ky-KG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ku-Arab-IQ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\kok-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\kn-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\km-KH
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\kk-KZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ka-GE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\is-IS
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ig-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\id-ID
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\hy-AM
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ha-Latn-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\gu-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\gd-GB
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ga-IE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\fil-PH
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\fa-IR
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\cy-GB
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\chr-CHER-US
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ca-ES-valencia
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\bs-Latn-BA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\bn-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\bn-BD
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\be-BY
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\az-Latn-AZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\as-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\am-ET
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\af-ZA
2017-11-16 20:01 - 2017-09-03 02:54 - 000000000 ____D C:\Program Files\WhoCrashed
2017-11-16 16:56 - 2015-01-24 15:32 - 000000000 ____D C:\ProgramData\Package Cache
2017-11-14 15:41 - 2017-01-17 17:29 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Mozilla
2017-11-14 15:41 - 2016-07-23 17:08 - 000001228 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-11-14 01:22 - 2016-01-22 23:25 - 000002271 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-11-11 15:12 - 2017-09-30 15:34 - 000969320 _____ C:\WINDOWS\system32\perfh007.dat
2017-11-11 15:12 - 2017-09-30 15:34 - 000223032 _____ C:\WINDOWS\system32\perfc007.dat
2017-11-10 01:38 - 2017-06-21 16:11 - 000001056 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Core Temp.lnk
2017-11-07 12:33 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2017-11-04 02:25 - 2017-09-29 14:49 - 000835568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-11-04 02:25 - 2017-09-29 14:49 - 000177648 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-11-04 00:07 - 2017-01-17 17:43 - 000000000 ____D C:\Users\lem0th\AppData\Local\ElevatedDiagnostics
2017-11-03 21:29 - 2017-05-10 14:44 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-11-03 21:28 - 2017-03-08 18:48 - 000000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2017-11-03 21:26 - 2017-03-08 18:46 - 000000000 ____D C:\Program Files (x86)\TeamViewer
2017-11-03 21:23 - 2015-04-07 10:25 - 000000000 ____D C:\ProgramData\Skype
2017-11-03 21:12 - 2017-01-17 18:22 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Skype
2017-11-02 02:08 - 2017-06-21 16:53 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Everything
2017-10-31 12:18 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\appcompat
2017-10-30 16:51 - 2017-02-20 17:19 - 000002358 _____ C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Vivaldi.lnk
2017-10-30 16:51 - 2017-02-20 17:19 - 000000000 ____D C:\Users\lem0th\AppData\Local\Vivaldi
2017-10-30 16:39 - 2017-01-17 16:59 - 000000000 ____D C:\Users\lem0th\AppData\Local\TileDataLayer
2017-10-30 16:39 - 2015-07-29 17:28 - 000000000 __RHD C:\Users\Public\AccountPictures
2017-10-30 16:35 - 2017-09-29 14:46 - 000000000 ____D C:\Program Files\windows nt
2017-10-30 16:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\Registration
2017-10-30 16:34 - 2017-09-29 09:45 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2017-10-30 16:32 - 2015-07-29 17:19 - 000023056 _____ C:\WINDOWS\system32\emptyregdb.dat
2017-10-30 16:30 - 2017-09-29 14:46 - 000000000 __RSD C:\WINDOWS\media
2017-10-30 16:19 - 2017-10-15 17:36 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Everything
2017-10-30 16:19 - 2017-04-17 21:18 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Paragon Partition Manager™ 14 Free
2017-10-30 16:19 - 2017-02-13 15:20 - 000000000 ___RD C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Test2
2017-10-30 16:12 - 2017-09-29 14:46 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-10-30 16:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\inetsrv
2017-10-30 16:09 - 2017-09-29 14:46 - 000000000 ____D C:\ProgramData\USOPrivate
2017-10-30 16:09 - 2017-02-26 20:44 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Hammer & Chisel, Inc
2017-10-30 16:08 - 2015-11-19 15:54 - 000000000 ____D C:\Users\Administrator\AppData\Local\Packages
2017-10-30 16:02 - 2017-04-06 16:05 - 002003936 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2017-10-30 16:01 - 2017-09-29 09:45 - 000000000 ____D C:\WINDOWS\system32\Sysprep
2017-10-30 16:00 - 2017-04-06 16:04 - 000000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2017-10-30 15:57 - 2017-09-29 14:46 - 000028672 _____ C:\WINDOWS\system32\config\BCD-Template
2017-10-30 15:55 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase
2017-10-30 15:55 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\system32\Tasks_Migrated
2017-10-30 15:54 - 2017-10-15 17:58 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2017-10-30 15:54 - 2017-10-15 17:52 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2017-10-30 15:54 - 2017-10-15 17:01 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VeraCrypt
2017-10-30 15:54 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\SysWOW64\WCN
2017-10-30 15:54 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\SysWOW64\sysprep
2017-10-30 15:54 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\system32\WCN
2017-10-30 15:54 - 2017-09-29 14:49 - 000000000 ____D C:\WINDOWS\Setup
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 __SHD C:\Program Files\Windows Sidebar
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 __SHD C:\Program Files (x86)\Windows Sidebar
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\SysWOW64\DiagSvcs
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\Downloaded Program Files
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\IME
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\spool
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\IME
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\AppLocker
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\schemas
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\Resources
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\IME
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\Program Files\Common Files\microsoft shared
2017-10-30 15:54 - 2017-08-31 03:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinMerge
2017-10-30 15:54 - 2017-08-30 17:21 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
2017-10-30 15:54 - 2017-08-17 12:53 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Software
2017-10-30 15:54 - 2017-04-17 21:28 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AOMEI Partition Assistant Standard Edition 6.1
2017-10-30 15:54 - 2017-03-30 22:36 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 5.2
2017-10-30 15:54 - 2017-03-29 14:52 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware
2017-10-30 15:54 - 2017-03-21 02:59 - 000000000 __RSD C:\WINDOWS\system32\WindowsDevicePortal
2017-10-30 15:54 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\system32\catroot2.bak
2017-10-30 15:54 - 2017-03-11 00:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
2017-10-30 15:54 - 2017-02-23 22:44 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack
2017-10-30 15:54 - 2017-01-21 23:07 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Classic Shell
2017-10-30 15:54 - 2016-12-30 02:08 - 000000000 ____D C:\WINDOWS\SysWOW64\%ProductFolder%
2017-10-30 15:54 - 2016-12-30 00:07 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Anti-Ransomware Tool for Business
2017-10-30 15:54 - 2016-12-09 00:40 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-10-30 15:54 - 2016-09-02 00:41 - 000000000 ____D C:\WINDOWS\SysWOW64\Hotspot Shield
2017-10-30 15:54 - 2016-08-03 18:45 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2017-10-30 15:54 - 2016-08-03 18:06 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CrystalDiskInfo
2017-10-30 15:54 - 2016-06-22 13:59 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gpg4win
2017-10-30 15:54 - 2016-05-31 12:20 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steuer 2015
2017-10-30 15:54 - 2015-10-27 01:05 - 000000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2017-10-30 15:54 - 2015-05-30 17:25 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\puush
2017-10-30 15:54 - 2015-02-21 23:13 - 000000000 ____D C:\WINDOWS\SysWOW64\Adobe
2017-10-30 15:54 - 2014-11-22 15:04 - 000000000 ____D C:\WINDOWS\system32\appmgmt
2017-10-30 15:54 - 2014-11-03 18:48 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NETGEAR WNA3100M Genie
2017-10-30 15:54 - 2014-01-23 19:41 - 000000000 ____D C:\WINDOWS\system32\MRT
2017-10-30 15:45 - 2017-09-29 14:46 - 000000000 __RHD C:\Users\Public\Libraries
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\SysWOW64\winrm
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\SysWOW64\slmgr
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\SysWOW64\Printing_Admin_Scripts
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\system32\winrm
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\system32\slmgr
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\system32\Printing_Admin_Scripts
2017-10-30 15:36 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2017-10-30 15:36 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\en-GB
2017-10-30 15:36 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2017-10-30 15:36 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\oobe
2017-10-30 15:36 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\en-GB
2017-10-30 15:36 - 2017-04-06 16:04 - 000000000 ____D C:\WINDOWS\system32\SRSLabs
2017-10-30 15:36 - 2017-03-21 02:59 - 000000000 ___RD C:\WINDOWS\WebManagement
2017-10-30 15:35 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\system32\dsc
2017-10-30 15:35 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\system32\DiagSvcs
2017-10-30 15:34 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\OCR
2017-10-30 15:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\Help
2017-10-30 15:34 - 2017-09-29 14:46 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2017-10-30 15:34 - 2017-09-29 14:46 - 000000000 ____D C:\Program Files\Common Files\system
2017-10-30 15:34 - 2017-09-29 14:46 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2017-10-30 15:34 - 2017-08-17 12:51 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
2017-10-30 15:34 - 2017-04-06 16:04 - 000000000 ____D C:\Program Files\Realtek
2017-10-30 15:34 - 2016-08-29 17:47 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\sixteen tons entertainment
2017-10-30 15:34 - 2016-01-30 19:55 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MAGIX
2017-10-30 15:34 - 2015-09-22 16:14 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games
2017-10-30 15:27 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\inetsrv
2017-10-30 15:26 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\MUI
2017-10-30 15:26 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\MUI
2017-10-30 15:25 - 2017-09-29 14:43 - 000613376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqsnap.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000261632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000096256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa.tlb
2017-10-30 15:25 - 2017-09-29 14:43 - 000090624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa30.tlb
2017-10-30 15:25 - 2017-09-29 14:43 - 000055296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa20.tlb
2017-10-30 15:25 - 2017-09-29 14:43 - 000048640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\admwprox.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000036864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa10.tlb
2017-10-30 15:25 - 2017-09-29 14:43 - 000016896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisreset.exe
2017-10-30 15:25 - 2017-09-29 14:43 - 000014848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqcertui.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000011264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wamregps.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisrstap.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000009096 _____ C:\WINDOWS\SysWOW64\msmqtrc.mof
2017-10-30 15:25 - 2017-09-29 14:42 - 000054272 _____ (Microsoft Corporation) C:\WINDOWS\system32\admwprox.dll
2017-10-30 15:25 - 2017-09-29 14:42 - 000018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisreset.exe
2017-10-30 15:25 - 2017-09-29 14:42 - 000015360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wamregps.dll
2017-10-30 15:25 - 2017-09-29 14:42 - 000013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisrstap.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000980888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\lxcore.sys
2017-10-30 15:25 - 2017-09-29 14:41 - 000222720 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqrt.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplayx.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmsif.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mqac.sys
2017-10-30 15:25 - 2017-09-29 14:41 - 000072704 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsl.exe
2017-10-30 15:25 - 2017-09-29 14:41 - 000046592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpwsockx.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000024576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpmodemx.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000020480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplaysvr.exe
2017-10-30 15:25 - 2017-09-29 14:41 - 000018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmsifproxystub.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisRtl.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisRtl.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\ahadmin.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ahadmin.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000014336 _____ (Microsoft Corporation) C:\WINDOWS\system32\cngkeyhelper.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000011264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cngkeyhelper.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 001677824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmswitch.sys
2017-10-30 15:24 - 2017-09-29 14:41 - 000776192 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqsnap.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000747008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Wnv.sys
2017-10-30 15:24 - 2017-09-29 14:41 - 000564224 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqutil.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000389120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnet.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000306688 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000126464 _____ (Microsoft Corporation) C:\WINDOWS\system32\LxRun.exe
2017-10-30 15:24 - 2017-09-29 14:41 - 000125952 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqlogmgr.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000096256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa.tlb
2017-10-30 15:24 - 2017-09-29 14:41 - 000090624 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa30.tlb
2017-10-30 15:24 - 2017-09-29 14:41 - 000088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\nvspinfo.exe
2017-10-30 15:24 - 2017-09-29 14:41 - 000073216 _____ (Microsoft Corporation) C:\WINDOWS\system32\bash.exe
2017-10-30 15:24 - 2017-09-29 14:41 - 000062464 _____ (Microsoft Corporation) C:\WINDOWS\system32\wnvapi.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnathlp.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000055296 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa20.tlb
2017-10-30 15:24 - 2017-09-29 14:41 - 000036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa10.tlb
2017-10-30 15:24 - 2017-09-29 14:41 - 000034816 _____ (Microsoft Corporation) C:\WINDOWS\system32\wslapi.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000033688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmsproxy.sys
2017-10-30 15:24 - 2017-09-29 14:41 - 000022528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnsvr.exe
2017-10-30 15:24 - 2017-09-29 14:41 - 000017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqcertui.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000009096 _____ C:\WINDOWS\system32\msmqtrc.mof
2017-10-30 15:24 - 2017-09-29 14:41 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhupnp.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhpast.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnlobby.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnaddr.dll
2017-10-30 15:23 - 2017-09-29 14:43 - 000562176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqutil.dll
2017-10-30 15:23 - 2017-09-29 14:43 - 000156160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqrt.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 001381888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqqm.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000464896 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnet.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000067584 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnathlp.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqbkup.exe
2017-10-30 15:23 - 2017-09-29 14:41 - 000041984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wslconfig.exe
2017-10-30 15:23 - 2017-09-29 14:41 - 000026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnsvr.exe
2017-10-30 15:23 - 2017-09-29 14:41 - 000026112 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqsvc.exe
2017-10-30 15:23 - 2017-09-29 14:41 - 000015768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\lxss.sys
2017-10-30 15:23 - 2017-09-29 14:41 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhupnp.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhpast.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnlobby.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnaddr.dll
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\lv-LV
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\lt-LT
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\et-EE
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\es-MX
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\lv-LV
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\lt-LT
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\et-EE
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\es-MX
2017-10-30 13:04 - 2017-08-31 13:31 - 000028574 _____ C:\Users\lem0th\Documents\NeueDatenbank.kdbx
2017-10-28 12:21 - 2016-04-05 13:15 - 000000000 ____D C:\Program Files\7-Zip
2017-10-28 12:19 - 2017-06-22 03:14 - 000000000 ____D C:\Users\lem0th\AppData\Local\Everything

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2017-05-28 21:40 - 2017-05-28 21:41 - 832691886 _____ () C:\Users\lem0th\AppData\Roaming\Factorio.zip
2017-02-17 23:26 - 2017-03-27 02:39 - 000000154 _____ () C:\Users\lem0th\AppData\Roaming\prio.ini
2017-04-30 18:56 - 2017-04-30 02:43 - 000000027 _____ () C:\Users\lem0th\AppData\Roaming\test.bat
2017-11-17 20:35 - 2017-11-17 20:35 - 000000000 _____ () C:\Users\lem0th\AppData\Roaming\text.txt
2017-01-17 17:42 - 2016-07-17 22:18 - 000007656 _____ () C:\Users\lem0th\AppData\Local\Resmon.ResmonCfg

Einige Dateien in TEMP:
====================
2017-11-25 16:42 - 2017-11-25 16:42 - 001458856 _____ (Sysinternals - www.sysinternals.com) C:\Users\lem0th\AppData\Local\Temp\procexp64.exe

==================== Bamital & volsnap ======================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert

LastRegBack: 2017-11-19 18:21

==================== Ende von FRST.txt ============================

Ladekabel612 · 25.11.2017, 17:24

FRST Additions Logfile:

Code:

ATTFilter

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 24-11-2017 01 durchgeführt von lem0th (25-11-2017 17:14:55) Gestartet von C:\Users\lem0th\Desktop Windows 10 Pro Version 1709 16299.64 (X64) (2017-10-30 15:36:44) Start-Modus: Normal ==========================================================   ==================== Konten: =============================  Administrator (S-1-5-21-624198674-977653023-2037852723-500 - Administrator - Disabled) => C:\Users\Administrator DefaultAccount (S-1-5-21-624198674-977653023-2037852723-503 - Limited - Disabled) Gast (S-1-5-21-624198674-977653023-2037852723-501 - Limited - Disabled) lem0th (S-1-5-21-624198674-977653023-2037852723-1040 - Administrator - Enabled) => C:\Users\lem0th WDAGUtilityAccount (S-1-5-21-624198674-977653023-2037852723-504 - Limited - Disabled) _ashbackuppb_ (S-1-5-21-624198674-977653023-2037852723-1052 - Administrator - Enabled) => C:\Users\_ashbackuppb_  ==================== Sicherheits-Center ========================  (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)  AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}  ==================== Installierte Programme ======================  (Nur Adware-Programme mit dem Zusatz &quot;Hidden&quot; können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)  7-Zip 16.04 (x64) (HKLM\...\7-Zip) (Version: 16.04 - Igor Pavlov) Adobe Flash Player 27 NPAPI (HKLM-x32\...\{34D4D627-00A1-4C0D-BF68-576C146B9ED6}) (Version: 27.0.0.187 - Adobe Systems Incorporated) Adobe Shockwave Player 12.1 (HKLM-x32\...\{7E33E883-0D17-4397-A461-B576605E34B1}) (Version: 12.1.6.156 - Adobe Systems, Inc) AMD Catalyst Install Manager (HKLM\...\{37FCE154-7F59-74F0-3A35-BF503CEB230B}) (Version: 8.0.877.0 - Advanced Micro Devices, Inc.) AOMEI Partition Assistant Standard Edition 6.1 (HKLM-x32\...\{02F850ED-FD0E-4ED1-BE0B-54981f5BD3D4}_is1) (Version:  - AOMEI Technology Co., Ltd.) Ashampoo Backup Pro 11 (HKLM\...\{DF972766-3CEA-0FEC-AD7D-0A1791430C35}_is1) (Version: 11.08 - Ashampoo GmbH & Co. KG) Ashampoo UnInstaller 7 (HKLM-x32\...\{4209F371-C268-A90D-7A44-135E420FACEF}_is1) (Version: 7.00.00 - Ashampoo GmbH & Co. KG) Classic Shell (HKLM\...\{383BB30A-B4A7-4666-9A83-22CFA8640097}) (Version: 4.3.0 - IvoSoft) CrystalDiskInfo 7.0.2 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 7.0.2 - Crystal Dew World) CrystalDiskMark 5.1.2 (HKLM\...\CrystalDiskMark5_is1) (Version: 5.1.2 - Crystal Dew World) Discord (HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Discord) (Version: 0.0.298 - Discord Inc.) Emergency 4 Deluxe (HKLM-x32\...\{EDA12670-56B5-4459-BA21-D010F0E3EBA1}) (Version: 1.03.001 - ) Epson Scan 2 (HKLM-x32\...\Epson Scan 2) (Version:  - Seiko Epson Corporation) EPSON Scan OCR Component (HKLM-x32\...\{563B99D8-8895-4E3E-AE8D-15BE8C05F1C1}) (Version: 3.00.01 - SEIKO EPSON Corp.) Epson Software Updater (HKLM-x32\...\{B55DB65D-EF6E-4E04-89D5-B03603BF681B}) (Version: 4.4.5 - SEIKO EPSON CORPORATION) EPSON XP-540 Series Printer Uninstall (HKLM\...\EPSON XP-540 Series) (Version:  - Seiko Epson Corporation) EPSON-Handbücher (HKLM-x32\...\{84CECC1B-21EF-41B1-9A91-3E724E5D99D3}) (Version: 1.53.0.0 - Seiko Epson Corporation) EpsonNet Print (HKLM\...\{96ED1D58-440C-4345-8FEE-C4781366C67F}) (Version: 3.1.4.0 - SEIKO EPSON Corporation) Everything 1.4.1.877 (x64) (HKLM\...\Everything) (Version: 1.4.1.877 (x64) - David Carpenter) Factorio version 0.15.15 (HKLM\...\Factorio_is1) (Version:  - ) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 62.0.3202.94 - Google Inc.) Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden Gpg4win (2.3.3) (HKLM-x32\...\GPG4Win) (Version: 2.3.3 - The Gpg4win Project) Grand Theft Auto San Andreas (HKLM-x32\...\{086BADF8-9B1F-4E89-B207-2EDA520972D6}) (Version: 1.00.00001 - Rockstar Games) Java 8 Update 151 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180151F0}) (Version: 8.0.1510.12 - Oracle Corporation) Kaspersky Anti-Ransomware Tool for Business (HKLM-x32\...\{0F30C04E-E20E-4A5D-95AE-BF041D6CF673}) (Version: 1.1.24.0 - Kaspersky Lab) Hidden KeePass Password Safe 2.37 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.37 - Dominik Reichl) Kits Configuration Installer (HKLM-x32\...\{86E59C8F-61D5-1782-A3CE-60AE7E4D7791}) (Version: 10.1.16299.15 - Microsoft) Hidden K-Lite Codec Pack 13.2.0 Standard (HKLM-x32\...\KLiteCodecPack_is1) (Version: 13.2.0 - KLCP) LibreOffice 5.2.6.2 (HKLM-x32\...\{443795BA-BBA0-46CF-A07F-DB5B461785F7}) (Version: 5.2.6.2 - The Document Foundation) MAGIX Movie Edit Pro 2016 Premium (HKLM\...\{0E64129B-4258-44B9-8034-464C6E28878D}) (Version: 15.0.0.73 - MAGIX Software GmbH) Hidden MAGIX Movie Edit Pro 2016 Premium (HKLM\...\MX.{0E64129B-4258-44B9-8034-464C6E28878D}) (Version: 15.0.0.73 - MAGIX Software GmbH) MAGIX Video deluxe 2016 Premium Update (HKLM\...\{AA6874A6-C7EB-42D5-B434-A86B75E00F32}) (Version: 15.0.0.77 - MAGIX Software GmbH) Hidden Malwarebytes Version 3.1.2.1733 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.1.2.1733 - Malwarebytes) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61187 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61186 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.7523 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.7523 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.7523 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.7523 - Microsoft Corporation) Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{b341426f-8543-4e0d-96c3-e976f8ec5ab6}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{3c3aafc8-d898-43ec-998f-965ffdae065a}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40649 (HKLM-x32\...\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}) (Version: 12.0.40649.5 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23918 (HKLM-x32\...\{dab68466-3a7d-41a8-a5cf-415e3ff8ef71}) (Version: 14.0.23918.0 - Microsoft Corporation) Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation) Microsoft Visual J# 2.0 Redistributable Package - SE (x64) (HKLM\...\Microsoft Visual J# 2.0 Redistributable Package - SE (x64)) (Version:  - Microsoft Corporation) Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation) Microsoft_VC100_CRT_x86 (HKLM-x32\...\{6FDDB201-2CA0-42BD-973F-7B2C4A61EA3F}) (Version: 1.0.0 - Microsoft) Mozilla Firefox 57.0 (x64 de) (HKLM\...\Mozilla Firefox 57.0 (x64 de)) (Version: 57.0 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 57.0.0.6525 - Mozilla) MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation) MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation) MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation) NETGEAR WNA3100M N300 Wireless USB Adapter (HKLM-x32\...\{D3580358-0F78-402A-BE53-2E9D06383E04}) (Version: 1.2.0.6 - NETGEAR) NetSpeedMonitor 2.5.4.0 x64 (HKLM\...\{88F41EE2-949B-4B52-933D-C7F8F67BC1D2}) (Version: 2.5.4.0 - Florian Gilles) Notepad++ (64-bit x64) (HKLM\...\Notepad++) (Version: 7.5.1 - Notepad++ Team) paint.net (HKLM\...\{F10AAD91-58DF-44EC-A647-810197141667}) (Version: 4.0.19 - dotPDN LLC) Paragon Partition Manager™ 14 Free (HKLM\...\{47E5588F-C3A0-11DE-9857-005056C00008}) (Version: 90.00.0003 - Paragon Software) Prio (HKLM\...\Prio) (Version: 2.1.0.4391 - ) puush (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284B}) (Version: 1.0.0.0 - Dean Herbert) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7535 - Realtek Semiconductor Corp.) Resilio Sync (HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Resilio Sync) (Version: 2.4.4 - Resilio, Inc.) Revo Uninstaller 2.0.2 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.2 - VS Revo Group, Ltd.) SDK Debuggers (HKLM-x32\...\{E14725F0-A67E-BEA3-8BAF-7D9C5B5881E4}) (Version: 10.1.16299.15 - Microsoft Corporation) Hidden SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - ) Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation) Steuer 2015 (HKLM-x32\...\{E262CD3B-8825-4D56-AEF1-5E127F2FBB05}) (Version: 23.00.1146 - Buhl Data Service GmbH) VC80CRTRedist - 8.0.50727.6195 (HKLM-x32\...\{933B4015-4618-4716-A828-5289FC03165F}) (Version: 1.2.0 - DivX, Inc) Hidden VeraCrypt (HKLM-x32\...\VeraCrypt) (Version: 1.21 - IDRIX) Vivaldi (HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Vivaldi) (Version: 1.12.955.48 - Vivaldi) VLC media player (HKLM\...\VLC media player) (Version: 2.2.6 - VideoLAN) VMware Workstation (HKLM\...\{A4D1DB40-C6DC-40F8-AF6D-46BD4DD5ACAC}) (Version: 12.5.5 - VMware, Inc.) WhoCrashed 5.54 (HKLM\...\WhoCrashed_is1) (Version:  - Resplendence Software Projects Sp.) Windows Software Development Kit - Windows 10.0.16299.15 (HKLM-x32\...\{6195c203-b53c-4bb7-983a-6070a902e704}) (Version: 10.1.16299.15 - Microsoft Corporation) WinMerge 2.14.0 (HKLM-x32\...\WinMerge_is1) (Version: 2.14.0 - Thingamahoochie Software)  ==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================  (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)  CustomCLSID: HKU\S-1-5-21-624198674-977653023-2037852723-1040_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\lem0th\AppData\Local\Microsoft\OneDrive\17.3.6816.0313\amd64\FileSyncShell64.dll => Keine Datei CustomCLSID: HKU\S-1-5-21-624198674-977653023-2037852723-1040_Classes\CLSID\{581FFA00-FC33-0004-0402-95003A5CDE89}\InprocServer32 -> C:\Users\lem0th\AppData\Roaming\Resilio Sync\ShellExtensionPath64_2DC.dll () CustomCLSID: HKU\S-1-5-21-624198674-977653023-2037852723-1040_Classes\CLSID\{581FFA01-FC33-0004-0402-95003A5CDE89}\InprocServer32 -> C:\Users\lem0th\AppData\Roaming\Resilio Sync\ShellExtensionPath64_2DC.dll () CustomCLSID: HKU\S-1-5-21-624198674-977653023-2037852723-1040_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\lem0th\AppData\Local\Microsoft\OneDrive\17.3.6816.0313\amd64\FileSyncShell64.dll => Keine Datei CustomCLSID: HKU\S-1-5-21-624198674-977653023-2037852723-1040_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\lem0th\AppData\Local\Microsoft\OneDrive\17.3.6816.0313\amd64\FileSyncShell64.dll => Keine Datei ShellIconOverlayIdentifiers: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei ShellIconOverlayIdentifiers: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei ShellIconOverlayIdentifiers: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> Keine Datei ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> Keine Datei ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> Keine Datei ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> Keine Datei ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> Keine Datei ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> Keine Datei ShellIconOverlayIdentifiers: [!Resilio Sync 2.4.4Done] -> {581FFA04-FC33-0004-0402-95003A5CDE89} => C:\ProgramData\Resilio Sync\ShellExtensionOverlay64_2DC.dll [2017-03-25] () ShellIconOverlayIdentifiers: [!Resilio Sync 2.4.4RO] -> {581FFA03-FC33-0004-0402-95003A5CDE89} => C:\ProgramData\Resilio Sync\ShellExtensionOverlay64_2DC.dll [2017-03-25] () ShellIconOverlayIdentifiers: [!Resilio Sync 2.4.4RW] -> {581FFA02-FC33-0004-0402-95003A5CDE89} => C:\ProgramData\Resilio Sync\ShellExtensionOverlay64_2DC.dll [2017-03-25] () ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> Keine Datei ShellIconOverlayIdentifiers: [1MediaFireIconError] -> {5EE8C634-CDC0-453D-9731-DF0B19F4E807} => C:\Program Files (x86)\MediaFire Desktop\MediaFireIcon3_d1739.dll -> Keine Datei ShellIconOverlayIdentifiers: [1MediaFireIconReadOnly] -> {7995D0FC-769B-4197-AEC0-991921CB99E1} => C:\Program Files (x86)\MediaFire Desktop\MediaFireIcon5_d1739.dll -> Keine Datei ShellIconOverlayIdentifiers: [1MediaFireIconSynched] -> {9A3B79CB-D899-40B5-8DBC-20447F1ADC8F} => C:\Program Files (x86)\MediaFire Desktop\MediaFireIcon_d1739.dll -> Keine Datei ShellIconOverlayIdentifiers: [1MediaFireIconSyncing] -> {C4D81971-6B13-4173-AB21-F83AD20CCC04} => C:\Program Files (x86)\MediaFire Desktop\MediaFireIcon2_d1739.dll -> Keine Datei ShellIconOverlayIdentifiers: [EldosIconOverlay-cbfs6] -> {36A9E202-9EBD-4037-9EC8-9403A1FE827B} => C:\WINDOWS\system32\cbfsMntNtf6.dll [2016-06-13] (EldoS Corporation) ShellIconOverlayIdentifiers: [MediaFireIconLock] -> {759F3E92-F4E8-4953-8315-238B8B17E0F3} => C:\Program Files (x86)\MediaFire Desktop\MediaFireIcon4_d1739.dll -> Keine Datei ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft) ShellIconOverlayIdentifiers-x32: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei ShellIconOverlayIdentifiers-x32: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei ShellIconOverlayIdentifiers-x32: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> Keine Datei ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> Keine Datei ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> Keine Datei ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> Keine Datei ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> Keine Datei ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> Keine Datei ShellIconOverlayIdentifiers-x32: [!Resilio Sync 2.4.4Done] -> {581FFA04-FC33-0004-0402-95003A5CDE89} => C:\ProgramData\Resilio Sync\ShellExtensionOverlay64_2DC.dll [2017-03-25] () ShellIconOverlayIdentifiers-x32: [!Resilio Sync 2.4.4RO] -> {581FFA03-FC33-0004-0402-95003A5CDE89} => C:\ProgramData\Resilio Sync\ShellExtensionOverlay64_2DC.dll [2017-03-25] () ShellIconOverlayIdentifiers-x32: [!Resilio Sync 2.4.4RW] -> {581FFA02-FC33-0004-0402-95003A5CDE89} => C:\ProgramData\Resilio Sync\ShellExtensionOverlay64_2DC.dll [2017-03-25] () ShellIconOverlayIdentifiers-x32: [EldosIconOverlay-cbfs6] -> {36A9E202-9EBD-4037-9EC8-9403A1FE827B} => C:\WINDOWS\system32\cbfsMntNtf6.dll [2016-06-13] (EldoS Corporation) ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft) ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov) ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files\Notepad++\NppShell_06.dll [2017-08-29] () ContextMenuHandlers1: [GpgEX] -> {CCD955E4-5C16-4A33-AFDA-A8947A94946B} => C:\Program Files (x86)\GNU\GnuPG\bin\gpgex.dll [2016-08-18] (g10 Code GmbH) ContextMenuHandlers1: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei ContextMenuHandlers1: [MFShellStatic] -> {007D3D20-762B-40FF-BE6A-15E479A9DBFA} => C:\Program Files (x86)\MediaFire Desktop\MFDesktopShellStatic_d1739.dll -> Keine Datei ContextMenuHandlers1: [WinMerge] -> {4E716236-AA30-4C65-B225-D68BBA81E9C2} => C:\Program Files (x86)\WinMerge\ShellExtensionX64.dll [2013-02-02] (hxxp://winmerge.org) ContextMenuHandlers2: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei ContextMenuHandlers2-x32: [VMDiskMenuHandler] -> {271DC252-6FE1-4D59-9053-E4CF50AB99DE} => C:\Program Files (x86)\VMware\VMware Workstation\vmdkShellExt.dll [2017-03-21] (VMware, Inc.) ContextMenuHandlers2-x32: [VMDiskMenuHandler64] -> {E4D28EDC-8C0B-43EE-9E7D-C8A8682334DC} => C:\Program Files (x86)\VMware\VMware Workstation\x64\vmdkShellExt64.dll [2017-03-21] (VMware, Inc.) ContextMenuHandlers2-x32: [WinMerge] -> {4E716236-AA30-4C65-B225-D68BBA81E9C2} => C:\Program Files (x86)\WinMerge\ShellExtensionX64.dll [2013-02-02] (hxxp://winmerge.org) ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-05-09] (Malwarebytes) ContextMenuHandlers3: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei ContextMenuHandlers3: [SendTo] -> -{7BA4C740-9E81-11CF-99D3-00AA004AE837} =>  -> Keine Datei ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov) ContextMenuHandlers4: [GpgEX] -> {CCD955E4-5C16-4A33-AFDA-A8947A94946B} => C:\Program Files (x86)\GNU\GnuPG\bin\gpgex.dll [2016-08-18] (g10 Code GmbH) ContextMenuHandlers4: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei ContextMenuHandlers4: [MSSE] -> {0365FE2C-F183-4091-AC82-BFC39FB75C49} =>  -> Keine Datei ContextMenuHandlers4: [WinMerge] -> {4E716236-AA30-4C65-B225-D68BBA81E9C2} => C:\Program Files (x86)\WinMerge\ShellExtensionX64.dll [2013-02-02] (hxxp://winmerge.org) ContextMenuHandlers5: [Gadgets] -> {6B9228DA-9C15-419e-856C-19E768A13BDC} =>  -> Keine Datei ContextMenuHandlers5: [WinMerge] -> {4E716236-AA30-4C65-B225-D68BBA81E9C2} => C:\Program Files (x86)\WinMerge\ShellExtensionX64.dll [2013-02-02] (hxxp://winmerge.org) ContextMenuHandlers6: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov) ContextMenuHandlers6: [Fast Explorer] -> {693BE9C0-BEC3-11D2-B4C1-C33BBD3AD64B} =>  -> Keine Datei ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-05-09] (Malwarebytes) ContextMenuHandlers6: [MFShellStatic] -> {007D3D20-762B-40FF-BE6A-15E479A9DBFA} => C:\Program Files (x86)\MediaFire Desktop\MFDesktopShellStatic_d1739.dll -> Keine Datei ContextMenuHandlers6: [StartMenuExt] -> {E595F05F-903F-4318-8B0A-7F633B520D2B} => C:\WINDOWS\System32\StartMenuHelper64.dll [2016-07-30] (IvoSoft) ContextMenuHandlers1_S-1-5-21-624198674-977653023-2037852723-1040: [Resilio Sync 2.4.4] -> {581FFA00-FC33-0004-0402-95003A5CDE89} => C:\Users\lem0th\AppData\Roaming\Resilio Sync\ShellExtensionPath64_2DC.dll [2017-03-25] () ContextMenuHandlers4_S-1-5-21-624198674-977653023-2037852723-1040: [Resilio Sync 2.4.4] -> {581FFA00-FC33-0004-0402-95003A5CDE89} => C:\Users\lem0th\AppData\Roaming\Resilio Sync\ShellExtensionPath64_2DC.dll [2017-03-25] ()  ==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============  (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)  Task: {077D9730-A325-418A-A370-8FDB2AB69740} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-01-22] (Google Inc.) Task: {0925C293-A417-4212-97B6-79AA19FA7961} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe Task: {0B75604B-9502-4A48-ADE3-1237E2FBF078} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe Task: {15D635DD-27BD-4CBB-8FF7-667CA955FEB0} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\WINDOWS\ehome\ehrec.exe Task: {1E24BA0C-A9C7-4EB3-B9FC-80BA2F51F025} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe Task: {2010C5A7-AB3A-49B1-9C74-87670E1563B1} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe Task: {28F380A0-0DF8-4D51-B386-871F732C952C} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\WINDOWS\ehome\mcupdate.exe Task: {2922E616-61B8-4990-B55D-D5E006369855} - System32\Tasks\EPSON XP-540 Series Update {57EB58A9-FBFB-47E1-B238-BD9213EE8D07} => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSRIE.EXE [2013-11-22] (SEIKO EPSON CORPORATION) Task: {34150056-E698-4C15-A124-37E8DE1AC7C7} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe Task: {40237349-3DDE-4B82-8440-23FA248D5599} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe Task: {5403244C-E898-4F08-895E-F3CA03F79136} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe Task: {5653A8BA-5766-4972-AFE4-6AF986F39A5A} - \{A1C0E21F-C04B-4D7F-A3C7-F4A887B38845} -> Keine Datei  C:\WINDOWS\ehome\ehPrivJob.exe Task: {56F31CE6-6542-4ED2-AD8A-6B1BDE758A4B} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei  C:\WINDOWS\ehome\ehPrivJob.exe Task: {5ACFA180-BE93-4757-A600-57A61FE79EDC} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei  C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool.exe [2017-05-24] () Task: {6670D31E-C371-47EA-AEBC-DFCB51D7B4B5} - System32\Tasks\Sperrbildschirm => reg.exe add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData /t REG_DWORD /v AllowLockScreen /d 0 /f Task: {6B947FBC-CBFA-49C1-BE7A-76A0EEA3F402} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei  C:\WINDOWS\ehome\ehrec.exe Task: {7D2FC676-CC2E-44B0-820F-C92183A172FF} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe Task: {852E0376-20DA-4B53-8524-4C6ED036C24F} - System32\Tasks\Microsoft\Windows\Windows Subsystem for Linux\AptPackageIndexUpdate => C:\WINDOWS\System32\LxRun.exe [2017-10-30] (Microsoft Corporation) Task: {8C74191A-5503-44AD-8270-915C52BBC428} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe Task: {90633838-3B10-43F0-BC61-5C8504498795} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei  Keine Datei  C:\Program Files\Core Temp\Core Temp.exe Task: {92F20432-E2F6-40CC-BDCF-8C7F6266DC22} - System32\Tasks\EPSON XP-540 Series Update {2AB6DE24-84C4-4AAB-BF4A-771C3BEF1053} => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSRIE.EXE [2013-11-22] (SEIKO EPSON CORPORATION) Task: {9958AC97-9AE4-4593-BC43-0FC982D5E833} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe Task: {9B052FB7-4425-490E-BC1E-4E7554AD627D} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei  C:\WINDOWS\ehome\ehPrivJob.exe Task: {A03E5801-CB80-4C0C-A0E8-F73C97F59AEB} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe Task: {A97FEBFA-8C43-4447-B21D-C6897DA374E4} - \CreateChoiceProcessTask -> Keine Datei  C:\WINDOWS\ehome\ehPrivJob.exe Task: {B1D23DB8-9377-47F8-9BBC-16FDCB8B191A} - System32\Tasks\CreateExplorerShellUnelevatedTask => C:\WINDOWS\explorer.exe /NOUACCHECK Task: {B6E6AFBA-338C-44F1-B2A5-FBD198DEC00C} - \{A4058700-9B97-4117-8851-8B6C3C211F42} -> Keine Datei  Keine Datei  C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-11-20] (Adobe Systems Incorporated) Task: {C9DE67D1-1BB8-4B1A-AA9D-E0B1199931F8} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe Task: {CDE38717-7FCF-49E4-9B48-4D8930E458E0} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei  C:\WINDOWS\ehome\ehPrivJob.exe Task: {E7EAF163-3F7F-44D3-9B80-C8B5F93C8F28} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe Task: {F1E4FF0B-03E2-4A42-BF69-17E5765E0C20} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe Task: {F6A11EE2-0023-4595-8D9D-F2922462880E} - \{1A673BBD-E760-48DE-8182-982ABA1E0CD0} -> Keine Datei  C:\WINDOWS\ehome\mcupdate.exe Task: {FB409A52-D98C-4458-BB8A-24EE89EF7A6E} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei  Keine Datei  Keine Datei  C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-01-22] (Google Inc.) Task: {FFF8BFAC-4011-4218-BA7B-C5B42F2008CC} - \{104B9CA5-EF7D-4A10-ADB6-70F6F3EB62CE} -> Keine Datei  C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSRIE.EXE:/EXE:{2AB6DE24-84C4-4AAB-BF4A-771C3BEF1053} /F:UpdateWORKGROUP\COMPUTER-128234$ĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi Task: C:\WINDOWS\Tasks\EPSON XP-540 Series Update {57EB58A9-FBFB-47E1-B238-BD9213EE8D07}.job => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSRIE.EXE:/EXE:{57EB58A9-FBFB-47E1-B238-BD9213EE8D07} /F:UpdateWORKGROUP\COMPUTER-128234$ĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi  ==================== Verknüpfungen & WMI ========================  (Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)   ShortcutWithArgument: C:\Users\lem0th\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\69639df789022856\Lem0th - Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=&quot;Profile 1&quot;  ==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============  2017-09-29 14:41 - 2017-09-29 14:41 - 000184432 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll 2016-08-18 09:27 - 2016-08-18 09:27 - 000216576 _____ () C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe 2014-11-03 18:48 - 2014-08-18 17:50 - 000316120 _____ () C:\Program Files (x86)\NETGEAR\WNA3100M\WifiSvc.exe 2017-03-15 12:52 - 2017-05-08 13:50 - 000034712 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupService-abpb.exe 2017-03-15 12:52 - 2017-05-08 13:50 - 000084376 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupServiceLib.dll 2017-03-15 12:52 - 2017-05-08 13:50 - 008931224 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupCore.dll 2017-03-15 12:52 - 2017-05-08 13:50 - 000132504 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\deemon.dll 2017-03-15 12:52 - 2017-05-08 13:50 - 000425368 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\twirl.dll 2017-03-15 12:52 - 2017-05-08 13:50 - 005060504 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\ox.dll 2017-03-15 12:52 - 2017-05-08 13:50 - 000443800 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\veem.dll 2017-03-15 12:52 - 2017-05-08 13:50 - 000131480 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\scoolite.dll 2017-03-15 12:52 - 2017-05-08 13:50 - 000274328 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\crumb.dll 2017-03-15 12:52 - 2017-05-08 13:50 - 001075096 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\webdave.dll 2017-03-15 12:52 - 2017-05-08 13:50 - 000059288 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\lzmaUtil.dll 2017-03-15 12:52 - 2017-05-03 12:33 - 000080896 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\ziputil.dll 2017-03-15 12:52 - 2017-05-03 12:33 - 000026112 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\zlibutil.dll 2017-03-15 12:52 - 2017-05-08 13:50 - 000063896 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\minizutil.dll 2017-03-15 12:52 - 2017-05-03 12:33 - 000256512 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\jsoncpp.dll 2017-03-15 12:52 - 2017-05-03 12:33 - 000250880 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\party.dll 2017-03-15 12:52 - 2017-05-08 13:50 - 000308120 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\tomb.dll 2017-03-15 12:52 - 2017-05-08 13:50 - 000163224 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\netutil.dll 2017-03-15 12:52 - 2017-05-08 13:50 - 000080280 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\ashinetutil.dll 2017-03-15 12:52 - 2017-05-03 12:33 - 000083456 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\zdll.dll 2017-03-15 12:52 - 2017-05-03 12:33 - 000581632 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\sqlite.dll 2017-03-15 12:52 - 2017-05-08 13:50 - 000031128 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\lz4util.dll 2017-03-15 12:52 - 2017-05-03 12:33 - 000052224 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\lzma.dll 2017-03-15 12:52 - 2017-05-03 12:33 - 000111616 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\minizip.dll 2017-03-15 12:52 - 2017-05-08 13:50 - 000042392 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\lz4.dll 2017-03-15 12:52 - 2017-05-08 13:50 - 000044952 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\oxHelper.exe 2017-03-25 01:04 - 2017-03-25 01:04 - 000529408 _____ () C:\ProgramData\Resilio Sync\ShellExtensionOverlay64_2DC.dll 2017-09-29 14:42 - 2017-09-30 15:36 - 011044864 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll 2017-09-29 14:42 - 2017-09-30 15:36 - 001804288 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll 2017-09-29 14:42 - 2017-09-30 15:36 - 003655064 _____ () C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\ContentDeliveryManager.Background.dll 2017-09-29 14:42 - 2017-09-30 15:36 - 002470296 _____ () C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\ContentManagementSDK.dll 2017-11-23 11:57 - 2017-11-23 11:58 - 000087552 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkypeHost.exe 2017-11-23 11:57 - 2017-11-23 11:58 - 000206336 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll 2017-11-23 11:57 - 2017-11-23 11:58 - 025461760 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkyWrap.dll 2017-11-23 11:57 - 2017-11-23 11:58 - 002552832 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\skypert.dll 2017-03-15 12:52 - 2017-05-08 13:50 - 000326040 _____ () C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupClient-abpb.exe 2017-03-15 12:52 - 2017-05-08 13:50 - 006125976 _____ () C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupClientLib.dll 2017-03-15 12:52 - 2017-05-08 13:50 - 000304536 _____ () C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\updateman.dll 2017-03-15 12:52 - 2017-05-08 13:50 - 000126872 _____ () C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\featback.dll 2012-01-10 13:41 - 2015-05-30 17:26 - 000568904 _____ () C:\Program Files (x86)\puush\puush.exe 2015-02-11 19:57 - 2015-08-10 01:21 - 008276200 _____ () C:\Program Files (x86)\NETGEAR\WNA3100M\WNA3100M.exe 2017-11-14 01:22 - 2017-11-10 10:57 - 004135768 _____ () C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\libglesv2.dll 2017-11-14 01:22 - 2017-11-10 10:57 - 000100184 _____ () C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\libegl.dll 2017-11-11 00:43 - 2017-11-11 00:43 - 000454144 _____ () C:\Program Files\WindowsApps\49297T.Partl.DailyPic2_2.8.6.0_x64__jr9bq2af9farr\LockscreenBackgroundTask.dll 2017-11-11 00:43 - 2017-11-11 00:43 - 000016384 _____ () C:\Program Files\WindowsApps\49297T.Partl.DailyPic2_2.8.6.0_x64__jr9bq2af9farr\DailyPic.exe 2017-11-11 00:43 - 2017-11-11 00:43 - 010366976 _____ () C:\Program Files\WindowsApps\49297T.Partl.DailyPic2_2.8.6.0_x64__jr9bq2af9farr\DailyPic.dll 2017-11-11 00:42 - 2017-11-11 00:42 - 000836096 _____ () C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.1710.0_x64__8wekyb3d8bbwe\Microsoft.Services.Store.Engagement.dll 2016-04-05 12:12 - 2016-04-05 12:12 - 000221696 _____ () C:\Program Files (x86)\GNU\GnuPG\libksba-8.dll 2016-08-18 09:14 - 2016-08-18 09:14 - 000073728 _____ () C:\Program Files (x86)\GNU\GnuPG\libassuan-0.dll 2016-08-18 09:17 - 2016-08-18 09:17 - 000751104 _____ () C:\Program Files (x86)\GNU\GnuPG\libgcrypt-20.dll 2016-08-18 09:09 - 2016-08-18 09:09 - 000103424 _____ () C:\Program Files (x86)\GNU\GnuPG\libgpg-error-0.dll 2016-08-18 09:03 - 2016-08-18 09:03 - 000050176 _____ () C:\Program Files (x86)\GNU\GnuPG\libw32pth-0.dll 2014-11-03 18:48 - 2015-07-15 16:26 - 000450560 _____ () C:\Program Files (x86)\NETGEAR\WNA3100M\WifiLib.dll 2017-08-09 01:12 - 2017-08-08 14:13 - 001893880 _____ () C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\ffmpeg.dll 2017-08-09 01:43 - 2017-08-09 01:43 - 001577976 _____ () \\?\C:\Users\lem0th\AppData\Roaming\discord\0.0.298\modules\discord_toaster\discord_toaster.node 2015-02-11 19:58 - 2014-07-22 10:18 - 000278528 _____ () C:\Program Files (x86)\NETGEAR\WNA3100M\WifiSvcLib.dll 2017-08-09 01:12 - 2017-08-08 14:13 - 001938424 _____ () C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\libglesv2.dll 2017-08-09 01:12 - 2017-08-08 14:13 - 000095736 _____ () C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\libegl.dll 2017-08-09 01:43 - 2017-10-06 20:00 - 009722360 _____ () \\?\C:\Users\lem0th\AppData\Roaming\discord\0.0.298\modules\discord_voice\discord_voice.node 2017-08-09 01:43 - 2017-11-23 02:48 - 001494520 _____ () \\?\C:\Users\lem0th\AppData\Roaming\discord\0.0.298\modules\discord_utils\discord_utils.node 2017-11-25 17:10 - 2017-11-25 17:10 - 000148992 _____ () \\?\C:\Users\lem0th\AppData\Local\Temp\CCC2.tmp.node 2017-08-09 01:42 - 2017-08-09 01:42 - 002658296 _____ () \\?\C:\Users\lem0th\AppData\Roaming\discord\0.0.298\modules\discord_rpc\discord_rpc.node 2017-08-09 01:44 - 2017-08-09 01:44 - 002673656 _____ () \\?\C:\Users\lem0th\AppData\Roaming\discord\0.0.298\modules\discord_contact_import\discord_contact_import.node 2017-11-23 03:07 - 2017-11-23 03:07 - 001505272 _____ () \\?\C:\Users\lem0th\AppData\Roaming\discord\0.0.298\modules\discord_game_utils\discord_game_utils.node  ==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========  (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)   ==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================  (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert &quot;AlternateShell&quot; wird wiederhergestellt.)   ==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============  (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)   ==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============  (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)   ==================== Hosts Inhalt: ==========================  (Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)  2009-07-14 03:34 - 2017-10-08 13:41 - 000004915 _____ C:\WINDOWS\system32\Drivers\etc\hosts  127.0.0.1 choice.microsoft.com 127.0.0.1 Choice.microsoft.com.nstac.net 127.0.0.1 Df.telemetry.microsoft.com 127.0.0.1 Oca.telemetry.microsoft.com 127.0.0.1 Oca.telemetry.microsoft.com.nsatc.net 127.0.0.1 Redir.metaservices.microsoft.com 127.0.0.1 Reports.wes.df.telemetry.microsoft.com 127.0.0.1 Services.wes.df.telemetry.microsoft.com 127.0.0.1 Settings-sandbox.data.microsoft.com 127.0.0.1 Sqm.df.telemetry.microsoft.com 127.0.0.1 Sqm.telemetry.microsoft.com 127.0.0.1 Sqm.telemetry.microsoft.com.nsatc.net 127.0.0.1 Telecommand.telemetry.microsoft.com 127.0.0.1 Telecommand.telemetry.microsoft.com.nsatc.net 127.0.0.1 Telemetry.appex.bing.net 127.0.0.1 Telemetry.appex.bing.net:443 127.0.0.1 Telemetry.microsoft.com 127.0.0.1 Telemetry.urs.microsoft.com 127.0.0.1 Vortex-sandbox.data.microsoft.com 127.0.0.1 Vortex-win.data.microsoft.com 127.0.0.1 Vortex.data.microsoft.com 127.0.0.1 Watson.telemetry.microsoft.com 127.0.0.1 Watson.telemetry.microsoft.com.nsatc.net 127.0.0.1 apps.skype.com 127.0.0.1 apps.spotify.com 0.0.0.0 a.ads1.msn.com  0.0.0.0 a.ads2.msads.net  0.0.0.0 a.ads2.msn.com  0.0.0.0 a.rad.msn.com  0.0.0.0 a-0001.a-msedge.net   Da befinden sich 109 zusätzliche Einträge.   ==================== Andere Bereiche ============================  (Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)  HKU\S-1-5-21-624198674-977653023-2037852723-1040\Control Panel\Desktop\\Wallpaper -> c:\windows\web\wallpaper\theme1\img1.jpg HKU\S-1-5-21-624198674-977653023-2037852723-1052\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg DNS Servers: 192.168.1.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 1) (EnableLUA: 1) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Warn) Windows Firewall ist aktiviert.  ==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==  MSCONFIG\Services: dbupdate => 2 MSCONFIG\Services: dbupdatem => 3 MSCONFIG\Services: Disc Soft Lite Bus Service => 3 MSCONFIG\Services: GalaxyClientService => 3 MSCONFIG\Services: GalaxyCommunication => 3 MSCONFIG\Services: gupdate => 2 MSCONFIG\Services: gupdatem => 3 MSCONFIG\Services: hshld => 2 MSCONFIG\Services: HssTrayService => 3 MSCONFIG\Services: HssWd => 2 MSCONFIG\Services: MBAMScheduler => 2 MSCONFIG\Services: MBAMService => 3 MSCONFIG\Services: MF NTFS Monitor => 2 MSCONFIG\Services: Origin Client Service => 3 MSCONFIG\Services: Origin Web Helper Service => 2 MSCONFIG\Services: TeamViewer => 3 MSCONFIG\Services: VMAuthdService => 2 MSCONFIG\Services: VMnetDHCP => 2 MSCONFIG\Services: VMUSBArbService => 2 MSCONFIG\Services: VMware NAT Service => 2 MSCONFIG\Services: VMwareHostd => 2 MSCONFIG\startupreg: CCleaner Monitoring => &quot;C:\Program Files\CCleaner\CCleaner64.exe&quot; /MONITOR MSCONFIG\startupreg: PeerBlock => C:\Program Files\PeerBlock\peerblock.exe MSCONFIG\startupreg: Skype => &quot;C:\Program Files (x86)\Skype\Phone\Skype.exe&quot; /minimized /regrun MSCONFIG\startupreg: Steam => &quot;C:\Program Files (x86)\Steam\steam.exe&quot; -silent HKLM\...\StartupApproved\Run: => &quot;Everything&quot; HKLM\...\StartupApproved\Run: => &quot;SecurityHealth&quot; HKLM\...\StartupApproved\Run: => &quot;AdobeAAMUpdater-1.0&quot; HKLM\...\StartupApproved\Run: => &quot;NetSpeedMonitor&quot; HKLM\...\StartupApproved\Run: => &quot;Malwarebytes TrayApp&quot; HKLM\...\StartupApproved\Run: => &quot;OODITRAY.EXE&quot; HKLM\...\StartupApproved\Run32: => &quot;Dropbox&quot; HKLM\...\StartupApproved\Run32: => &quot;SunJavaUpdateSched&quot; HKLM\...\StartupApproved\Run32: => &quot;ISUSScheduler&quot; HKLM\...\StartupApproved\Run32: => &quot;Adobe Creative Cloud&quot; HKLM\...\StartupApproved\Run32: => &quot;KeePass 2 PreLoad&quot; HKLM\...\StartupApproved\Run32: => &quot;vmware-tray.exe&quot; HKLM\...\StartupApproved\Run32: => &quot;DivXMediaServer&quot; HKLM\...\StartupApproved\Run32: => &quot;SE61T-UserTools&quot; HKLM\...\StartupApproved\Run32: => &quot;EaseUS Cleanup&quot; HKLM\...\StartupApproved\Run32: => &quot;EaseUS EPM tray&quot; HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\StartupApproved\StartupFolder: => &quot;Twitch.lnk&quot; HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\StartupApproved\Run: => &quot;Skype&quot; HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\StartupApproved\Run: => &quot;GoogleDriveSync&quot; HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\StartupApproved\Run: => &quot;ISUSPM Startup&quot; HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\StartupApproved\Run: => &quot;SpiderOakONE&quot; HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\StartupApproved\Run: => &quot;OneDriveSetup&quot; HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\StartupApproved\Run: => &quot;Vivaldi Update Notifier&quot;  ==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============  (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)  FirewallRules: [{E4735402-E623-4D0B-9BB3-B96FE4A35570}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe FirewallRules: [{6D9980E7-0AD8-47AB-A16F-1F3F3E193746}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe FirewallRules: [TCP Query User{3D3FCAEF-1F9C-495A-94DC-77FFDD819C02}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe FirewallRules: [UDP Query User{39E193BC-0B4F-43CA-BAAF-2493DEE650EC}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe FirewallRules: [TCP Query User{1062E0D3-4209-414F-8733-C841B6316640}C:\program files (x86)\google\chrome\application\chrome.exe] => (Block) C:\program files (x86)\google\chrome\application\chrome.exe FirewallRules: [UDP Query User{4C4DD40E-CE9A-4D3E-9B29-2B5C520B0AF3}C:\program files (x86)\google\chrome\application\chrome.exe] => (Block) C:\program files (x86)\google\chrome\application\chrome.exe  ==================== Wiederherstellungspunkte =========================  20-11-2017 13:08:57 Windows Update  ==================== Fehlerhafte Geräte im Gerätemanager =============  Name: PS/2-Standardtastatur Description: PS/2-Standardtastatur Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318} Manufacturer: (Standardtastaturen) Service: i8042prt Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved.   ==================== Fehlereinträge in der Ereignisanzeige: =========================  Applikationsfehler: ================== Error: (11/25/2017 02:20:09 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: COMPUTER-128234) Description: Das Paket „Microsoft.MicrosoftEdge_41.16299.15.0_neutral__8wekyb3d8bbwe+MicrosoftEdge“ wurde beendet, da das Anhalten zu lange dauerte.  Error: (11/24/2017 10:53:11 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm firefox.exe, Version 57.0.0.6525 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Systemsteuerung &quot;Sicherheit und Wartung&quot;, um nach weiteren Informationen zum Problem zu suchen.  Prozess-ID: 153c  Startzeit: 01d3656d818ebc87  Beendigungszeit: 158  Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe  Berichts-ID: 5a549173-0544-4a7b-86af-cb9b5bce1281  Vollständiger Name des fehlerhaften Pakets:   Auf das fehlerhafte Paket bezogene Anwendungs-ID:  Error: (11/20/2017 05:02:20 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: WifiSvc.exe, Version: 2.1.0.24, Zeitstempel: 0x53cdc9f5 Name des fehlerhaften Moduls: WifiLib.dll, Version: 2.1.1.20, Zeitstempel: 0x55a6273a Ausnahmecode: 0xc0000005 Fehleroffset: 0x00003486 ID des fehlerhaften Prozesses: 0x1f20 Startzeit der fehlerhaften Anwendung: 0x01d35fde7851ac63 Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\NETGEAR\WNA3100M\WifiSvc.exe Pfad des fehlerhaften Moduls: C:\Program Files (x86)\NETGEAR\WNA3100M\WifiLib.dll Berichtskennung: a1075dbd-05f3-4bab-ac23-7d74583d1f85 Vollständiger Name des fehlerhaften Pakets:  Anwendungs-ID, die relativ zum fehlerhaften Paket ist:  Error: (11/17/2017 09:50:53 PM) (Source: COM) (EventID: 10031) (User: ) Description: Eine das Marshalling aufhebende Richtlinienprüfung wurde ausgeführt, als das Marshalling eines benutzerdefinierten gemarshallten Objekts aufgehoben wurde. Die Klasse &quot;{41FD88F7-F295-4D39-91AC-A85F3149A05B}&quot; wurde abgelehnt.  Error: (11/17/2017 09:50:53 PM) (Source: COM) (EventID: 10031) (User: ) Description: Eine das Marshalling aufhebende Richtlinienprüfung wurde ausgeführt, als das Marshalling eines benutzerdefinierten gemarshallten Objekts aufgehoben wurde. Die Klasse &quot;{95CABCC9-BC57-4C12-B8DF-BA193232AA01}&quot; wurde abgelehnt.  Error: (11/17/2017 08:27:41 PM) (Source: COM) (EventID: 10031) (User: ) Description: Eine das Marshalling aufhebende Richtlinienprüfung wurde ausgeführt, als das Marshalling eines benutzerdefinierten gemarshallten Objekts aufgehoben wurde. Die Klasse &quot;{41FD88F7-F295-4D39-91AC-A85F3149A05B}&quot; wurde abgelehnt.  Error: (11/17/2017 08:27:41 PM) (Source: COM) (EventID: 10031) (User: ) Description: Eine das Marshalling aufhebende Richtlinienprüfung wurde ausgeführt, als das Marshalling eines benutzerdefinierten gemarshallten Objekts aufgehoben wurde. Die Klasse &quot;{41FD88F7-F295-4D39-91AC-A85F3149A05B}&quot; wurde abgelehnt.  Error: (11/17/2017 04:00:37 PM) (Source: VSS) (EventID: 8193) (User: ) Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine &quot;QueryFullProcessImageNameW&quot; ist ein unerwarteter Fehler aufgetreten. hr = 0x8007001f, Ein an das System angeschlossenes Gerät funktioniert nicht. .   Vorgang:    Asynchroner Vorgang wird ausgeführt  Kontext:    Aktueller Status: DoSnapshotSet  Error: (11/17/2017 03:59:10 PM) (Source: VSS) (EventID: 8194) (User: ) Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle &quot;IVssWriterCallback&quot; ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert . Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.   Vorgang:    Generatordaten werden gesammelt  Kontext:    Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}    Generatorname: System Writer    Generatorinstanz-ID: {75abbc58-bc28-442a-8219-e77724043f24}  Error: (11/17/2017 03:52:29 PM) (Source: ESENT) (EventID: 455) (User: ) Description: DllHost (7176,R,0) WebCacheLocal: Fehler -1032 (0xfffffbf8) beim Öffnen von Protokolldatei C:\Users\lem0th\AppData\Local\Microsoft\Windows\WebCache\V01.log.   Systemfehler: ============= Error: (11/25/2017 05:08:40 PM) (Source: DCOM) (EventID: 10016) (User: COMPUTER-128234) Description: Durch die Berechtigungseinstellungen für &quot;Anwendungsspezifisch&quot; wird dem Benutzer &quot;COMPUTER-128234\lem0th&quot; (SID: S-1-5-21-624198674-977653023-2037852723-1040) unter der Adresse &quot;LocalHost (unter Verwendung von LRPC)&quot; keine Berechtigung vom Typ &quot;Lokal Aktivierung&quot; für die COM-Serveranwendung mit der CLSID  {D63B10C5-BB46-4990-A94F-E40B9D520160}  und der APPID  {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}  im Anwendungscontainer &quot;Nicht verfügbar&quot; (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.  Error: (11/25/2017 05:06:23 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst &quot;VMware NAT Service&quot; wurde unerwartet beendet. Dies ist bereits 3 Mal passiert.  Error: (11/25/2017 05:06:22 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst &quot;VMware NAT Service&quot; wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 1000 Millisekunden durchgeführt: Neustart des Diensts.  Error: (11/25/2017 05:06:21 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst &quot;VMware NAT Service&quot; wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 1000 Millisekunden durchgeführt: Neustart des Diensts.  Error: (11/25/2017 05:06:21 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Der Dienst &quot;NetTcpActivator&quot; ist vom Dienst &quot;NetTcpPortSharing&quot; abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:  Der Dienst antwortete nicht rechtzeitig auf die Start- oder Steuerungsanforderung.  Error: (11/25/2017 05:06:21 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst &quot;NetTcpPortSharing&quot; wurde aufgrund folgenden Fehlers nicht gestartet:  Der Dienst antwortete nicht rechtzeitig auf die Start- oder Steuerungsanforderung.  Error: (11/25/2017 05:06:21 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst NetTcpPortSharing erreicht.  Error: (11/25/2017 05:06:11 PM) (Source: Service Control Manager) (EventID: 7024) (User: ) Description: Der Dienst &quot;VMwareHostd&quot; wurde mit dem folgenden dienstspezifischen Fehler beendet:  %%4294967295  Error: (11/25/2017 05:06:01 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Der Dienst &quot;W3SVC&quot; ist vom Dienst &quot;WAS&quot; abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:  Die Daten sind unzulässig.  Error: (11/25/2017 05:06:01 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Der Dienst &quot;NetPipeActivator&quot; ist vom Dienst &quot;WAS&quot; abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:  Die Daten sind unzulässig.   CodeIntegrity: ===================================   Date: 2017-11-25 17:11:53.069   Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.    Date: 2017-11-25 17:11:53.040   Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.    Date: 2017-11-25 17:11:53.015   Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.    Date: 2017-11-25 17:11:52.992   Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.    Date: 2017-11-25 16:00:29.362   Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.    Date: 2017-11-25 16:00:29.334   Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.    Date: 2017-11-25 16:00:29.303   Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.    Date: 2017-11-25 16:00:29.250   Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.    Date: 2017-11-25 15:59:23.472   Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.    Date: 2017-11-25 15:59:23.446   Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.   ==================== Speicherinformationen ===========================   Prozessor: Intel(R) Core(TM)2 Duo CPU E7300 @ 2.66GHz Prozentuale Nutzung des RAM: 69% Installierter physikalischer RAM: 4094.18 MB Verfügbarer physikalischer RAM: 1233.02 MB Summe virtueller Speicher: 8190.18 MB Verfügbarer virtueller Speicher: 4909.26 MB  ==================== Laufwerke ================================  Drive c: (Windows) (Fixed) (Total:464.75 GB) (Free:306.6 GB) NTFS  ==================== MBR & Partitionstabelle ==================  ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 933BC6BB) Partition 1: (Active) - (Size=99 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=464.8 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=473 MB) - (Type=27) Partition 4: (Not Active) - (Size=455 MB) - (Type=27)  ======================================================== Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 279.5 GB) (Disk ID: B828D6C1) Partition 1: (Not Active) - (Size=279.5 GB) - (Type=07 NTFS)  ==================== Ende von Addition.txt ============================

--- --- ---

M-K-D-B · 25.11.2017, 17:52

Servus,

wir entfernen noch ein bisschen was und kontrollieren nochmal alles.

Hinweis: Der Suchlauf mit ESET kann länger dauern.

Schritt 1

Kopiere den Inhalt der folgenden Code-Box:

Code:

ATTFilter

Start::
AppInit_DLLs: prio.dll => Keine Datei
Task: {5653A8BA-5766-4972-AFE4-6AF986F39A5A} - \{A1C0E21F-C04B-4D7F-A3C7-F4A887B38845} -> Keine Datei <==== ACHTUNG
Task: {56F31CE6-6542-4ED2-AD8A-6B1BDE758A4B} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {5ACFA180-BE93-4757-A600-57A61FE79EDC} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {6B947FBC-CBFA-49C1-BE7A-76A0EEA3F402} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {90633838-3B10-43F0-BC61-5C8504498795} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {90AFBFCB-A5D9-4CA2-A58A-95CFFE3A4C90} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {9B052FB7-4425-490E-BC1E-4E7554AD627D} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG
Task: {A97FEBFA-8C43-4447-B21D-C6897DA374E4} - \CreateChoiceProcessTask -> Keine Datei <==== ACHTUNG
Task: {B6E6AFBA-338C-44F1-B2A5-FBD198DEC00C} - \{A4058700-9B97-4117-8851-8B6C3C211F42} -> Keine Datei <==== ACHTUNG
Task: {B954A2A3-7EA5-47B8-93AB-136A508381A7} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Task: {CDE38717-7FCF-49E4-9B48-4D8930E458E0} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {F6A11EE2-0023-4595-8D9D-F2922462880E} - \{1A673BBD-E760-48DE-8182-982ABA1E0CD0} -> Keine Datei <==== ACHTUNG
Task: {FB409A52-D98C-4458-BB8A-24EE89EF7A6E} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {FC13AE24-50AF-4150-830A-1BA18858E237} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {FE639A93-6D40-4961-AC31-1B45E9126512} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {FFF8BFAC-4011-4218-BA7B-C5B42F2008CC} - \{104B9CA5-EF7D-4A10-ADB6-70F6F3EB62CE} -> Keine Datei <==== ACHTUNG
EmptyTemp:
End::

Starte nun FRST und klicke direkt den Entfernen Button. Wichtig: Du brauchst den Inhalt der Code-Box nirgends einfügen, da sich FRST den Code aus der Zwischenablage holt!
Das Tool führt die gewünschten Schritte aus und erstellt eine fixlog.txt im selben Verzeichnis, in dem sich die FRST/FRST64.exe befindet.
Gegebenenfalls muss dein Rechner dafür neu gestartet werden.
Poste mir den Inhalt der fixlog.txt mit deiner nächsten Antwort.

Schritt 2
Downloade dir die passende Version von HitmanPro auf deinen Desktop: HitmanPro - 32 Bit | HitmanPro - 64 Bit.

Starte die HitmanPro.exe
Klicke auf
Entferne den Haken bei
Klicke auf
und
Akzeptiere die Lizenzbedingungen und klicke auf
Klicke auf

und auf
Wenn der Scan beendet wurde, nichts löschen lassen etc. sondern wähle unten links auf der Button-Leiste
und speichere die Logdatei auf Deinem Desktop.
Schließe HitmanPro und poste mir das Log.

Schritt 3
Downloade Dir bitte ESET Online Scanner (Bebilderte Anleitung)

Starte die Installationsdatei.
Akzeptiere die Nutzungsbedingungen.
Wähle Erkennung evtl. unerwünschter Anwendungen aktivieren aus und klicke auf Scannen.
Zuerst werden die notwendigen Signaturen heruntergeladen, anschließend startet ESET automatisch den Suchlauf.
Am Ende des Suchlaufs werden gegebenenfalls die gefundenen Elemente aufgelistet.
Wähle In Textdatei speichern... aus und speichere die Datei als eset.txt auf deinem Desktop ab.
Füge den Inhalt der eset.txt mit deiner nächsten Antwort hinzu.
Sollte ESET nichts finden, so kann auch keine Logdatei erstellt werden. Teile uns das dann unbedingt mit.
Schließe den ESET Online Scanner rechts oben [ X ] und klicke anschließend auf Schließen.

Schritt 4

Starte die FRST.exe erneut. Vergewissere dich, dass vor Addition.txt ein Haken gesetzt ist und drücke auf Untersuchen.
FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
Poste mir beide Logdateien mit deiner nächsten Antwort.

Gibt es jetzt noch Probleme mit dem PC oder mit deinen Internet Browsern? Wenn ja, welche?

Bitte poste mit deiner nächsten Antwort

die Logdatei des FRST-Fix,
die Logdatei von HitmanPro,
die Logdatei von ESET,
die beiden neuen Logdateien von FRST,
die Beantwortung der gestellten Fragen.

Ladekabel612 · 26.11.2017, 15:19

Habe eine Verständnisfrage von Hitman Pro: Auf was soll ich klicken? Du schriebst ja folgendes:

Zitat:

Starte die HitmanPro.exe
Klicke auf

Entferne den Haken bei

Klicke auf
und
Akzeptiere die Lizenzbedingungen und klicke auf
Klicke auf

Und der Browser macht weiterhin Probleme.

M-K-D-B · 27.11.2017, 15:04

Servus,

die Frage, ob es noch Probleme gibt, sollst du erst beantworten (und zwar möglichst detailliert, welcher Browser was für Probleme macht), wenn du alle Schritte abgearbeitet hast.

Ich verstehe deine Frage zu HitmanPro nicht.
Die Anleitung ist doch eindeutig, was nacheinander zu tun ist. Habs gerade selbst getestet.
Evtl. musst du deine Frage spezifizieren.

Ladekabel612 · 27.11.2017, 21:39

Code:

ATTFilter

Entfernungsergebnis von Farbar Recovery Scan Tool (x64) Version: 24-11-2017 01
durchgeführt von lem0th (26-11-2017 15:08:06) Run:1
Gestartet von C:\Users\lem0th\Desktop
Geladene Profile: lem0th & _ashbackuppb_ (Verfügbare Profile: lem0th & _ashbackuppb_ & Administrator & DefaultAppPool)
Start-Modus: Normal
==============================================

fixlist Inhalt:
*****************
AppInit_DLLs: prio.dll => Keine Datei
Task: {5653A8BA-5766-4972-AFE4-6AF986F39A5A} - \{A1C0E21F-C04B-4D7F-A3C7-F4A887B38845} -> Keine Datei <==== ACHTUNG
Task: {56F31CE6-6542-4ED2-AD8A-6B1BDE758A4B} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Keine Datei <==== ACHTUNG
Task: {5ACFA180-BE93-4757-A600-57A61FE79EDC} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {6B947FBC-CBFA-49C1-BE7A-76A0EEA3F402} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {90633838-3B10-43F0-BC61-5C8504498795} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Keine Datei <==== ACHTUNG
Task: {90AFBFCB-A5D9-4CA2-A58A-95CFFE3A4C90} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Keine Datei <==== ACHTUNG
Task: {9B052FB7-4425-490E-BC1E-4E7554AD627D} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Keine Datei <==== ACHTUNG
Task: {A97FEBFA-8C43-4447-B21D-C6897DA374E4} - \CreateChoiceProcessTask -> Keine Datei <==== ACHTUNG
Task: {B6E6AFBA-338C-44F1-B2A5-FBD198DEC00C} - \{A4058700-9B97-4117-8851-8B6C3C211F42} -> Keine Datei <==== ACHTUNG
Task: {B954A2A3-7EA5-47B8-93AB-136A508381A7} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Keine Datei <==== ACHTUNG
Task: {CDE38717-7FCF-49E4-9B48-4D8930E458E0} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {F6A11EE2-0023-4595-8D9D-F2922462880E} - \{1A673BBD-E760-48DE-8182-982ABA1E0CD0} -> Keine Datei <==== ACHTUNG
Task: {FB409A52-D98C-4458-BB8A-24EE89EF7A6E} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {FC13AE24-50AF-4150-830A-1BA18858E237} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Keine Datei <==== ACHTUNG
Task: {FE639A93-6D40-4961-AC31-1B45E9126512} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {FFF8BFAC-4011-4218-BA7B-C5B42F2008CC} - \{104B9CA5-EF7D-4A10-ADB6-70F6F3EB62CE} -> Keine Datei <==== ACHTUNG
EmptyTemp:

*****************

"prio.dll" => Wert Daten erfolgreich entfernt.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5653A8BA-5766-4972-AFE4-6AF986F39A5A} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5653A8BA-5766-4972-AFE4-6AF986F39A5A} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{A1C0E21F-C04B-4D7F-A3C7-F4A887B38845} => Schlüssel nicht gefunden. 
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{56F31CE6-6542-4ED2-AD8A-6B1BDE758A4B} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{56F31CE6-6542-4ED2-AD8A-6B1BDE758A4B} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5ACFA180-BE93-4757-A600-57A61FE79EDC} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5ACFA180-BE93-4757-A600-57A61FE79EDC} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{6B947FBC-CBFA-49C1-BE7A-76A0EEA3F402} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6B947FBC-CBFA-49C1-BE7A-76A0EEA3F402} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{90633838-3B10-43F0-BC61-5C8504498795} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{90633838-3B10-43F0-BC61-5C8504498795} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{90AFBFCB-A5D9-4CA2-A58A-95CFFE3A4C90} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{90AFBFCB-A5D9-4CA2-A58A-95CFFE3A4C90} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9B052FB7-4425-490E-BC1E-4E7554AD627D} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9B052FB7-4425-490E-BC1E-4E7554AD627D} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A97FEBFA-8C43-4447-B21D-C6897DA374E4} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A97FEBFA-8C43-4447-B21D-C6897DA374E4} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\CreateChoiceProcessTask => Schlüssel nicht gefunden. 
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B6E6AFBA-338C-44F1-B2A5-FBD198DEC00C} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B6E6AFBA-338C-44F1-B2A5-FBD198DEC00C} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{A4058700-9B97-4117-8851-8B6C3C211F42} => Schlüssel nicht gefunden. 
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B954A2A3-7EA5-47B8-93AB-136A508381A7} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B954A2A3-7EA5-47B8-93AB-136A508381A7} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CDE38717-7FCF-49E4-9B48-4D8930E458E0} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CDE38717-7FCF-49E4-9B48-4D8930E458E0} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F6A11EE2-0023-4595-8D9D-F2922462880E} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F6A11EE2-0023-4595-8D9D-F2922462880E} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{1A673BBD-E760-48DE-8182-982ABA1E0CD0} => Schlüssel nicht gefunden. 
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{FB409A52-D98C-4458-BB8A-24EE89EF7A6E} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FB409A52-D98C-4458-BB8A-24EE89EF7A6E} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{FC13AE24-50AF-4150-830A-1BA18858E237} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FC13AE24-50AF-4150-830A-1BA18858E237} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{FE639A93-6D40-4961-AC31-1B45E9126512} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FE639A93-6D40-4961-AC31-1B45E9126512} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{FFF8BFAC-4011-4218-BA7B-C5B42F2008CC} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FFF8BFAC-4011-4218-BA7B-C5B42F2008CC} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{104B9CA5-EF7D-4A10-ADB6-70F6F3EB62CE} => Schlüssel nicht gefunden. 

=========== EmptyTemp: ==========

BITS transfer queue => 6578176 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 11014537 B
Java, Flash, Steam htmlcache => 37776922 B
Windows/system/drivers => 83483554 B
Edge => 181568177 B
Chrome => 208615349 B
Firefox => 43872399 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 6656 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 3290 B
NetworkService => 207382 B
lem0th => 77302042 B
_ashbackuppb_ => 66598 B
Administrator => 0 B
DefaultAppPool => 0 B

RecycleBin => 0 B
EmptyTemp: => 620.4 MB temporäre Dateien entfernt.

================================


Das System musste neu gestartet werden.

==== Ende von Fixlog 15:10:19 ====

Code:

ATTFilter

HitmanPro 3.7.20.286
www.hitmanpro.com

   Computer name . . . . : COMPUTER-128234
   Windows . . . . . . . : 10.0.0.16299.X64/2
   User name . . . . . . : COMPUTER-128234\lem0th
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2017-11-27 16:21:03
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 13m 50s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 0
   Traces  . . . . . . . : 3

   Objects scanned . . . : 2.201.889
   Files scanned . . . . : 64.755
   Remnants scanned  . . : 783.602 files / 1.353.532 keys

Suspicious files ____________________________________________________________

   C:\Users\lem0th\Desktop\FRST-OlderVersion\FRST64.exe
      Size . . . . . . . : 2.393.088 bytes
      Age  . . . . . . . : 2.9 days (2017-11-24 19:27:19)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : 7979F8897A3C90513A1B6F58804021FFFA3E8AD709B48F2AB623551FD324E2FF
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.

   C:\Users\lem0th\Desktop\FRST64.exe
      Size . . . . . . . : 2.393.088 bytes
      Age  . . . . . . . : 2.7 days (2017-11-24 22:31:01)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : 471B21CC0F3176EF6CCAA1CA1D90CF8AFDF6D41129CA2385B39CC7B1631E64AA
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.
      Forensic Cluster
         -21.8s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\28\C074FC304EF968E0.dat
         -4.1s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\2\28\C074FC304EF968E0.dat
         -2.6s C:\Users\lem0th\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220
         -2.6s C:\Users\lem0th\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220
         -0.8s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\44\1F167443FF12AA64.dat
         -0.6s C:\Users\lem0th\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D8412589658B2
         -0.6s C:\Users\lem0th\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D8412589658B2
         -0.4s C:\Users\lem0th\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F
         -0.4s C:\Users\lem0th\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F
          0.0s C:\Users\lem0th\Desktop\FRST64.exe
          1.2s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\73\AE85E8CBACE167DD.dat
          1.4s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\85\EF7E2EB4E060A351.dat
          8.0s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\94\D7FFC12BF2801192.dat
         10.1s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\96\650CBBF419F03C98.dat
         17.7s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\45\3EDA0B1ADD4571E1.dat
         19.0s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\41\10034A39F97BD349.dat
         27.0s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\76\9DD5970688F44708.dat
         36.0s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\38\91C6FA8C35D1397E.dat
         45.1s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\95\04EF1AE4FD2BD8D3.dat
         57.1s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\63\C6C84AAD18D21A03.dat
         64.7s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\62\9F413DC634445702.dat
         66.0s C:\Users\lem0th\Desktop\FRST-OlderVersion\
         68.5s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\55\D0ECCA3BBB597237.dat
         70.8s C:\Users\lem0th\Desktop\FRST.txt

   C:\Users\lem0th\Documents\FRST64.exe
      Size . . . . . . . : 2.403.328 bytes
      Age  . . . . . . . : 28.0 days (2017-10-30 17:10:45)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : BFEDDEF5ED4AD146B3670CE3002EE8D0AF4941047EB49E9BE9175448DC982810
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 22.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

ESET hat nix gefunden, insofern kein Log.

Code:

ATTFilter

HitmanPro 3.7.20.286
www.hitmanpro.com

   Computer name . . . . : COMPUTER-128234
   Windows . . . . . . . : 10.0.0.16299.X64/2
   User name . . . . . . : COMPUTER-128234\lem0th
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2017-11-27 16:21:03
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 13m 50s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 0
   Traces  . . . . . . . : 3

   Objects scanned . . . : 2.201.889
   Files scanned . . . . : 64.755
   Remnants scanned  . . : 783.602 files / 1.353.532 keys

Suspicious files ____________________________________________________________

   C:\Users\lem0th\Desktop\FRST-OlderVersion\FRST64.exe
      Size . . . . . . . : 2.393.088 bytes
      Age  . . . . . . . : 2.9 days (2017-11-24 19:27:19)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : 7979F8897A3C90513A1B6F58804021FFFA3E8AD709B48F2AB623551FD324E2FF
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.

   C:\Users\lem0th\Desktop\FRST64.exe
      Size . . . . . . . : 2.393.088 bytes
      Age  . . . . . . . : 2.7 days (2017-11-24 22:31:01)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : 471B21CC0F3176EF6CCAA1CA1D90CF8AFDF6D41129CA2385B39CC7B1631E64AA
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.
      Forensic Cluster
         -21.8s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\28\C074FC304EF968E0.dat
         -4.1s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\2\28\C074FC304EF968E0.dat
         -2.6s C:\Users\lem0th\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220
         -2.6s C:\Users\lem0th\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220
         -0.8s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\44\1F167443FF12AA64.dat
         -0.6s C:\Users\lem0th\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D8412589658B2
         -0.6s C:\Users\lem0th\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D8412589658B2
         -0.4s C:\Users\lem0th\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F
         -0.4s C:\Users\lem0th\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F
          0.0s C:\Users\lem0th\Desktop\FRST64.exe
          1.2s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\73\AE85E8CBACE167DD.dat
          1.4s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\85\EF7E2EB4E060A351.dat
          8.0s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\94\D7FFC12BF2801192.dat
         10.1s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\96\650CBBF419F03C98.dat
         17.7s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\45\3EDA0B1ADD4571E1.dat
         19.0s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\41\10034A39F97BD349.dat
         27.0s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\76\9DD5970688F44708.dat
         36.0s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\38\91C6FA8C35D1397E.dat
         45.1s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\95\04EF1AE4FD2BD8D3.dat
         57.1s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\63\C6C84AAD18D21A03.dat
         64.7s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\62\9F413DC634445702.dat
         66.0s C:\Users\lem0th\Desktop\FRST-OlderVersion\
         68.5s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\55\D0ECCA3BBB597237.dat
         70.8s C:\Users\lem0th\Desktop\FRST.txt

   C:\Users\lem0th\Documents\FRST64.exe
      Size . . . . . . . : 2.403.328 bytes
      Age  . . . . . . . : 28.0 days (2017-10-30 17:10:45)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : BFEDDEF5ED4AD146B3670CE3002EE8D0AF4941047EB49E9BE9175448DC982810
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 22.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

Code:

ATTFilter

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 27-11-2017
durchgeführt von lem0th (27-11-2017 21:22:59)
Gestartet von C:\Users\lem0th\Desktop
Windows 10 Pro Version 1709 16299.64 (X64) (2017-10-30 15:36:44)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-624198674-977653023-2037852723-500 - Administrator - Disabled) => C:\Users\Administrator
DefaultAccount (S-1-5-21-624198674-977653023-2037852723-503 - Limited - Disabled)
Gast (S-1-5-21-624198674-977653023-2037852723-501 - Limited - Disabled)
lem0th (S-1-5-21-624198674-977653023-2037852723-1040 - Administrator - Enabled) => C:\Users\lem0th
WDAGUtilityAccount (S-1-5-21-624198674-977653023-2037852723-504 - Limited - Disabled)
_ashbackuppb_ (S-1-5-21-624198674-977653023-2037852723-1052 - Administrator - Enabled) => C:\Users\_ashbackuppb_

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

7-Zip 16.04 (x64) (HKLM\...\7-Zip) (Version: 16.04 - Igor Pavlov)
Adobe Flash Player 27 NPAPI (HKLM-x32\...\{34D4D627-00A1-4C0D-BF68-576C146B9ED6}) (Version: 27.0.0.187 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\{7E33E883-0D17-4397-A461-B576605E34B1}) (Version: 12.1.6.156 - Adobe Systems, Inc)
AMD Catalyst Install Manager (HKLM\...\{37FCE154-7F59-74F0-3A35-BF503CEB230B}) (Version: 8.0.877.0 - Advanced Micro Devices, Inc.)
AOMEI Partition Assistant Standard Edition 6.1 (HKLM-x32\...\{02F850ED-FD0E-4ED1-BE0B-54981f5BD3D4}_is1) (Version:  - AOMEI Technology Co., Ltd.)
Ashampoo Backup Pro 11 (HKLM\...\{DF972766-3CEA-0FEC-AD7D-0A1791430C35}_is1) (Version: 11.08 - Ashampoo GmbH & Co. KG)
Ashampoo UnInstaller 7 (HKLM-x32\...\{4209F371-C268-A90D-7A44-135E420FACEF}_is1) (Version: 7.00.00 - Ashampoo GmbH & Co. KG)
Classic Shell (HKLM\...\{383BB30A-B4A7-4666-9A83-22CFA8640097}) (Version: 4.3.0 - IvoSoft)
CrystalDiskInfo 7.0.2 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 7.0.2 - Crystal Dew World)
CrystalDiskMark 5.1.2 (HKLM\...\CrystalDiskMark5_is1) (Version: 5.1.2 - Crystal Dew World)
Discord (HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Discord) (Version: 0.0.298 - Discord Inc.)
Emergency 4 Deluxe (HKLM-x32\...\{EDA12670-56B5-4459-BA21-D010F0E3EBA1}) (Version: 1.03.001 - )
Epson Scan 2 (HKLM-x32\...\Epson Scan 2) (Version:  - Seiko Epson Corporation)
EPSON Scan OCR Component (HKLM-x32\...\{563B99D8-8895-4E3E-AE8D-15BE8C05F1C1}) (Version: 3.00.01 - SEIKO EPSON Corp.)
Epson Software Updater (HKLM-x32\...\{B55DB65D-EF6E-4E04-89D5-B03603BF681B}) (Version: 4.4.5 - SEIKO EPSON CORPORATION)
EPSON XP-540 Series Printer Uninstall (HKLM\...\EPSON XP-540 Series) (Version:  - Seiko Epson Corporation)
EPSON-Handbücher (HKLM-x32\...\{84CECC1B-21EF-41B1-9A91-3E724E5D99D3}) (Version: 1.53.0.0 - Seiko Epson Corporation)
EpsonNet Print (HKLM\...\{96ED1D58-440C-4345-8FEE-C4781366C67F}) (Version: 3.1.4.0 - SEIKO EPSON Corporation)
Everything 1.4.1.877 (x64) (HKLM\...\Everything) (Version: 1.4.1.877 (x64) - David Carpenter)
Factorio version 0.15.15 (HKLM\...\Factorio_is1) (Version:  - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 62.0.3202.94 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
Gpg4win (2.3.3) (HKLM-x32\...\GPG4Win) (Version: 2.3.3 - The Gpg4win Project)
Grand Theft Auto San Andreas (HKLM-x32\...\{086BADF8-9B1F-4E89-B207-2EDA520972D6}) (Version: 1.00.00001 - Rockstar Games)
Java 8 Update 151 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180151F0}) (Version: 8.0.1510.12 - Oracle Corporation)
Kaspersky Anti-Ransomware Tool for Business (HKLM-x32\...\{0F30C04E-E20E-4A5D-95AE-BF041D6CF673}) (Version: 1.1.24.0 - Kaspersky Lab) Hidden
KeePass Password Safe 2.37 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.37 - Dominik Reichl)
Kits Configuration Installer (HKLM-x32\...\{86E59C8F-61D5-1782-A3CE-60AE7E4D7791}) (Version: 10.1.16299.15 - Microsoft) Hidden
K-Lite Codec Pack 13.2.0 Standard (HKLM-x32\...\KLiteCodecPack_is1) (Version: 13.2.0 - KLCP)
LibreOffice 5.2.6.2 (HKLM-x32\...\{443795BA-BBA0-46CF-A07F-DB5B461785F7}) (Version: 5.2.6.2 - The Document Foundation)
MAGIX Movie Edit Pro 2016 Premium (HKLM\...\{0E64129B-4258-44B9-8034-464C6E28878D}) (Version: 15.0.0.73 - MAGIX Software GmbH) Hidden
MAGIX Movie Edit Pro 2016 Premium (HKLM\...\MX.{0E64129B-4258-44B9-8034-464C6E28878D}) (Version: 15.0.0.73 - MAGIX Software GmbH)
MAGIX Video deluxe 2016 Premium Update (HKLM\...\{AA6874A6-C7EB-42D5-B434-A86B75E00F32}) (Version: 15.0.0.77 - MAGIX Software GmbH) Hidden
Malwarebytes Version 3.1.2.1733 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.1.2.1733 - Malwarebytes)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61187 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61186 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.7523 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.7523 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.7523 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.7523 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{b341426f-8543-4e0d-96c3-e976f8ec5ab6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{3c3aafc8-d898-43ec-998f-965ffdae065a}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40649 (HKLM-x32\...\{5d0723d3-cff7-4e07-8d0b-ada737deb5e6}) (Version: 12.0.40649.5 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23918 (HKLM-x32\...\{dab68466-3a7d-41a8-a5cf-415e3ff8ef71}) (Version: 14.0.23918.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual J# 2.0 Redistributable Package - SE (x64) (HKLM\...\Microsoft Visual J# 2.0 Redistributable Package - SE (x64)) (Version:  - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)
Microsoft_VC100_CRT_x86 (HKLM-x32\...\{6FDDB201-2CA0-42BD-973F-7B2C4A61EA3F}) (Version: 1.0.0 - Microsoft)
Mozilla Firefox 57.0 (x64 de) (HKLM\...\Mozilla Firefox 57.0 (x64 de)) (Version: 57.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 57.0.0.6525 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
NETGEAR WNA3100M N300 Wireless USB Adapter (HKLM-x32\...\{D3580358-0F78-402A-BE53-2E9D06383E04}) (Version: 1.2.0.6 - NETGEAR)
NetSpeedMonitor 2.5.4.0 x64 (HKLM\...\{88F41EE2-949B-4B52-933D-C7F8F67BC1D2}) (Version: 2.5.4.0 - Florian Gilles)
Notepad++ (64-bit x64) (HKLM\...\Notepad++) (Version: 7.5.1 - Notepad++ Team)
paint.net (HKLM\...\{F10AAD91-58DF-44EC-A647-810197141667}) (Version: 4.0.19 - dotPDN LLC)
Paragon Partition Manager™ 14 Free (HKLM\...\{47E5588F-C3A0-11DE-9857-005056C00008}) (Version: 90.00.0003 - Paragon Software)
Prio (HKLM\...\Prio) (Version: 2.1.0.4391 - )
puush (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284B}) (Version: 1.0.0.0 - Dean Herbert)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7535 - Realtek Semiconductor Corp.)
Resilio Sync (HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Resilio Sync) (Version: 2.4.4 - Resilio, Inc.)
Revo Uninstaller 2.0.2 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.2 - VS Revo Group, Ltd.)
SDK Debuggers (HKLM-x32\...\{E14725F0-A67E-BEA3-8BAF-7D9C5B5881E4}) (Version: 10.1.16299.15 - Microsoft Corporation) Hidden
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Steuer 2015 (HKLM-x32\...\{E262CD3B-8825-4D56-AEF1-5E127F2FBB05}) (Version: 23.00.1146 - Buhl Data Service GmbH)
VC80CRTRedist - 8.0.50727.6195 (HKLM-x32\...\{933B4015-4618-4716-A828-5289FC03165F}) (Version: 1.2.0 - DivX, Inc) Hidden
VeraCrypt (HKLM-x32\...\VeraCrypt) (Version: 1.21 - IDRIX)
Vivaldi (HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Vivaldi) (Version: 1.12.955.48 - Vivaldi)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.6 - VideoLAN)
VMware Workstation (HKLM\...\{A4D1DB40-C6DC-40F8-AF6D-46BD4DD5ACAC}) (Version: 12.5.5 - VMware, Inc.)
WhoCrashed 5.54 (HKLM\...\WhoCrashed_is1) (Version:  - Resplendence Software Projects Sp.)
Windows Software Development Kit - Windows 10.0.16299.15 (HKLM-x32\...\{6195c203-b53c-4bb7-983a-6070a902e704}) (Version: 10.1.16299.15 - Microsoft Corporation)
WinMerge 2.14.0 (HKLM-x32\...\WinMerge_is1) (Version: 2.14.0 - Thingamahoochie Software)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-624198674-977653023-2037852723-1040_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\lem0th\AppData\Local\Microsoft\OneDrive\17.3.6816.0313\amd64\FileSyncShell64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-624198674-977653023-2037852723-1040_Classes\CLSID\{581FFA00-FC33-0004-0402-95003A5CDE89}\InprocServer32 -> C:\Users\lem0th\AppData\Roaming\Resilio Sync\ShellExtensionPath64_2DC.dll ()
CustomCLSID: HKU\S-1-5-21-624198674-977653023-2037852723-1040_Classes\CLSID\{581FFA01-FC33-0004-0402-95003A5CDE89}\InprocServer32 -> C:\Users\lem0th\AppData\Roaming\Resilio Sync\ShellExtensionPath64_2DC.dll ()
CustomCLSID: HKU\S-1-5-21-624198674-977653023-2037852723-1040_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\lem0th\AppData\Local\Microsoft\OneDrive\17.3.6816.0313\amd64\FileSyncShell64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-624198674-977653023-2037852723-1040_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\lem0th\AppData\Local\Microsoft\OneDrive\17.3.6816.0313\amd64\FileSyncShell64.dll => Keine Datei
ShellIconOverlayIdentifiers: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ShellIconOverlayIdentifiers: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ShellIconOverlayIdentifiers: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [!Resilio Sync 2.4.4Done] -> {581FFA04-FC33-0004-0402-95003A5CDE89} => C:\ProgramData\Resilio Sync\ShellExtensionOverlay64_2DC.dll [2017-03-25] ()
ShellIconOverlayIdentifiers: [!Resilio Sync 2.4.4RO] -> {581FFA03-FC33-0004-0402-95003A5CDE89} => C:\ProgramData\Resilio Sync\ShellExtensionOverlay64_2DC.dll [2017-03-25] ()
ShellIconOverlayIdentifiers: [!Resilio Sync 2.4.4RW] -> {581FFA02-FC33-0004-0402-95003A5CDE89} => C:\ProgramData\Resilio Sync\ShellExtensionOverlay64_2DC.dll [2017-03-25] ()
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> Keine Datei
ShellIconOverlayIdentifiers: [1MediaFireIconError] -> {5EE8C634-CDC0-453D-9731-DF0B19F4E807} => C:\Program Files (x86)\MediaFire Desktop\MediaFireIcon3_d1739.dll -> Keine Datei
ShellIconOverlayIdentifiers: [1MediaFireIconReadOnly] -> {7995D0FC-769B-4197-AEC0-991921CB99E1} => C:\Program Files (x86)\MediaFire Desktop\MediaFireIcon5_d1739.dll -> Keine Datei
ShellIconOverlayIdentifiers: [1MediaFireIconSynched] -> {9A3B79CB-D899-40B5-8DBC-20447F1ADC8F} => C:\Program Files (x86)\MediaFire Desktop\MediaFireIcon_d1739.dll -> Keine Datei
ShellIconOverlayIdentifiers: [1MediaFireIconSyncing] -> {C4D81971-6B13-4173-AB21-F83AD20CCC04} => C:\Program Files (x86)\MediaFire Desktop\MediaFireIcon2_d1739.dll -> Keine Datei
ShellIconOverlayIdentifiers: [EldosIconOverlay-cbfs6] -> {36A9E202-9EBD-4037-9EC8-9403A1FE827B} => C:\WINDOWS\system32\cbfsMntNtf6.dll [2016-06-13] (EldoS Corporation)
ShellIconOverlayIdentifiers: [MediaFireIconLock] -> {759F3E92-F4E8-4953-8315-238B8B17E0F3} => C:\Program Files (x86)\MediaFire Desktop\MediaFireIcon4_d1739.dll -> Keine Datei
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
ShellIconOverlayIdentifiers-x32: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ShellIconOverlayIdentifiers-x32: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ShellIconOverlayIdentifiers-x32: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> Keine Datei
ShellIconOverlayIdentifiers-x32: [!Resilio Sync 2.4.4Done] -> {581FFA04-FC33-0004-0402-95003A5CDE89} => C:\ProgramData\Resilio Sync\ShellExtensionOverlay64_2DC.dll [2017-03-25] ()
ShellIconOverlayIdentifiers-x32: [!Resilio Sync 2.4.4RO] -> {581FFA03-FC33-0004-0402-95003A5CDE89} => C:\ProgramData\Resilio Sync\ShellExtensionOverlay64_2DC.dll [2017-03-25] ()
ShellIconOverlayIdentifiers-x32: [!Resilio Sync 2.4.4RW] -> {581FFA02-FC33-0004-0402-95003A5CDE89} => C:\ProgramData\Resilio Sync\ShellExtensionOverlay64_2DC.dll [2017-03-25] ()
ShellIconOverlayIdentifiers-x32: [EldosIconOverlay-cbfs6] -> {36A9E202-9EBD-4037-9EC8-9403A1FE827B} => C:\WINDOWS\system32\cbfsMntNtf6.dll [2016-06-13] (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files\Notepad++\NppShell_06.dll [2017-08-29] ()
ContextMenuHandlers1: [GpgEX] -> {CCD955E4-5C16-4A33-AFDA-A8947A94946B} => C:\Program Files (x86)\GNU\GnuPG\bin\gpgex.dll [2016-08-18] (g10 Code GmbH)
ContextMenuHandlers1: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ContextMenuHandlers1: [MFShellStatic] -> {007D3D20-762B-40FF-BE6A-15E479A9DBFA} => C:\Program Files (x86)\MediaFire Desktop\MFDesktopShellStatic_d1739.dll -> Keine Datei
ContextMenuHandlers1: [WinMerge] -> {4E716236-AA30-4C65-B225-D68BBA81E9C2} => C:\Program Files (x86)\WinMerge\ShellExtensionX64.dll [2013-02-02] (hxxp://winmerge.org)
ContextMenuHandlers2: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ContextMenuHandlers2-x32: [VMDiskMenuHandler] -> {271DC252-6FE1-4D59-9053-E4CF50AB99DE} => C:\Program Files (x86)\VMware\VMware Workstation\vmdkShellExt.dll [2017-03-21] (VMware, Inc.)
ContextMenuHandlers2-x32: [VMDiskMenuHandler64] -> {E4D28EDC-8C0B-43EE-9E7D-C8A8682334DC} => C:\Program Files (x86)\VMware\VMware Workstation\x64\vmdkShellExt64.dll [2017-03-21] (VMware, Inc.)
ContextMenuHandlers2-x32: [WinMerge] -> {4E716236-AA30-4C65-B225-D68BBA81E9C2} => C:\Program Files (x86)\WinMerge\ShellExtensionX64.dll [2013-02-02] (hxxp://winmerge.org)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-05-09] (Malwarebytes)
ContextMenuHandlers3: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ContextMenuHandlers3: [SendTo] -> -{7BA4C740-9E81-11CF-99D3-00AA004AE837} =>  -> Keine Datei
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers4: [GpgEX] -> {CCD955E4-5C16-4A33-AFDA-A8947A94946B} => C:\Program Files (x86)\GNU\GnuPG\bin\gpgex.dll [2016-08-18] (g10 Code GmbH)
ContextMenuHandlers4: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\Users\lem0th\AppData\Local\MEGAsync\ShellExtX64.dll -> Keine Datei
ContextMenuHandlers4: [MSSE] -> {0365FE2C-F183-4091-AC82-BFC39FB75C49} =>  -> Keine Datei
ContextMenuHandlers4: [WinMerge] -> {4E716236-AA30-4C65-B225-D68BBA81E9C2} => C:\Program Files (x86)\WinMerge\ShellExtensionX64.dll [2013-02-02] (hxxp://winmerge.org)
ContextMenuHandlers5: [Gadgets] -> {6B9228DA-9C15-419e-856C-19E768A13BDC} =>  -> Keine Datei
ContextMenuHandlers5: [WinMerge] -> {4E716236-AA30-4C65-B225-D68BBA81E9C2} => C:\Program Files (x86)\WinMerge\ShellExtensionX64.dll [2013-02-02] (hxxp://winmerge.org)
ContextMenuHandlers6: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers6: [Fast Explorer] -> {693BE9C0-BEC3-11D2-B4C1-C33BBD3AD64B} =>  -> Keine Datei
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-05-09] (Malwarebytes)
ContextMenuHandlers6: [MFShellStatic] -> {007D3D20-762B-40FF-BE6A-15E479A9DBFA} => C:\Program Files (x86)\MediaFire Desktop\MFDesktopShellStatic_d1739.dll -> Keine Datei
ContextMenuHandlers6: [StartMenuExt] -> {E595F05F-903F-4318-8B0A-7F633B520D2B} => C:\WINDOWS\System32\StartMenuHelper64.dll [2016-07-30] (IvoSoft)
ContextMenuHandlers1_S-1-5-21-624198674-977653023-2037852723-1040: [Resilio Sync 2.4.4] -> {581FFA00-FC33-0004-0402-95003A5CDE89} => C:\Users\lem0th\AppData\Roaming\Resilio Sync\ShellExtensionPath64_2DC.dll [2017-03-25] ()
ContextMenuHandlers4_S-1-5-21-624198674-977653023-2037852723-1040: [Resilio Sync 2.4.4] -> {581FFA00-FC33-0004-0402-95003A5CDE89} => C:\Users\lem0th\AppData\Roaming\Resilio Sync\ShellExtensionPath64_2DC.dll [2017-03-25] ()

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {077D9730-A325-418A-A370-8FDB2AB69740} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-01-22] (Google Inc.)
Task: {0925C293-A417-4212-97B6-79AA19FA7961} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {0B75604B-9502-4A48-ADE3-1237E2FBF078} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {15D635DD-27BD-4CBB-8FF7-667CA955FEB0} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\WINDOWS\ehome\ehrec.exe
Task: {1E24BA0C-A9C7-4EB3-B9FC-80BA2F51F025} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {2010C5A7-AB3A-49B1-9C74-87670E1563B1} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {28F380A0-0DF8-4D51-B386-871F732C952C} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\WINDOWS\ehome\mcupdate.exe
Task: {2922E616-61B8-4990-B55D-D5E006369855} - System32\Tasks\EPSON XP-540 Series Update {57EB58A9-FBFB-47E1-B238-BD9213EE8D07} => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSRIE.EXE [2013-11-22] (SEIKO EPSON CORPORATION)
Task: {34150056-E698-4C15-A124-37E8DE1AC7C7} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {40237349-3DDE-4B82-8440-23FA248D5599} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe
Task: {5403244C-E898-4F08-895E-F3CA03F79136} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {565763B7-74CD-4027-9408-72B0647956E7} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {5804C292-C77C-4BA6-A77B-687BCA77E37D} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {5E4561E9-FD6F-448E-86AE-14F6C764A2B4} - System32\Tasks\klcp_update => C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool.exe [2017-05-24] ()
Task: {6670D31E-C371-47EA-AEBC-DFCB51D7B4B5} - System32\Tasks\Sperrbildschirm => reg.exe add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData /t REG_DWORD /v AllowLockScreen /d 0 /f
Task: {79A51A49-477E-4F5F-8156-0AC3B0B6EE79} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe
Task: {7D2FC676-CC2E-44B0-820F-C92183A172FF} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {852E0376-20DA-4B53-8524-4C6ED036C24F} - System32\Tasks\Microsoft\Windows\Windows Subsystem for Linux\AptPackageIndexUpdate => C:\WINDOWS\System32\LxRun.exe [2017-10-30] (Microsoft Corporation)
Task: {8C74191A-5503-44AD-8270-915C52BBC428} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {92ED629F-603B-4D58-A644-04F7BB98D4C8} - System32\Tasks\Core Temp Autostart Tygan => C:\Program Files\Core Temp\Core Temp.exe
Task: {92F20432-E2F6-40CC-BDCF-8C7F6266DC22} - System32\Tasks\EPSON XP-540 Series Update {2AB6DE24-84C4-4AAB-BF4A-771C3BEF1053} => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSRIE.EXE [2013-11-22] (SEIKO EPSON CORPORATION)
Task: {9958AC97-9AE4-4593-BC43-0FC982D5E833} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {9EEF6C19-6405-4416-B34E-A560701B7380} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {A03E5801-CB80-4C0C-A0E8-F73C97F59AEB} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe
Task: {AA43015D-35A1-43C5-BE5E-A138B79B3AF1} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {B1D23DB8-9377-47F8-9BBC-16FDCB8B191A} - System32\Tasks\CreateExplorerShellUnelevatedTask => C:\WINDOWS\explorer.exe /NOUACCHECK
Task: {BC28107D-F86D-4C90-86FA-BC9A0D4BD14E} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-11-20] (Adobe Systems Incorporated)
Task: {C9DE67D1-1BB8-4B1A-AA9D-E0B1199931F8} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {DA80726F-9E08-4DF3-B961-7A8A7D20A5C6} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {E7EAF163-3F7F-44D3-9B80-C8B5F93C8F28} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {F1E4FF0B-03E2-4A42-BF69-17E5765E0C20} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {F8D69DA4-D5C2-4E9D-930E-2906092F8638} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {FF4245B5-59A8-403F-B4E5-8A1D3FF865E7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-01-22] (Google Inc.)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\WINDOWS\Tasks\EPSON XP-540 Series Update {2AB6DE24-84C4-4AAB-BF4A-771C3BEF1053}.job => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSRIE.EXE:/EXE:{2AB6DE24-84C4-4AAB-BF4A-771C3BEF1053} /F:UpdateWORKGROUP\COMPUTER-128234$ĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
Task: C:\WINDOWS\Tasks\EPSON XP-540 Series Update {57EB58A9-FBFB-47E1-B238-BD9213EE8D07}.job => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSRIE.EXE:/EXE:{57EB58A9-FBFB-47E1-B238-BD9213EE8D07} /F:UpdateWORKGROUP\COMPUTER-128234$ĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi

==================== Verknüpfungen & WMI ========================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)


ShortcutWithArgument: C:\Users\lem0th\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\69639df789022856\Lem0th - Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory="Profile 1"

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2017-09-29 14:41 - 2017-09-29 14:41 - 000184432 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2016-08-18 09:27 - 2016-08-18 09:27 - 000216576 _____ () C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
2014-11-03 18:48 - 2014-08-18 17:50 - 000316120 _____ () C:\Program Files (x86)\NETGEAR\WNA3100M\WifiSvc.exe
2017-03-15 12:52 - 2017-05-08 13:50 - 000034712 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupService-abpb.exe
2017-03-15 12:52 - 2017-05-08 13:50 - 000084376 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupServiceLib.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000132504 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\deemon.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000425368 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\twirl.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 008931224 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupCore.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 005060504 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\ox.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000308120 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\tomb.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000443800 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\veem.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000131480 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\scoolite.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000059288 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\lzmaUtil.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 001075096 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\webdave.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000274328 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\crumb.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000063896 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\minizutil.dll
2017-03-15 12:52 - 2017-05-03 12:33 - 000026112 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\zlibutil.dll
2017-03-15 12:52 - 2017-05-03 12:33 - 000256512 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\jsoncpp.dll
2017-03-15 12:52 - 2017-05-03 12:33 - 000080896 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\ziputil.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000080280 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\ashinetutil.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000163224 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\netutil.dll
2017-03-15 12:52 - 2017-05-03 12:33 - 000250880 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\party.dll
2017-03-15 12:52 - 2017-05-03 12:33 - 000083456 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\zdll.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000031128 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\lz4util.dll
2017-03-15 12:52 - 2017-05-03 12:33 - 000581632 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\sqlite.dll
2017-03-15 12:52 - 2017-05-03 12:33 - 000052224 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\lzma.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000042392 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\lz4.dll
2017-03-15 12:52 - 2017-05-03 12:33 - 000111616 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\minizip.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000044952 _____ () c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\oxHelper.exe
2017-03-25 01:04 - 2017-03-25 01:04 - 000529408 _____ () C:\ProgramData\Resilio Sync\ShellExtensionOverlay64_2DC.dll
2017-09-29 14:42 - 2017-09-30 15:36 - 011044864 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-09-29 14:42 - 2017-09-30 15:36 - 001804288 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000326040 _____ () C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupClient-abpb.exe
2017-03-15 12:52 - 2017-05-08 13:50 - 006125976 _____ () C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupClientLib.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000126872 _____ () C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\featback.dll
2017-03-15 12:52 - 2017-05-08 13:50 - 000304536 _____ () C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\updateman.dll
2012-01-10 13:41 - 2015-05-30 17:26 - 000568904 _____ () C:\Program Files (x86)\puush\puush.exe
2015-02-11 19:57 - 2015-08-10 01:21 - 008276200 _____ () C:\Program Files (x86)\NETGEAR\WNA3100M\WNA3100M.exe
2017-11-14 01:22 - 2017-11-10 10:57 - 004135768 _____ () C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\libglesv2.dll
2017-11-14 01:22 - 2017-11-10 10:57 - 000100184 _____ () C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\libegl.dll
2017-11-23 11:57 - 2017-11-23 11:58 - 000087552 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2017-11-23 11:57 - 2017-11-23 11:58 - 000206336 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2017-11-23 11:57 - 2017-11-23 11:58 - 025461760 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2017-11-23 11:57 - 2017-11-23 11:58 - 002552832 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\skypert.dll
2017-11-23 11:57 - 2017-11-23 11:58 - 000685056 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\RtmMvrUap.dll
2016-04-05 12:12 - 2016-04-05 12:12 - 000221696 _____ () C:\Program Files (x86)\GNU\GnuPG\libksba-8.dll
2016-08-18 09:03 - 2016-08-18 09:03 - 000050176 _____ () C:\Program Files (x86)\GNU\GnuPG\libw32pth-0.dll
2016-08-18 09:14 - 2016-08-18 09:14 - 000073728 _____ () C:\Program Files (x86)\GNU\GnuPG\libassuan-0.dll
2016-08-18 09:17 - 2016-08-18 09:17 - 000751104 _____ () C:\Program Files (x86)\GNU\GnuPG\libgcrypt-20.dll
2016-08-18 09:09 - 2016-08-18 09:09 - 000103424 _____ () C:\Program Files (x86)\GNU\GnuPG\libgpg-error-0.dll
2014-11-03 18:48 - 2015-07-15 16:26 - 000450560 _____ () C:\Program Files (x86)\NETGEAR\WNA3100M\WifiLib.dll
2017-08-09 01:12 - 2017-08-08 14:13 - 001893880 _____ () C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\ffmpeg.dll
2017-08-09 01:43 - 2017-08-09 01:43 - 001577976 _____ () \\?\C:\Users\lem0th\AppData\Roaming\discord\0.0.298\modules\discord_toaster\discord_toaster.node
2015-02-11 19:58 - 2014-07-22 10:18 - 000278528 _____ () C:\Program Files (x86)\NETGEAR\WNA3100M\WifiSvcLib.dll
2017-08-09 01:12 - 2017-08-08 14:13 - 001938424 _____ () C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\libglesv2.dll
2017-08-09 01:12 - 2017-08-08 14:13 - 000095736 _____ () C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\libegl.dll
2017-08-09 01:43 - 2017-10-06 20:00 - 009722360 _____ () \\?\C:\Users\lem0th\AppData\Roaming\discord\0.0.298\modules\discord_voice\discord_voice.node
2017-08-09 01:43 - 2017-11-23 02:48 - 001494520 _____ () \\?\C:\Users\lem0th\AppData\Roaming\discord\0.0.298\modules\discord_utils\discord_utils.node
2017-11-27 16:18 - 2017-11-27 16:18 - 000148992 _____ () \\?\C:\Users\lem0th\AppData\Local\Temp\9C9A.tmp.node
2017-08-09 01:42 - 2017-08-09 01:42 - 002658296 _____ () \\?\C:\Users\lem0th\AppData\Roaming\discord\0.0.298\modules\discord_rpc\discord_rpc.node
2017-11-23 03:07 - 2017-11-23 03:07 - 001505272 _____ () \\?\C:\Users\lem0th\AppData\Roaming\discord\0.0.298\modules\discord_game_utils\discord_game_utils.node
2017-08-09 01:44 - 2017-08-09 01:44 - 002673656 _____ () \\?\C:\Users\lem0th\AppData\Roaming\discord\0.0.298\modules\discord_contact_import\discord_contact_import.node

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)


==================== Hosts Inhalt: ==========================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2009-07-14 03:34 - 2017-10-08 13:41 - 000004915 _____ C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1 choice.microsoft.com
127.0.0.1 Choice.microsoft.com.nstac.net
127.0.0.1 Df.telemetry.microsoft.com
127.0.0.1 Oca.telemetry.microsoft.com
127.0.0.1 Oca.telemetry.microsoft.com.nsatc.net
127.0.0.1 Redir.metaservices.microsoft.com
127.0.0.1 Reports.wes.df.telemetry.microsoft.com
127.0.0.1 Services.wes.df.telemetry.microsoft.com
127.0.0.1 Settings-sandbox.data.microsoft.com
127.0.0.1 Sqm.df.telemetry.microsoft.com
127.0.0.1 Sqm.telemetry.microsoft.com
127.0.0.1 Sqm.telemetry.microsoft.com.nsatc.net
127.0.0.1 Telecommand.telemetry.microsoft.com
127.0.0.1 Telecommand.telemetry.microsoft.com.nsatc.net
127.0.0.1 Telemetry.appex.bing.net
127.0.0.1 Telemetry.appex.bing.net:443
127.0.0.1 Telemetry.microsoft.com
127.0.0.1 Telemetry.urs.microsoft.com
127.0.0.1 Vortex-sandbox.data.microsoft.com
127.0.0.1 Vortex-win.data.microsoft.com
127.0.0.1 Vortex.data.microsoft.com
127.0.0.1 Watson.telemetry.microsoft.com
127.0.0.1 Watson.telemetry.microsoft.com.nsatc.net
127.0.0.1 apps.skype.com
127.0.0.1 apps.spotify.com
0.0.0.0 a.ads1.msn.com 
0.0.0.0 a.ads2.msads.net 
0.0.0.0 a.ads2.msn.com 
0.0.0.0 a.rad.msn.com 
0.0.0.0 a-0001.a-msedge.net 

Da befinden sich 109 zusätzliche Einträge.


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-624198674-977653023-2037852723-1040\Control Panel\Desktop\\Wallpaper -> c:\windows\web\wallpaper\theme1\img1.jpg
HKU\S-1-5-21-624198674-977653023-2037852723-1052\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg
HKU\S-1-5-21-624198674-977653023-2037852723-500\Control Panel\Desktop\\Wallpaper -> 
HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\Control Panel\Desktop\\Wallpaper -> 
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 1) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Warn)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

MSCONFIG\Services: dbupdate => 2
MSCONFIG\Services: dbupdatem => 3
MSCONFIG\Services: Disc Soft Lite Bus Service => 3
MSCONFIG\Services: GalaxyClientService => 3
MSCONFIG\Services: GalaxyCommunication => 3
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: hshld => 2
MSCONFIG\Services: HssTrayService => 3
MSCONFIG\Services: HssWd => 2
MSCONFIG\Services: MBAMScheduler => 2
MSCONFIG\Services: MBAMService => 3
MSCONFIG\Services: MF NTFS Monitor => 2
MSCONFIG\Services: Origin Client Service => 3
MSCONFIG\Services: Origin Web Helper Service => 2
MSCONFIG\Services: TeamViewer => 3
MSCONFIG\Services: VMAuthdService => 2
MSCONFIG\Services: VMnetDHCP => 2
MSCONFIG\Services: VMUSBArbService => 2
MSCONFIG\Services: VMware NAT Service => 2
MSCONFIG\Services: VMwareHostd => 2
MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
MSCONFIG\startupreg: PeerBlock => C:\Program Files\PeerBlock\peerblock.exe
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: Steam => "C:\Program Files (x86)\Steam\steam.exe" -silent
HKLM\...\StartupApproved\Run: => "Everything"
HKLM\...\StartupApproved\Run: => "SecurityHealth"
HKLM\...\StartupApproved\Run: => "AdobeAAMUpdater-1.0"
HKLM\...\StartupApproved\Run: => "NetSpeedMonitor"
HKLM\...\StartupApproved\Run: => "Malwarebytes TrayApp"
HKLM\...\StartupApproved\Run: => "OODITRAY.EXE"
HKLM\...\StartupApproved\Run32: => "Dropbox"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "ISUSScheduler"
HKLM\...\StartupApproved\Run32: => "Adobe Creative Cloud"
HKLM\...\StartupApproved\Run32: => "KeePass 2 PreLoad"
HKLM\...\StartupApproved\Run32: => "vmware-tray.exe"
HKLM\...\StartupApproved\Run32: => "DivXMediaServer"
HKLM\...\StartupApproved\Run32: => "SE61T-UserTools"
HKLM\...\StartupApproved\Run32: => "EaseUS Cleanup"
HKLM\...\StartupApproved\Run32: => "EaseUS EPM tray"
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\StartupApproved\StartupFolder: => "Twitch.lnk"
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\StartupApproved\Run: => "Skype"
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\StartupApproved\Run: => "GoogleDriveSync"
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\StartupApproved\Run: => "ISUSPM Startup"
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\StartupApproved\Run: => "SpiderOakONE"
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\StartupApproved\Run: => "OneDriveSetup"
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\StartupApproved\Run: => "Vivaldi Update Notifier"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [{E4735402-E623-4D0B-9BB3-B96FE4A35570}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
FirewallRules: [{6D9980E7-0AD8-47AB-A16F-1F3F3E193746}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
FirewallRules: [TCP Query User{3D3FCAEF-1F9C-495A-94DC-77FFDD819C02}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [UDP Query User{39E193BC-0B4F-43CA-BAAF-2493DEE650EC}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [TCP Query User{1062E0D3-4209-414F-8733-C841B6316640}C:\program files (x86)\google\chrome\application\chrome.exe] => (Block) C:\program files (x86)\google\chrome\application\chrome.exe
FirewallRules: [UDP Query User{4C4DD40E-CE9A-4D3E-9B29-2B5C520B0AF3}C:\program files (x86)\google\chrome\application\chrome.exe] => (Block) C:\program files (x86)\google\chrome\application\chrome.exe

==================== Wiederherstellungspunkte =========================

20-11-2017 13:08:57 Windows Update

==================== Fehlerhafte Geräte im Gerätemanager =============

Name: PS/2-Standardtastatur
Description: PS/2-Standardtastatur
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardtastaturen)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (11/26/2017 03:11:13 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1512) (User: NT-AUTORITÄT)
Description: Die Registrierungsdatei konnte nicht entladen werden. Der für die Registrierung verwendete Arbeitsspeicher wurde nicht freigegeben. Dieses wird oft durch Dienste verursacht, die unter einem Benutzerkonto ausgeführt werden. Versuchen Sie die Dienste entweder unter dem Konto "LocalService" oder "NetworkService" auszuführen. 

 Details - Das Medium ist schreibgeschützt.

Error: (11/25/2017 02:20:09 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: COMPUTER-128234)
Description: Das Paket „Microsoft.MicrosoftEdge_41.16299.15.0_neutral__8wekyb3d8bbwe+MicrosoftEdge“ wurde beendet, da das Anhalten zu lange dauerte.

Error: (11/24/2017 10:53:11 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm firefox.exe, Version 57.0.0.6525 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Systemsteuerung "Sicherheit und Wartung", um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 153c

Startzeit: 01d3656d818ebc87

Beendigungszeit: 158

Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Berichts-ID: 5a549173-0544-4a7b-86af-cb9b5bce1281

Vollständiger Name des fehlerhaften Pakets: 

Auf das fehlerhafte Paket bezogene Anwendungs-ID:

Error: (11/20/2017 05:02:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: WifiSvc.exe, Version: 2.1.0.24, Zeitstempel: 0x53cdc9f5
Name des fehlerhaften Moduls: WifiLib.dll, Version: 2.1.1.20, Zeitstempel: 0x55a6273a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00003486
ID des fehlerhaften Prozesses: 0x1f20
Startzeit der fehlerhaften Anwendung: 0x01d35fde7851ac63
Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\NETGEAR\WNA3100M\WifiSvc.exe
Pfad des fehlerhaften Moduls: C:\Program Files (x86)\NETGEAR\WNA3100M\WifiLib.dll
Berichtskennung: a1075dbd-05f3-4bab-ac23-7d74583d1f85
Vollständiger Name des fehlerhaften Pakets: 
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:


Systemfehler:
=============
Error: (11/27/2017 04:38:47 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
Der Treiber konnte nicht geladen werden.

Error: (11/27/2017 04:38:47 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\lem0th\AppData\Local\Temp\ehdrv.sys

Error: (11/27/2017 04:38:47 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
Der Treiber konnte nicht geladen werden.

Error: (11/27/2017 04:38:47 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\lem0th\AppData\Local\Temp\ehdrv.sys

Error: (11/27/2017 04:38:47 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
Der Treiber konnte nicht geladen werden.

Error: (11/27/2017 04:38:47 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\lem0th\AppData\Local\Temp\ehdrv.sys

Error: (11/27/2017 04:38:47 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
Der Treiber konnte nicht geladen werden.

Error: (11/27/2017 04:38:47 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\lem0th\AppData\Local\Temp\ehdrv.sys

Error: (11/27/2017 04:38:46 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 
Der Treiber konnte nicht geladen werden.

Error: (11/27/2017 04:38:46 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\lem0th\AppData\Local\Temp\ehdrv.sys


CodeIntegrity:
===================================
  Date: 2017-11-27 20:30:35.869
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.

  Date: 2017-11-27 20:30:35.852
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.

  Date: 2017-11-27 20:30:35.833
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.

  Date: 2017-11-27 20:30:35.772
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.

  Date: 2017-11-27 20:30:13.041
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.

  Date: 2017-11-27 20:30:13.008
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.

  Date: 2017-11-27 20:30:12.942
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.

  Date: 2017-11-27 20:30:12.916
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.

  Date: 2017-11-27 20:18:15.803
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.

  Date: 2017-11-27 20:18:15.781
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atipdl64.dll that did not meet the Microsoft signing level requirements.


==================== Speicherinformationen =========================== 

Prozessor: Intel(R) Core(TM)2 Duo CPU E7300 @ 2.66GHz
Prozentuale Nutzung des RAM: 73%
Installierter physikalischer RAM: 4094.18 MB
Verfügbarer physikalischer RAM: 1068.34 MB
Summe virtueller Speicher: 8190.18 MB
Verfügbarer virtueller Speicher: 3310.1 MB

==================== Laufwerke ================================

Drive c: (Windows) (Fixed) (Total:464.75 GB) (Free:305.42 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 933BC6BB)
Partition 1: (Active) - (Size=99 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=464.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=473 MB) - (Type=27)
Partition 4: (Not Active) - (Size=455 MB) - (Type=27)

========================================================
Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 279.5 GB) (Disk ID: B828D6C1)
Partition 1: (Not Active) - (Size=279.5 GB) - (Type=07 NTFS)

==================== Ende von Addition.txt ============================

Zum Browser Problem:

Als Beispiel nehme ich nun eine Weiterleitung zu YouTube, welche ich auf Twitter eben gerade gefunden habe.

Die Weiterleitungs-URL ist folgende: http://youtu.be/niscw1ovYrE?a

klicke ich die oben genannte URL an, leitet Chrome mich auf folgende Website weiter: https://t.co/PF7ty53lzq

auf der Seite bleibt Chrome dann schlussendlich und zeigt mir ein die weiße Seite an. Ich werde nicht zu YouTube weitergeleitet, wie es eigentlich passieren sollte.

Ladekabel612 · 27.11.2017, 21:46

Code:

ATTFilter

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 27-11-2017
durchgeführt von lem0th (Administrator) auf COMPUTER-128234 (27-11-2017 21:20:18)
Gestartet von C:\Users\lem0th\Desktop
Geladene Profile: lem0th & _ashbackuppb_ & Administrator & DefaultAppPool (Verfügbare Profile: lem0th & _ashbackuppb_ & Administrator & DefaultAppPool)
Platform: Windows 10 Pro Version 1709 16299.64 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Ransomware Tool for Business 1.1\anti_ransom.exe
(WIBU-SYSTEMS AG) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
() C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
() C:\Program Files (x86)\NETGEAR\WNA3100M\WifiSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
() C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupService-abpb.exe
() C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\oxHelper.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Ransomware Tool for Business 1.1\anti_ransom_gui.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupClient-abpb.exe
() C:\Program Files (x86)\puush\puush.exe
() C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\oxHelper.exe
(Discord Inc.) C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\Discord.exe
() C:\Program Files (x86)\NETGEAR\WNA3100M\WNA3100M.exe
(Discord Inc.) C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\Discord.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Discord Inc.) C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\Discord.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.8.487.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(ESET spol. s r.o.) C:\Users\lem0th\Downloads\esetonlinescanner_deu.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Dominik Reichl) C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe

==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [630168 2017-09-29] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13885696 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [163800 2016-07-30] (IvoSoft)
HKLM\...\Run: [Ashampoo Backup PB] => C:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupClient-abpb.exe [326040 2017-05-08] ()
HKLM\...\Run: [Everything] => C:\Program Files\Everything\Everything.exe [2197608 2017-06-07] ()
HKLM-x32\...\Run: [ISUSScheduler] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2004-06-14] (InstallShield Software Corporation)
HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [3222448 2017-10-12] (Dominik Reichl)
HKLM-x32\...\Run: [vmware-tray.exe] => C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe [112104 2017-03-21] (VMware, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-09-05] (Oracle Corporation)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Beschränkung <==== ACHTUNG
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Run: [puush] => C:\Program Files (x86)\puush\puush.exe [568904 2015-05-30] ()
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Run: [Discord] => C:\Users\lem0th\AppData\Local\Discord\app-0.0.298\Discord.exe [57477112 2017-08-08] (Discord Inc.)
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Run: [ISUSPM Startup] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [221184 2004-06-14] (InstallShield Software Corporation)
HKU\S-1-5-21-624198674-977653023-2037852723-1040\...\Run: [Vivaldi Update Notifier] => C:\ProgramData\chocolatey\lib\Vivaldi\tools\vivaldi\Vivaldi-bin\update_notifier.exe [4716664 2017-09-20] (Vivaldi Technologies AS)
HKU\S-1-5-21-624198674-977653023-2037852723-1052\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [519680 2017-09-29] (Microsoft Corporation)
HKU\S-1-5-21-624198674-977653023-2037852723-500\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [519680 2017-09-29] (Microsoft Corporation)
HKU\S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [519680 2017-09-29] (Microsoft Corporation)
SSODL: EldosMountNotificator-cbfs6 - {73F8D53A-4E1F-4434-A7D0-7C1E3B50BB78} - C:\WINDOWS\system32\cbfsMntNtf6.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator-cbfs6 - {73F8D53A-4E1F-4434-A7D0-7C1E3B50BB78} - C:\WINDOWS\SysWOW64\cbfsMntNtf6.dll (EldoS Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WNA3100M Genie.lnk [2016-07-10]
ShortcutTarget: NETGEAR WNA3100M Genie.lnk -> C:\Program Files (x86)\NETGEAR\WNA3100M\WNA3100M.exe ()

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{0a287408-cae2-4b64-9929-6ec5bb421193}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-624198674-977653023-2037852723-1040\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://de.yahoo.com/?fr=yset_ie_syc_oracle&type=orcl_hpset
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-624198674-977653023-2037852723-1040 -> {8CD4FD52-359A-4F3E-BEB3-D2114C31B19B} URL = hxxps://de.search.yahoo.com/search?p={searchTerms}&intl=de&fr=yset_ie_syc_oracle&type=orcl_default&partnerexternal-oracle=external-oracle
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_151\bin\ssv.dll [2017-10-28] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_151\bin\jp2ssv.dll [2017-10-28] (Oracle Corporation)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2016-07-30] (IvoSoft)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2016-07-30] (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2016-07-30] (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2016-07-30] (IvoSoft)

FireFox:
========
FF DefaultProfile: 3am39cb5.default
FF ProfilePath: C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default [2017-11-27]
FF NetworkProxy: Mozilla\Firefox\Profiles\3am39cb5.default -> backup.ftp", "100.44.118.68"
FF Extension: (No Resource URI Leak) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\@no-resource-uri-leak.xpi [2016-12-24] [Lagacy]
FF Extension: (HTTPS Everywhere) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\https-everywhere@eff.org.xpi [2017-11-23]
FF Extension: (uBlock Origin) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\uBlock0@raymondhill.net.xpi [2017-11-08]
FF Extension: (uMatrix) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\uMatrix@raymondhill.net.xpi [2017-11-23]
FF Extension: (User Agent Switcher) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}.xpi [2017-03-27] [Lagacy]
FF Extension: (O2 Service Suite) - C:\Users\lem0th\AppData\Roaming\Mozilla\Firefox\Profiles\3am39cb5.default\Extensions\{} [2017-01-17] [Lagacy] [ist nicht signiert]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_27_0_0_187.dll [2017-11-20] ()
FF Plugin: @java.com/DTPlugin,version=11.151.2 -> C:\Program Files\Java\jre1.8.0_151\bin\dtplugin\npDeployJava1.dll [2017-10-28] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.151.2 -> C:\Program Files\Java\jre1.8.0_151\bin\plugin2\npjp2.dll [2017-10-28] (Oracle Corporation)
FF Plugin: @videolan.org/vlc,version=2.2.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_187.dll [2017-11-20] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll [2015-01-09] (Adobe Systems, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-13] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-13] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [Keine Datei]

Chrome: 
=======
CHR DefaultProfile: Profile 1
CHR StartupUrls: Profile 1 -> "hxxps://www.youtube.com/feed/subscriptions","hxxps://twitter.com/"
CHR DefaultSearchURL: Profile 1 -> hxxps://de.search.yahoo.com/search?p={searchTerms}&fr=yset_chr_syc_oracle&type=default
CHR DefaultSearchKeyword: Profile 1 -> Yahoo
CHR DefaultSuggestURL: Profile 1 -> hxxps://de.search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10
CHR Profile: C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default [2017-11-26]
CHR Extension: (Google Präsentationen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-03-12]
CHR Extension: (Google Docs) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-03-12]
CHR Extension: (Google Drive) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-03-12]
CHR Extension: (YouTube) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-03-12]
CHR Extension: (Google Tabellen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-03-12]
CHR Extension: (Google Docs Offline) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-06-30]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2017-03-12]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-12]
CHR Extension: (Google Mail) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-03-12]
CHR Extension: (Chrome Media Router) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-06-30]
CHR Profile: C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old [2017-03-15] <==== ACHTUNG
CHR Extension: (Google Präsentationen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-01-17]
CHR Extension: (Google Docs) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\aohghmighlieiainnegkcijnfilokake [2017-01-17]
CHR Extension: (Google Drive) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-01-17]
CHR Extension: (YouTube) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-01-17]
CHR Extension: (Google Tabellen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-01-17]
CHR Extension: (Google Docs Offline) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-01-17]
CHR Extension: (Blue Space) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\lgafflokkagpjiofcoodepkehnpldbge [2017-01-17]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-17]
CHR Extension: (Google Mail) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Default.old\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-01-17]
CHR Profile: C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1 [2017-11-27]
CHR Extension: (Google Präsentationen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-01-17]
CHR Extension: (Google Docs) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2017-01-17]
CHR Extension: (Google Drive) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-01-17]
CHR Extension: (YouTube) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-01-17]
CHR Extension: (CryptUp: Encrypt Gmail with PGP) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bnjglocicdkmhmoohhfkfkbbkejdhdgc [2017-02-10]
CHR Extension: (uBlock Origin) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2017-01-17]
CHR Extension: (Google Tabellen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-01-17]
CHR Extension: (HTTPS Everywhere) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gcbommkclmclpchllfjekcdonpmejbdp [2017-01-28]
CHR Extension: (Google Docs Offline) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-01-17]
CHR Extension: (Black blue shards) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\hgoflmajhinnohnhkfeggflmmppiilck [2017-01-17]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-19]
CHR Extension: (uMatrix) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ogfcmafjalglgifnmanfmnieipoejdcf [2017-01-17]
CHR Extension: (Google Mail) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-01-17]
CHR Extension: (Chrome Media Router) - C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-01-28]
CHR Profile: C:\Users\lem0th\AppData\Local\Google\Chrome\User Data\System Profile [2017-01-17]
CHR HKU\S-1-5-21-624198674-977653023-2037852723-1040\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx

==================== Dienste (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S4 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2207960 2016-09-26] (Adobe Systems, Incorporated)
R2 AntiRansom; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Ransomware Tool for Business 1.1\anti_ransom.exe [693720 2016-07-19] (AO Kaspersky Lab)
R2 ashbackuppb; c:\Program Files\Ashampoo\Ashampoo Backup Pro 11\bin\backupService-abpb.exe [34712 2017-05-08] ()
R2 DirMngr; C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [216576 2016-08-18] () [Datei ist nicht signiert]
R2 EpsonScanSvc; C:\WINDOWS\system32\EscSvc64.exe [145224 2016-11-08] (Seiko Epson Corporation)
S3 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4470736 2017-05-09] (Malwarebytes)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [303360 2015-06-24] (Realtek Semiconductor)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [4297920 2017-09-30] (Microsoft Corporation)
S2 VMwareHostd; C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe [12482024 2017-03-21] ()
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [355304 2017-09-29] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [105944 2017-09-29] (Microsoft Corporation)
R2 WSWNA3100M; C:\Program Files (x86)\NETGEAR\WNA3100M\WifiSvc.exe [316120 2014-08-18] ()

===================== Treiber (Nicht auf der Ausnahmeliste) ======================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 ampa; C:\WINDOWS\system32\ampa.sys [38320 2016-12-25] ()
S3 ampa; C:\WINDOWS\SysWOW64\ampa.sys [38320 2016-12-25] ()
R1 cbfs6; C:\WINDOWS\system32\drivers\cbfs6.sys [460992 2016-06-13] (EldoS Corporation)
S3 dtlitescsibus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [30264 2016-09-17] (Disc Soft Ltd)
S3 dtliteusbbus; C:\WINDOWS\System32\drivers\dtliteusbbus.sys [47672 2016-09-17] (Disc Soft Ltd)
R0 kl1; C:\WINDOWS\System32\DRIVERS\kl1.sys [554416 2016-06-02] (AO Kaspersky Lab)
R3 klflt; C:\WINDOWS\system32\DRIVERS\klflt.sys [191312 2016-06-26] (AO Kaspersky Lab)
R1 klhk; C:\WINDOWS\system32\DRIVERS\klhk.sys [413008 2016-06-28] (AO Kaspersky Lab)
R1 KLIF; C:\WINDOWS\System32\DRIVERS\klif.sys [1012048 2016-06-26] (AO Kaspersky Lab)
R1 klpd; C:\WINDOWS\System32\DRIVERS\klpd.sys [45488 2016-05-31] (AO Kaspersky Lab)
R1 Klwtp; C:\WINDOWS\system32\DRIVERS\klwtp.sys [126864 2016-06-02] (AO Kaspersky Lab)
R1 MpKsl722efe42; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{BB0841DD-DE49-4AF6-81AE-776A971DE3FD}\MpKsl722efe42.sys [58120 2017-11-27] (Microsoft Corporation)
R1 MpKsl8df47bf3; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9204F16B-F296-4935-BFA3-328E52C57FB6}\MpKsl8df47bf3.sys [58120 2017-11-26] (Microsoft Corporation)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [604160 2017-09-29] (Realtek )
R3 RtlWlanu; C:\WINDOWS\System32\drivers\rtwlanu.sys [3859704 2015-10-16] (Realtek Semiconductor Corporation )
R3 taphss6; C:\WINDOWS\System32\drivers\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.)
R2 UI5IFS; C:\Program Files (x86)\Ashampoo\Ashampoo UnInstaller 7\IFS64.sys [30016 2017-11-17] ()
S3 usbrndis6; C:\WINDOWS\System32\drivers\usb80236.sys [23040 2017-09-29] (Microsoft Corporation)
S3 VBAudioVACMME; C:\WINDOWS\system32\DRIVERS\vbaudio_cable64_win7.sys [41192 2016-01-29] (Windows (R) Win 7 DDK provider)
R1 VBoxNetAdp; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys [131144 2016-12-20] (Oracle Corporation)
S3 VBoxUSB; C:\WINDOWS\System32\Drivers\VBoxUSB.sys [125008 2015-11-10] (Oracle Corporation)
R1 veracrypt; C:\WINDOWS\System32\drivers\veracrypt.sys [631200 2017-10-15] (IDRIX)
R3 vpnpbus; C:\WINDOWS\System32\drivers\vpnpbus.sys [18624 2016-06-13] (EldoS Corporation)
R2 vstor2-mntapi20-shared; C:\Windows\SysWow64\drivers\vstor2-mntapi20-shared.sys [37960 2016-11-14] (VMware, Inc.)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44608 2017-09-29] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [309144 2017-09-29] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [119192 2017-09-29] (Microsoft Corporation)
U3 idsvc; kein ImagePath

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-11-27 16:36 - 2017-11-27 16:36 - 000000000 ____D C:\Users\lem0th\AppData\Local\ESET
2017-11-27 16:32 - 2017-11-27 16:32 - 006974584 _____ (ESET spol. s r.o.) C:\Users\lem0th\Downloads\esetonlinescanner_deu.exe
2017-11-27 16:20 - 2017-11-27 16:36 - 000000000 ____D C:\ProgramData\HitmanPro
2017-11-27 16:20 - 2017-11-27 16:20 - 011584088 _____ (SurfRight B.V.) C:\Users\lem0th\Downloads\HitmanPro_x64.exe
2017-11-26 23:52 - 2017-11-27 01:16 - 000000056 _____ C:\Users\lem0th\song.txt
2017-11-26 15:12 - 2017-11-27 16:14 - 000000022 _____ C:\WINDOWS\S.dirmngr
2017-11-26 15:12 - 2017-11-26 15:12 - 000000000 ____H C:\ProgramData\cm-lock
2017-11-26 15:08 - 2017-11-26 15:10 - 000010561 _____ C:\Users\lem0th\Desktop\Fixlog.txt
2017-11-25 17:27 - 2017-11-25 17:27 - 000059709 _____ C:\Users\lem0th\Downloads\Addition (1).txt
2017-11-25 16:06 - 2017-11-25 16:12 - 000000000 ____D C:\AdwCleaner
2017-11-25 16:05 - 2017-11-25 16:05 - 008261584 _____ (Malwarebytes) C:\Users\lem0th\Desktop\adwcleaner_7.0.4.0.exe
2017-11-24 22:38 - 2017-11-24 22:38 - 000000000 ____D C:\Users\Public\Documents\Ashampoo
2017-11-24 22:37 - 2017-11-25 17:20 - 000059709 _____ C:\Users\lem0th\Desktop\Addition.txt
2017-11-24 22:32 - 2017-11-27 21:21 - 000024089 _____ C:\Users\lem0th\Desktop\FRST.txt
2017-11-24 22:32 - 2017-11-27 21:20 - 000000000 ____D C:\Users\lem0th\Desktop\FRST-OlderVersion
2017-11-24 20:48 - 2017-11-24 20:48 - 000000134 _____ C:\Users\lem0th\sophie.txt
2017-11-24 20:35 - 2017-11-24 20:37 - 000000055 _____ C:\Users\lem0th\Desktop\sophie anschreiben text.txt
2017-11-24 19:34 - 2017-11-24 19:40 - 000081476 _____ C:\Users\lem0th\Downloads\Addition.txt
2017-11-24 19:28 - 2017-11-24 19:40 - 000096544 _____ C:\Users\lem0th\Downloads\FRST.txt
2017-11-24 19:27 - 2017-11-27 21:20 - 002391552 _____ (Farbar) C:\Users\lem0th\Desktop\FRST64.exe
2017-11-24 13:38 - 2017-11-24 13:38 - 000001285 _____ C:\Users\Public\Desktop\Ashampoo UnInstaller 7.lnk
2017-11-24 13:38 - 2017-11-24 13:38 - 000000000 ____D C:\Users\lem0th\AppData\Local\Ashampoo
2017-11-24 13:37 - 2017-11-24 13:37 - 000000000 ____D C:\Program Files (x86)\Ashampoo
2017-11-24 13:35 - 2017-11-24 13:37 - 015879616 _____ (Ashampoo GmbH & Co. KG ) C:\Users\lem0th\Downloads\ashampoo_uninstaller_7_7.00.00_sm.exe
2017-11-23 20:09 - 2017-10-21 20:00 - 002916352 _____ C:\Users\lem0th\Desktop\main.db
2017-11-23 11:49 - 2017-11-23 11:50 - 059117240 _____ (Skype Technologies S.A. ) C:\Users\lem0th\Downloads\Skype-8.11.0.4.exe
2017-11-22 05:27 - 2017-11-22 05:27 - 000000039 _____ C:\Users\lem0th\jeff stream.txt
2017-11-21 19:24 - 2017-11-21 19:24 - 000167296 _____ (Gibson Research Corp.) C:\Users\lem0th\Downloads\DNSBench.exe
2017-11-21 19:20 - 2017-11-21 19:21 - 000008653 _____ C:\Users\lem0th\Downloads\DNS Benchmarklist v1 by Möwe.ini
2017-11-21 02:18 - 2017-11-21 02:18 - 000000037 _____ C:\Users\lem0th\cities patar.txt
2017-11-20 01:46 - 2017-11-20 01:46 - 000001450 _____ C:\MediathekView.lnk
2017-11-20 01:44 - 2017-11-20 01:44 - 000004466 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2017-11-20 01:43 - 2017-11-20 01:43 - 000000000 ____D C:\Users\Default\AppData\Roaming\Macromedia
2017-11-20 01:43 - 2017-11-20 01:43 - 000000000 ____D C:\Users\Default User\AppData\Roaming\Macromedia
2017-11-17 21:28 - 2017-10-25 10:11 - 017083904 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
2017-11-17 21:28 - 2017-10-25 10:09 - 021753344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
2017-11-17 21:28 - 2017-10-25 04:36 - 025246208 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-11-17 21:28 - 2017-10-25 04:16 - 023658496 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-11-17 21:27 - 2017-10-25 10:11 - 000336896 _____ (Microsoft Corporation) C:\WINDOWS\system32\HolographicRuntimes.dll
2017-11-17 21:27 - 2017-10-25 09:57 - 000956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Spectrum.exe
2017-11-17 21:27 - 2017-10-25 09:57 - 000882688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Mirage.Internal.dll
2017-11-17 21:27 - 2017-10-25 09:56 - 000665600 _____ (Microsoft Corporation) C:\WINDOWS\system32\DHolographicDisplay.dll
2017-11-17 21:27 - 2017-10-25 07:36 - 000618496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Mirage.Internal.dll
2017-11-17 21:27 - 2017-10-25 05:41 - 000362176 _____ (Microsoft Corporation) C:\WINDOWS\system32\BioIso.exe
2017-11-17 21:27 - 2017-10-25 05:40 - 001634288 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2017-11-17 21:27 - 2017-10-25 05:40 - 000612760 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2017-11-17 21:27 - 2017-10-25 05:40 - 000269696 _____ C:\WINDOWS\system32\FaceProcessorCore.dll
2017-11-17 21:27 - 2017-10-25 05:39 - 007831248 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2017-11-17 21:27 - 2017-10-25 05:39 - 000479912 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64win.dll
2017-11-17 21:27 - 2017-10-25 05:39 - 000285080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2017-11-17 21:27 - 2017-10-25 05:37 - 001954048 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2017-11-17 21:27 - 2017-10-25 05:37 - 000610712 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2017-11-17 21:27 - 2017-10-25 05:36 - 008590744 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-11-17 21:27 - 2017-10-25 05:36 - 002400664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2017-11-17 21:27 - 2017-10-25 05:36 - 000187288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2017-11-17 21:27 - 2017-10-25 05:34 - 002573208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2017-11-17 21:27 - 2017-10-25 05:34 - 000839928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Perception.Stub.dll
2017-11-17 21:27 - 2017-10-25 05:34 - 000710920 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2017-11-17 21:27 - 2017-10-25 05:32 - 000559512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2017-11-17 21:27 - 2017-10-25 05:32 - 000147864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wcifs.sys
2017-11-17 21:27 - 2017-10-25 05:31 - 000436120 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHostCommon.dll
2017-11-17 21:27 - 2017-10-25 05:31 - 000045464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storufs.sys
2017-11-17 21:27 - 2017-10-25 05:30 - 004487968 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2017-11-17 21:27 - 2017-10-25 05:30 - 000555416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2017-11-17 21:27 - 2017-10-25 05:29 - 002269080 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsrcsnk.dll
2017-11-17 21:27 - 2017-10-25 05:29 - 001507736 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2017-11-17 21:27 - 2017-10-25 05:29 - 000603920 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2017-11-17 21:27 - 2017-10-25 05:28 - 001170008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2017-11-17 21:27 - 2017-10-25 05:27 - 006791472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2017-11-17 21:27 - 2017-10-25 05:27 - 001970520 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2017-11-17 21:27 - 2017-10-25 05:27 - 001426152 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2017-11-17 21:27 - 2017-10-25 05:27 - 000374032 _____ (Microsoft Corporation) C:\WINDOWS\system32\vac.exe
2017-11-17 21:27 - 2017-10-25 05:24 - 000428952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2017-11-17 21:27 - 2017-10-25 05:20 - 002717392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2017-11-17 21:27 - 2017-10-25 04:52 - 001615720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2017-11-17 21:27 - 2017-10-25 04:50 - 001528904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2017-11-17 21:27 - 2017-10-25 04:30 - 005615968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2017-11-17 21:27 - 2017-10-25 04:30 - 000354200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudExperienceHostCommon.dll
2017-11-17 21:27 - 2017-10-25 04:28 - 004648528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2017-11-17 21:27 - 2017-10-25 04:28 - 001246432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2017-11-17 21:27 - 2017-10-25 04:28 - 000982016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2017-11-17 21:27 - 2017-10-25 04:27 - 001454568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsrcsnk.dll
2017-11-17 21:27 - 2017-10-25 04:27 - 001377080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2017-11-17 21:27 - 2017-10-25 04:27 - 001015008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2017-11-17 21:27 - 2017-10-25 04:24 - 000506256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Perception.Stub.dll
2017-11-17 21:27 - 2017-10-25 04:22 - 006015200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2017-11-17 21:27 - 2017-10-25 04:22 - 002465848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2017-11-17 21:27 - 2017-10-25 04:19 - 003670016 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-11-17 21:27 - 2017-10-25 04:19 - 000097792 _____ C:\WINDOWS\system32\runexehelper.exe
2017-11-17 21:27 - 2017-10-25 04:18 - 000975872 _____ C:\WINDOWS\system32\FaceProcessor.dll
2017-11-17 21:27 - 2017-10-25 04:18 - 000328192 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll
2017-11-17 21:27 - 2017-10-25 04:18 - 000301056 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcLayers.dll
2017-11-17 21:27 - 2017-10-25 04:18 - 000135168 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_CapabilityAccess.dll
2017-11-17 21:27 - 2017-10-25 04:18 - 000095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\CapabilityAccessManagerClient.dll
2017-11-17 21:27 - 2017-10-25 04:18 - 000056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcSpecfc.dll
2017-11-17 21:27 - 2017-10-25 04:16 - 000227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\CapabilityAccessManager.dll
2017-11-17 21:27 - 2017-10-25 04:16 - 000114688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\UcmCx.sys
2017-11-17 21:27 - 2017-10-25 04:16 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzres.dll
2017-11-17 21:27 - 2017-10-25 04:15 - 000140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2017-11-17 21:27 - 2017-10-25 04:14 - 000541184 _____ (Microsoft Corporation) C:\WINDOWS\system32\HolographicExtensions.dll
2017-11-17 21:27 - 2017-10-25 04:14 - 000046080 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdrleakdiag.exe
2017-11-17 21:27 - 2017-10-25 04:13 - 002972672 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
2017-11-17 21:27 - 2017-10-25 04:12 - 000708096 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2017-11-17 21:27 - 2017-10-25 04:12 - 000599040 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2017-11-17 21:27 - 2017-10-25 04:12 - 000568832 _____ (Microsoft Corporation) C:\WINDOWS\system32\TileDataRepository.dll
2017-11-17 21:27 - 2017-10-25 04:11 - 000768512 _____ (Microsoft Corporation) C:\WINDOWS\system32\PCPKsp.dll
2017-11-17 21:27 - 2017-10-25 04:10 - 008099328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-11-17 21:27 - 2017-10-25 04:10 - 004742144 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2017-11-17 21:27 - 2017-10-25 04:10 - 001167360 _____ (Microsoft Corporation) C:\WINDOWS\system32\ISM.dll
2017-11-17 21:27 - 2017-10-25 04:09 - 002862080 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2017-11-17 21:27 - 2017-10-25 04:09 - 002106368 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2017-11-17 21:27 - 2017-10-25 04:09 - 001806336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll
2017-11-17 21:27 - 2017-10-25 04:09 - 000812032 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 002905600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-11-17 21:27 - 2017-10-25 04:08 - 002781696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 002633216 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 002392576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 001667584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Input.Inking.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 000654848 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 000487424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcSpecfc.dll
2017-11-17 21:27 - 2017-10-25 04:08 - 000465408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 018914304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 003478016 _____ (Microsoft Corporation) C:\WINDOWS\system32\mispace.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 001485824 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 000685056 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 000372224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcLayers.dll
2017-11-17 21:27 - 2017-10-25 04:07 - 000064512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CapabilityAccessManagerClient.dll
2017-11-17 21:27 - 2017-10-25 04:06 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tzres.dll
2017-11-17 21:27 - 2017-10-25 04:05 - 019339776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-11-17 21:27 - 2017-10-25 04:05 - 000106496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2017-11-17 21:27 - 2017-10-25 04:05 - 000022528 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtcVSp1res.dll
2017-11-17 21:27 - 2017-10-25 04:04 - 000124928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\luafv.sys
2017-11-17 21:27 - 2017-10-25 04:04 - 000041984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdrleakdiag.exe
2017-11-17 21:27 - 2017-10-25 04:03 - 000450048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TileDataRepository.dll
2017-11-17 21:27 - 2017-10-25 04:02 - 000591872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PCPKsp.dll
2017-11-17 21:27 - 2017-10-25 04:01 - 000462848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2017-11-17 21:27 - 2017-10-25 03:59 - 003679232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2017-11-17 21:27 - 2017-10-25 03:59 - 000664576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2017-11-17 21:27 - 2017-10-25 03:58 - 002467840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2017-11-17 21:27 - 2017-10-25 03:58 - 001322496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Input.Inking.dll
2017-11-17 21:27 - 2017-10-25 03:58 - 001280000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll
2017-11-17 21:27 - 2017-10-25 03:57 - 006035968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-11-17 21:27 - 2017-10-25 03:55 - 002864640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mispace.dll
2017-11-17 21:27 - 2017-10-25 03:54 - 000022528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msdtcVSp1res.dll
2017-11-17 21:27 - 2017-10-21 13:25 - 003313968 _____ C:\WINDOWS\system32\Windows.Mirage.dll
2017-11-17 21:27 - 2017-10-20 15:17 - 002474584 _____ C:\WINDOWS\SysWOW64\Windows.Mirage.dll
2017-11-17 21:27 - 2017-10-20 06:08 - 000339968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msexcl40.dll
2017-11-17 20:35 - 2017-11-17 20:35 - 000000000 _____ C:\Users\lem0th\AppData\Roaming\text.txt
2017-11-17 20:27 - 2017-11-17 20:27 - 000000000 ____D C:\Users\lem0th\AppData\Local\CrystalDiskMark5
2017-11-17 20:14 - 2017-11-17 20:14 - 000000000 ____D C:\WINDOWS\containers
2017-11-17 20:05 - 2017-11-17 20:07 - 000000000 ____D C:\WLAN
2017-11-17 19:59 - 2017-11-17 20:00 - 000000000 ____D C:\Program Files\CrystalDiskMark5
2017-11-17 19:58 - 2017-11-17 19:59 - 002783312 _____ (Crystal Dew World ) C:\Users\lem0th\Downloads\crystaldiskmark5_1_2-en.exe
2017-11-17 15:56 - 2017-11-17 15:56 - 000000000 _____ C:\WINDOWS\SysWOW64\last.dump
2017-11-17 15:45 - 2017-11-17 15:45 - 000061304 _____ () C:\WINDOWS\system32\Drivers\lpsport.sys
2017-11-17 15:37 - 2017-11-17 15:43 - 000000000 ____D C:\ProgramData\AVAST Software
2017-11-17 15:34 - 2017-11-17 15:35 - 010849904 _____ (Piriform Ltd) C:\Users\lem0th\Downloads\ccsetup537.exe
2017-11-16 22:10 - 2017-11-16 22:10 - 000096646 _____ C:\sleepstudy-report.html
2017-11-16 20:01 - 2017-11-16 20:01 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WhoCrashed
2017-11-16 16:57 - 2017-11-16 16:57 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Kits
2017-11-16 16:57 - 2017-11-16 16:57 - 000000000 ____D C:\Program Files (x86)\Windows Kits
2017-11-14 16:15 - 2017-11-14 16:15 - 000000016 _____ C:\Users\lem0th\uke termin.txt
2017-11-13 15:15 - 2017-11-13 15:15 - 000030518 _____ C:\Users\lem0th\tasklist.txt
2017-11-12 22:08 - 2017-10-10 08:14 - 000139672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecdd.sys
2017-11-12 22:08 - 2017-10-10 08:11 - 000739696 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll
2017-11-12 22:08 - 2017-10-10 08:10 - 001200024 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2017-11-12 22:08 - 2017-10-10 08:01 - 005906264 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2017-11-12 22:08 - 2017-10-10 08:00 - 001053592 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2017-11-12 22:08 - 2017-10-10 08:00 - 000373656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2017-11-12 22:08 - 2017-10-10 07:59 - 001641536 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2017-11-12 22:08 - 2017-10-10 07:59 - 000778936 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2017-11-12 22:08 - 2017-10-10 07:54 - 001463856 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2017-11-12 22:08 - 2017-10-10 07:53 - 000464416 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2017-11-12 22:08 - 2017-10-10 07:53 - 000232344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2017-11-12 22:08 - 2017-10-10 07:51 - 000184984 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspicli.dll
2017-11-12 22:08 - 2017-10-10 07:49 - 001554216 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2017-11-12 22:08 - 2017-10-10 07:49 - 000060824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\urscx01000.sys
2017-11-12 22:08 - 2017-10-10 07:48 - 000677280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2017-11-12 22:08 - 2017-10-10 07:44 - 000246168 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2017-11-12 22:08 - 2017-10-10 07:43 - 000418712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2017-11-12 22:08 - 2017-10-10 07:36 - 001436432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2017-11-12 22:08 - 2017-10-10 07:31 - 001323840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2017-11-12 22:08 - 2017-10-10 07:30 - 000123520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll
2017-11-12 22:08 - 2017-10-10 07:26 - 000649304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2017-11-12 22:08 - 2017-10-10 07:11 - 000597160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll
2017-11-12 22:08 - 2017-10-10 07:07 - 001261864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2017-11-12 22:08 - 2017-10-10 07:06 - 000353688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2017-11-12 22:08 - 2017-10-10 06:46 - 001470976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2017-11-12 22:08 - 2017-10-10 06:46 - 000136192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\t2embed.dll
2017-11-12 22:08 - 2017-10-10 06:43 - 000566272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TpmCoreProvisioning.dll
2017-11-12 22:08 - 2017-10-10 06:43 - 000070656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XblAuthTokenBrokerExt.dll
2017-11-12 22:08 - 2017-10-10 06:42 - 000374784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FirewallAPI.dll
2017-11-12 22:08 - 2017-10-10 06:42 - 000326144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptngc.dll
2017-11-12 22:08 - 2017-10-10 06:37 - 002869248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2017-11-12 22:08 - 2017-10-10 06:37 - 001587200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2017-11-12 22:08 - 2017-10-10 06:37 - 001559552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2017-11-12 22:08 - 2017-10-10 06:36 - 001664000 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2017-11-12 22:08 - 2017-10-10 06:36 - 000177664 _____ (Microsoft Corporation) C:\WINDOWS\system32\t2embed.dll
2017-11-12 22:08 - 2017-10-10 06:34 - 000057344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\UcmUcsi.sys
2017-11-12 22:08 - 2017-10-10 06:34 - 000034816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BasicRender.sys
2017-11-12 22:08 - 2017-10-10 06:34 - 000028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspisrv.dll
2017-11-12 22:08 - 2017-10-10 06:33 - 000086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthTokenBrokerExt.dll
2017-11-12 22:08 - 2017-10-10 06:33 - 000058880 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll
2017-11-12 22:08 - 2017-10-10 06:32 - 000529408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nwifi.sys
2017-11-12 22:08 - 2017-10-10 06:32 - 000461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll
2017-11-12 22:08 - 2017-10-10 06:31 - 000665088 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmCoreProvisioning.dll
2017-11-12 22:08 - 2017-10-10 06:31 - 000478208 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnr.dll
2017-11-12 22:08 - 2017-10-10 06:30 - 000542208 _____ (Microsoft Corporation) C:\WINDOWS\system32\FirewallAPI.dll
2017-11-12 22:08 - 2017-10-10 06:30 - 000442880 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptngc.dll
2017-11-12 22:08 - 2017-10-10 06:27 - 001547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2017-11-12 22:08 - 2017-10-10 06:26 - 003334144 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2017-11-12 22:08 - 2017-10-10 06:26 - 001856000 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2017-11-12 22:08 - 2017-10-10 06:25 - 001822208 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2017-11-12 22:08 - 2017-10-10 06:25 - 000925184 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2017-11-12 22:08 - 2017-10-10 06:24 - 000726016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2017-11-12 22:08 - 2017-10-10 06:24 - 000422912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv.sys
2017-11-12 22:08 - 2017-10-10 06:24 - 000285696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2017-11-12 22:08 - 2017-10-03 23:42 - 000640512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mswstr10.dll
2017-11-12 22:08 - 2017-10-03 23:42 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjint40.dll
2017-11-05 23:06 - 2017-11-05 23:06 - 000000043 _____ C:\Users\lem0th\money glitch.txt
2017-11-04 00:38 - 2017-11-04 00:38 - 000000000 ____D C:\Users\lem0th\Documents\FeedbackHub
2017-11-03 21:22 - 2017-10-28 12:12 - 000110144 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-64.dll
2017-11-01 19:17 - 2017-11-01 19:17 - 000023610 _____ C:\Users\lem0th\Documents\my-umatrix-backup.txt
2017-11-01 19:12 - 2017-11-01 19:13 - 000015765 _____ C:\Users\lem0th\Documents\my-umatrix-rules.txt
2017-10-31 12:25 - 2017-10-31 12:26 - 058031933 _____ C:\Users\lem0th\Documents\TV-20171030-2347-5101.webxl.h264.mp4
2017-10-30 19:57 - 2017-11-23 11:59 - 000000000 ____D C:\Users\lem0th\AppData\Local\PlaceholderTileLogoFolder
2017-10-30 18:02 - 2017-09-29 14:41 - 001312504 _____ (Microsoft Corporation) C:\WINDOWS\Taskmgr.exe
2017-10-30 17:30 - 2017-10-30 17:31 - 000080083 _____ C:\Users\lem0th\Documents\Addition.txt
2017-10-30 17:28 - 2017-10-30 17:31 - 000115706 _____ C:\Users\lem0th\Documents\FRST.txt
2017-10-30 17:11 - 2017-11-27 21:20 - 000000000 ____D C:\FRST
2017-10-30 17:10 - 2017-10-30 17:11 - 002403328 _____ (Farbar) C:\Users\lem0th\Documents\FRST64.exe
2017-10-30 16:42 - 2017-10-30 16:42 - 000000000 ____D C:\ProgramData\Microsoft OneDrive
2017-10-30 16:41 - 2017-10-30 16:41 - 000000000 ___HD C:\Users\lem0th\MicrosoftEdgeBackups
2017-10-30 16:39 - 2017-11-25 16:12 - 000000008 __RSH C:\Users\lem0th\ntuser.pol
2017-10-30 16:39 - 2017-10-30 16:39 - 000000020 ___SH C:\Users\lem0th\ntuser.ini
2017-10-30 16:39 - 2017-10-30 16:39 - 000000000 ___RD C:\Users\lem0th\3D Objects
2017-10-30 16:33 - 2017-10-30 16:34 - 000019053 _____ C:\WINDOWS\diagwrn.xml
2017-10-30 16:33 - 2017-10-30 16:34 - 000019053 _____ C:\WINDOWS\diagerr.xml
2017-10-30 16:31 - 2017-11-27 16:14 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-10-30 16:31 - 2017-11-23 23:17 - 000003658 _____ C:\WINDOWS\System32\Tasks\CreateExplorerShellUnelevatedTask
2017-10-30 16:31 - 2017-11-13 20:15 - 000003628 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2017-10-30 16:31 - 2017-11-13 20:15 - 000003504 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2017-10-30 16:31 - 2017-10-30 16:32 - 000003502 _____ C:\WINDOWS\System32\Tasks\EPSON XP-540 Series Update {2AB6DE24-84C4-4AAB-BF4A-771C3BEF1053}
2017-10-30 16:31 - 2017-10-30 16:32 - 000003116 _____ C:\WINDOWS\System32\Tasks\klcp_update
2017-10-30 16:31 - 2017-10-30 16:32 - 000002484 _____ C:\WINDOWS\System32\Tasks\Defender tägliche Updates
2017-10-30 16:31 - 2017-10-30 16:31 - 000003502 _____ C:\WINDOWS\System32\Tasks\EPSON XP-540 Series Update {57EB58A9-FBFB-47E1-B238-BD9213EE8D07}
2017-10-30 16:31 - 2017-10-30 16:31 - 000002746 _____ C:\WINDOWS\System32\Tasks\Sperrbildschirm
2017-10-30 16:31 - 2017-10-30 16:31 - 000000000 ____D C:\WINDOWS\System32\Tasks\WPD
2017-10-30 16:31 - 2016-12-19 18:28 - 000002210 _____ C:\WINDOWS\System32\Tasks\Core Temp Autostart Tygan
2017-10-30 16:21 - 2017-10-30 16:21 - 000000020 ___SH C:\Users\_ashbackuppb_\ntuser.ini
2017-10-30 16:09 - 2017-11-24 13:42 - 000000000 ____D C:\Users\lem0th\AppData\Local\Packages
2017-10-30 16:09 - 2017-10-30 16:09 - 000000000 ____D C:\ProgramData\USOShared
2017-10-30 16:07 - 2017-11-27 16:15 - 000000000 ____D C:\Users\lem0th
2017-10-30 16:07 - 2017-11-27 16:14 - 000000000 ____D C:\Users\_ashbackuppb_
2017-10-30 16:07 - 2017-10-30 16:29 - 000000000 ____D C:\Users\DefaultAppPool
2017-10-30 16:07 - 2017-10-30 16:26 - 000000000 ____D C:\Users\Administrator
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Vorlagen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Startmenü
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Netzwerkumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Lokale Einstellungen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Eigene Dateien
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Druckumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Documents\Eigene Videos
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Documents\Eigene Musik
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Documents\Eigene Bilder
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\AppData\Local\Verlauf
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\AppData\Local\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\lem0th\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Vorlagen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Startmenü
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Netzwerkumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Lokale Einstellungen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Eigene Dateien
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Druckumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Documents\Eigene Videos
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Documents\Eigene Musik
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Documents\Eigene Bilder
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\AppData\Local\Verlauf
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\AppData\Local\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\DefaultAppPool\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Vorlagen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Startmenü
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Netzwerkumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Lokale Einstellungen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Eigene Dateien
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Druckumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Documents\Eigene Videos
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Documents\Eigene Musik
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Documents\Eigene Bilder
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\AppData\Local\Verlauf
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\AppData\Local\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\Administrator\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Vorlagen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Startmenü
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Netzwerkumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Lokale Einstellungen
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Eigene Dateien
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Druckumgebung
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Documents\Eigene Videos
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Documents\Eigene Musik
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Documents\Eigene Bilder
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\AppData\Local\Verlauf
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\AppData\Local\Anwendungsdaten
2017-10-30 16:07 - 2017-10-30 16:07 - 000000000 _SHDL C:\Users\_ashbackuppb_\Anwendungsdaten
2017-10-30 16:02 - 2017-11-26 15:07 - 002281604 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-10-30 16:01 - 2017-09-29 14:41 - 002241024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2017-10-30 15:58 - 2017-11-27 21:18 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2017-10-30 15:58 - 2017-11-22 05:37 - 000742728 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-10-30 15:35 - 2016-06-28 12:28 - 000413008 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klhk.sys
2017-10-30 15:35 - 2016-06-26 15:14 - 001012048 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klif.sys
2017-10-30 15:35 - 2016-06-26 15:14 - 000191312 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klflt.sys
2017-10-30 15:35 - 2016-06-02 22:39 - 000126864 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klwtp.sys
2017-10-30 15:35 - 2016-06-02 03:43 - 000554416 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\kl1.sys
2017-10-30 15:35 - 2016-05-31 23:31 - 000045488 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klpd.sys
2017-10-30 15:34 - 2017-10-30 15:34 - 000000000 ___DL C:\Users\Public\Recorded TV (1)
2017-10-30 15:34 - 2017-10-30 15:34 - 000000000 ____D C:\Program Files\Common Files\SpeechEngines
2017-10-30 15:33 - 2017-10-30 15:54 - 000000000 ____D C:\WINDOWS\system32\config\bbimigrate
2017-10-30 15:30 - 2017-10-30 15:33 - 000000000 ____D C:\WINDOWS\ServiceProfiles
2017-10-30 15:26 - 2017-10-30 15:54 - 000000000 ___SD C:\WINDOWS\system32\lxss
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\WINDOWS\SysWOW64\XPSViewer
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\WINDOWS\SysWOW64\BestPractices
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\WINDOWS\system32\msmq
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\WINDOWS\system32\BestPractices
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\Program Files\Reference Assemblies
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\Program Files\MSBuild
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\Program Files (x86)\Reference Assemblies
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\Program Files (x86)\MSBuild
2017-10-30 15:26 - 2017-10-30 15:26 - 000000000 ____D C:\inetpub
2017-10-30 15:21 - 2017-09-22 18:19 - 000778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2017-10-30 15:21 - 2017-09-22 18:19 - 000103120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2017-10-30 15:21 - 2017-09-22 18:19 - 000035456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2017-10-30 15:20 - 2017-09-28 15:50 - 001166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2017-10-30 15:20 - 2017-09-28 15:50 - 000124624 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2017-10-30 15:20 - 2017-09-28 15:50 - 000035456 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2017-10-30 14:49 - 2017-10-30 14:49 - 000008192 _____ C:\WINDOWS\system32\config\userdiff
2017-10-30 14:13 - 2017-11-02 10:44 - 000000000 ___DC C:\WINDOWS\Panther
2017-10-30 14:07 - 2017-10-30 14:13 - 000000036 _____ C:\WINDOWS\progress.ini
2017-10-30 13:37 - 2017-10-30 16:36 - 000000000 ___HD C:\$GetCurrent
2017-10-28 09:38 - 2017-10-28 09:38 - 000195346 _____ C:\Users\lem0th\Documents\wu170509 (1).diagcab

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2017-11-27 21:22 - 2017-01-17 18:40 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\NetSpeedMonitor
2017-11-27 16:21 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\DeliveryOptimization
2017-11-26 17:10 - 2017-01-17 17:29 - 000000000 ____D C:\Users\lem0th\AppData\LocalLow\Mozilla
2017-11-26 15:11 - 2017-09-29 09:45 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2017-11-26 15:09 - 2017-01-22 19:01 - 000000000 ____D C:\Users\lem0th\AppData\LocalLow\Temp
2017-11-26 15:07 - 2017-09-30 15:34 - 000985008 _____ C:\WINDOWS\system32\perfh007.dat
2017-11-26 15:07 - 2017-09-30 15:34 - 000227550 _____ C:\WINDOWS\system32\perfc007.dat
2017-11-26 14:56 - 2017-01-17 18:31 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\discord
2017-11-25 17:21 - 2016-12-09 00:41 - 000101784 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2017-11-25 17:21 - 2016-12-09 00:41 - 000093600 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2017-11-25 17:21 - 2016-12-09 00:41 - 000045472 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2017-11-25 17:21 - 2016-12-09 00:40 - 000253856 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-11-25 17:05 - 2017-03-15 12:52 - 000000000 ____D C:\ProgramData\Ashampoo
2017-11-25 16:19 - 2016-12-09 00:41 - 000188352 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMChameleon.sys
2017-11-25 16:12 - 2016-04-04 22:51 - 000000008 __RSH C:\ProgramData\ntuser.pol
2017-11-24 22:33 - 2017-10-22 21:52 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\vlc
2017-11-24 19:26 - 2017-03-15 12:54 - 000000000 ____D C:\Users\lem0th\AppData\Local\Ashampoo Backup PB
2017-11-24 13:42 - 2017-09-29 14:46 - 000000000 ___HD C:\Program Files\WindowsApps
2017-11-24 13:42 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\AppReadiness
2017-11-24 13:38 - 2017-03-15 12:52 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
2017-11-22 13:41 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\NDF
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\system32\F12
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\TextInput
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2017-11-22 05:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\appraiser
2017-11-22 05:34 - 2017-09-29 09:45 - 000000000 ____D C:\WINDOWS\system32\Dism
2017-11-22 05:33 - 2017-09-29 14:44 - 000000000 ____D C:\WINDOWS\INF
2017-11-21 21:01 - 2017-04-08 14:31 - 000000000 ____D C:\Users\lem0th\MediathekView
2017-11-21 21:00 - 2017-04-08 14:06 - 000000000 ____D C:\Users\lem0th\.mediathek3
2017-11-21 14:22 - 2010-11-21 04:27 - 000545440 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2017-11-20 01:44 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2017-11-20 01:44 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\Macromed
2017-11-18 21:01 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\rescache
2017-11-18 04:32 - 2017-01-17 18:33 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\KeePass
2017-11-17 21:32 - 2017-09-29 14:37 - 000000000 ____D C:\WINDOWS\CbsTemp
2017-11-17 20:17 - 2016-08-25 11:17 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-11-17 20:17 - 2014-11-05 16:46 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\zu-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\yo-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\xh-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\wo-SN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\vi-VN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\uz-Latn-UZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ur-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ug-CN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\tt-RU
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\tn-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\tk-TM
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ti-ET
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\tg-Cyrl-TJ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\te-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ta-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\sw-KE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-RS
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-BA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\sq-AL
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\si-LK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\sd-Arab-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\rw-RW
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\quz-PE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\quc-Latn-GT
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\prs-AF
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-Arab-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\or-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\nso-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\nn-NO
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ne-NP
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\mt-MT
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\mr-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\mn-MN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ml-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\mk-MK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\mi-NZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\lo-LA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\lb-LU
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ky-KG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ku-Arab-IQ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\kok-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\kn-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\km-KH
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\kk-KZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ka-GE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\is-IS
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ig-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\id-ID
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\hy-AM
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ha-Latn-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\gu-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\gd-GB
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ga-IE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\fil-PH
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\fa-IR
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\cy-GB
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\chr-CHER-US
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\ca-ES-valencia
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\bs-Latn-BA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\bn-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\bn-BD
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\be-BY
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\az-Latn-AZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\as-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\am-ET
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\SysWOW64\af-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\zu-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\yo-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\xh-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\wo-SN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\vi-VN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\uz-Latn-UZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ur-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ug-CN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\tt-RU
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\tn-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\tk-TM
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ti-ET
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\tg-Cyrl-TJ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\te-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ta-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\sw-KE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-RS
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-BA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\sq-AL
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\si-LK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\sd-Arab-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\rw-RW
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\quz-PE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\quc-Latn-GT
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\prs-AF
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\pa-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\pa-Arab-PK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\or-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\nso-ZA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\nn-NO
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ne-NP
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\mt-MT
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\mr-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\mn-MN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ml-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\mk-MK
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\mi-NZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\lo-LA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\lb-LU
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ky-KG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ku-Arab-IQ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\kok-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\kn-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\km-KH
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\kk-KZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ka-GE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\is-IS
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ig-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\id-ID
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\hy-AM
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ha-Latn-NG
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\gu-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\gd-GB
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ga-IE
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\fil-PH
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\fa-IR
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\cy-GB
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\chr-CHER-US
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\ca-ES-valencia
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\bs-Latn-BA
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\bn-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\bn-BD
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\be-BY
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\az-Latn-AZ
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\as-IN
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\am-ET
2017-11-17 20:14 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\system32\af-ZA
2017-11-16 20:01 - 2017-09-03 02:54 - 000000000 ____D C:\Program Files\WhoCrashed
2017-11-16 16:56 - 2015-01-24 15:32 - 000000000 ____D C:\ProgramData\Package Cache
2017-11-14 15:41 - 2017-01-17 17:29 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Mozilla
2017-11-14 15:41 - 2016-07-23 17:08 - 000001228 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-11-14 01:22 - 2016-01-22 23:25 - 000002271 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-11-10 01:38 - 2017-06-21 16:11 - 000001056 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Core Temp.lnk
2017-11-07 12:33 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2017-11-04 02:25 - 2017-09-29 14:49 - 000835568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-11-04 02:25 - 2017-09-29 14:49 - 000177648 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-11-04 00:07 - 2017-01-17 17:43 - 000000000 ____D C:\Users\lem0th\AppData\Local\ElevatedDiagnostics
2017-11-03 21:29 - 2017-05-10 14:44 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-11-03 21:28 - 2017-03-08 18:48 - 000000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2017-11-03 21:26 - 2017-03-08 18:46 - 000000000 ____D C:\Program Files (x86)\TeamViewer
2017-11-03 21:23 - 2015-04-07 10:25 - 000000000 ____D C:\ProgramData\Skype
2017-11-03 21:12 - 2017-01-17 18:22 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Skype
2017-11-02 02:08 - 2017-06-21 16:53 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Everything
2017-10-31 12:18 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\appcompat
2017-10-30 16:51 - 2017-02-20 17:19 - 000002358 _____ C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Vivaldi.lnk
2017-10-30 16:51 - 2017-02-20 17:19 - 000000000 ____D C:\Users\lem0th\AppData\Local\Vivaldi
2017-10-30 16:39 - 2017-01-17 16:59 - 000000000 ____D C:\Users\lem0th\AppData\Local\TileDataLayer
2017-10-30 16:39 - 2015-07-29 17:28 - 000000000 __RHD C:\Users\Public\AccountPictures
2017-10-30 16:35 - 2017-09-29 14:46 - 000000000 ____D C:\Program Files\windows nt
2017-10-30 16:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\Registration
2017-10-30 16:34 - 2017-09-29 09:45 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2017-10-30 16:32 - 2015-07-29 17:19 - 000023056 _____ C:\WINDOWS\system32\emptyregdb.dat
2017-10-30 16:30 - 2017-09-29 14:46 - 000000000 __RSD C:\WINDOWS\media
2017-10-30 16:19 - 2017-10-15 17:36 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Everything
2017-10-30 16:19 - 2017-04-17 21:18 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Paragon Partition Manager™ 14 Free
2017-10-30 16:19 - 2017-02-13 15:20 - 000000000 ___RD C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Test2
2017-10-30 16:12 - 2017-09-29 14:46 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-10-30 16:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\inetsrv
2017-10-30 16:09 - 2017-09-29 14:46 - 000000000 ____D C:\ProgramData\USOPrivate
2017-10-30 16:09 - 2017-02-26 20:44 - 000000000 ____D C:\Users\lem0th\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Hammer & Chisel, Inc
2017-10-30 16:08 - 2015-11-19 15:54 - 000000000 ____D C:\Users\Administrator\AppData\Local\Packages
2017-10-30 16:02 - 2017-04-06 16:05 - 002003936 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2017-10-30 16:01 - 2017-09-29 09:45 - 000000000 ____D C:\WINDOWS\system32\Sysprep
2017-10-30 16:00 - 2017-04-06 16:04 - 000000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2017-10-30 15:57 - 2017-09-29 14:46 - 000028672 _____ C:\WINDOWS\system32\config\BCD-Template
2017-10-30 15:55 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase
2017-10-30 15:55 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\system32\Tasks_Migrated
2017-10-30 15:54 - 2017-10-15 17:58 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2017-10-30 15:54 - 2017-10-15 17:52 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2017-10-30 15:54 - 2017-10-15 17:01 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VeraCrypt
2017-10-30 15:54 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\SysWOW64\WCN
2017-10-30 15:54 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\SysWOW64\sysprep
2017-10-30 15:54 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\system32\WCN
2017-10-30 15:54 - 2017-09-29 14:49 - 000000000 ____D C:\WINDOWS\Setup
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 __SHD C:\Program Files\Windows Sidebar
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 __SHD C:\Program Files (x86)\Windows Sidebar
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\SysWOW64\DiagSvcs
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\Downloaded Program Files
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\IME
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\spool
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\IME
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\AppLocker
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\schemas
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\Resources
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\IME
2017-10-30 15:54 - 2017-09-29 14:46 - 000000000 ____D C:\Program Files\Common Files\microsoft shared
2017-10-30 15:54 - 2017-08-31 03:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinMerge
2017-10-30 15:54 - 2017-08-30 17:21 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
2017-10-30 15:54 - 2017-08-17 12:53 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Software
2017-10-30 15:54 - 2017-04-17 21:28 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AOMEI Partition Assistant Standard Edition 6.1
2017-10-30 15:54 - 2017-03-30 22:36 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 5.2
2017-10-30 15:54 - 2017-03-29 14:52 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware
2017-10-30 15:54 - 2017-03-21 02:59 - 000000000 __RSD C:\WINDOWS\system32\WindowsDevicePortal
2017-10-30 15:54 - 2017-03-18 22:03 - 000000000 ____D C:\WINDOWS\system32\catroot2.bak
2017-10-30 15:54 - 2017-03-11 00:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
2017-10-30 15:54 - 2017-02-23 22:44 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack
2017-10-30 15:54 - 2017-01-21 23:07 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Classic Shell
2017-10-30 15:54 - 2016-12-30 02:08 - 000000000 ____D C:\WINDOWS\SysWOW64\%ProductFolder%
2017-10-30 15:54 - 2016-12-30 00:07 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Anti-Ransomware Tool for Business
2017-10-30 15:54 - 2016-12-09 00:40 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-10-30 15:54 - 2016-09-02 00:41 - 000000000 ____D C:\WINDOWS\SysWOW64\Hotspot Shield
2017-10-30 15:54 - 2016-08-03 18:45 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2017-10-30 15:54 - 2016-08-03 18:06 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CrystalDiskInfo
2017-10-30 15:54 - 2016-06-22 13:59 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gpg4win
2017-10-30 15:54 - 2016-05-31 12:20 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steuer 2015
2017-10-30 15:54 - 2015-10-27 01:05 - 000000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2017-10-30 15:54 - 2015-05-30 17:25 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\puush
2017-10-30 15:54 - 2015-02-21 23:13 - 000000000 ____D C:\WINDOWS\SysWOW64\Adobe
2017-10-30 15:54 - 2014-11-22 15:04 - 000000000 ____D C:\WINDOWS\system32\appmgmt
2017-10-30 15:54 - 2014-11-03 18:48 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NETGEAR WNA3100M Genie
2017-10-30 15:54 - 2014-01-23 19:41 - 000000000 ____D C:\WINDOWS\system32\MRT
2017-10-30 15:45 - 2017-09-29 14:46 - 000000000 __RHD C:\Users\Public\Libraries
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\SysWOW64\winrm
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\SysWOW64\slmgr
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\SysWOW64\Printing_Admin_Scripts
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\system32\winrm
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\system32\slmgr
2017-10-30 15:36 - 2017-09-30 15:34 - 000000000 ____D C:\WINDOWS\system32\Printing_Admin_Scripts
2017-10-30 15:36 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2017-10-30 15:36 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\en-GB
2017-10-30 15:36 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2017-10-30 15:36 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\oobe
2017-10-30 15:36 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\en-GB
2017-10-30 15:36 - 2017-04-06 16:04 - 000000000 ____D C:\WINDOWS\system32\SRSLabs
2017-10-30 15:36 - 2017-03-21 02:59 - 000000000 ___RD C:\WINDOWS\WebManagement
2017-10-30 15:35 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\system32\dsc
2017-10-30 15:35 - 2017-09-29 14:46 - 000000000 ___SD C:\WINDOWS\system32\DiagSvcs
2017-10-30 15:34 - 2017-09-30 15:35 - 000000000 ____D C:\WINDOWS\OCR
2017-10-30 15:34 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\Help
2017-10-30 15:34 - 2017-09-29 14:46 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2017-10-30 15:34 - 2017-09-29 14:46 - 000000000 ____D C:\Program Files\Common Files\system
2017-10-30 15:34 - 2017-09-29 14:46 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2017-10-30 15:34 - 2017-08-17 12:51 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
2017-10-30 15:34 - 2017-04-06 16:04 - 000000000 ____D C:\Program Files\Realtek
2017-10-30 15:34 - 2016-08-29 17:47 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\sixteen tons entertainment
2017-10-30 15:34 - 2016-01-30 19:55 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MAGIX
2017-10-30 15:34 - 2015-09-22 16:14 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games
2017-10-30 15:27 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\inetsrv
2017-10-30 15:26 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\MUI
2017-10-30 15:26 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\MUI
2017-10-30 15:25 - 2017-09-29 14:43 - 000613376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqsnap.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000261632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000096256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa.tlb
2017-10-30 15:25 - 2017-09-29 14:43 - 000090624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa30.tlb
2017-10-30 15:25 - 2017-09-29 14:43 - 000055296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa20.tlb
2017-10-30 15:25 - 2017-09-29 14:43 - 000048640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\admwprox.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000036864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqoa10.tlb
2017-10-30 15:25 - 2017-09-29 14:43 - 000016896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisreset.exe
2017-10-30 15:25 - 2017-09-29 14:43 - 000014848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqcertui.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000011264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wamregps.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisrstap.dll
2017-10-30 15:25 - 2017-09-29 14:43 - 000009096 _____ C:\WINDOWS\SysWOW64\msmqtrc.mof
2017-10-30 15:25 - 2017-09-29 14:42 - 000054272 _____ (Microsoft Corporation) C:\WINDOWS\system32\admwprox.dll
2017-10-30 15:25 - 2017-09-29 14:42 - 000018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisreset.exe
2017-10-30 15:25 - 2017-09-29 14:42 - 000015360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wamregps.dll
2017-10-30 15:25 - 2017-09-29 14:42 - 000013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisrstap.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000980888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\lxcore.sys
2017-10-30 15:25 - 2017-09-29 14:41 - 000222720 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqrt.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplayx.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmsif.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mqac.sys
2017-10-30 15:25 - 2017-09-29 14:41 - 000072704 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsl.exe
2017-10-30 15:25 - 2017-09-29 14:41 - 000046592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpwsockx.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000024576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpmodemx.dll
2017-10-30 15:25 - 2017-09-29 14:41 - 000020480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplaysvr.exe
2017-10-30 15:25 - 2017-09-29 14:41 - 000018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\vmsifproxystub.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisRtl.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisRtl.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\ahadmin.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ahadmin.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000014336 _____ (Microsoft Corporation) C:\WINDOWS\system32\cngkeyhelper.dll
2017-10-30 15:24 - 2017-09-29 14:43 - 000011264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cngkeyhelper.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 001677824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmswitch.sys
2017-10-30 15:24 - 2017-09-29 14:41 - 000776192 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqsnap.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000747008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Wnv.sys
2017-10-30 15:24 - 2017-09-29 14:41 - 000564224 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqutil.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000389120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnet.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000306688 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000126464 _____ (Microsoft Corporation) C:\WINDOWS\system32\LxRun.exe
2017-10-30 15:24 - 2017-09-29 14:41 - 000125952 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqlogmgr.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000096256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa.tlb
2017-10-30 15:24 - 2017-09-29 14:41 - 000090624 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa30.tlb
2017-10-30 15:24 - 2017-09-29 14:41 - 000088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\nvspinfo.exe
2017-10-30 15:24 - 2017-09-29 14:41 - 000073216 _____ (Microsoft Corporation) C:\WINDOWS\system32\bash.exe
2017-10-30 15:24 - 2017-09-29 14:41 - 000062464 _____ (Microsoft Corporation) C:\WINDOWS\system32\wnvapi.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnathlp.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000055296 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa20.tlb
2017-10-30 15:24 - 2017-09-29 14:41 - 000036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqoa10.tlb
2017-10-30 15:24 - 2017-09-29 14:41 - 000034816 _____ (Microsoft Corporation) C:\WINDOWS\system32\wslapi.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000033688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmsproxy.sys
2017-10-30 15:24 - 2017-09-29 14:41 - 000022528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnsvr.exe
2017-10-30 15:24 - 2017-09-29 14:41 - 000017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqcertui.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000009096 _____ C:\WINDOWS\system32\msmqtrc.mof
2017-10-30 15:24 - 2017-09-29 14:41 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhupnp.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhpast.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnlobby.dll
2017-10-30 15:24 - 2017-09-29 14:41 - 000005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnaddr.dll
2017-10-30 15:23 - 2017-09-29 14:43 - 000562176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqutil.dll
2017-10-30 15:23 - 2017-09-29 14:43 - 000156160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqrt.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 001381888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqqm.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000464896 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnet.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000067584 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnathlp.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqbkup.exe
2017-10-30 15:23 - 2017-09-29 14:41 - 000041984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wslconfig.exe
2017-10-30 15:23 - 2017-09-29 14:41 - 000026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnsvr.exe
2017-10-30 15:23 - 2017-09-29 14:41 - 000026112 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqsvc.exe
2017-10-30 15:23 - 2017-09-29 14:41 - 000015768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\lxss.sys
2017-10-30 15:23 - 2017-09-29 14:41 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhupnp.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhpast.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnlobby.dll
2017-10-30 15:23 - 2017-09-29 14:41 - 000006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnaddr.dll
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\lv-LV
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\lt-LT
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\et-EE
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\SysWOW64\es-MX
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\lv-LV
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\lt-LT
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\et-EE
2017-10-30 15:11 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\system32\es-MX
2017-10-30 13:04 - 2017-08-31 13:31 - 000028574 _____ C:\Users\lem0th\Documents\NeueDatenbank.kdbx
2017-10-28 12:21 - 2016-04-05 13:15 - 000000000 ____D C:\Program Files\7-Zip
2017-10-28 12:19 - 2017-06-22 03:14 - 000000000 ____D C:\Users\lem0th\AppData\Local\Everything
2017-10-28 12:14 - 2017-10-27 19:57 - 000000000 ____D C:\Program Files\Java
2017-10-28 12:12 - 2017-10-27 19:58 - 000110144 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2017-05-28 21:40 - 2017-05-28 21:41 - 832691886 _____ () C:\Users\lem0th\AppData\Roaming\Factorio.zip
2017-02-17 23:26 - 2017-03-27 02:39 - 000000154 _____ () C:\Users\lem0th\AppData\Roaming\prio.ini
2017-04-30 18:56 - 2017-04-30 02:43 - 000000027 _____ () C:\Users\lem0th\AppData\Roaming\test.bat
2017-11-17 20:35 - 2017-11-17 20:35 - 000000000 _____ () C:\Users\lem0th\AppData\Roaming\text.txt
2017-01-17 17:42 - 2016-07-17 22:18 - 000007656 _____ () C:\Users\lem0th\AppData\Local\Resmon.ResmonCfg

==================== Bamital & volsnap ======================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert

LastRegBack: 2017-11-19 18:21

==================== Ende von FRST.txt ============================

M-K-D-B · 28.11.2017, 16:30

Servus,

Schritt 1

Deinstalliere über die Systemsteuerung (Bebilderte Anleitung):
- Google Chrome
Bei der Frage, ob auch die Browserdaten gelöscht werden sollen, wähle Ja.
Starte den Rechner im Anschluss neu auf.
Installiere Google Chrome ggf. im Anschluss neu. Jedoch darfst du dich vorab nicht mit dem Google Konto Syncronisieren und auch keine Erweiterungen installieren.

Schritt 2

Starte die FRST.exe erneut. Vergewissere dich, dass vor Addition.txt ein Haken gesetzt ist und drücke auf Untersuchen.
FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
Poste mir beide Logdateien mit deiner nächsten Antwort.

Gibt es jetzt noch diese Probleme Google Chrome?

Bitte poste mit deiner nächsten Antwort

die beiden neuen Logdateien von FRST (FRST.txt und Addition.txt),
die Beantwortung der gestellten Fragen.

M-K-D-B · 02.12.2017, 15:05

Fehlende Rückmeldung
Dieses Thema wurde aus den Abos gelöscht. Somit bekomme ich keine Benachrichtigung über neue Antworten.
PM inklusive Link zum Thema an mich falls du denoch weiter machen willst.

Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen!

27.11.2017, 15:04	#10
M-K-D-B /// TB-Ausbilder	search and new tab by yahoo Servus, die Frage, ob es noch Probleme gibt, sollst du erst beantworten (und zwar möglichst detailliert, welcher Browser was für Probleme macht), wenn du alle Schritte abgearbeitet hast. Ich verstehe deine Frage zu HitmanPro nicht. Die Anleitung ist doch eindeutig, was nacheinander zu tun ist. Habs gerade selbst getestet. Evtl. musst du deine Frage spezifizieren.

search and new tab by yahoo

Plagegeister aller Art und deren Bekämpfung: search and new tab by yahoo